A customer has a campus that has expanded to several buildings. The buildings are between 100 and 200 feet (30 m and 61 m) apart and connected with SM fiber. The customer currently has instant APs (IAPs) clusters on several floors of several buildings. The customer has consolidated central resources in a small data center in one of the buildings.
The customer would like a more centralized architecture in which all wireless traffic is tunneled to the data center and IAPs are managed centrally.
What should the architect recommend?

• A. Purchase a subscription for Aruba Central device management.
• B. Deploy Aruba MCs in a central location, and convert IAPs to CAPs.
• C. Purchase a license for a Virtual Mobility Master (VMM).
• D. Deploy Aruba AirWave in a central location.

Refer to the exhibit.

An architect needs to design the topology for a new wired network at a campus with three buildings. The exhibit above shows the cabling layout.
The customer requires link redundancy at all layers, up to one switch-to-switch link can fail without an effect on client connectivity. The architect has determined that the closet of each floor should have three Aruba
2930M switches, and the core will use Aruba 5406 switches.
The aggregation layer, if used, will use Aruba 3810M switches. However, the customer prefers the elimination of the aggregation layer and has asked the architect to advise the impact of the elimination of this layer.
Where would the elimination of the aggregation layer require rewriting?

• A. Building 3 only
• B. All of the buildings
• C. Building 1 and Building 3 only
• D. Building 1 and Building 2 only

In which of these scenarios do the customer requirements point towards tunneled node, or dynamic segmentation, on AOS-Switches?

• A. A customer has wired IoT devices and wants to be able to control their access. The architect recommends sending all of their traffic through the MC role-based firewall.
• B. A customer lacks physical security and wants to impose 802.1X authentication on wired ports. After employees complete 802.1X authentication, they should receive full access to the network.
• C. A customer wants to manage their AOS-Switches in a more centralized manner. They would like to connect AOS-Switches to AirWave over secure IPsec tunnels and control all configuration from there.
• D. A customer has a branch office with an AOS-Switch and an Internet connection. The customer would like to give branch office users secure access to the corporate LAN over an IPsec tunnel.

Case study
A retailer needs a wireless and wired network upgrade, as well as an authentication and access control solution for a network that includes a main office with a three-floor building and six branch sites. The branch users all use resources at the main corporate office. Branch office employees will use wireless connections. At the main office, employees use wired and wireless connections.
The customer wants the strongest authentication for employee wireless connections. It is also important that the MC role-based firewall can implement consistent access controls on employee connections no matter where the employees connect and no matter how they connect (wirelessly or, at the main site, wired).
The customer also needs to provide complimentary wireless access for guests. Guest should be redirected to a portal, through which they can register and login.
The customer would like two SSIDs, CompanyXEmployee and CompanyXGuest. The company wants to divide employees in two groups, managers and staff. In the corporate network, managers should only have access to Server Group Managers and staff should only have access to Server Group Staff. Each server group includes necessary services such as domain and DHCP, as well as servers that the employees access to do their jobs. All employees should also have access to the Internet. Guests should only have HTTP and HTTPS access, and only to the Internet.
The customer has:
*a maximum of 1000 employee devices
*a maximum of 100 guest devices at the same time
*500 devices on wired ports at the main site, which will be supported by 12 new AOS-Switches (mostly employee laptops, as well as a few non-802.1X capable printers, which should just communicate with print servers) The devices used by employees include 450 company-issued laptops, which the company wants to screen for security issues and violations of security policies. All authentications are assumed to be concurrent.
To fulfill the requirements for the wireless network upgrade, the architect plans to propose:
*5 RAPs at each of 6 branch sites
*60 APs at the main site
The architect will also propose an MM and ClearPass.
The architect still needs to plan the Mobility Controllers (MCs). The customer requires high availability for wireless services and redundancy for the MCs. If a single MC fails, the network must continue to function without impact. If an MC fails, the customer must also receive a replacement component for the failed component by the next business day so that their IT staff can install it and get the network back to normal operation as soon as possible.
Software upgrades must also be seamless, without the introduction of any downtime for wireless services, and the customer needs to be able to obtain the latest software over the lifetime of the solution for the next several years.
What is a correct plan for firewall rules for the guest role? (The options describe the rules, but do not need to use correct command syntax.)

• A. deny all to corporateLAN, permit all HTTP, permit all HTTPS, deny all other traffic
• B. permit all DHCP, permit all DNS, deny all to corporateLAN, permit all HTTP, permit all HTTPS
• C. permit all HTTP, permit all HTTPS
• D. permit all DHCP, permit all DNS, permit all HTTP, permit all HTTPS

What is one requirement for ensuring that MCs can update their software without the need for a maintenance window?

• A. MCs must be in a cluster and connected in the same VLANs.
• B. MCs must be managed by an MM and connected to the same switch.
• C. MCs must have AP licenses assigned to them in a dedicated local pool.
• D. MCs must be directly connected on at least one port.