Wireless Monitoring and Management (15%)

350-101 · 45 questions

• Retail clients associate and complete PSK authentication, then show a 169.254 address and no network access. The access point is joined and the WLAN is up. What should be checked next?
• A student reported yesterday that a laptop connected and then had very poor throughput for an hour. Nothing was tracing the client at the time. Where should the engineer look first for that past hour?
• A manufacturer schedules a Catalyst 9800 software upgrade and wants the new access-point image already on the access points, so the cutover does not download that image to every access point at the moment of the reload. Which maintenance action does that?
• Before a bank changes policy tags on the production Catalyst 9800, the engineer wants a way back to today's configuration if the change is wrong. Which maintenance action provides that?
• A single nurse's handset at a hospital fails to connect to the clinical WLAN. The engineer wants that client's events from the Catalyst 9800, without enabling a debug of every client on the controller. Which monitoring approach fits?
• A SaaS campus wants location analytics and a captive-portal experience from Cisco Spaces, while authentication and authorization decisions stay on ISE. Which split matches those products?
• Retail clients associate, pass PSK, receive a normal address, and can ping their gateway. Applications that use names fail, while an application opened by IP address works. What should be checked next?
• A city NOC wants wireless controller events in its existing SIEM, using the controller's own event messages. Which integration does that?
• A manufacturer finds that new access points can reach the Catalyst 9800 but cannot finish the secure join. The certificate the controller presents for that join is past its end date. Which maintenance action fixes the join?
• A single warehouse scanner is associated and has an address, and its application frames look wrong. The engineer wants those frames, for that scanner only, without taking the access point out of service. Which monitoring choice fits?
• University clients associate, pass authentication, and receive an address in the correct subnet. They cannot ping the gateway. Name resolution is not the complaint, because nothing on the subnet answers. What is the next check?
• A bank must activate a new access-point image across a trading floor. Neighbors cover the same desks. How should the reloads be arranged so a desk is not left with every nearby access point down?
• Office clients stay associated, hold normal addresses, and show high retry rates and poor throughput all afternoon. Authentication logs are quiet. What should be checked next?
• One government laptop is rejected as soon as it tries the WLAN. Every other laptop on that WLAN works. The controller shows the failing laptop on the client exclusion list. What explains the rejection?
• A store uses dashboard-managed access points and has no Catalyst 9800. A client was slow yesterday. Where is the first place to read that client's history?
• A hospital uses Cisco Spaces for floor maps, and the maps stay empty. The controller is not sending location information toward Spaces. Which integration is missing?
• After a plant-wide access-point image activation, most access points show the new image and a handful still show the previous one. Clients on those few access points are up. What should maintenance check first?
• Users call a clinic access point slow. The engineer wants that radio's channel utilization over the last hour. Which view has it?
• Every laptop on a new WLAN sits in authenticating, and the RADIUS server log shows no requests from the controller. A ping from the controller to that server fails. What is the first fault?
• One clinic radio shows constant errors, and its spectrum report shows a steady non-Wi-Fi signal in the channel. Where should the engineer look first to confirm that interferer?
• ISE shows successful wireless authentications and almost no session updates afterward. The controller is not sending RADIUS accounting to ISE. What does that missing integration break?
• During a maintenance window both chassis of a Catalyst 9800 SSO pair were reloaded together. Access points dropped until a chassis finished booting. How should the next upgrade avoid that?
• An engineer changes a Catalyst 9800 policy tag, does not save, and reloads during a maintenance window. After the reload the previous policy tag is back. What was skipped?
• A hospital tablet is lost. It still has a device certificate the clinical WLAN trusts. Which system should retire that tablet so the certificate is no longer a valid identity?
• A laptop works on an access point's 5 GHz radio and fails on that same access point's 2.4 GHz radio. Other access points are fine on both bands. The laptop's certificate succeeds on 5 GHz. Where is the fault?
• A museum wants a wayfinding app to follow visitors. An engineer plans to scrape the controller's client list every minute. Which integration matches the job?
• A conference client has a strong signal and a valid address, and transfers crawl. The access point shows the channel busy almost continuously. Authentication succeeded. What is the limit?
• After a controller restore, every radio stays down. The restored configuration was taken before a country was set. What has to be set again before the radios can transmit?
• A phone drops off a store WLAN and the client detail says the phone initiated the disconnect. The signal was strong and the channel was quiet. What should the engineer treat as the lead?
• A warehouse scanner associates, receives an address, and then cannot reach anything. The authentication log shows success. Which view should the engineer open next?
• Fifty Catalyst controllers need the same WLAN change. An engineer plans to paste it into each one. Catalyst Center already manages those controllers. Where should the change be made?
• A laptop on a branch WLAN can ping its gateway and cannot reach the internet. Other destinations on the gateway's own subnet work. Association and the address are fine. Where is the fault?
• Before a risky change, an engineer opens the configuration archive and finds it empty. The backup job has been failing for weeks. What has to be fixed before the change is safe to make?
• A tablet landed on an unexpected VLAN. The controller shows the VLAN it was given. An engineer needs the authorization rule that returned that VLAN. Which product has the rule?
• Access points predownloaded a new image, and nobody activated it. After the controller is upgraded they reboot and come back on the old image. What step was skipped?
• One scanner shows high retries on a radio where every other client looks clean. An engineer opens a building-wide syslog and cannot see the scanner's retries. Which view has them?
• A scanner never gets an address. A radioactive trace filtered to that scanner shows a DHCP nak from the server. A building syslog from the same minute does not mention the scanner. Where was the failure caught?
• A laptop on a store WLAN resolves names and cannot ping its gateway. Other clients on the same WLAN ping the gateway. What is the fault for this laptop?
• A laptop is associated, authenticated, and holding a valid address. It can ping the gateway and other local servers. One application server does not respond. What is the next place to look?
• A phone cannot join, and the controller shows it on the exclusion list. An engineer is about to clear the entry and try again. What should they read first?
• Admin syslog from a controller is arriving at the SIEM. An engineer searches it for one client's RSSI and finds nothing. Where does that RSSI live?
• An upgrade that was supposed to run overnight ran at mid-morning. The clock on the scheduler is correct UTC, and the window was entered as local time with no timezone. What was wrong with the window?
• A client never gets an address. A capture on the access-point switch port shows the client's DHCP discover and no offer. Where is the evidence the server did not answer?
• A change window depends on a configuration backup that has never been restored, even in a lab. What is still unproven about that backup?
• A client is slow in a spot where a nearby access point is healthy. A trace of that client shows it associated to a distant access point. What did the trace establish?