Free ACMX Practice Questions

Question 1

A university's lecture rooms perform well with a few wireless clients but slow markedly during full classes. The 5-GHz radios use 80-MHz channels; neighboring rooms repeatedly reuse the same channel blocks. Surveys show adequate signal and SNR, and most busy airtime consists of decodable traffic from neighboring BSSs. Non-Wi-Fi energy is low, clients are associated with appropriate APs, and the wired uplinks are not congested. Which RF redesign addresses the dominant limitation?

Accepted Answer

Use narrower channels with a revised reuse plan, then validate capacity with the rooms occupied.

Answer

Raise AP power to increase client link rates without changing channel assignments.

Answer

Add a same-channel AP in each room to divide client load between radios.

Answer

Increase ClientMatch steering aggressiveness so clients change APs sooner, while retaining the existing channel and power plan.

Question 2

Identify the faulty policy stage in this Access Tracker and gateway session summary for a Staff user receiving guest restrictions:

Selected service: Staff
EAP-TLS: success
Directory department: Engineering
Mapped ClearPass role: Employee
Returned Aruba-User-Role: guest
Installed gateway role: guest

Both employee and guest roles exist on the gateway and enforce the intended permissions for other sessions.

Accepted Answer

The enforcement policy/profile that selects the returned Aruba-User-Role attribute.

Answer

The role-mapping rule that assigns the Employee policy role.

Answer

The permissions in the gateway's local employee role.

Answer

The client-CA trust list used by the EAP-TLS method.

Question 3

An AOS-10 mixed-forwarding WLAN uses one gateway cluster and no secondary cluster. Employees are assigned VLAN 210 at the cluster. Contractors are assigned VLAN 310, which was available only on the AP uplinks and local access LAN. After VLAN 310 is also created on the gateway cluster, newly connected contractors still authenticate and receive VLAN 310 but no longer reach their local DHCP service. The AP trunks and local DHCP service are unchanged. Contractors must remain locally bridged, employees must remain tunneled, and VLAN 310 has no required use at the cluster. What restores the intended forwarding split?

Accepted Answer

Remove VLAN 310 from the gateway cluster's VLAN configuration.

Answer

Remove VLAN 310 from the AP uplinks while retaining it on the gateway cluster.

Answer

Retain VLAN 310 at both locations and add its local DHCP server as a gateway relay target.

Answer

Move both user groups to a replacement WLAN profile that uses bridge forwarding.

Question 4

An operator proposes resetting OSPF on all four AOS-CX routers after reviewing this OSPFv2 neighbor summary for a broadcast segment:

R1: DR
R2: BDR
R3: Full with R1 and R2; 2-Way with R4
R4: Full with R1 and R2; 2-Way with R3

Routes are present and traffic remains normal. Does the neighbor state justify the proposed reset?

Accepted Answer

No; 2-Way is expected between R3 and R4 because neither is the DR nor the BDR.

Answer

Yes; every router pair must reach Full before a broadcast segment is stable.

Answer

Yes; R3 and R4 must restart database exchange after their interface MTUs are aligned.

Answer

Yes; change all four interfaces to point-to-point type, then reset to establish Full adjacencies between every pair.

Question 5

A warehouse acceptance test requires a received level of at least -67 dBm and an SNR of at least 25 dB in BOTH directions at each test point. Simultaneous measurements at one point are:
Client receiving the AP: signal -62 dBm; noise floor -82 dBm.
AP receiving the client: signal -58 dBm; noise floor -96 dBm.
Which assessment uses the measurements correctly?

Accepted Answer

Reject: client-side SNR is 20 dB, although AP-side SNR is 38 dB.

Answer

Accept: both received signal levels exceed the -67 dBm requirement.

Answer

Accept: client signal -62 dBm minus AP noise -96 dBm gives 34 dB.

Answer

Reject: AP signal -58 dBm minus client noise -82 dBm gives 24 dB on the uplink.

