350-101 practice questions
Cisco · 350-101 · 300 questions
Original practice questions for the Implementing and Operating Cisco Wireless Core Technologies (WLCOR) exam, covering every domain of the official exam objectives.
This course contains the use of artificial intelligence.
About the 350-101 exam
- Questions
- not published
- Passing score
- not published
- Format
- 120-minute exam associated with CCNP Wireless and CCIE Wireless; languages English and Japanese; price US$400 or Cisco Learning Credits
Schedule this exam The certification this earns
Exam details published by the vendor, checked 8 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
RF Fundamentals (15%) · 45 questions
- At a stadium, a phone still shows a moderate received signal during the event, but throughput collapses as the noise floor rises. Which measurement explains that collapse better than the signal number alone?
- A hospital mounts a corridor access point, then installs a lead-lined imaging door between that access point and the waiting room. Waiting-room clients fall to a much weaker signal, while a laptop that stays beside the access point does not change. Which propagation effect accounts for the waiting-room drop?
- A logistics engineer compares two access-point power settings, 17 dBm and 20 dBm, on the same radio and antenna. Which statement about the 20 dBm setting is correct?
- A stadium designer replaces a low-gain omnidirectional antenna with a higher-gain directional antenna aimed at one seating section, using the same radio transmit power. What changes in the coverage pattern?
- A logistics engineer reads a radio configured at a high transmit power and cannot understand why a handheld at the end of the aisle shows a weak received signal. What is the engineer comparing incorrectly?
- A university raises the lowest mandatory data rate on a residence WLAN. Students near the access points stay connected, and students at the edge of the same rooms can no longer associate. Why did the edge fail?
- A stadium survey with a laptop shows a healthy downlink, but phones in the same seats keep failing while the laptop still works. The phones transmit at lower power than the access point. What is the limit?
- A warehouse with floor-to-ceiling metal racks has clients whose signal flutters sharply even when they stand near an access point with a clear view of it. Which propagation effect are the racks adding?
- A hospital break room has constant client retries on 2.4 GHz. A spectrum capture of that channel shows continuous energy that is not an 802.11 signal, and no extra beacon is present. What is the source?
- A stadium radio is set to 15 dBm conducted power, the antenna is rated 5 dBi, and the cable loss is 2 dB. What is the EIRP?
- Two neighboring hospital access points are both on the same channel. Client SNR looks healthy, and throughput falls whenever both cells are busy. What is hurting throughput?
- A lecture-hall access point is a four-stream radio. A tablet with a single radio chain never reaches the four-stream data rate, even when it sits next to the access point at high SNR. What limits the rate?
- A logistics client stands around a concrete corner with no line of sight to the access point and still hears a weak signal that fades as they move deeper behind the corner. Which propagation effect is filling in that shadow?
- A handheld shows a received signal of -65 dBm and a noise floor of -90 dBm. What is the SNR?
- A logistics bridge aims a directional antenna at a far building. One antenna is mounted vertical and the other horizontal. The link is much weaker than the same antennas aligned the same way. What is wrong?
- A hotel corridor is long and narrow. A ceiling omnidirectional antenna covers a round blob and leaves the far end of the corridor weak. What antenna choice fits the corridor better?
- A stadium access point is mounted high and aimed flat. Seats far across the bowl hear it, and seats directly below are weak. The radio power is already moderate. What should change?
- A campus path that looks short on a map crosses a row of trees and metal sculpture. The signal at the far bench is jumpy and weaker than the same distance across open lawn. Which effect are the trees and sculpture adding?
- Two clinic access points sit next to each other on channels 1 and 2 in the 2.4 GHz band. Clients near both hear errors even when the noise floor is otherwise quiet. What is the overlap?
- An engineer compares a radio at 10 dBm with the same radio at 20 dBm. Which statement is correct?
- Two scanners sit on the same access point with the same noise floor. One shows a received signal of -45 dBm and the other shows -75 dBm. Which statement is correct?
- A bank survey finds an access point that is not in the inventory and is beaconing the corporate SSID. The corporate radios show beacons from it on the same channel. What is it?
- Two hallway antennas are fed with the same conducted power. One is 6 dBi and the other is 9 dBi. How do they compare in the main lobe?
- A stairwell is usable on 2.4 GHz and nearly dead on 5 GHz from the same access point through the same wall. What does that difference illustrate?
- A phone and a laptop sit in the same spot and show the same received signal. The phone has one spatial stream and the laptop has two. The laptop holds a higher rate. Why?
- Two seats show the same received signal from an access point. The noise floor is much higher at the second seat, and the laptop there holds a lower rate. Why is the rate lower?
- A logistics bridge had a stable outdoor link. A new structure now rises into the space around the visual line of sight, and the link fades even though both antennas still point at each other. What did the structure enter?
- A lab inserts a 6 dB attenuator between a radio and its antenna. About how much of the conducted power reaches the antenna?
- Handheld scanners in a warehouse support 2.4 GHz only. The new capacity WLAN is 5 GHz only, and the scanners never see it. What does the design still need for those scanners?
- A survey in an empty hangar measures a signal, then moves the laptop to twice the distance from the same access point with nothing in the way. About how much does free-space loss increase?
- An omnidirectional antenna on a high ceiling is replaced with a higher-gain omnidirectional antenna to reach the floor below. The floor below gets weaker. Why?
- A clinic laptop holds a low rate beside a lab appliance. The appliance is removed, the received signal stays the same, the noise floor drops, and the rate rises. Why did the rate rise?
- A client hears one access point at -55 dBm and another at -75 dBm. The weaker reading comes from the access point with the higher configured transmit power, which is much farther away. Which reading should drive the design?
- Clients in a lobby attach to an access point that beacons the corporate SSID at a stronger signal than the corporate radios. That access point is not in the inventory. Why do the clients attach to it?
