Refer to the exhibit. A network engineer must create a PSK WLAN that will be anchored to the DMZ. After this WLAN is created, users cannot connect to it. Based on the output from the RA trace, which action must the engineer take to resolve the issue?
Answer(s): B
The failure is occurring during WPA/WPA2 key management, not during mobility anchoring. The radioactive trace shows Failed to validate eapol mic. MIC mismatch followed by Failed to validate eapol key m2, which means the authenticator and supplicant derived different key material during the PSK handshake. Cisco’s Catalyst 9800 client-connectivity troubleshooting maps this log pattern directly to a wrong password condition and lists the corrective actions as fixing the password on the endpoint or on the SSID/WLAN. The 11r MIC validation failed phrase does not automatically make 802.11r the root cause; it only shows that the failed MIC validation occurred while Fast Transition key logic was in use. Disabling 802.11r would be a workaround only for client capability or FT interoperability issues, but the trace points to PSK mismatch. Removing the anchor WLC would break the intended DMZ anchoring design, and matching WLANs on foreign and anchor is required for anchor deployments, but it would not produce this EAPOL M2 MIC failure. The correct remediation is to ensure the client-entered PSK matches the WLAN PSK. Reference topics: WPA/WPA2-PSK authentication, EAPOL 4-way handshake, Catalyst 9800 radioactive trace analysis, and client connectivity troubleshooting.
Exhibit:Refer to the exhibit. An organization wants to use Cisco Spaces for location analytics, and an engineer is setting up the Cisco Catalyst 9800 WLC to send location data. The Spaces connector has already been configured and is operational on the WLC. The engineer must now configure the controller to forward telemetry data to the correct Spaces cloud endpoint using TLS to complete the integration.Which CLI command must be added to the box in the code?
Answer(s): C
The correct command is receiver ip address 198.51.100.10 57555 protocol tls-native profile spaces-profile because it matches the Cisco IOS XE model-driven telemetry subscription syntax used on Catalyst 9800 controllers. Cisco documents the receiver statement under telemetry ietf subscription as receiver ip address ip-address receiver-port protocol protocol profile name, and describes it as the command that configures the receiver IP address, port, protocol, and profile for telemetry notifications.In the exhibit, the subscription already defines the telemetry feed: encode-tdl encoding, a native stream, the TDL URI for ewlc/wlan_config, the WLC source address, and an on-change update policy.What is missing is the collector destination. For Cisco Spaces or Catalyst Center-style integrations, the WLC must know where to export telemetry and which secure transport profile to use. Cisco troubleshooting examples for Catalyst 9800 telemetry use the same command structure: receiver ip address X.X.X.X 25103 protocol tls-native profile ... under the telemetry subscription.Options A, B, and D are invalid because they reorder the CLI keywords. IOS XE telemetry configuration is parser-order sensitive: the command begins with receiver ip address, followed by the receiver port, then protocol, then profile. Reference topic: Wireless Monitoring and Management — Catalyst 9800 streaming telemetry, Cisco Spaces integration, TLS transport, and telemetry receiver configuration.
A hotel wants to provide guests with wireless connectivity via a captive portal using a Cisco 9800 WLC. The solution must meet these requirements: • Ensure that guests are redirected to a custom web page for login and after authentication must have only internet access. • The guest SSID must not require a password and must be visible to all clients. • Network segmentation between staff and guests is required at the VLAN level.What must the IT team configure on the WLAN?
