Career upgrade: Learn practical AI skills for better jobs and higher pay.
Level up
PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free Aruba Architect Expert (Written) Practice Questions

Pass your HPE Aruba Networking Certified Expert - Campus Access Architect (Written, HPE7-A13) exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
HPE Aruba does not publicly disclose pass rates Pass Rate
100+ Questions
100% Free
1 / 100
Question 1
Score: 0/0

An expert architect is asked which AOS-CX feature produces a structured event/log feed that can be ingested into a SIEM at scale.

A
B
C
D
to track
Same family resources

Explore More HPE Aruba Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

Aruba Certified Design Associate (ACDA)

Practice Questions

Aruba Certified Mobility Associate (ACMA)

Practice Questions

Aruba Certified Mobility Professional (ACMP)

Practice Questions

Aruba Certified Switching Associate (ACSA)

Practice Questions

Aruba Certified Switching Professional (ACSP)

Practice Questions

HPE Aruba Certified Associate

Practice Questions
2026 Statistics

Key Facts: Aruba Architect Expert (Written) Exam

~65

Exam Questions

Multiple-choice and scenario format (verify on datacard)

~67%

Passing Score

HPE Aruba published target

~115 min

Time Limit

Pearson VUE delivery

~$300

Exam Fee

Per attempt; HPE4-A54 lab is separate

3 yrs

Validity

HPE Aruba certification policy

Expert

Credential Tier

Pairs with HPE4-A54 design lab

The HPE Aruba Networking Certified Expert - Campus Access Architect (Written, HPE7-A13) is the written portion of HPE Aruba's expert-tier campus design credential, with approximately 60-70 questions, ~105-120 minutes, ~67% passing score, and a ~$300 fee through Pearson VUE. It tests Aruba ESP architecture, EVPN-VXLAN large-scale fabric design, AOS 10 gateway cluster sizing, dynamic segmentation (UBT/GBP), ClearPass cluster design, Aruba Central with NetConductor, capacity planning, and operations. HPE7-A13 must be passed alongside the separate HPE4-A54 8-hour practical design lab to earn the full Expert credential. The exam is the modern successor to the legacy ACDX track.