- A rooftop run has 10 dB of cable loss between a radio and the antenna. About how much of the conducted power arrives at the antenna?
- Two neighboring clinics put 20 MHz radios on channel 1 and channel 3 and expect no overlap. The radios still interfere. Why?
- An upstairs access point hears the downstairs 2.4 GHz radio strongly, and the two contend. The downstairs radio is on the ceiling of the floor below. What is the propagation fact?
- A survey shows a received signal of -45 dBm and a noise floor of -85 dBm. Which signal-to-noise ratio matches those two readings?
- A warehouse channel shows a steady high noise floor, and a spectrum check shows constant energy from a wireless camera. No beacons come from that camera. What is it?
- Laptops work through a warehouse aisle. A one-stream handset with lower transmit power drops in the same aisle. The design was surveyed with a laptop only. What should the cell be designed for?
- A high-ceiling antenna aimed at the horizon is strong at the far wall and weak in the seats below it. What change aims the energy at the seats?
- A directional antenna points down a hall. A client behind the antenna, in the opposite direction, has a weak signal a few meters away. What is the client sitting in?
- A radio is set to 14 dBm conducted, the antenna is 6 dBi, and the cable loss is 2 dB. What is the EIRP in the main lobe?
- A corporate channel has a high noise floor and no extra beacons. A rogue access point is beaconing the corporate SSID on a different channel. What is the noise on the corporate channel?
- An access point is configured for 20 dBm, and a client at a desk hears it at -70 dBm. An engineer adds those two numbers and treats the sum as the link quality. What is wrong with that?
802.11 Technology Fundamentals (10%) · 30 questions
- A government procurement requires access points to carry the WPA3 certification mark. Which body issues that mark?
- A retailer is opening stores in another country and must choose legal channels and radiated power for the access points there. Which body sets those limits for that country?
- A SaaS wireless team is asked who wrote the 802.11ax amendment that their Wi-Fi 6 access points implement. Which body wrote that amendment?
- A retailer sets each radio to the highest conducted power its country allows, then adds a high-gain antenna and ignores cable loss. Which limit can that combination break?
- In a university hall, many laptops send small frames at once and airtime collapses while each transmission still serves only one station. The access points are Wi-Fi 6. Which mechanism serves several stations in one transmission by dividing the channel?
- A retail chain in North America is choosing a 2.4 GHz channel plan so neighboring access points do not overlap on 20 MHz channels. Which set meets that goal?
- A stadium access point sends traffic to several phones in one downlink transmission, separating them by their location in space rather than by slicing the channel into smaller frequency units. Which feature is that?
- A university design requires a laptop to use two bands at the same time to one access point, as a single multi-link device. Which generation adds that operation?
- A hospital access point on a 5 GHz channel suddenly changes channel, and the log says radar was detected. Clients rejoin on the new channel. What happened?
- After a neighbor access point comes up on the same channel, the campus controller moves an access point to a cleaner channel with no operator typing a channel. Which RRM behavior is that?
- A campus deploys many access points under one SSID so laptops can roam between them. There is no laptop-to-laptop ad hoc network. Which topology is this?
- A university sets every access point in a dense lecture hall to 160 MHz channels. Retries rise and per-client throughput falls, even though each channel is wider. Why?
- Laptops next to a lecture-hall access point use a denser constellation, and laptops at the back of the hall fall to a simpler one. SNR is high in front and poor at the back. Why does the back of the hall drop?
- A student phone sends a probe request for the campus SSID before it associates. Which kind of frame is that probe request?
- A capture shows a client data frame and no acknowledgement after it. The client retries the data. What is the missing acknowledgement?
- A small office sets its only 2.4 GHz WLAN to a 40 MHz channel. A second access point has no non-overlapping 2.4 GHz channel left. Why?
- A university capture of a staff WLAN shows high-efficiency operation on the access points. Which standard defines that PHY?
- A retailer copies the 2.4 GHz transmit settings onto new 6 GHz radios in the same country and assumes the copy is legal. What is wrong with that assumption?
- Three access points advertise the same SSID and clients roam among them. There is no controller. A design note calls this an independent basic service set. What is it actually?
- A warehouse puts every access point on 2.4 GHz only, and capable laptops and the old scanners all share it. Airtime is exhausted. What change helps the laptops without taking the scanners off the air?
- A vendor worksheet lists a channel for a store, and that channel is not allowed by the country's regulator. The controller is set to that country. What decides whether the radio may use the channel?
- Dynamic channel assignment is turned off. A new access point joins and stays on a channel that overlaps its neighbor. Why was it not moved?
- Transmit power control is turned off. A new access point stays at maximum power, and nearby clients cling to it instead of roaming. Why was the power not reduced?
- A retailer slide says the new phones are Wi-Fi 6E. Which organization is responsible for that generation name?
- A lecture hall access point transmits to several laptops at the same time, each on its own spatial stream. Which feature is that?
- After a laptop associates, it moves a file. Which frame carries that file's payload?
- An access point advertises a clinic SSID about ten times a second with a beacon. What kind of frame is that beacon?
- Two outdoor radios link two buildings. Each is in bridge mode, and no client associates to them. A note calls the link an extended service set. What is it?
- A phone box says Wi-Fi 7. Which organization published that generation name?
- A store slide says the new WLAN is Wi-Fi 6E, so an engineer enables it on access points that have only 2.4 and 5 GHz radios. The 6 GHz SSID never appears. What did the slide assume these radios have?
Wireless Network Implementation (10%) · 30 questions
- A logistics aisle has no Ethernet run, and the new access point there must carry clients and reach the controller through a nearby access point that does have a cable. Which architecture fits that aisle?
- A university is building SD-Access and wants user traffic from the wireless clients encapsulated to the fabric edge, not carried in a controller data tunnel, while the access points remain controlled by the wireless controller. Which architecture is that?
