support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Cisco
  4. 350-101

Cisco 350-101 Exam Prep
Implementing and Operating Cisco Wireless Core Technologies (WLCOR) (Page 5 )

Updated On: 21-Sep-2026
Page 2 of 14
PDF with 140 Questions

A school district is deploying Cisco Catalyst 9176 APs to remote sites with occasional WAN outages. The IT team wants the APs to attempt joining a secondary or tertiary Catalyst 9800 WLC if the primary controller is unreachable. The team must preconfigure all controller IP addresses using the AP CLI before deploying.
Which set of CLI commands sets the primary, secondary, and tertiary controller IP addresses on a Catalyst 9176 AP?

  1. set controller primary-base main-wlc 10.10.10.10 set controller secondary-base backup 10.10.10.20 set controller tertiary-base tertiary-wlc 10.10.10.30
  2. capwap ap primary-base main-wlc 10.10.10.10 capwap ap secondary-base backup-wlc 10.10.10.20 capwap ap tertiary-base tertiary-wlc 10.10.10.30
  3. ap join primary 10.10.10.10 ap join secondary 10.10.10.20 ap join tertiary 10.10.10.30
  4. capwap ap wlc primary 10.10.10.10 capwap ap wlc secondary 10.10.10.20 capwap ap wlc tertiary 10.10.10.30

Answer(s): B

Explanation:

Cisco lightweight and Catalyst access points use CAPWAP for AP-to-controller discovery and join operations. For AP-side preconfiguration, Cisco documents the syntax as capwap ap {primary-base | secondary-base | tertiary-base} controller-name controller-ip-address, specifically for configuring primary, secondary, and tertiary controllers on the AP. This matches option B exactly because it includes the CAPWAP AP command, the controller priority keyword, the controller name, and the controller management IP address. (Cisco)
The Catalyst 9800 AP join process also recognizes these configured controller entries in priority order: primary controller using capwap ap primary-base, secondary controller using capwap ap secondary-base, and tertiary controller using capwap ap tertiary-base. (Cisco) This allows the AP to attempt a backup controller when the preferred controller is unavailable, which is appropriate for remote sites with intermittent WAN reachability. Option A uses obsolete or invalid set controller syntax. Option C invents an ap join command format. Option D incorrectly inserts wlc into the AP CAPWAP command. Reference topics: Wireless Network Implementation — CAPWAP discovery, AP join process, Catalyst 9800 controller redundancy, and AP CLI provisioning.



Refer to the exhibit.

An engineer is setting up a new WLC in a branch office. The IT security policy states that all management access must use encrypted protocols, administrators will connect remotely, and network scans will be run to check for any noncompliant management protocol exposure.
Which action must the engineer take to achieve the required management access policy?

  1. Permit only HTTP, Telnet, and SSH across all VLANs for 10.10.1.0/24.
  2. Enable Telnet, SSH, and HTTPS across the management and guest interfaces.
  3. Permit console access for 10.10.1.0/24 only with HTTP disabled.
  4. Enable HTTPS and SSH, and disable HTTP and Telnet on the WLC.

Answer(s): D

Explanation:

The correct action is to expose only encrypted management services: HTTPS for WebUI administration and SSH for remote CLI administration. The exhibit confirms the WLC wireless management interface is VLAN 10 with IP address 10.10.1.2, but interface placement alone does not enforce secure management protocol policy. Cisco Catalyst 9800 documentation identifies web admin settings as controller management configuration that determines administrator access, protocols, and interfaces for remote management. Cisco further states that administrators can connect securely over HTTPS, while HTTP “is not a secure connection,” and that HTTPS encrypts data to and from the server.
For CLI access, Cisco’s Catalyst 9800 Secure Shell guidance states that SSH enables secure remote access, and using transport input ssh prevents non-SSH Telnet connections, limiting the device to SSH-only access. Therefore, options A and B violate policy because they permit Telnet and/or HTTP. Option C fails because console access is local, not remote, and disabling only HTTP still leaves Telnet exposure unresolved. Reference topics: Wireless Monitoring and Management — WLC management access, secure administration, HTTPS, SSH, and management-plane hardening.



How does the optimized roaming function operate in a WLC implementation?

  1. It disassociates clients when the RSSI is lower than the set threshold.
  2. It is integrated with external services for client wireless experience.
  3. Device locations are determined through peer-to-peer beacons.
  4. Load balancing is statically defined for all locations.

