For modern campus networks, secure administrative access to network devices (switches, access points, and controllers) is a critical design requirement. HPE Aruba Networking supports several standard protocols to provide centralized Authentication, Authorization, and Accounting (AAA) for management users.

The three primary supported security protocols for device management access are:

TACACS (Terminal Access Controller Access-Control System): This is the preferred protocol for device management because it separates authentication, authorization, and accounting. It allows for granular command-level authorization, ensuring that different administrators have specific permission levels (e.g., read-only vs. full configuration).

RADIUS (Remote Authentication Dial-In User Service): RADIUS is a widely supported protocol that provides centralized AAA services. While it is often used for network access (802.1X), it is also a standard method for authenticating management sessions on Aruba infrastructure.

LDAPS (Lightweight Directory Access Protocol over SSL/TLS): This protocol allows the network infrastructure to authenticate management users directly against a directory service, such as Microsoft Active Directory. Using the secure version (LDAPS) ensures that credentials are encrypted during the authentication process.

While RadSec (RADIUS over TLS) is supported by Aruba for secure AAA transport, it is generally considered a transport method for RADIUS traffic rather than a distinct management authentication requirement in this context. GRE (Generic Routing Encapsulation) is a tunneling protocol and is not used for management authentication.

Aruba Central: Aruba Central is the cloud-native management and monitoring platform within the Aruba ESP architecture . It provides:

Network usage visibility : dashboards and reports on client, application, and device traffic across wired, wireless, and WAN.

Application visibility and deep packet inspection (DPI) : showing how much bandwidth is consumed by each app or category.

Historical and real-time analytics : enabling IT to monitor utilization trends and demonstrate network usage to stakeholders.

Why not the other options?

UXI (User Experience Insight): Provides end-user experience monitoring by using sensor devices to simulate client behavior (e.g., connectivity tests, SaaS performance), but it does not give full network usage visibility in terms of traffic volume or bandwidth utilization.

ArubaOS 8.x: This is the operating system for Aruba mobility controllers and APs, enabling advanced WLAN features, but not a dedicated platform for traffic visibility dashboards or long-term usage reporting.

ClearPass: Provides policy-based access control and security (authentication, authorization, accounting, device profiling), but it is not designed to show network traffic usage or utilization statistics.

Aruba Design Guidance Alignment: According to Aruba’s Campus Access Design Guides and Aruba Central documentation , the correct tool for showing and reporting network usage visibility is Aruba Central , which integrates AI Insights, traffic monitoring, and reporting capabilities as part of the ESP cloud platform.

Final Justification:

Option B is correct because only HPE Aruba Networking Central provides the ability to monitor and display network usage visibility in a centralized, graphical, and reportable way.

Reference Extracts (Aruba Official Study & Design Guides):

Aruba ESP Campus Design Guide: Aruba Central as the management and visibility layer.

Aruba Central Technical Overview: built-in dashboards for bandwidth utilization, client traffic, and application visibility.

Aruba Central AI Insights: usage trends and capacity monitoring.

When floor plans are not available for site surveys or simulations, the best alternative source to use is the fire escape plan (Option D). Fire escape plans are typically available in most buildings and provide a simplified layout of the premises, including walls, doors, and sometimes the location of permanent fixtures. While not as detailed as architectural floor plans, fire escape plans can offer enough information for initial site survey estimations and RF planning. They allow network designers to understand the basic layout and potential RF obstacles or coverage areas, making them a practical tool for preliminary wireless network planning and simulations in the absence of more detailed floor plans.

To support a combination of Downloadable User Roles (DUR) and VNBT-based (Virtual Network Based Tunneling) distributed Dynamic Segmentation, the hardware must support specific advanced Layer 3 and VXLAN capabilities at the access layer.

Distributed Dynamic Segmentation: This architecture requires switches to act as VXLAN Tunnel End Points (VTEPs) to encapsulate traffic into VXLAN tunnels based on the assigned User Role.

6300F/M Capability: The AOS-CX 6300 series is the primary access layer switch designed for this role. It provides the necessary hardware support for VXLAN and GBPs (Group Based Policies) required for distributed Dynamic Segmentation.

DUR Support: Like other AOS-CX switches, the 6300 series integrates fully with Aruba ClearPass to download user roles dynamically upon authentication, ensuring centralized policy management.

Comparison:

6200F/M: This is a " Value " access switch. While it supports DUR, it lacks the hardware capability for VXLAN/VTEP, meaning it cannot support VNBT-based distributed Dynamic Segmentation.

8360 / 8100: These are core/aggregation switches. While they support VXLAN, they are not typically the point of ingress for user authentication and DUR-based access control in a campus design.

Access : 24:1

Aggregation : 4:1

Core : 2:1

ToR : 4:1