- At a plant, new access points join the wireless controller, but on several of them one radio never comes up. The switch reports that those ports are supplying a lower PoE class than the access points requested. What should be checked first?
- A retailer installed dashboard-managed access points in its stores and is waiting for them to join the on-premises Catalyst 9800. They never appear. Which architecture were those access points built for?
- Several engineers share one local admin account on a Catalyst 9800, and the security team wants a separate accounting record for each engineer's management login. Which change provides that?
- Warehouse clients on mesh access points all drop at once. The root access point has lost its Ethernet uplink, and the mesh access points have no other wired path. What failed?
- A university access point sits on an SD-Access edge, but a client capture shows user traffic still tunneled to the wireless controller. The design called for fabric data. What is missing?
- A branch uses FlexConnect local switching, but the switch port toward each access point is an access port in only the access-point VLAN. Locally switched clients associate and never get an address. What does that port need?
- A hotel runs local-mode access points. The guest VLAN was added on the access-point switch ports and was not added on the controller uplink. Guest clients associate and never get an address. Where does that VLAN have to exist?
- A retailer's dashboard-managed access points lose contact with the dashboard for an hour. Clients are already associated and use locally bridged VLANs. What happens to that client data during the outage?
- A lecture hall access point shows healthy client SNR and a 1 Gbps link to the switch that stays full while clients are busy. The access point and the cable can run faster than 1 Gbps. What is the limit?
- A warehouse access point shows clean client SNR, and its switch port negotiated 100 Mbps on a cable that should run at gigabit. Clients are slow only when they move real traffic. What is the limit?
- Office engineers can SSH to a Catalyst 9800, and the NOC subnet cannot. A management access restriction on the controller includes the office subnet and omits the NOC. What is missing?
- A store SSID in the cloud dashboard is set to bridge clients onto VLAN 30. The access-point switch port is an access port in VLAN 10. Clients get VLAN 10 addresses. Why?
- New access points are cabled only toward the Catalyst 9800 service port, which is the out-of-band management port. They never join. The wireless management interface is on a different network that the access points do not touch. What is wrong?
- A stadium crew mounts mesh access points and powers them up. No root access point is on the wired network yet. The mesh access points never join. What has to come up first?
- A fabric access point is joined and a client is passing traffic. A capture on the controller's data path shows none of that client's frames. What does the empty capture mean?
- Local-mode clients never get an address. The access switch has a DHCP scope on the access-point VLAN, and the controller's client VLAN has no DHCP path. Where does a local-mode client actually request an address?
- A store manager can open the cloud dashboard and see the WLAN, and every attempt to edit the SSID is refused. A network administrator edits the same SSID successfully. What is the manager missing?
- A root access point is joined and its 2.4 GHz radio is up. Mesh access points never appear. The mesh backhaul is 5 GHz, and that radio on the root is shut down. What is missing?
- A local-mode access point is cabled to a trunk. Its untagged VLAN on that trunk has no path to the controller, and the access point never joins. Client VLANs are supposed to live at the controller. What is wrong?
- Clients associate with a strong signal and then see corrupted transfers. The access-point switch port shows input errors and CRC errors climbing. The radios' retry counters are quiet. Where is the fault?
- One new access point never powers up. Other access points on the same switch are up, and the switch reports that its power budget is exhausted. What is the limit?
- An access point link is up, and the switch port is hardcoded to half duplex while the access point is set to negotiate. The port shows collisions and late collisions. Clients are slow only when they pass traffic. What is mismatched?
- A new store comes online from the dashboard with only a guest SSID. The staff SSID was never in the configuration applied to that store. Other stores that received the full configuration have both. What is missing at the new store?
- Store clients get an address from the access point and cannot reach anything on the store VLAN. The dashboard SSID is set to NAT at the access point. The store VLAN and its gateway are on the switch. What should the SSID do instead?
- A root access point is joined. A mesh access point at the far end of a stadium hears that root only weakly, and the backhaul never stays up. What is too weak?
- Engineers on the user VLAN cannot open a Catalyst 9800 management address. The same address opens from the admin VLAN. Wireless clients on the user VLAN are passing traffic. What is unreachable?
- A wired register is plugged into a mesh access point and works. When the mesh backhaul drops, the register drops too, even though its Ethernet cable is still connected. Why?
- A local-mode access point on an access port receives an address and never joins. That VLAN has no path to the controller. Other access points on a VLAN that can reach the controller join. What is wrong with this port?
Wireless Network Operation (20%) · 60 questions
- A logistics site places new access points on a VLAN that has no wireless controller. Discovery is supposed to come from DHCP. Which DHCP information gives those access points the controller address?
- A bank brings up a new Catalyst 9800, and the access points join, but every radio stays disabled. The controller has no country configured for the branch where those access points are installed. Which initial-setup item lets the radios operate in that country?
- A government office needs one access point to capture 802.11 frames on a single channel and forward them to a laptop running a packet analyzer. That access point must not serve clients while it captures. Which mode matches the job?
- A manufacturer's new access points join an old lab controller instead of the new campus controller. DHCP has no controller option, and the name CISCO-CAPWAP-CONTROLLER still resolves to the lab address. What should change?
- A government office finishes a Catalyst 9800 install and EAP-TLS fails for every laptop. The laptop certificates are inside their validity dates, and the controller clock is several hours behind. Which initial-setup item should be corrected first?
- A hotel created and enabled a guest WLAN profile yesterday, but guests never see that SSID. The profile was not added to the policy tag assigned to the guest access points. What is missing?
- A retail branch has a thin WAN back to the campus Catalyst 9800. Client traffic should stay on the branch LAN, while the access points still take their configuration from that controller. Which mode fits?
- A hospital requires clinical tablets to pass a compliance check in the mobile device management service before the policy server will authorize them on the clinical WLAN. Which platform is the compliance authority in that design?