Sample Aruba Architect Expert (Written) Practice Questions

Try these sample questions to test your Aruba Architect Expert (Written) exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1An expert architect is sizing an AOS 10 gateway cluster for a 6,000-AP large campus. Which design statement aligns with HPE Aruba published cluster scale guidance?
A.A single homogeneous gateway cluster scales to 12 nodes; split AP load across multiple clusters or use MultiZone when device counts exceed a single cluster's documented limits
B.A single gateway cluster supports unlimited APs as long as the gateways are the same model
C.Cluster scale is determined only by the publisher gateway's CPU; member gateways are stateless
D.An AOS 10 cluster must contain at least 4 gateways and at most 6 to be supported
Explanation: HPE Aruba documents a per-platform maximum of 12 gateways in a homogeneous cluster (e.g., 7200/9200/9300 series). Beyond that, large campus designs split APs across multiple clusters in different roaming domains or use MultiZone so APs anchor specific WLANs to different clusters. The architect picks gateway model and cluster count by the published per-model client/AP capacity, not by an arbitrary minimum.
2Which statement BEST describes the role split between a Validated Solution Guide (VSG) campus reference architecture and a customer-specific design?
A.VSG architectures replace customer designs; if the VSG fits, no further design work is needed
B.VSGs document validated building blocks (small/medium/large campus, EVPN-VXLAN, capacity); the architect adapts a chosen reference to the customer's requirements and constraints
C.VSGs only apply to data center designs; campus designs are not validated by HPE Aruba
D.VSGs are a sales tool with no technical validation behind the topologies
Explanation: Aruba VSGs publish validated reference architectures - small, medium, and large campus, EVPN-VXLAN, capacity planning - tested against specific software releases and platforms. The expert architect's job is to map customer requirements to the closest validated pattern, then adjust scale, redundancy, and integrations within those validated boundaries.
3A multi-site campus design must keep an existing Layer 2 segment stretched between two buildings 12 km apart over dark fiber, while modernizing the underlay to routed-only. Which Aruba ESP construct meets this requirement?
A.VRRP across the dark fiber
B.EVPN-VXLAN overlay with anycast gateway on AOS-CX, terminating the L2 VNI on leaf VTEPs in each building
C.MSTP region spanning both buildings
D.AOS 10 MultiZone tunneling between two campus locations
Explanation: EVPN-VXLAN provides L2 extension over a routed underlay. With anycast gateway, both buildings share the same default gateway IP/MAC for the stretched VLAN, so hosts can move between sites without changing gateways. This keeps the underlay loop-free and routed while preserving any required L2 adjacency.
4In a large EVPN-VXLAN campus fabric, why is route-reflector (RR) placement on the spines preferred over full-mesh iBGP between leaves?
A.Full-mesh iBGP is not supported on AOS-CX
B.RRs reduce the iBGP session count from N(N-1)/2 to roughly 2N (each leaf peers with two RRs), enabling fabric scale and cleaner failure domains
C.RRs encrypt EVPN updates that would otherwise be sent in cleartext
D.Spine RRs replace the need for an IGP underlay
Explanation: Route reflectors collapse iBGP control-plane meshing. With two RRs on the spines, each leaf has two iBGP sessions instead of N-1, which scales the EVPN control plane and simplifies operations. The IGP underlay still provides next-hop reachability, and EVPN messages remain BGP-signaled.
5An architect is designing a Multi-Domain EVPN deployment connecting two independent campus EVPN-VXLAN fabrics through a border. Which mechanism stitches the two domains while preserving distinct underlay route-targets?
A.GRE tunnel with static MAC entries on each border
B.BGP EVPN inter-domain route-target import/export with re-origination at the border-leaf or DCI device, often with downstream VNI assignment
C.OSPF area 0 stitching over the border
D.PIM-SM rendezvous point on the border
Explanation: Multi-Domain EVPN stitching reuses the BGP EVPN address family at the border, importing routes from one domain, re-originating them with the local domain's RT/RD, and optionally translating VNIs. This preserves administrative isolation per domain while extending L2/L3 connectivity end-to-end.
6A customer requires that wired user authentication and policy enforcement happen at an AOS 10 gateway cluster rather than at the access switch. Which Aruba feature enforces this?
A.Local user roles defined on AOS-CX with port-based ACLs
B.User-Based Tunneling (UBT) from AOS-CX to an AOS 10 gateway cluster, where the gateway role enforces policy
C.Static VLAN assignment by RADIUS
D.Spanning-tree BPDU guard plus storm control
Explanation: UBT tunnels the user's traffic from the AOS-CX access switch to a designated AOS 10 gateway cluster zone. The switch directs traffic by user role; the gateway cluster terminates the GRE tunnel and applies the policy/role for enforcement. This is the canonical Dynamic Segmentation pattern when the customer wants centralized wired policy.
7An access switch has eight different user roles, each tunneling to a different gateway cluster. What scale-related design rule does this violate?
A.Each role must use a unique VLAN ID
B.AOS-CX supports a maximum of eight UBT zones per switch/stack; designing exactly at the limit leaves no headroom for change or migration
C.UBT requires symmetric routing on the underlay
D.Roles must be downloaded from ClearPass via CoA every five minutes
Explanation: AOS-CX caps UBT zones at eight per switch or VSF stack. Designing right at the maximum leaves zero room for adding a new gateway cluster (e.g., during a phased migration) and is fragile. Architects typically reserve at least one zone for transitional or evacuation use.
8Which segmentation strategy enforces user-to-user policy independent of IP/VLAN as users roam across an EVPN-VXLAN campus fabric?
A.ACLs applied per VLAN on each leaf
B.Group-Based Policy (GBP) using SGT-style group tags carried in the VXLAN header and enforced at egress on AOS-CX
C.MAC ACLs configured on every distribution port
D.DHCP option 82 filtering
Explanation: Group-Based Policy carries an identity/group tag in the VXLAN header so policy follows the user across the fabric. Egress enforcement at the destination switch decouples policy from VLAN and IP, which is the right answer for a roaming user who keeps the same identity but lands on different leaves.
9When designing role hierarchy in a large campus, which approach BEST balances flexibility and operational complexity?
A.One mega-role with all permissions, narrowed by ACLs
B.A small set of base roles tied to identity attributes, with ClearPass downloadable user roles (DUR) for situational overrides
C.One role per individual user
D.Static port-based roles only, no RADIUS
Explanation: A small set of base roles backed by ClearPass downloadable user roles is the canonical Aruba pattern. Identity attributes (department, posture, device type) drive role choice; downloadable roles let ClearPass push exceptions without recoding the switch or gateway. One-role-per-user or one-mega-role both fail at scale.
10An expert architect is comparing UBT, native role enforcement on AOS-CX, and Group-Based Policy for a 5,000-user campus. Which factor MOST often pushes the design toward GBP at scale?
A.GBP is the only Aruba option that supports 802.1X authentication
B.GBP decouples policy from VLAN, supports east-west enforcement at egress, and avoids hairpinning all wired traffic to a gateway cluster
C.GBP is mandatory whenever ClearPass is used
D.GBP requires fewer switch ports than UBT
Explanation: Pure UBT centralizes policy at gateways but adds tunnel-encapsulation overhead and a hairpin path for wired-to-wired flows on the same access switch. GBP places enforcement at egress on the destination switch using group tags, which scales horizontally and avoids hairpinning. Native switch roles work well at smaller sites but are harder to manage uniformly across many switches.

