Explanation
AirMatch is a feature that provides centralized RF planning and optimization service for Aruba wireless networks. It uses cloud-based algorithms and machine learning to optimize the RF performance and user experience. References:https://www.arubanetworks.com/assets/ds/DS_AirMatch.pdf

Explanation
The RADIUS message that you should look for to ensure a successful connection via 802.1X is Access-Accept. This message indicates that the RADIUS server has authenticated and authorized the supplicant (the device that wants to access thenetwork) and has granted it access to the network resources. The Access-Accept message may also contain additional attributes such as VLAN ID, session timeout, or filter ID that specify how the authenticator (the device that controls access to the network, such as a switch) should treat the supplicant's traffic.
The other options are not RADIUS messages because:
Authorized: This is not a RADIUS message, but a state that indicates that a port on an authenticator is allowed to pass traffic from a supplicant after successful authentication and authorization.
Success: This is not a RADIUS message, but a status that indicates that an EAP Extensible Authentication Protocol (EAP) is an authentication framework that provides support for multiple authentication methods, such as passwords, certificates, tokens, or biometrics. EAP is used in wireless networks and point-to-point connections to provide secure authentication between a supplicant (a device that wants to access the network) and an authentication server (a device that verifies the credentials of the supplicant). exchange has completed successfully between a supplicant and an authentication server.
Authenticated: This is not a RADIUS message, but a state that indicates that a port on an authenticator has received an EAP-Success message from an authentication server after successful authentication of a supplicant.
References: https://en.wikipedia.org/wiki/RADIUS#Access-Accept
https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-1
https://en.wikipedia.org/wiki/IEEE_802.1X#Port-based_network_access_control
https://en.wikipedia.org/wiki/Extensible_Authentication_Protocol#EAP_exchange

The part of WPA Key Hierarchy that is used to encrypt and/or decrypt data is Pairwise Temporal Key (PTK). PTK is a key that is derived from PMK Pairwise Master Key (PMK) is a key that is derived from PSK Pre-shared Key (PSK) is a key that is shared between two parties before communication begins , ANonce Authenticator Nonce (ANonce) is a random number generated by an authenticator (a device that controls access to network resources, such as an AP) , SNonce Supplicant Nonce (SNonce) is a random number generated by supplicant (a device that wants to access network resources, such as an STA) , AA Authenticator Address (AA) is MAC address of authenticator , SA Supplicant Address (SA) is MAC address of supplicant using Pseudo-Random Function (PRF). PTK consists of four subkeys:
KCK Key Confirmation Key (KCK) is used for message integrity check
KEK Key Encryption Key (KEK) is used for encryption key distribution
TK Temporal Key (TK) is used for data encryption
MIC Message Integrity Code (MIC) key
The subkey that is specifically used for data encryption is TK Temporal Key (TK). TK is also known as Pairwise Transient Key (PTK). TK changes periodically during communication based on time or number of packets transmitted.
The other options are not part of WPA Key Hierarchy because:
PMK: PMK is not part of WPA Key Hierarchy, but rather an input for deriving PTK.
KCK: KCK is part of WPA Key Hierarchy, but it is not used for data encryption, but rather for message integrity check.
Nonce: Nonce is not part of WPA Key Hierarchy, but rather an input for deriving PTK.

Virtual Switching Extension (VSX) is a feature that allows two Aruba CX switches to operate as a single logical device with a single control plane and data plane. VSX provides high availability, scalability, and simplified management for campus and data center networks3. In VSX, one switch is designated as the primary switch and the other as the secondary switch. The primary switch owns and responds to ARP Address Resolution Protocol. ARP is a communication protocol used for discovering the link layer address, such as a MAC address, associated with a given internet layer address, typically an IPv4 address. This mapping is a critical function in the Internet protocol suite. requests for the virtual IP address of the VSX pair4. The virtual IP address is used as the default gateway for clients connected to the access switch. If the primary switch fails, the secondary switch takes over the virtual IP address and continues to forward traffic for the clients5.
References:
3 https://www.arubanetworks.com/techdocs/AOS-CX_10_04/UG/Content/cx-ug/vsx/vsx-overview.htm
4 https://www.arubanetworks.com/techdocs/AOS-CX_10_04/UG/Content/cx-ug/vsx/vsx-ip- addressing.htm
5 https://www.arubanetworks.com/techdocs/AOS-CX_10_04/UG/Content/cx-ug/vsx/vsx-failover.htm

Using the provided topology and show command output, it can be determined that L3-SW-2 in the Branch Office does not have a route to reach the subnet where PC1 resides (192.168.1.0/24 in the HQ Office). L3-SW-1 in the HQ Office has a route to the Branch Office subnet (172.16.1.0/24), but without the reciprocal route on L3-SW-2, traffic from the Branch Office will not be able to reach the HQ Office subnet, hence PC1 cannot ping PC2.