- Bank guests see the guest SSID and receive addresses from the employee VLAN. The WLAN profile is enabled and is present on the access points. The policy tag maps that WLAN to the employee policy profile. What is wrong?
- A hospital runs a Catalyst 9800 high-availability pair in stateful switchover. The active controller fails. What should the access points do?
- An IP camera on a plant WLAN is identified by profiling. The team wants only that camera type placed on a camera VLAN, and they do not want the WLAN disabled. Where does that per-device rule belong?
- Campus access points receive DHCP addresses, and a firewall sits between them and the Catalyst 9800. They never join. A capture shows UDP 5246 from the access points is dropped. What must the firewall permit?
- A government site wants one access point to spend its time scanning for rogue access points and wireless attacks, and that access point must not serve clients. A packet analyzer is not part of the request. Which mode fits?
- University clients pass 802.1X and land in the wrong VLAN. The WLAN and the policy profile are correct when ISE is bypassed. Which platform is assigning the VLAN they actually receive?
- A plant WLAN is up and visible to laptops on 5 GHz. Handheld barcode scanners that only support 2.4 GHz never see that SSID. The WLAN radio policy is 5 GHz only. Why are the scanners blind?
- An engineer edits a WLAN directly on a Catalyst 9800, and the next Catalyst Center provision puts the old WLAN settings back. Catalyst Center is provisioning this site. Where should the change be made so it sticks?
- Retail clients associate, receive an address, and can ping their gateway. Traffic beyond the gateway fails. An ACL on the WLAN policy profile denies that traffic. Where is the failure?
- A new access point joins a Catalyst 9800 and its radios stay down. Other access points in the same country are serving clients. This access point's regulatory domain does not match the configured country. What is the mismatch?
- A store uses FlexConnect local switching. When the WAN to the controller fails, already connected clients keep passing local traffic, and new clients cannot authenticate. Central authentication is the only method configured. What is missing for new clients during that failure?
- A new Catalyst 9800 pair never shows the standby ready. The redundancy link between the two controllers is down, and the WLANs are already configured. What has to be repaired first?
- A retail access point is configured with a primary and a secondary controller. The primary is down, and the secondary is reachable. The access point does not join anything. What should it do?
- Access points in one bank branch join a lab controller. Their site tag uses an AP join profile whose primary controller address is the lab. Other branches with a different join profile join production. What should change?
- A hospital voice WLAN is up, and the policy profile that serves it is set to best effort while a data WLAN is given the higher treatment. Calls chop when the data WLAN is busy. What should change?
- A warehouse hides the SSID and configures no passphrase and no 802.1X. A capture still shows client probes that name the network, and frames are readable. Why is hiding the SSID not the control they need?
- A Catalyst 9800 shows the correct time from NTP. New access points fail the secure join and their logs show the time as years off. The access points are not configured with a time source. What is missing?
- A failed tablet is marked non-compliant by the mobile device manager, and ISE can see that result. The authorization rule for the clinical WLAN never checks it, so the tablet still lands on the production VLAN. What is missing?
- A retailer wants one access point to join the controller and test the store WLAN as a client would, rather than serve shoppers or feed a protocol analyzer. Which mode fits?
- A Catalyst 9800 SSO pair keeps dropping its stateful relationship. The redundancy link rides a switch path that also carries client traffic and flaps several times a day. What should change?
- New access points discover a Catalyst 9800, start the join, and stall while transferring the image. A small ping to the controller works, and a large ping across the same path fails. What is the fault?
- New store access points keep joining a decommissioned lab controller. DHCP option 43 on the store scope points at the production controller. Each access point has a static controller address set to the lab. Why is option 43 ignored?
- An engineer builds an RF profile that keeps access points off a noisy channel, then finds every access point still using that channel. The access points are on the default RF tag, which does not include the new profile. What is missing?
- A university wants employee phones in a staff VLAN. An engineer looks for that VLAN inside the Spaces engagement settings and cannot find a place that changes where clients are bridged. Which product owns that decision?
- A branch FlexConnect WLAN is locally switched and mapped to VLAN 20. VLAN 20 does not exist on the branch switch. Clients associate and never get an address. What is wrong?
- An engineer adds a FlexConnect profile to a site tag and the access points stay in local mode. Local Site is still enabled on that site tag. Why did the access points ignore the flex profile?
- Local-mode access points join a Catalyst 9800, and client data never arrives at the controller. The firewall allows UDP 5246 and blocks UDP 5247. What is blocked?
- A branch WLAN is supposed to authenticate employees with ISE. The WAN is up, and ISE shows no requests. The WLAN is set to authenticate locally at the access point. What should change?
- A branch FlexConnect WLAN centrally switches every client across a congested WAN. Clients associate quickly and then crawl. The branch has the VLAN and the gateway locally. What change keeps client data off that WAN?
- A dual-band handheld in a plant is strong on 2.4 GHz and weak on 5 GHz. Band select keeps steering it to 5 GHz, and the session stalls there. What should change for this WLAN?
- Access points in the same VLAN as a Catalyst 9800 join by broadcast. Access points in a new VLAN never join. That VLAN has no DHCP option 43 and no DNS entry for the controller. Why do the new ones fail?
- A library wants guest devices blocked from a staff server. An engineer looks for that block inside a Spaces engagement campaign. Where does the block belong?
- Employees associate to a campus WLAN and never get an address. The SSID is on the policy tag, and the client VLAN that the policy profile names is shut down on the controller's switch. What is broken?
- A store's access points are managed only from the cloud dashboard. An engineer prepares a list of Catalyst 9800 commands to create the store WLAN. Why will those commands not create it?
- A Catalyst 9800 pair will not form stateful switchover. The redundancy link is up, and the standby chassis is running a different software release from the active. What has to match?
- New access points get an address and never join. They have no static controller and no DHCP option 43. A lookup of CISCO-CAPWAP-CONTROLLER fails because the access points have no DNS domain, and the record exists only under the corporate suffix. What is missing?