About the Aruba Architect Expert (Written) Exam

The HPE Aruba Networking Certified Expert - Campus Access Architect (Written, HPE7-A13) is the WRITTEN portion of the Expert-tier campus design credential. It validates expert-level design knowledge of Aruba ESP architecture across wired, wireless, and SD-Branch, including multi-site campus design with the Aruba Validated Solution Guides (VSG), EVPN-VXLAN large-scale fabric design (route-reflector spines, anycast gateway, symmetric IRB, Multi-Domain EVPN), AOS 10 gateway cluster sizing and MultiZone, dynamic segmentation with UBT/GBP/native roles, ClearPass cluster design at scale, Aruba Central group/site hierarchy and NetConductor fabric automation, capacity planning, HA, and zero-trust segmentation. HPE7-A13 is the successor to the legacy ACDX track and pairs with the HPE4-A54 8-hour practical design lab to earn the full Expert credential.

Assessment

Approximately 60-70 multiple-choice and scenario-based questions covering Aruba ESP architecture, EVPN-VXLAN large-scale fabric design, AOS 10 gateway cluster and mobility, dynamic segmentation, ClearPass cluster design, Aruba Central, capacity planning, WAN/SD-Branch integration, HA, and operations

Time Limit

~105-120 minutes

Passing Score

~67%

Exam Fee

~$300 USD (HPE / Pearson VUE)

Aruba Architect Expert (Written) Exam Content Outline

20%

Multi-site Campus Architecture and ESP Design

Aruba ESP unified architecture, VSG reference designs, multi-site interconnection, AOS-CX platform selection (CX 6300/6400/8325/9300), collapsed core vs 3-tier, MSP and group/site hierarchy

20%

EVPN-VXLAN Large-Scale Fabric Design

Underlay + overlay BGP EVPN, route-reflector design, anycast gateway, symmetric vs asymmetric IRB, EVPN type-2/4/5, Multi-Domain EVPN stitching, RT/RD policy, hub-and-spoke VRFs, BUM via ingress replication or PIM-SM

15%

AOS 10 Gateway Cluster and Mobility Design

AOS 10 cluster sizing (max 12 per homogeneous cluster), MultiZone, roaming domains, 802.11r/k/v, AirMatch/ClientMatch, Wi-Fi 6E/Wi-Fi 7 320 MHz, RAP/Microbranch, stadium and high-density

12%

Dynamic Segmentation and Zero Trust

UBT (8 zones max per switch/stack), GBP at egress, native AOS-CX roles, ClearPass role assignment, downloadable user roles, IoT segmentation, identity-aware policy across wired/wireless/VPN

10%

ClearPass Cluster Design at Scale

Publisher/Subscriber cluster sizing to ~100K endpoints, dedicated Insight node, Log/Insight DB non-replication, OnGuard, Onboard PKI with OCSP, EAP-TLS at scale, SAML/OIDC federation

8%

Aruba Central Design and NetConductor

Group/site hierarchy, MSP tenants, configuration templates with audit/drift, AI Insights/NetInsight, scheduled firmware upgrades, NetConductor fabric automation, control-plane resiliency

5%

Capacity Planning and PoE

PoE++ 802.3bt Class 6 (60W) for Wi-Fi 6E/7 APs, redundant PSU sizing, uplink capacity (25/100/400G, multi-gig access), client/AP scale per gateway, login-storm bursts, design-ceiling documentation

5%

WAN, SD-Branch, and Cloud Integration

Aruba branch gateways, SD-Branch with EdgeConnect SD-WAN, IPSec overlays, BGP failover, RAP/Microbranch teleworker, MPLS handoff via VRF-Lite, cloud onramp to AWS/Azure/GCP

3%

High Availability and Failure-Domain Analysis

VSX with active gateway and MC-LAG, VSF access stacking, EVPN multi-homing (ESI all-active, type-4 DF), N+1 cluster sizing, BFD, OSPF graceful restart, geographic/power diversity

2%

Security, Compliance, and Operations

CPSec, Aruba Threat Defense and IDS/IPS at choke points, PCI/HIPAA segmentation, sFlow/IPFIX east-west visibility, gNMI/syslog SIEM, QoS, change management, runbooks, 30/60/90 handover