Question 6

After a ClearPass EAP server certificate replacement, managed laptops fail EAP-TLS before presenting their client certificates. Their profiles trust the issuing CA and permit only radius.campus.example as the authentication-server identity. The replacement certificate chains correctly, is currently valid, has the required serverAuth usage, and contains only radius-new.campus.example in its subject alternative name. The approved service identity has NOT changed. Which repair preserves the intended server-authentication policy?

Accepted Answer

Replace the server certificate with one whose SAN includes radius.campus.example.

Answer

Redeploy the issuing CA certificate to the laptops while retaining the replacement server certificate.

Answer

Reissue the laptops' client certificates with radius.campus.example as their subject alternative name.

Answer

Remove the permitted-server-name restriction from the laptop profiles while continuing to require the issuing CA.

Question 7

Emergency-call phones lose service immediately after a temporary switch receives a second uplink to an AOS-CX access switch. The uplinks terminate on ports 1/1/17 and 1/1/18, both forwarding in VLAN 40 with BPDU filtering enabled and neither in a LAG. Captures confirm that broadcasts leaving 1/1/17 return through 1/1/18 and continue circulating. The temporary switch can operate through either uplink alone. During incident containment, which action directly breaks the demonstrated loop while preserving its remaining connection?

Accepted Answer

Disable port 1/1/18; keep the temporary switch connected through port 1/1/17.

Answer

Lower the distribution bridge priorities to re-elect the spanning-tree root.

Answer

Apply storm control on the phone ports without altering either temporary-switch uplink.

Answer

Disconnect the access switch from distribution pending a complete audit of the VLAN 40 topology.

Question 8

A VSX pair raises a keepalive-reachability alarm after a change to the separate management-path ACL. Both peers remain reachable through out-of-band access. The ISL is up, peer synchronization is healthy, and the downstream multi-chassis LAGs remain collecting and distributing without loss. Captures show keepalive packets being dropped on the management path. Choose the response that matches the actual failure.

Accepted Answer

Restore the management-path ACL for keepalive; retain the healthy ISL and forwarding LAGs.

Answer

Suspend the secondary peer's multi-chassis LAGs until keepalive returns.

Answer

Carry keepalive over the ISL instead of the independent management path.

Answer

Reboot the secondary peer to reestablish peer synchronization.

Question 9

A campus VXLAN handoff must carry a 1,500-byte inner IP packet without fragmentation or reducing the client MTU. The VTEPs preserve one inner 802.1Q tag but do not carry the inner Ethernet FCS. The outer transport is IPv6 with its base header and no extension headers, followed by UDP and the ordinary VXLAN header. Every underlay hop currently has an IP MTU of 1,560 bytes and supports an increase to 1,600 bytes. Which outer IP packet size and underlay decision are correct?

Accepted Answer

1,574 bytes; raise the underlay IP MTU to at least 1,574 bytes along the entire path.

Answer

1,550 bytes; retain the 1,560-byte underlay IP MTU because the encapsulated packet already fits.

Answer

1,554 bytes; retain the 1,560-byte underlay IP MTU because the inner VLAN tag still fits.

Answer

1,570 bytes; raise the underlay IP MTU to 1,570 bytes along the entire path.

Question 10

Voice quality deteriorates only when a routed transit link carrying an AOS-10 tunnel becomes congested. The radio-side mapping is already verified as DSCP 46 to UP 6 to AC_VO. Captures show voice packets retain inner DSCP 46 but receive outer DSCP 0 at encapsulation. The transit switches classify only the outer IP header. Backup traffic shares the tunnel and must remain best effort. Which adjustment targets the loss without promoting the backups?

Accepted Answer

Map approved voice traffic to EF in the tunnel's outer header.

Answer

Move DSCP 46 traffic from UP 6 to UP 7.

Answer

Set the outer DSCP to EF for every packet in the AP-to-gateway tunnel.

Answer

Re-mark voice as EF after the gateway removes the tunnel header.

Free ACMX Practice Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

That's 10 of 1,030