- A campus access point that should tunnel clients to the controller was set to bridge mode. Clients no longer land on the controller's client VLAN. What mode should it use?
- After a survey, a clinic access point was left in monitor mode. Clients never associate to it, and the floor plan still counts it as a serving radio. What is that access point doing?
- A clinical tablet is denied. ISE has an allow rule for it and never sees a request. A MAC filter on the controller denies that MAC before authentication. What is blocking the tablet?
- A policy tag still lists a staff WLAN, and that WLAN profile is administratively disabled. The SSID is absent on the floor. What has to change before the tag can put it on the air?
- A Catalyst 9800 was set by typing the local time into the clock as if it were UTC, so the clock is hours off. New certificates fail their validity checks. What should be corrected?
- Most new access points join. One got its address from a different DHCP scope, and that scope has no option 43. The access-point scope does. The stray access point never joins. Why?
- A new staff WLAN is enabled and listed on the policy tag, and its radio policy is 6 GHz only. The access points on that floor have no 6 GHz radio. The SSID never appears. Why?
- Employees join the employee SSID and receive guest-VLAN addresses. The employee WLAN is paired, on the policy tag, with the guest policy profile. What caused the guest addresses?
- A branch WAN drops. Centrally switched clients stall. Locally switched clients on the same access points keep reaching the branch gateway. What is the difference?
- A lost tablet was retired in the device manager, and ISE would deny it. The tablet still joins. A local allow entry for its MAC remains on the controller and is hit first. What is letting it on?
- An engineer builds a 6 GHz profile that avoids a noisy channel. Access points stay on that channel. Their RF tag does not include the new profile. What is missing?
- New access points use a public DNS resolver from the wrong scope. CISCO-CAPWAP-CONTROLLER exists only on the corporate DNS. They get an address and never join. Why does the name fail?
- An open WLAN in a lobby is paired with the employee policy profile. Visitors join with no password and receive employee-VLAN addresses. What put them on that VLAN?
- DHCP option 43 gives the correct controller address. The access point's own address is in a subnet with no default gateway, and the controller is on another subnet. The access point never joins. Why?
- A Catalyst 9800 pair will not form stateful switchover. The redundancy link shows up, and a device in the middle of that link is dropping the redundancy traffic. What is preventing the pair?
- An access point in sensor mode joins the staff WLAN and runs a test. A planner counts it as another serving radio for the floor. What is wrong with that count?
Client Connectivity Configuration (20%) · 60 questions
- University laptops associate to the 802.1X campus WLAN, then fail authentication. The external RADIUS server log says the wireless controller is not a known network device. What must be added on that server before students can pass authentication?
- A bank builds a WLAN allow list from each laptop's hardware MAC address. Windows laptops present a randomized MAC address through association and fail the filter, even though those hardware addresses are on the list. Which client behavior explains the failure?
- Hospital laptops use PEAP to an external RADIUS server and fail with a server-certificate warning. The controller is already a trusted network device on that server. What has to be fixed for the laptops to trust the authentication server?
- A bank wants branch guest sessions to terminate on a controller in the DMZ, not on the branch employee VLAN. Each branch already has its own controller. Which guest design places that traffic on the DMZ controller?
- University voice handsets complete a full EAP exchange every time they change access points, and the call audio gaps. The WLAN is already 802.1X. Which roaming mechanism avoids repeating that full EAP exchange inside the same mobility domain?
- A hotel wants lobby visitors to join a WLAN with no password and no 802.1X login, while still encrypting each visitor's frames so other guests cannot sniff them. Which security configuration matches that requirement?
- Hotel guests associate to the guest WLAN and never see the captive portal, and they never get an address. The pre-authentication ACL on that WLAN blocks DHCP and DNS. What must that ACL allow before the portal can run?
- A hotel wants lobby guests to type a username on a page hosted by the wireless controller, with no external policy server in the design. Which authentication fits?
- Hospital voice handsets roam without a full EAP exchange, but each roam still takes a long time while the handset scans every channel. Which mechanism shortens that scan?
- A bank will not allow user passwords on the office WLAN and requires each laptop and the authentication server to prove identity with a certificate. Which method fits?
- University iPhones must use EAP-TLS on the campus WLAN. Students who only receive a verbal passphrase cannot get the phones to present a certificate. What do the phones need before they can connect that way?
- A hotel wants the staff WLAN to use one shared passphrase and WPA3, with protected management frames, and it does not want a RADIUS server. Which WLAN security matches that?
- Hotel guests on the guest WLAN can reach other guests' devices directly. The hotel wants that client-to-client traffic stopped and the SSID left in place. Which configuration does that?
- Hotel phones stay associated to a distant access point at a weak signal while a nearer access point is idle. The WLAN already has fast transition. Which feature lets the infrastructure suggest that the phone move?
- A clinic laptop passes 802.1X and then fails posture. ISE is supposed to move that session onto a remediation VLAN without a new association. What must ISE send?
- A university laptop fails the dorm PSK on every try. A new phone, given the same passphrase by the help desk, joins immediately. The laptop has an old passphrase saved for that SSID. What should the student do on the laptop?
- Bank Windows laptops must be on the domain WLAN at the logon screen, before any user signs in, so they can run startup scripts. They only join the WLAN after the user enters a password. What is the supplicant missing?
- A hotel sets a staff WLAN to WPA3 and then disables protected management frames. WPA3 clients refuse the WLAN. What does WPA3 require here?
- Voice handsets on a campus WLAN cannot use 802.11r, and each roam still runs a full EAP exchange. The access points are on one controller. Which feature avoids that full exchange without 802.11r?
- A lab WLAN uses MAC filtering as its only control and calls that authentication. A tester sets a laptop to an allowed MAC address and joins with no credentials. What did the filter fail to do?