Answer(s): A

Explanation:

Optimized roaming is a Cisco WLC feature designed to reduce sticky-client behavior. A sticky client remains associated to an AP even after moving far enough away that another AP would provide better RF service. Cisco describes optimized roaming as actively monitoring client data RSSI and disconnecting clients when received signal strength falls below the configured threshold. The official Catalyst 9800 documentation states that optimized roaming “disassociates client when the RSSI is lower than the set threshold,” which directly matches option A.
This function does not calculate device location through peer-to-peer beaconing, does not depend on external experience services, and is not static load balancing. It is an RF/client-roaming enforcement mechanism controlled by the wireless infrastructure. In practical operation, the AP/WLC evaluates client signal quality and, when the configured optimized roaming criteria are met, forces the client to disconnect so it can reassess the RF environment and roam to a better AP. Cisco also notes that optimized roaming helps maintain client connectivity by managing disassociationn based on RSSI and data-rate thresholds. Reference topics: Client Connectivity Configuration — client roaming behavior, sticky-client mitigation, RSSI thresholds, and WLC roaming optimization



A network engineer must isolate all guest users connected to the WLAN on a Cisco 9800 WLC so they cannot communicate with each other but can access the internet. The WLAN must meet these requirements: •SSID named VisitorAccess assigned to VLAN 30 •guests prohibited from sharing files with other guests •must be scalable to multiple access points in the building
Which action must the network engineer take to meet the requirements?

  1. Enable P2P blocking in the policy profile and map the WLAN to a dedicated guest VLAN.
  2. Set up local authentication and map the WLAN to a dedicated guest VLAN.
  3. Set up a FlexConnect group and use local switching for the guest WLAN internet access.
  4. Enable multicast mode and associate a RADIUS server with the guest WLAN.

Answer(s): A

Explanation:

The requirement is guest client isolation, not merely guest authentication or internet breakout. On a Catalyst 9800 WLC, peer-to-peer blocking is the correct control because it prevents wireless clients associated to the same WLAN from communicating directly with one another. Cisco defines peer-to-peer blocking as a WLAN security feature applied to individual WLANs, where each client inherits the WLAN’s P2P blocking behavior, and traffic can be bridged locally, dropped, or forwarded upstream. For this scenario, the appropriate action is the drop behavior, because guest-to-guest file sharing must be prohibited while upstream internet access remains available.
The dedicated guest VLAN, VLAN 30, provides traffic segmentation from production networks and creates a clean policy boundary for VisitorAccess. Cisco’s Catalyst 9800 configuration model maps WLANs to policy profiles, and the policy profile defines client network and switching policy, including VLAN association. Options B, C, and D do not solve client isolation: local authentication validates users, FlexConnect/local switching changes traffic forwarding behavior, and multicast/RADIUS does not block unicast guest-to-guest traffic. Reference topics: Client Connectivity Configuration — guest WLAN design, P2P blocking, VLAN segmentation, and Catalyst 9800 WLAN-to-policy mapping.



How does MIMO operate during wireless transmission?

  1. It uses multiple radio paths to increase throughput and reliability.
  2. It applies frequency hopping to prevent crosstalk.
  3. It shares a single connection among endpoints for coverage expansion.
  4. It limits data paths to a single antenna for error reduction.

Answer(s): A

Explanation:

MIMO, or Multiple-Input Multiple-Output, is a core 802.11n and later wireless technology that uses multiple transmit and receive radio chains and antennas to improve wireless performance. Cisco’s Wireless RF Reference Guide explains that IEEE 802.11n introduced MIMO, replacing the older single-radio SISO model with multiple radios, each using its own antenna, to increase data rates and improve reception in multipath environments. Cisco also notes that weak or distorted multipath signals can be received by more than one radio and reconstructed, improving decode quality and reliability.
This directly supports option A: MIMO exploits multiple RF paths rather than treating multipath as purely destructive. Depending on implementation, MIMO can use spatial diversity, maximal ratio combining, and spatial streams to increase throughput, improve signal-to-noise ratio, reduce retries, and make more efficient use of airtime. Cisco describes spatial stream notation such as 4x4:4 as four transmitters, four receivers, and four spatial streams. Option B describes frequency hopping, not MIMO. Option C is not a MIMO function. Option D is the opposite of MIMO because MIMO deliberately uses multiple antennas and radio paths. Reference topics: 802.11 Technology Fundamentals — MIMO, spatial streams, multipath, SISO versus MIMO, and 802.11n/ac/ax PHY enhancements.



Refer to the exhibit.

The Catalyst 9800 WLC logs show when a client with MAC address 9C:4E:36:8A:2B:F1 fails to connect to a WLAN configured for Wi-Fi Protected Access 3-Enterprise with 802.1X.
Which action must the engineer take to resolve the issue?

  1. Ensure that the AP is using the appropriate credentials.
  2. Change the WLAN to Wi-Fi Protected Access 2-Personal and configure a preshared key.
  3. Verify the client's Active Directory credentials and ensure that the RADIUS server is reachable.
  4. Disable RADIUS NAC on the policy profile assigned to the WLAN.

