Wireless Network Operation (20%)

350-101 · 60 questions

• A logistics site places new access points on a VLAN that has no wireless controller. Discovery is supposed to come from DHCP. Which DHCP information gives those access points the controller address?
• A bank brings up a new Catalyst 9800, and the access points join, but every radio stays disabled. The controller has no country configured for the branch where those access points are installed. Which initial-setup item lets the radios operate in that country?
• A government office needs one access point to capture 802.11 frames on a single channel and forward them to a laptop running a packet analyzer. That access point must not serve clients while it captures. Which mode matches the job?
• A manufacturer's new access points join an old lab controller instead of the new campus controller. DHCP has no controller option, and the name CISCO-CAPWAP-CONTROLLER still resolves to the lab address. What should change?
• A government office finishes a Catalyst 9800 install and EAP-TLS fails for every laptop. The laptop certificates are inside their validity dates, and the controller clock is several hours behind. Which initial-setup item should be corrected first?
• A hotel created and enabled a guest WLAN profile yesterday, but guests never see that SSID. The profile was not added to the policy tag assigned to the guest access points. What is missing?
• A retail branch has a thin WAN back to the campus Catalyst 9800. Client traffic should stay on the branch LAN, while the access points still take their configuration from that controller. Which mode fits?
• A hospital requires clinical tablets to pass a compliance check in the mobile device management service before the policy server will authorize them on the clinical WLAN. Which platform is the compliance authority in that design?
• Bank guests see the guest SSID and receive addresses from the employee VLAN. The WLAN profile is enabled and is present on the access points. The policy tag maps that WLAN to the employee policy profile. What is wrong?
• A hospital runs a Catalyst 9800 high-availability pair in stateful switchover. The active controller fails. What should the access points do?
• An IP camera on a plant WLAN is identified by profiling. The team wants only that camera type placed on a camera VLAN, and they do not want the WLAN disabled. Where does that per-device rule belong?
• Campus access points receive DHCP addresses, and a firewall sits between them and the Catalyst 9800. They never join. A capture shows UDP 5246 from the access points is dropped. What must the firewall permit?
• A government site wants one access point to spend its time scanning for rogue access points and wireless attacks, and that access point must not serve clients. A packet analyzer is not part of the request. Which mode fits?
• University clients pass 802.1X and land in the wrong VLAN. The WLAN and the policy profile are correct when ISE is bypassed. Which platform is assigning the VLAN they actually receive?
• A plant WLAN is up and visible to laptops on 5 GHz. Handheld barcode scanners that only support 2.4 GHz never see that SSID. The WLAN radio policy is 5 GHz only. Why are the scanners blind?
• An engineer edits a WLAN directly on a Catalyst 9800, and the next Catalyst Center provision puts the old WLAN settings back. Catalyst Center is provisioning this site. Where should the change be made so it sticks?
• Retail clients associate, receive an address, and can ping their gateway. Traffic beyond the gateway fails. An ACL on the WLAN policy profile denies that traffic. Where is the failure?
• A new access point joins a Catalyst 9800 and its radios stay down. Other access points in the same country are serving clients. This access point's regulatory domain does not match the configured country. What is the mismatch?
• A store uses FlexConnect local switching. When the WAN to the controller fails, already connected clients keep passing local traffic, and new clients cannot authenticate. Central authentication is the only method configured. What is missing for new clients during that failure?
• A new Catalyst 9800 pair never shows the standby ready. The redundancy link between the two controllers is down, and the WLANs are already configured. What has to be repaired first?
• A retail access point is configured with a primary and a secondary controller. The primary is down, and the secondary is reachable. The access point does not join anything. What should it do?
• Access points in one bank branch join a lab controller. Their site tag uses an AP join profile whose primary controller address is the lab. Other branches with a different join profile join production. What should change?
• A hospital voice WLAN is up, and the policy profile that serves it is set to best effort while a data WLAN is given the higher treatment. Calls chop when the data WLAN is busy. What should change?
• A warehouse hides the SSID and configures no passphrase and no 802.1X. A capture still shows client probes that name the network, and frames are readable. Why is hiding the SSID not the control they need?
• A Catalyst 9800 shows the correct time from NTP. New access points fail the secure join and their logs show the time as years off. The access points are not configured with a time source. What is missing?
• A failed tablet is marked non-compliant by the mobile device manager, and ISE can see that result. The authorization rule for the clinical WLAN never checks it, so the tablet still lands on the production VLAN. What is missing?
• A retailer wants one access point to join the controller and test the store WLAN as a client would, rather than serve shoppers or feed a protocol analyzer. Which mode fits?
• A Catalyst 9800 SSO pair keeps dropping its stateful relationship. The redundancy link rides a switch path that also carries client traffic and flaps several times a day. What should change?
• New access points discover a Catalyst 9800, start the join, and stall while transferring the image. A small ping to the controller works, and a large ping across the same path fails. What is the fault?