- A corporate laptop has its EAP-TLS certificate in the machine certificate store. The Windows supplicant for the office WLAN is set to use a certificate from the user store, and authentication fails before a password prompt. What is mis-set?
- Hotel guests get an address on the guest WLAN and never see the ISE portal. DHCP works. The WLAN is meant to use central web authentication, and the session is not being redirected. What is missing?
- Bank laptops present machine certificates for EAP-TLS. The RADIUS server log says it does not trust the authority that issued those certificates. What is missing on the server?
- Staff roam between two buildings, each with its own Catalyst 9800, and their phones get a new address every time, which drops the call. The SSID and security match. Mobility is not configured between the controllers. What is missing?
- After a brief WAN blip, a clinic controller marks its only RADIUS server dead. New 802.1X clients fail until the dead timer ends, and there is no second server. What should be added?
- Handsets that support fast transition still do a full EAP exchange when they roam across a campus. The WLAN has fast transition enabled, and the two access points advertise different mobility domain names. What breaks the fast roam?
- Bank guests get online and can also resolve internal bank hostnames. The guest DHCP scope is handing out the internal DNS servers. What should change?
- Hotel guests reach the captive portal and the browser warns that the portal certificate is not trusted. The portal page is otherwise the right one. What should be installed?
- After a dorm WLAN moves from WPA2 to WPA3, student phones keep failing. Each phone has the old WPA2 network saved and offers WPA2. A phone that forgets the network and joins fresh succeeds with WPA3. What should the other students do?
- Factory scanners that only support WPA2 stop joining after a staff WLAN is set to WPA3 only. Phones that support WPA3 must keep using WPA3. Which WLAN setting lets both on?
- A new phone fails EAP-TLS on a campus WLAN. The same certificate works in a laptop. The phone's clock is set a year behind, and the certificate's start date is last month. What should change on the phone?
- A factory lab wants 802.1X for six laptops and has no RADIUS server on site. The production WLAN must keep using the corporate RADIUS servers. What fits the lab WLAN?
- A phone roams between two campus access points and keeps the SSID. The new policy puts it in a different VLAN. Existing sessions stall until the phone gets an address in the new subnet. What kind of roam is this?
- After a hospital RADIUS certificate is reissued by a new CA, laptops reject the server. The new certificate is in date, and the laptops trust only the old CA. What do the laptops need?
- Hotel guests get an address and can resolve the portal name. The browser never opens the portal. The pre-authentication filter allows DHCP and DNS only. What is missing from that filter?
- Clinic laptops reject the RADIUS server during PEAP. The certificate is inside its dates and is signed by a CA the laptops trust, and the name on the certificate is the old lab name. The laptops are set to check the production server name. What is wrong?
- Production laptops fail 802.1X on a new WLAN. The same accounts succeed on the existing WLAN. The new WLAN is aimed at a lab RADIUS server that has none of those accounts. What should change?
- A campus WLAN now requires EAP-TLS. A laptop has a working certificate profile and an older PEAP profile, and it keeps offering PEAP. A laptop that is set to the certificate profile joins. What should the other laptops change?
- Visitors at a city hall are given the employee pre-shared key so they can get online. They land on the employee WLAN and can see employee servers. What should replace that shortcut?
- A plant WLAN requires fast transition. Newer phones roam quickly. Older scanners that do not support fast transition cannot associate at all. What does the requirement do to those scanners?
- A lobby WLAN uses Enhanced Open. Guests join with no password and the frames are encrypted. A technician wants to add a pre-shared key so that encryption will start. What is the right response?
- Phones fail a WPA2 pre-shared key that the front desk swears is correct. The controller value matches the card except for a space at the end. What is wrong?
- A laptop fails authorization on a campus WLAN. It uses a random MAC on that SSID, and the only allow rule matches the laptop's hardware MAC. The same laptop joins a WLAN that does not match on MAC. What should change for the campus WLAN?
- Handsets that support fast transition only over the distribution system do a full EAP roam. The WLAN offers fast transition only over the air. Phones that support the over-the-air method roam quickly. What should change for the handsets?
- Hotel guests never see the portal. The pre-authentication filter allows the portal and blocks DHCP. A guest that is given a static address can open the portal. What is the filter blocking that the guests need first?
- Guest phones associate at a branch and then fail. The mobility tunnel to the anchor controller is up. The guest WLAN exists on the branch and does not exist on the anchor. What is missing on the anchor?
- A laptop fails EAP-TLS. Its user certificate expired last week. The RADIUS server certificate is valid, and a laptop with a current user certificate joins. What should be renewed?
- Guests are redirected to a local web page and then rejected. The guest account on the controller expired yesterday. The redirect itself loads. What should be updated?
- A laptop fails EAP-TLS. The user certificate is in the certificate store and is valid. The supplicant is set to use a smart card, and no smart card is present. What should change?
- A phone clings to the first access point long after a nearer access point is much stronger. The phone is set to stay associated until the signal is very poor. What is deciding the roam?
- Handsets that support neighbor reports drop calls while they roam. Neighbor reports are disabled, so each handset scans every channel before it moves. What should be enabled?
- Laptops are set to trust a RADIUS name. The certificate contains that name and not the server's IP address. The WLAN is configured with the IP address, and the laptops reject the server. Why?
- A lab WLAN uses local EAP on the controller. One new engineer fails, and other local users join. That engineer was never added to the local user list. What is missing?
- A WPA2 WLAN requires protected management frames. New phones join. Older scanners that cannot protect management frames never associate. What does the requirement do?
- Guests are anchored on a controller in the DMZ. An engineer moves the guest VLAN onto the campus switch so the anchor is no longer in the path. Guests can now reach campus servers. What was bypassed?
- The pre-shared key on a WLAN was rotated. Phones that still have the old key saved fail. A phone that is given the new key joins. What do the failing phones still have?
