The most secure and appropriate method is to create a custom role with the specific write permissions needed for day-to-day management (WLAN, AP, Switch) and then apply it with a Group scope. This scope limits the administrator’s view and control to only the device groups (folders) assigned to their specific branch, effectively creating administrative boundaries. Global scope is too broad, ‘Full Administrator’ defeats the purpose of delegation, and ‘Observer’ is a read-only role.

In environments with high metal shelving (a dense, RF-hostile environment), signal reflection and multipath are common. Ceiling-mounted APs and beacons have their line-of-sight signals blocked and reflected by the shelves, causing erratic RSSI readings. Placing beacons on the side of shelves at 1-2 meters height provides a more consistent, direct path to APs walking the aisles, significantly improving accuracy. While other options are valid troubleshooting steps, the scenario points to the physical environment as the root cause.

Simply requiring AUP acceptance is not enough to log the details. The ‘AUP Logging’ advanced feature, when enabled, specifically records the username (if provided) and the timestamp of the acceptance to the Central monitoring logs. This creates the auditable trail required for compliance. The Access Tracker shows sessions but not necessarily AUP acceptance details, and syslog is for sending logs externally, not for enabling the collection of the data itself.

This is a core concept of Aruba Central’s hierarchy. By default, a child group inherits all configuration profiles (e.g., SSID, AP, UTM) from its parent. However, the power of the model is that you can apply a new profile of the same type (e.g., a different WLAN SSID profile) directly to the child group. This local profile overrides the inherited one for that specific group and its children, allowing for both consistency and localized exceptions.

The requirement is for access to be tied to the *machine itself*, not the user. Certificate-Based 802.1X with machine authentication (EAP-TLS) is the most secure method. The machine presents its unique certificate, and ClearPass can authorize it based on attributes in that certificate (like OU=’Finance’) or by looking up the corresponding computer account in Active Directory. This ensures only domain-joined, finance-department machines can connect, providing strong device identity and security. MAB is less secure (spoofable), and user-based auth does not meet the device-centric requirement.

WPA3-Enterprise mandates the use of specific, more secure EAP methods (like EAP-TLS, EAP-TTLS) and cannot use older methods like PEAP-MSCHAPv2. The most common issue is a mismatch between the WLAN’s security setting and the RADIUS server’s supported EAP types. The next logical step is to verify the RADIUS server (likely ClearPass) is reachable and correctly configured to accept connections for the new SSID with the appropriate EAP protocol. The other options are less likely; the profile is applied, rebooting is a last resort, regulatory domain affects channels not cipher suites, and the checkbox is a basic setting that would have been configured.

A Service Set is a key policy construct in Aruba SD-Branch (formerly SD-WAN). It is a container for a cohesive set of services—primarily stateful firewall policies, NAT rules, and VPN tunnel configurations—that are applied to traffic based on its source/destination or other classifiers. For example, you create a ‘Guest’ Service Set with policies that block access to the corporate network and force traffic out a local breakout tunnel. It’s the core method for implementing business intent for different traffic classes.

Aruba Central has a built-in Alerts & Events engine designed for this exact purpose. You can create an Alert Rule, define the condition (Device Status = Down), set the scope to the specific group (‘London-Office’), specify a duration (5 minutes) to avoid transient alerts, and select the action (Email to specified recipients). This is the native, supported, and most efficient method without requiring external scripts or APIs.

This tests understanding of the two primary gateway modes in ESP. The cloud-based VPNC (part of Central) terminates client tunnels and applies policy in the cloud, which is simple and scalable. A local Master Controller (an on-premises gateway) terminates tunnels and applies policy locally at the branch. The choice is crucial: a local MC allows for direct internet breakout at the branch (improving performance for cloud apps) and keeps sensitive user traffic on-premises to comply with data sovereignty laws, unlike the VPNC which backhauls traffic to the cloud first.

The most secure and appropriate method is to create a custom role with the specific write permissions needed for day-to-day management (WLAN, AP, Switch) and then apply it with a Group scope. This scope limits the administrator’s view and control to only the device groups (folders) assigned to their specific branch, effectively creating administrative boundaries. Global scope is too broad, ‘Full Administrator’ defeats the purpose of delegation, and ‘Observer’ is a read-only role.0