Answer(s): C

Explanation:

The log is a Layer 2 802.1X authentication failure, not an AP join or WLAN encryption mismatch. In WPA3-Enterprise, the client authenticates with 802.1X/EAP through the configured AAA path. Cisco’s Catalyst 9800 WPA3 Enterprise configuration requires the necessary RADIUS or AAA servers and authentication lists before enabling WPA3 Enterprise, and the WLAN must reference the dot1x authentication list. Therefore, a Cred Fail reason points directly at the user/device credential validation path: the supplicant credentials, Active Directory identity source, RADIUS policy match, or RADIUS reachability.
Cisco’s 9800 802.1X configuration workflow also shows the controller defining a RADIUS server, adding it to a RADIUS group, creating a dot1x AAA authentication method list, and applying that list to the WLAN. It further recommends checking whether the RADIUS server is alive and using ISE RADIUS Live Logs to inspect authentication requests and results. Option A is wrong because the AP is not the supplicant in this WLAN client authentication event. Option B downgrades the security model and avoids 802.1X rather than fixing it. Option D addresses NAC behavior, not a credential authentication failure. Reference topics: Client Connectivity Configuration — WPA3-Enterprise, 802.1X/EAP, RADIUS authentication, and client authentication troubleshooting.



Which feature does bridge mode provide in a Cisco wireless mesh architecture?

  1. It enables point-to-point communication between network segments.
  2. It switches all traffic passing through the AP to 2.4 GHz by default.
  3. It adjusts RF transmit power on any neighbor nodes.
  4. It communicates with WAN edge by default.

Answer(s): A

Explanation:

Bridge mode in a Cisco wireless mesh deployment allows access points to operate as mesh infrastructure nodes, typically as a Root AP (RAP) or Mesh AP (MAP), so Ethernet segments can be connected across a wireless backhaul. Cisco’s mesh design documentation states that in a point-to-point bridging scenario, a mesh AP can extend a remote network by using the backhaul radio “to bridge two segments of a switched network.” This directly maps to option A: point-to-point communication between network segments.
In Catalyst 9800 mesh deployments, Cisco documents converting an AP to bridge mode with capwap ap mode bridge, after which the AP rejoins the controller in bridge mode and can be assigned a mesh role. Cisco also defines the RAP as the AP with the wired connection toward the WLC, while the MAP joins through its radio path toward the RAP. Option B is incorrect because bridge mode does not force all traffic to 2.4 GHz; Cisco mesh backhaul can use configured backhaul radios. Option C describes RRM/TPC behavior, not bridge mode. Option D incorrectly associates mesh bridge mode with WAN edge functions. Reference topics: Wireless Network Implementation — mesh AP roles, RAP/MAP operation, wireless backhaul, and Ethernet bridging.
‘



Refer to the exhibit.

An engineer must configure wireless guest networking for a deployment at site A, which requires support for guest VLAN assignment and assignment for wlan guest-network 20. The controller will provide network segregation and restrict access to internal resources. Based on the configuration commands, which action meets the requirements?

  1. Establish a mesh bridge connection for the guest VLAN and assign logical interface for isolation.
  2. Create a policy profile for the guest VLAN and a policy tag to map the WLAN to the policy profile.
  3. Assign a policy tag to map the to WLAN and assign a physical interface for isolation.
  4. Implement the Spanning Tree Protocol and assign an AP group name.

Answer(s): B

Explanation:

The exhibit creates WLAN profile guest-network with WLAN ID 20 and enables web authentication, but it does not yet define the client VLAN or bind the WLAN to a deployable policy. On Catalyst 9800 controllers, the WLAN profile defines SSID and wireless/security characteristics, while the policy profile defines client-facing network policy, including VLAN assignment, AAA, ACLs, and switching behavior. Cisco’s web authentication configuration guide states that the policy profile specifies client VLAN, AAA, ACLs, timeout settings, and related policy, and the VLAN is assigned under the policy profile.
The second required object is the policy tag, because a policy tag maps the WLAN profile to the policy profile. Cisco also notes that the default policy tag automatically maps only WLAN IDs 1 through 16; WLAN ID 17 or higher cannot use that default mapping. Since this WLAN is ID 20, a custom policy tag mapping is required. Mesh bridging, STP, AP group naming, or physical-interface isolation do not complete the Catalyst 9800 WLAN-to-VLAN policy model. Reference topics: Wireless Network Implementation — Catalyst 9800 configuration model, WLAN profiles, policy profiles, policy tags, guest VLAN assignment, and web authentication.



  PDF
Viewing page 5 of 14
Viewing questions 33 - 40 out of 140 questions


Post your Comments and Discuss Cisco 350-101 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!