HP HPE6-A47 Exam With Confidence Using Practice Dumps

The customer wants to use certificates to authenticate user devices, which means that they need a strong and secure method of verifying the identity of the devices that connect to the employee WLAN. The best option for this is to use EAP-TLS instead of PEAP-MSCHAPv2. EAP-TLS stands for Extensible Authentication Protocol-Transport Layer Security, and it is a protocol that uses certificates on both the client and the server side to establish a mutual authentication and a secure channel for data exchange. EAP-TLS is considered the most secure EAP method, as it prevents common attacks such as dictionary attacks, man-in-the-middle attacks, and replay attacks.

The other options are not suitable for the customer requirements:

• Option B is incorrect because TKIP encryption is weaker than AES encryption. TKIP stands for Temporal Key Integrity Protocol, and it is an older encryption method that was designed to replace WEP, which had serious security flaws. However, TKIP also has some vulnerabilities, and it is not recommended for modern WLANs. AES stands for Advanced Encryption Standard, and it is a newer and stronger encryption method that provides better security and performance for WLANs.
• Option C is incorrect because WPA2-PSK is less secure than WPA2-Enterprise. WPA2-PSK stands for Wi-Fi Protected Access 2-Pre-Shared Key, and it is a security mode that uses a common passphrase or key to authenticate all devices that connect to the WLAN. However, this passphrase or key can be easily compromised or shared, and it does not provide individual authentication or encryption for each device. WPA2-Enterprise stands for Wi-Fi Protected Access 2-Enterprise, and it is a security mode that uses a RADIUS server to authenticate each device individually and dynamically generate encryption keys for each session. WPA2-Enterprise provides better security and scalability for WLANs.
• Option D is incorrect because TTLS does not use certificates to authenticate user devices. TTLS stands for Tunneled Transport Layer Security, and it is a protocol that uses certificates only on the server side to establish a secure tunnel for data exchange. The client side can use different methods to authenticate, such as passwords, tokens, or certificates. However, TTLS does not require certificates on the client side, and it is less secure than EAP-TLS.

References:

• ArubaOS 8.5 User Guide)
• ArubaOS 8.5 Security Guide)
• Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))

The traditional guideline limits a wired VLAN to a /24 subnet, which provides enough IP addresses for 253 endpoints. You might have suggested one of three approaches: one VLAN per floor, one VLAN per building, or one VLAN per campus. The one VLAN per floor approach is not recommended because it interferes with roaming and adds complexity. If you did take this approach, the /24 subnets are not large enough for the requirements on every floor. You would need to ask for /23 subnets. The one VLAN per building approach would work if you considered each building its own RF domain. It provides roaming within a building and, if you are using a single cluster at the data center, between buildings. Ifyou deployed two MCs or clusters, one at each building, though, GRE tunneling would be required to support roaming between buildings.

The Virtual Switching Framework (VSF) is a technology that allows two or more Aruba switches to operate as a single logical device, providing high availability, simplified management, and increased performance. VSF is supported on Aruba 5400R zl2 switches, which are modular switches that can accommodate different types of line cards and power supplies1.

The VSF fabric requires two types of connections between the member switches: VSF links and VSF ports. VSF links are the physical connections that carry the VSF control and data traffic, while VSF ports are the logical interfaces that bundle the VSF links into a single logical link. VSF links can be either 10 GbE or 40 GbE, and VSF ports can be either 10 GbE or 40 GbE1.

To create a VSF fabric with two 5406R zl2 switches, the architect needs to ensure that the switches have the compatible modules, transceivers, and cables for the VSF links and ports. According to the ArubaOS-Switch Management and Configuration Guide1, the following requirements apply for the VSF fabric:

• The switches must have the same chassis model, the same number and type of modules, and the same firmware version.
• The switches must have at least one v3 module in slot A or B. The v3 modules are the ones with the letter “M” in the part number, such as J9990A, J9991A, and J9992A. The v2 modules are the ones with the letter “A” in the part number, such as J9534A, J9535A, and J9536A.
• The switches must have the same type of transceivers and cables for the VSF links. The supported transceivers are the Aruba 10G SFP+ LC SR, the Aruba 10G SFP+ LC LR, the Aruba 40G QSFP+ LC SR4, and the Aruba 40G QSFP+ MPO SR4. The supported cables are the Aruba 10G SFP+ to SFP+ 1m DAC Cable, the Aruba 10G SFP+ to SFP+ 3m DAC Cable, the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable, and the Aruba 40G QSFP+ to QSFP+ 3m DAC Cable.

Based on the exhibit, the architect has planned to use the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable (JH234A) for the VSF links, which is a supported option. However, the architect has also selected the Aruba 24p 10GBASE-T v2 zl Module (J9536A) and the Aruba 20p 10GbE SFP+ v2 zl Module (J9535A) for the switches, which are not compatible with the VSF fabric. The architect should change these v2 modules to v3 modules, such as the Aruba 24p 10GBASE-T v3 zl2 Module (J9996A) and the Aruba 20p 10GbE SFP+ v3 zl2 Module (J9990A), to meet the VSF requirements.

The other options are not issues with the plan. Adding two QSPF+ MP0 SR4 transceivers (A) is not necessary, as the DAC cable already provides the 40 GbE connection for the VSF links. Adding stacking modules and cables © is not required, as the VSF fabric does not use the traditional stacking technology. Changing the power supply type (D) is not relevant, as the VSF fabric does not impose any restrictions on the power supply type.

References: 1: ArubaOS-Switch Management and Configuration Guide - Aruba, Chapter 12: Virtual Switching Framework, pages 219-227.