Answer(s): D
Central Web Authentication is the correct design for an open guest SSID that redirects users to a captive portal before allowing network access. Cisco describes CWA as a guest-redirection method where the redirect URL and redirect ACL are centrally controlled and communicated to the WLC through RADIUS, with the external authentication system handling the login workflow. On a Catalyst 9800 WLAN, Cisco’s configuration flow for Central Web Authentication requires AAA/ACL configuration, including the AAA server list and an ACL tied to the WLAN so client access can be controlled before and after authentication.Option D is the only answer that satisfies all requirements: captive portal redirection, post-authentication restriction to Internet-only access, and policy enforcement through ACLs. VLAN-level segmentation is implemented through the WLAN policy profile, which maps guest clients to the guest VLAN rather than the staff VLAN. WPA2-PSK is invalid because the guest SSID must not require a password. A local web server alone does not enforce Internet-only authorization or staff-network isolation. mDNS is unrelated to captive portal authentication or guest segmentation. Reference topics: Guest WLAN design, Central Web Authentication, Catalyst 9800 policy profiles, ACL enforcement, VLAN segmentation, and captive portal client onboarding.
What is a benefit of applying TACACS authentication for device access?
TACACS+ is used for device administration, especially for GUI and CLI access to infrastructure platforms such as Cisco Catalyst 9800 WLCs, switches, and routers. Cisco defines TACACS+ as a security application that provides centralized validation for users attempting to access a device or network access server, and it separates authentication, authorization, and accounting functions for administrative control. Cisco ISE device administration documentation further states that TACACS+ is used to control and audit network device configuration, allowing devices to query ISE for administrator authentication and authorization while sending accounting records for logging administrator actions.Therefore, the primary benefit is streamlined administrator access across platforms. Instead of maintaining local administrator accounts independently on every WLC or network device, TACACS+ enables centralized identity validation, role-based authorization, and consistent audit trails. Option A is incorrect because TACACS+ supports differentiated authorization rather than static grouping. Option B is the opposite of centralized accounting. Option D is inaccurate because TACACS+ is mainly for device administration, whereas client or endpoint network access is typically handled with RADIUS. Reference topics: Wireless Monitoring and Management — AAA for WLC administration, TACACS+ device administration, role-based access, and centralized audit control.
Refer to the exhibit.Refer to the exhibit. A startup company has recently moved to new offices and performed a full network refresh. The application development team requested a high-speed reliable wireless network to use for testing real-time applications. Although, the wireless network is Wi-Fi 7 enabled, the wireless clients are connecting using lower speeds.Which configuration must be applied on the WLC to increase throughput?
The correct configuration is security wpa wpa2 ciphers gcmp256. The WLAN already contains WPA3, SAE, FT-SAE, SAE-EXT-KEY, and FT-SAE-EXT-KEY AKMs, so adding another SAE-EXT-KEY command is not the missing element. For Wi-Fi 7 operation, Cisco states that WPA3-Personal requires GCMP256 with SAE-EXT-KEY and/or FT + SAE-EXT-KEY, and that AES/CCMP128 clients do not operate as Wi-Fi 7 clients when the required stronger cipher combination is absent. Cisco’s Catalyst 9800 WPA3 security enhancement guide gives the CLI syntax directly: security wpa wpa2 ciphers gcmp256, which configures GCMP-256 cipher support.Option D is therefore the only valid WLC command that enables the required cipher for Wi-Fi 7-capable client operation and higher throughput behavior. Option A uses incorrect syntax and is already functionally represented in the exhibit as security wpa akm sae ext-key. Options B and C use invalid cipher constructs; TKIP is legacy and incompatible with modern high-throughput WLAN operation. Reference topics: 802.11be/Wi-Fi 7 security requirements, WPA3-Personal, SAE-EXT-KEY, GCMP-256 cipher support, and Catalyst 9800 WLAN security configuration.
A wireless engineer is rolling out a group of new Meraki APs across multiple office floors. The APs must be centrally managed through the Meraki dashboard and be set up for automatic cloud registration. Network connectivity has been established, and the company firewall follows standard security policies. To minimize manual configuration for each AP the engineer must configure them to automatically discover the dashboard.Which action must the engineer take?
