HPE6-A47 Exam Dumps : Designing Aruba Solutions

 To ensure that wireless voice traffic is properly prioritized for Microsoft Skype for Business, the architect should set up firewall policies and SDN to mark voice on the MCs or MM. Firewall policies are used to classify and prioritize traffic based on the application, user role, device type, and location. SDN is used to integrate with the Skype for Business SDN API, which provides real-time information about voice and video sessions, such as source and destination IP addresses, ports, codecs, and quality metrics. By using firewall policies and SDN, the MCs or MM can dynamically mark voice traffic with the appropriate DSCP values and queue them in the highest priority queue on the wireless and wired network12.

The other options are not sufficient or relevant for ensuring wireless voice traffic prioritization for Skype for Business. Broadcast suppression combined with AirGroup is used to reduce the network overhead and improve the user experience for wireless devices that use multicast or broadcast protocols, such as Apple Bonjour or Microsoft UPnP3. Airtime Fairness set to fair-access is used to balance the airtime usage among clients with different capabilities and data rates, such as 802.11ac and 802.11n4. Voice-aware Layer 3 roaming is used to enable seamless handoff of voice sessions across different subnets without dropping the call5. While these features may enhance the overall wireless performance and reliability, they do not directly prioritize voice traffic for Skype for Business.

References:

• Aruba Validated Reference Design: 802.11ac Networks
• Aruba Validated Reference Design: Skype for Business
• Aruba Validated Reference Design: AirGroup
• Aruba Validated Reference Design: Adaptive Radio Management
• Aruba Validated Reference Design: Voice over Wireless LAN

The traditional guideline limits a wired VLAN to a /24 subnet, which provides enough IP addresses for 253 endpoints. You might have suggested one of three approaches: one VLAN per floor, one VLAN per building, or one VLAN per campus. The one VLAN per floor approach is not recommended because it interferes with roaming and adds complexity. If you did take this approach, the /24 subnets are not large enough for the requirements on every floor. You would need to ask for /23 subnets. The one VLAN per building approach would work if you considered each building its own RF domain. It provides roaming within a building and, if you are using a single cluster at the data center, between buildings. Ifyou deployed two MCs or clusters, one at each building, though, GRE tunneling would be required to support roaming between buildings.

The customer wants to use certificates to authenticate user devices, which means that they need a strong and secure method of verifying the identity of the devices that connect to the employee WLAN. The best option for this is to use EAP-TLS instead of PEAP-MSCHAPv2. EAP-TLS stands for Extensible Authentication Protocol-Transport Layer Security, and it is a protocol that uses certificates on both the client and the server side to establish a mutual authentication and a secure channel for data exchange. EAP-TLS is considered the most secure EAP method, as it prevents common attacks such as dictionary attacks, man-in-the-middle attacks, and replay attacks.

The other options are not suitable for the customer requirements:

• Option B is incorrect because TKIP encryption is weaker than AES encryption. TKIP stands for Temporal Key Integrity Protocol, and it is an older encryption method that was designed to replace WEP, which had serious security flaws. However, TKIP also has some vulnerabilities, and it is not recommended for modern WLANs. AES stands for Advanced Encryption Standard, and it is a newer and stronger encryption method that provides better security and performance for WLANs.
• Option C is incorrect because WPA2-PSK is less secure than WPA2-Enterprise. WPA2-PSK stands for Wi-Fi Protected Access 2-Pre-Shared Key, and it is a security mode that uses a common passphrase or key to authenticate all devices that connect to the WLAN. However, this passphrase or key can be easily compromised or shared, and it does not provide individual authentication or encryption for each device. WPA2-Enterprise stands for Wi-Fi Protected Access 2-Enterprise, and it is a security mode that uses a RADIUS server to authenticate each device individually and dynamically generate encryption keys for each session. WPA2-Enterprise provides better security and scalability for WLANs.
• Option D is incorrect because TTLS does not use certificates to authenticate user devices. TTLS stands for Tunneled Transport Layer Security, and it is a protocol that uses certificates only on the server side to establish a secure tunnel for data exchange. The client side can use different methods to authenticate, such as passwords, tokens, or certificates. However, TTLS does not require certificates on the client side, and it is less secure than EAP-TLS.

References:

• ArubaOS 8.5 User Guide)
• ArubaOS 8.5 Security Guide)
• Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))