Your Director of Security asks you to assign AOS-CX switch management roles to new employees...

The correct built-in AOS-CX management role is administrators. HPE Aruba Networking defines the administrators group as the default role with full management privileges and explicitly assigns it privilege level 15. Members of this group can perform firmware upgrades, modify switch configuration, view sensitive configuration information, add or remove local user accounts, change passwords, and use all supported REST API methods. Aruba Networking

The existing auditors assignment does not satisfy the requirement. The auditors group is intentionally restricted to audit-related operations and is assigned privilege level 19, not 15. Its CLI access is limited to the auditor context, and its Web UI and REST API permissions are similarly restricted to logging and auditing resources. Aruba Networking

AOS-CX also documents the mapping used with TACACS+: privilege level 15 maps to administrators, privilege level 1 maps to operators, and privilege level 19 maps to auditors. Aruba Networking

Therefore, because this user needs both firmware-upgrade capability and privilege level 15, the appropriate default management role is administrators.

Study Guide Topics: AOS-CX Management Users, Built-in User Groups, RBAC, Privilege Levels, Administrators vs. Auditors, Firmware Management, TACACS+ Authorization.