Meraki AP onboarding is designed around cloud-initiated registration, not manual controller discovery. A Meraki AP must obtain network reachability, resolve Meraki cloud services, and establish outbound connectivity to the Meraki dashboard. Cisco Meraki documentation states that the dashboard provides centralized management and that, for dashboard management, a Meraki device must communicate with the Cisco Meraki cloud over a secure tunnel. The MR quick-start process further describes that, after power-on, the AP requests an IP address by DHCP, reaches the Meraki cloud through the Internet, and checks in to the dashboard.Therefore, the required action is to connect the APs to a network with Internet access and permit the necessary outbound firewall flows to Meraki cloud services. A site-to-site VPN is unnecessary for dashboard discovery. Static management addressing may be used in constrained environments, but it increases manual work and is not required for automatic registration. DHCP lease-table serial registration is not a Meraki onboarding mechanism. Reference topics: Wireless Network Implementation — Meraki AP cloud onboarding, DHCP/DNS reachability, outbound firewall policy, and dashboard-based AP lifecycle management.
Refer to the exhibit. A retail business is deploying guest wireless across its remote branch locations. Each branch uses FlexConnect APs in local switching mode, and the central wireless LAN controller is configured with an ACL named CWA_REDIRECT. Cisco ISE is configured to return this ACL during the authentication process for central web authentication (CWA). However, when clients attempt to connect to the guest wireless LAN, they are added to the exclusion list.Which configuration step resolves the connectivity issue?
The failure is caused by the redirect ACL not being available where enforcement occurs. In FlexConnect local switching, client data-plane handling occurs on the AP, so the CWA redirect ACL cannot exist only as a controller ACL or only as a policy-profile reference. Cisco states that the redirect ACL is a punt ACL and that, for FlexConnect local switching, the ACL must be predefined on the AP because the AAA server returns only the ACL name, not the ACL definition.The exhibit shows Redirect ACL failure and EXCLUDE_PUNT_ACL_FAIL, which aligns with an AP-side punt/redirect ACL application failure. Cisco’s Catalyst 9800 CWA configuration specifically requires the redirect ACL definition to be sent through the FlexConnect profile; in the GUI this is done under the Flex Profile Policy ACL tab by adding the ACL, enabling central web authentication, and applying the change. The equivalent CLI is wireless profile flex <profile> followed by acl-policy <acl-name> and central-webauth, after which the AP uses the ACL for client redirection. AP-Join profiles do not carry client redirect ACL policy, and adding the ACL only to the policy profile does not push it to FlexConnect APs for local switching. Reference topics: FlexConnect local switching, CWA redirect ACLs, Catalyst 9800 policy ACLs, and ISE URL-redirect authorization.
What is the main benefit of using AI Enhanced RRM on the Cisco Catalyst 9800 wireless controller?
AI Enhanced RRM is not a static-threshold tuning feature and it is not designed to simply raise AP transmit power. Cisco defines AI Enhanced RRM as a radio resource management technology that applies artificial intelligence and machine learning to optimize RF environments, uses distributed data collection from Cisco wireless controllers with cloud-based analytics, and automates adaptive RF parameter tuning for Cisco wireless networks.The operational model is telemetry-driven. RF telemetry is collected from APs by the Catalyst 9800 WLC, sent through Cisco Catalyst Center to the Cisco AI Analytics Cloud, analyzed by RRM algorithms, and then configuration-change information is returned through Catalyst Center toward the managed wireless infrastructure. Cisco’s AI-Enhanced RRM deployment guide further identifies DCA, TPC, FRA, and DBS as examples of optimizations performed, meaning the feature enhances dynamic RF control rather than disabling it.Therefore, option D is the only correct answer. Options A, B, and C describe either legacy/static behavior, harmful power-only logic, or a fixed RF design model that contradicts Cisco AI Enhanced RRM. Reference topics: Automation and AI — AI/ML-driven RF optimization, Catalyst Center assurance, RRM telemetry, DCA, TPC, FRA, and DBS.
Post your Comments and Discuss Cisco 350-101 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 350-101 content, but please register or login to continue.