Case study
A retailer needs a wireless and wired network upgrade, as well as an authentication and access control solution for a network that includes a main office with a three-floor building and six branch sites. The branch users all use resources at the main corporate office. Branch office employees will use wireless connections. At the main office, employees use wired and wireless connections.
The customer wants the strongest authentication for employee wireless connections. It is also important that the MC role-based firewall can implement consistent access controls on employee connections no matter where the employees connect and no matter how they connect (wirelessly or, at the main site, wired).
The customer also needs to provide complimentary wireless access for guests. Guest should be redirected to a portal, through which they can register and login.
The customer would like two SSIDs, CompanyXEmployee and CompanyXGuest. The company wants to divide employees in two groups, managers and staff. In the corporate network, managers should only have access to Server Group Managers and staff should only have access to Server Group Staff. Each server group includes necessary services such as domain and DHCP, as well as servers that the employees access to do their jobs. All employees should also have access to the Internet. Guests should only have HTTP and HTTPS access, and only to the Internet.
The customer has:
* a maximum of 1000 employee devices
* a maximum of 100 guest devices at the same time
* 500 devices on wired ports at the main site, which will be supported by 12 new AOS-Switches (mostly employee laptops, as well as a few non-802.1X capable printers, which should just communicate with print servers) The devices used by employees include 450 company-issued laptops, which the company wants to screen for security issues and violations of security policies. All authentications are assumed to be concurrent.
To fulfill the requirements for the wireless network upgrade, the architect plans to propose:
* 5 RAPs at each of 6 branch sites
* 60 APs at the main site
The architect will also propose an MM and ClearPass.
The architect still needs to plan the Mobility Controllers (MCs). The customer requires high availability for wireless services and redundancy for the MCs. If a single MC fails, the network must continue to function without impact. If an MC fails, the customer must also receive a replacement component for the failed component by the next business day so that their IT staff can install it and get the network back to normal operation as soon as possible.
Software upgrades must also be seamless, without the introduction of any downtime for wireless services, and the customer needs to be able to obtain the latest software over the lifetime of the solution for the next several years.
Which plan for authentication meets the customer needs?

• A. Employee SSID = WPA2-802.1X, Guest SSID = WPA2-PSK, Wired edge ports = No authentication
• B. Employee SSID = WPA2-802.1X, Guest SSID = Captive portal, Wired edge ports = 802.1X + MAC-Auth
• C. Employee SSID = WPA2-802.1X, Guest SSID = Captive portal, Wired edge ports = No authentication
• D. Employee SSID = WPA2-PSK, Guest SSID = MAC-Auth, Wired edge ports = MAC-Auth

A customer has critical wired endpoints and wants to minimize the chances they will lose their connection to the network. These endpoints are dual-homed, each with two Ethernet connections that are in a link aggregation.
The architect plans to deploy two 5406R switches in the closet.
What else should the architect specify in the plan?

• A. The 5406R switches are not in a VSF fabric; each switch has redundant power supplies but not redundant management modules.
• B. The 5406R switches are in a VSF fabric; each switch has redundant power supplies, but not redundant management modules.
• C. The 5406R switches are not in a VSF fabric; each switch has redundant power supplies and redundant management modules.
• D. The 5406R switches are in a VSF fabric; each switch has redundant power supplies and redundant management modules.

A retailer wants to provide wireless services for guests across a section of store floor, which consists of 82 foot (25m) long aisles of cans and dry food goods. The shelves are six feet (1.8 m) high, and the ceiling height is
13 feet (4 m) high.
The architect recommends overhead APs deployed at 40-50 foot (12 to 15 m) intervals every few aisles rather than in every aisle.
What is one factor that justifies this recommendation?

• A. the low transmit power of most guest devices
• B. the aisle length
• C. the low ceiling height
• D. the low shelf height relative to ceiling height

A retailer has many small outlets. Each outlet has: a local Internet connection, but no local services. The outlets have no local IT staff. All traffic must go through the main office. Devices at the site are primarily POS systems.
The retailer currently has a complex VPN solution, but would like to:
* Shift entirely to wireless devices with a new 802.11ac network
* Simplify network setup for existing and new outlets
The architect has examined the sites and determined that each will require about 1 to 3 APs.
The customer wants the most cost-effective solution that meets the requirements.
Which solution should the architect recommend for each remote site?

• A. Remote APs (RAPs) with IPsec tunnels to a main office MC
• B. Instant APs (IAPs) with CPSec control channels to Aruba Central
• C. Campus APs (CAPs) with CPSec control channels to a main office MC
• D. Campus APs (CAPs) with a local MC that has an SD-WAN license

What is one requirement for ensuring that MCs can update their software without the need for a maintenance window?

• A. MCs must be in a cluster and connected in the same VLANs.
• B. MCs must have AP licenses assigned to them in a dedicated local pool.
• C. MCs must be directly connected on at least one port.
• D. MCs must be managed by an MM and connected to the same switch.