- Guests reach the internet before they authenticate. The pre-authentication filter allows DHCP, DNS, the portal, and general internet access. What is the filter allowing that it should not?
- Some laptops reject the RADIUS server and others accept it. The server certificate is signed by an intermediate CA. The laptops that accept it have that intermediate installed, and the others do not. What is missing on the failing laptops?
- A laptop fails EAP-TLS after a user logs on. The machine certificate is present and valid. The profile is set for user authentication, and this user has no certificate. What is missing?
- Clients authenticate while the primary RADIUS server is up. When it is down, they fail. The secondary server is reachable, and its shared secret does not match the controller. What is wrong?
Wireless Monitoring and Management (15%) · 45 questions
- Retail clients associate and complete PSK authentication, then show a 169.254 address and no network access. The access point is joined and the WLAN is up. What should be checked next?
- A student reported yesterday that a laptop connected and then had very poor throughput for an hour. Nothing was tracing the client at the time. Where should the engineer look first for that past hour?
- A manufacturer schedules a Catalyst 9800 software upgrade and wants the new access-point image already on the access points, so the cutover does not download that image to every access point at the moment of the reload. Which maintenance action does that?
- Before a bank changes policy tags on the production Catalyst 9800, the engineer wants a way back to today's configuration if the change is wrong. Which maintenance action provides that?
- A single nurse's handset at a hospital fails to connect to the clinical WLAN. The engineer wants that client's events from the Catalyst 9800, without enabling a debug of every client on the controller. Which monitoring approach fits?
- A SaaS campus wants location analytics and a captive-portal experience from Cisco Spaces, while authentication and authorization decisions stay on ISE. Which split matches those products?
- Retail clients associate, pass PSK, receive a normal address, and can ping their gateway. Applications that use names fail, while an application opened by IP address works. What should be checked next?
- A city NOC wants wireless controller events in its existing SIEM, using the controller's own event messages. Which integration does that?
- A manufacturer finds that new access points can reach the Catalyst 9800 but cannot finish the secure join. The certificate the controller presents for that join is past its end date. Which maintenance action fixes the join?
- A single warehouse scanner is associated and has an address, and its application frames look wrong. The engineer wants those frames, for that scanner only, without taking the access point out of service. Which monitoring choice fits?
- University clients associate, pass authentication, and receive an address in the correct subnet. They cannot ping the gateway. Name resolution is not the complaint, because nothing on the subnet answers. What is the next check?
- A bank must activate a new access-point image across a trading floor. Neighbors cover the same desks. How should the reloads be arranged so a desk is not left with every nearby access point down?
- Office clients stay associated, hold normal addresses, and show high retry rates and poor throughput all afternoon. Authentication logs are quiet. What should be checked next?
- One government laptop is rejected as soon as it tries the WLAN. Every other laptop on that WLAN works. The controller shows the failing laptop on the client exclusion list. What explains the rejection?
- A store uses dashboard-managed access points and has no Catalyst 9800. A client was slow yesterday. Where is the first place to read that client's history?
- A hospital uses Cisco Spaces for floor maps, and the maps stay empty. The controller is not sending location information toward Spaces. Which integration is missing?
- After a plant-wide access-point image activation, most access points show the new image and a handful still show the previous one. Clients on those few access points are up. What should maintenance check first?
- Users call a clinic access point slow. The engineer wants that radio's channel utilization over the last hour. Which view has it?
- Every laptop on a new WLAN sits in authenticating, and the RADIUS server log shows no requests from the controller. A ping from the controller to that server fails. What is the first fault?
- One clinic radio shows constant errors, and its spectrum report shows a steady non-Wi-Fi signal in the channel. Where should the engineer look first to confirm that interferer?
- ISE shows successful wireless authentications and almost no session updates afterward. The controller is not sending RADIUS accounting to ISE. What does that missing integration break?
- During a maintenance window both chassis of a Catalyst 9800 SSO pair were reloaded together. Access points dropped until a chassis finished booting. How should the next upgrade avoid that?
- An engineer changes a Catalyst 9800 policy tag, does not save, and reloads during a maintenance window. After the reload the previous policy tag is back. What was skipped?
- A hospital tablet is lost. It still has a device certificate the clinical WLAN trusts. Which system should retire that tablet so the certificate is no longer a valid identity?
- A laptop works on an access point's 5 GHz radio and fails on that same access point's 2.4 GHz radio. Other access points are fine on both bands. The laptop's certificate succeeds on 5 GHz. Where is the fault?
- A museum wants a wayfinding app to follow visitors. An engineer plans to scrape the controller's client list every minute. Which integration matches the job?
- A conference client has a strong signal and a valid address, and transfers crawl. The access point shows the channel busy almost continuously. Authentication succeeded. What is the limit?
- After a controller restore, every radio stays down. The restored configuration was taken before a country was set. What has to be set again before the radios can transmit?
- A phone drops off a store WLAN and the client detail says the phone initiated the disconnect. The signal was strong and the channel was quiet. What should the engineer treat as the lead?
- A warehouse scanner associates, receives an address, and then cannot reach anything. The authentication log shows success. Which view should the engineer open next?
- Fifty Catalyst controllers need the same WLAN change. An engineer plans to paste it into each one. Catalyst Center already manages those controllers. Where should the change be made?
- A laptop on a branch WLAN can ping its gateway and cannot reach the internet. Other destinations on the gateway's own subnet work. Association and the address are fine. Where is the fault?
- Before a risky change, an engineer opens the configuration archive and finds it empty. The backup job has been failing for weeks. What has to be fixed before the change is safe to make?
- A tablet landed on an unexpected VLAN. The controller shows the VLAN it was given. An engineer needs the authorization rule that returned that VLAN. Which product has the rule?
- Access points predownloaded a new image, and nobody activated it. After the controller is upgraded they reboot and come back on the old image. What step was skipped?