How to Pass the Aruba Architect Expert (Written) Exam

What You Need to Know

  • Passing score: ~67%
  • Assessment: Approximately 60-70 multiple-choice and scenario-based questions covering Aruba ESP architecture, EVPN-VXLAN large-scale fabric design, AOS 10 gateway cluster and mobility, dynamic segmentation, ClearPass cluster design, Aruba Central, capacity planning, WAN/SD-Branch integration, HA, and operations
  • Time limit: ~105-120 minutes
  • Exam fee: ~$300 USD

Keys to Passing

  • Complete 500+ practice questions
  • Score 80%+ consistently before scheduling
  • Focus on highest-weighted sections
  • Use our AI tutor for tough concepts

Aruba Architect Expert (Written) Study Tips from Top Performers

1Memorize the AOS 10 cluster ceiling: maximum 12 gateways in a homogeneous cluster; design MultiZone or multiple clusters when device counts exceed per-model client/AP capacity
2Internalize the AOS-CX UBT zone limit (8 per switch/stack) and design with at least one reserved zone for migration or transitional use
3Practice EVPN concepts cold: type-2 (MAC/IP), type-4 (Ethernet Segment / Designated Forwarder), type-5 (IP prefix), MAC mobility extended community, RT vs RD
4Drill the Discover-Analyze-Architect-Propose (DAAP) methodology and what artifacts belong in each phase - the expert exam tests deliverables, not just protocols
5Know capacity gotchas: PoE++ 802.3bt Class 6 (60W) for Wi-Fi 6E/7, login-storm bursts against ClearPass auth-rate, multi-gig uplink saturation in dense closets
6Understand the data-plane vs control-plane split: Aruba Central is a management plane, so AOS-CX, AOS 10, and ClearPass keep enforcing during a Central outage

Frequently Asked Questions

What is the HPE7-A13 (HPE Aruba Networking Certified Expert - Campus Access Architect Written) exam?

HPE7-A13 is the WRITTEN portion of HPE Aruba Networking's Expert-tier Campus Access Architect credential. It validates expert-level design knowledge of Aruba ESP, EVPN-VXLAN large-scale fabrics, AOS 10 gateway clusters, dynamic segmentation, ClearPass cluster design, Aruba Central with NetConductor, capacity planning, and operations. To earn the full Expert credential, candidates must also pass the separate HPE4-A54 8-hour practical design lab.

How many questions are on HPE7-A13 and how much time do I have?

HPE7-A13 typically contains approximately 60-70 multiple-choice and scenario-based questions with a time limit of about 105-120 minutes. The passing score is approximately 67%. Verify exact details on the official HPE7-A13 datacard at exam scheduling time, since HPE periodically updates question counts and weights.

How does HPE7-A13 relate to HPE4-A54?

HPE7-A13 is the WRITTEN exam (knowledge-based, ~2 hours, multiple choice). HPE4-A54 is the practical 8-hour design lab where candidates produce real architecture artifacts under time pressure. Both are required to earn the HPE Aruba Networking Certified Expert - Campus Access Architect credential. Most candidates pass HPE7-A13 first as a prerequisite mindset for the lab.

What is the HPE7-A13 exam fee?

HPE7-A13 costs approximately $300 USD per attempt through Pearson VUE. The HPE4-A54 design lab is priced separately and is typically several times higher due to its 8-hour proctored format. Always confirm current pricing on the HPE certification portal at registration time.

Is HPE7-A13 the successor to the legacy ACDX exam?

Yes. HPE7-A13 is part of the modernized HPE Aruba Networking Expert track that succeeds the legacy Aruba Certified Design Expert (ACDX). The Expert track now spans Campus Access Switching (HPE7-A06), Mobility (HPE7-A07), and Architect (HPE7-A13 written + HPE4-A54 design lab). Holders of recent ACDX-aligned credentials should review the new blueprints for delta study.

What experience is recommended before attempting HPE7-A13?

HPE recommends candidates already hold the HPE Aruba Networking Certified Professional - Campus Access Architect (HPE7-A11) or equivalent experience. In practice, expect to need significant hands-on time with Aruba ESP designs, EVPN-VXLAN fabrics, AOS 10 mobility at scale, and ClearPass cluster operations. Many successful candidates have multi-year Aruba consulting or large-customer design experience.

How should I prepare for HPE7-A13?

Read the Aruba Validated Solution Guides (VSG) end-to-end (campus design, EVPN-VXLAN, capacity planning, data center design). Build a small EVPN-VXLAN lab on AOS-CX. Practice failure-domain analysis and Discover-Analyze-Architect-Propose documentation. Use this 100-question free practice bank to drill expert-level scenarios, then run the official HPE study guide and any HPE-led design workshops.