Free HPE7-A09 sample questions

Correct answer: Ingress Replication (Head-end replication) on all VTEPs

In AOS-CX 10.13 EVPN-VXLAN, BUM traffic is flooded with head-end (ingress) replication: the source VTEP sends one unicast VXLAN copy to each remote VTEP in the VNI's flood list, which EVPN builds automatically from the Type-3 (IMET) routes. The AOS-CX 10.13 EVPN VXLAN Guide states: "For BUM traffic flooding, only Head End Replication (HER) is supported." Underlay multicast replication with PIM-SM is therefore not available at 10.13 (later releases such as 10.17 add an optional underlay-multicast replication mode). Anycast RP with MSDP is an RP-redundancy design rather than a VXLAN replication method, and static VXLAN tunnels give up the EVPN control plane and rely on flood-and-learn.

Correct answer: Virtual Switching Extension (VSX) with VSX LAGs

VSX keeps an independent control plane on each switch, synchronized over the ISL, and VSX LAGs (multi-chassis LAGs) let downstream switches use both uplinks actively with no STP blocking. For upgrades, `vsx update-software` installs the new image on both peers and reboots the secondary first and then the primary, so one peer keeps forwarding while the other reloads; HPE markets this as VSX Live Upgrade with LACP traffic draining, which minimizes rather than completely eliminates disruption. VSF stacking is supported only on 6200/6300-class switches, not on the 8325; MEC is Cisco terminology; standalone routed switches with ECMP and BFD provide no coordinated upgrade of a redundant pair.

Correct answer: Configure UBT Zone mode with a Clustered Mobility Gateway group

UBT Zone mode is the preferred design for scalability. By configuring a UBT Zone that points to a Cluster of gateways (Mobility Controllers/Gateways), the system provides stateful failover and load balancing of user tunnels. Standalone controllers introduce a single point of failure, and PAPI is a control plane protocol, not a tunneling mode.

Correct answer: Configure Area 1 as a Totally Stubby Area and implement route summarization at the ABRs

Configuring Area 1 as a Totally Stubby Area prevents external (Type 5) and inter-area (Type 3) LSAs from entering the access layer, replacing them with a single default route. This minimizes the LSDB size on access switches. Furthermore, implementing route summarization at the ABR (Distribution) towards the Core prevents specific link flaps in the access layer from triggering SPF calculations in the Core, stabilizing the backbone.

Correct answer: Configure VLANs on the ISL and use 'vsx-sync' to ensure consistency

The ISL is a member of all VLANs by default, and the VSX Guide warns that VLANs containing VSX LAG members must not be excluded from the ISL: traffic for single-homed devices, or traffic that arrives on one peer after a downstream link to the other peer fails, has to cross the ISL. Enabling `vsx-sync` in each VLAN context keeps the VLAN definitions identical on both peers and prevents configuration drift. Excluding VLANs from the ISL, using PVLANs on the ISL or splitting devices into separate VRFs would break these paths.

Correct answer: interface vlan 10 ip address 10.1.10.2/24 active-gateway ip 10.1.10.1 mac 12:01:00:00:01:00

With VSX active gateway, each peer keeps its own SVI address (here .2 on the primary, another address such as .3 on the secondary) and both peers answer for the shared virtual IP (.1) and virtual MAC, so both route traffic for the default gateway. The VIP and VMAC must be identical on both VSX peers (`active-gateway ip mac `), and the SVI needs an IP address in the same subnet. HPE recommends a locally administered unicast VMAC (x2/x6/xA/xE-xx-xx-xx-xx-xx, for example 12:01:00:00:XX:0Y for an aggregation pair) and never the peer system MAC. VRRP cannot be configured on an SVI that uses active gateway, and `vsx-sync active-gateways` only synchronizes the configuration; it does not create the gateway.