- One scanner shows high retries on a radio where every other client looks clean. An engineer opens a building-wide syslog and cannot see the scanner's retries. Which view has them?
- A scanner never gets an address. A radioactive trace filtered to that scanner shows a DHCP nak from the server. A building syslog from the same minute does not mention the scanner. Where was the failure caught?
- A laptop on a store WLAN resolves names and cannot ping its gateway. Other clients on the same WLAN ping the gateway. What is the fault for this laptop?
- A laptop is associated, authenticated, and holding a valid address. It can ping the gateway and other local servers. One application server does not respond. What is the next place to look?
- A phone cannot join, and the controller shows it on the exclusion list. An engineer is about to clear the entry and try again. What should they read first?
- Admin syslog from a controller is arriving at the SIEM. An engineer searches it for one client's RSSI and finds nothing. Where does that RSSI live?
- An upgrade that was supposed to run overnight ran at mid-morning. The clock on the scheduler is correct UTC, and the window was entered as local time with no timezone. What was wrong with the window?
- A client never gets an address. A capture on the access-point switch port shows the client's DHCP discover and no offer. Where is the evidence the server did not answer?
- A change window depends on a configuration backup that has never been restored, even in a lab. What is still unproven about that backup?
- A client is slow in a spot where a nearby access point is healthy. A trace of that client shows it associated to a distant access point. What did the trace establish?
Automation and AI (10%) · 30 questions
- Catalyst Center shows campus onboarding time jumping above the baseline it learned for that site. The wireless team wants the product capability that surfaces this comparison. Which capability is that?
- Every Monday morning a campus wireless utilization peak is normal, and a Sunday peak of the same size is not. The team wants Catalyst Center to page only for the Sunday case. Which capability does that?
- A SaaS campus wants channel and power decisions based on long-term RF telemetry analyzed in the cloud and applied through Catalyst Center, instead of only the controller's recent local measurements. Which capability is that?
- A government engineer wants to read and edit wireless controller configuration as structured data over SSH, using a formal model of that data. Which pairing names the protocol and the model?
- A retailer manages its store access points only from the cloud dashboard and wants a script to rename a store SSID. There is no on-premises wireless controller. Which programmatic interface matches that network?
- A SaaS script sends an HTTP GET, calls raiseforstatus, then prints the length of the list inside the JSON response field. The server returns status 200 and a list of 40 access points. What does a successful run print?
- A script calls the cloud dashboard API to list store access points and receives HTTP 401. The stores are up and serving clients. What does the 401 mean?
- An engineer edits a controller with HTTPS and a JSON body and calls the session NETCONF. Which description of NETCONF is accurate?
- Catalyst Center AI Analytics ranks one hospital floor far worse than the others for client onboarding time. The newest access points are on a different floor that ranks as normal. Where should the team look first?
- A script loads a JSON list of access points into the variable aps and then evaluates aps["name"]. It throws a type error. Each list item is an object with a name field. What is the mistake?
- A campus has heavy co-channel contention and, separately, a DHCP scope that is exhausted. Which of those problems does AI-Enhanced RRM take on?
- A script loads a JSON list of access points and, for each object, prints the hostname field. The list contains three access points named dock-1, dock-2, and dock-3. What does a successful run print?
- AI Operations pages every weekday afternoon at a headquarters. The baseline was learned over a holiday week when the building was empty, and the afternoon load matches a normal occupied day. What is the baseline missing?
- A dorm floor has more 2.4 GHz radios than the clients need, and 5 GHz is congested. The radios can change role. Which AI-Enhanced RRM action fits?
- AI Analytics shows the retry rate on one dorm floor rising across two weeks. RF health elsewhere is flat. An engineer expects the analytics product to push a channel change. What should happen instead?
- On a normal workday a clinic floor drops to zero clients at noon and stays there. The learned baseline for that hour is a busy floor. What should AI Operations do with this noon drop?
- A NETCONF edit to a Catalyst 9800 is rejected. The session is up, and the payload names a configuration node that the controller's YANG model does not contain. Why was it rejected?
- A dashboard API returns the first page of store access points and a pointer to the next page. The script prints only that first page and reports 50 access points. The dashboard shows 200. What did the script skip?
- AI Analytics shows onboarding success steady for weeks, then worse starting the hour a RADIUS change was made. RF health is unchanged. What is the comparison telling you?
- A script calls a list API and prints the raw response text. An engineer reads the length of that text and reports it as the number of access points. What did the length actually measure?
- A dashboard API token returns an empty store list for a retailer that has dozens of stores in the dashboard. The token was created in a different organization. Why is the list empty?
- AI-Enhanced RRM narrowed a dense hall from a wide channel to a narrower one, and contention fell. An engineer forces the wide channel back and contention returns. What did the narrow channel accomplish?
- A corner of a ward suddenly goes weak and clients there drop. Coverage-hole detection is available on the controller. An engineer waits for the next cloud AI-RRM cycle to raise power. What should react to this corner?
- A script opens a NETCONF session and sends a get for the WLAN list. The engineer expects a WLAN to be renamed. The name does not change. Why not?
- AI Operations stays quiet during a daily one-hour outage. The baseline was learned during a week that included that same outage every day. What did the baseline learn?
- A site has a daily afternoon peak that matches the learned baseline, and today it also had a one-time noon outage the baseline has never contained. Which event should AI Operations surface?
- A script wraps an API call in a handler that catches every exception and then prints that the change succeeded. The API rejected the change. The script prints success. What hid the rejection?
- A script parses a JSON list of access-point objects and prints the length of that list. The list contains 12 objects. What does the length report?
- A script sends a JSON body to a Catalyst 9800 NETCONF session and the edit is rejected. What is the mismatch?
- A NETCONF edit is rejected and the session stays up. The payload names a real node, and the value is outside the range that node allows. Why was it rejected?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Cisco and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Cisco.