• New store access points keep joining a decommissioned lab controller. DHCP option 43 on the store scope points at the production controller. Each access point has a static controller address set to the lab. Why is option 43 ignored?
• An engineer builds an RF profile that keeps access points off a noisy channel, then finds every access point still using that channel. The access points are on the default RF tag, which does not include the new profile. What is missing?
• A university wants employee phones in a staff VLAN. An engineer looks for that VLAN inside the Spaces engagement settings and cannot find a place that changes where clients are bridged. Which product owns that decision?
• A branch FlexConnect WLAN is locally switched and mapped to VLAN 20. VLAN 20 does not exist on the branch switch. Clients associate and never get an address. What is wrong?
• An engineer adds a FlexConnect profile to a site tag and the access points stay in local mode. Local Site is still enabled on that site tag. Why did the access points ignore the flex profile?
• Local-mode access points join a Catalyst 9800, and client data never arrives at the controller. The firewall allows UDP 5246 and blocks UDP 5247. What is blocked?
• A branch WLAN is supposed to authenticate employees with ISE. The WAN is up, and ISE shows no requests. The WLAN is set to authenticate locally at the access point. What should change?
• A branch FlexConnect WLAN centrally switches every client across a congested WAN. Clients associate quickly and then crawl. The branch has the VLAN and the gateway locally. What change keeps client data off that WAN?
• A dual-band handheld in a plant is strong on 2.4 GHz and weak on 5 GHz. Band select keeps steering it to 5 GHz, and the session stalls there. What should change for this WLAN?
• Access points in the same VLAN as a Catalyst 9800 join by broadcast. Access points in a new VLAN never join. That VLAN has no DHCP option 43 and no DNS entry for the controller. Why do the new ones fail?
• A library wants guest devices blocked from a staff server. An engineer looks for that block inside a Spaces engagement campaign. Where does the block belong?
• Employees associate to a campus WLAN and never get an address. The SSID is on the policy tag, and the client VLAN that the policy profile names is shut down on the controller's switch. What is broken?
• A store's access points are managed only from the cloud dashboard. An engineer prepares a list of Catalyst 9800 commands to create the store WLAN. Why will those commands not create it?
• A Catalyst 9800 pair will not form stateful switchover. The redundancy link is up, and the standby chassis is running a different software release from the active. What has to match?
• New access points get an address and never join. They have no static controller and no DHCP option 43. A lookup of CISCO-CAPWAP-CONTROLLER fails because the access points have no DNS domain, and the record exists only under the corporate suffix. What is missing?
• A campus access point that should tunnel clients to the controller was set to bridge mode. Clients no longer land on the controller's client VLAN. What mode should it use?
• After a survey, a clinic access point was left in monitor mode. Clients never associate to it, and the floor plan still counts it as a serving radio. What is that access point doing?
• A clinical tablet is denied. ISE has an allow rule for it and never sees a request. A MAC filter on the controller denies that MAC before authentication. What is blocking the tablet?
• A policy tag still lists a staff WLAN, and that WLAN profile is administratively disabled. The SSID is absent on the floor. What has to change before the tag can put it on the air?
• A Catalyst 9800 was set by typing the local time into the clock as if it were UTC, so the clock is hours off. New certificates fail their validity checks. What should be corrected?
• Most new access points join. One got its address from a different DHCP scope, and that scope has no option 43. The access-point scope does. The stray access point never joins. Why?
• A new staff WLAN is enabled and listed on the policy tag, and its radio policy is 6 GHz only. The access points on that floor have no 6 GHz radio. The SSID never appears. Why?
• Employees join the employee SSID and receive guest-VLAN addresses. The employee WLAN is paired, on the policy tag, with the guest policy profile. What caused the guest addresses?
• A branch WAN drops. Centrally switched clients stall. Locally switched clients on the same access points keep reaching the branch gateway. What is the difference?
• A lost tablet was retired in the device manager, and ISE would deny it. The tablet still joins. A local allow entry for its MAC remains on the controller and is hit first. What is letting it on?
• An engineer builds a 6 GHz profile that avoids a noisy channel. Access points stay on that channel. Their RF tag does not include the new profile. What is missing?
• New access points use a public DNS resolver from the wrong scope. CISCO-CAPWAP-CONTROLLER exists only on the corporate DNS. They get an address and never join. Why does the name fail?
• An open WLAN in a lobby is paired with the employee policy profile. Visitors join with no password and receive employee-VLAN addresses. What put them on that VLAN?
• DHCP option 43 gives the correct controller address. The access point's own address is in a subnet with no default gateway, and the controller is on another subnet. The access point never joins. Why?
• A Catalyst 9800 pair will not form stateful switchover. The redundancy link shows up, and a device in the middle of that link is dropping the redundancy traffic. What is preventing the pair?
• An access point in sensor mode joins the staff WLAN and runs a test. A planner counts it as another serving radio for the floor. What is wrong with that count?