HPE Network Data Center Professional Architect Exam HPE7-A12 Question # 4 Topic 1 Discussion
HPE7-A12 Exam Topic 1 Question 4 Discussion:
Question #: 4
Topic #: 1
You have delivered a CX 10000-based data-center network to a customer. The customer wants to ensure a smooth transition to the new network before beginning to implement the security capabilities.
What should you recommend for the initial deployment?
A.
Making sure that strict firewall bypass is enabled for ARP broadcasts
B.
Making sure that strict firewall mode is disabled
C.
Making sure that all VRFs have been added to PSM with an ingress policy that has no rules
D.
Making sure that all networks have been added to PSM with an egress policy that has no rules
When deploying the Aruba CX 10000 Distributed Services Switch (DSS) featuring the AMD Pensando Elba Data Processing Unit (DPU), understanding the baseline operational forwarding modes is essential to prevent unintended outages during brownfield cutovers and initial migrations.
The CX 10000 platform incorporates an administrative control known as " strict firewall mode " . When strict firewall mode is enabled on the switch, the integrated Pensando DPU enforces an absolute default-deny posture: all IPv4 and IPv6 unicast traffic traversing non-default VRFs is dropped immediately unless an explicit stateful security policy permitting that specific traffic has been authored, committed, and attached to the target VRF or Network object in Pensando Policy and Services Manager (PSM).
During initial network bring-up, workload onboarding, and verification phases, the architect should ensure that strict firewall mode remains disabled. With strict firewall mode disabled, the CX 10000 forwards data plane traffic normally using standard Layer 2/Layer 3 switching logic, providing a stable environment to validate routing, overlay encapsulation, and server connectivity before micro-segmentation and enforcement policies are systematically applied.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit