CCNP Wireless Infrastructure — 10 Questions

Question 1

A network engineer is deploying a new wireless LAN controller (WLC) in a campus network. The WLC must manage 200 access points across three buildings. The engineer configures the WLC with a management IP address and enables CAPWAP. However, the access points fail to join the WLC. The APs are in the same VLAN as the WLC and can ping the WLC's management IP. What is the most likely cause of the APs not joining?

Accepted Answer

The WLC does not have a CAPWAP source interface configured.. The correct answer is that the APs are unable to discover the WLC via CAPWAP because the WLC's CAPWAP source interface is not configured or is misconfigured. Even though the APs can ping the management IP, CAPWAP discovery requires the WLC to respond from a consistent source IP. The other options are less likely: DHCP option 43 is not needed if APs are in the same subnet, APs do not need a specific IOS version to join, and APs do not need a static IP if they can obtain one via DHCP.

Answer

The APs are not configured with DHCP option 43 to point to the WLC.

Answer

The APs are running an incompatible IOS version that does not support CAPWAP.

Answer

The APs must be assigned a static IP address to join the WLC.

Question 2

A company is deploying a new wireless network in a large warehouse. The network engineer must choose between using a centralized WLC architecture (with CAPWAP tunnels) or a converged access (SD-Access) wireless architecture. The warehouse has high-density client areas and requires low latency for real-time applications like voice and video. Which architecture should the engineer choose and why?

Accepted Answer

Converged access (SD-Access) wireless, because it allows local switching of traffic at the access layer, reducing latency.. The correct answer is converged access (SD-Access) because it enables local switching of traffic at the access layer, reducing latency and improving performance for real-time applications. Centralized CAPWAP tunnels would force all traffic back to the WLC, increasing latency. The other options are incorrect because centralized architecture does not inherently provide better RF management, and SD-Access does not require more APs or more WLCs.

Answer

Centralized WLC architecture, because it provides better RF management and security.

Answer

Centralized WLC architecture, because it requires fewer access points to cover the warehouse.

Answer

Converged access (SD-Access) wireless, because it requires fewer WLCs to manage the network.

Question 3

A network engineer is troubleshooting a wireless network where clients in a conference room experience intermittent connectivity. The engineer notices that the access point in that room is showing a high number of CRC errors on its uplink interface. The AP is connected to a Cisco 9300 switch via a copper cable. What is the most likely cause of the CRC errors?

Accepted Answer

The Ethernet cable is faulty or of poor quality.. CRC errors typically indicate physical layer issues such as faulty cabling, bad connectors, or electromagnetic interference. Since the AP is connected via copper, a faulty cable is the most likely cause. Duplex mismatch would cause alignment errors, not just CRC. AP overload would not cause CRC errors on the uplink. PoE issues would cause power problems, not CRC errors.

Answer

The AP is overloaded with too many clients.

Answer

The switch port is configured with a duplex mismatch.

Answer

The AP is not receiving enough power from Power over Ethernet (PoE).

Question 4

An engineer is configuring a new Cisco 9800 WLC in a branch office. The WLC will manage 50 APs and must provide guest access with a captive portal. The engineer configures a guest SSID with open authentication and a redirect ACL for the captive portal. However, after the configuration, clients can associate to the guest SSID but cannot reach the captive portal page. What is the most likely cause?

Accepted Answer

The redirect ACL is missing entries for DNS and HTTP traffic to the captive portal server.. The correct answer is that the redirect ACL is not properly configured to allow DNS and HTTP traffic to the captive portal server. Without proper ACL entries, the client's HTTP request is not redirected to the portal. The other options are incorrect because open authentication does not require a pre-shared key, the WLC does not need a specific interface for guest traffic (it can use a service port or management interface), and captive portal does not require RADIUS authentication by default.

Answer

The guest SSID is configured with open authentication, which does not support captive portal.

Answer

The WLC does not have a dedicated guest interface configured.

Answer

The captive portal requires a RADIUS server to be configured on the WLC.

Question 5

A network engineer is deploying a wireless mesh network using outdoor access points. The mesh APs are configured to use 802.11a/n on the 5 GHz band for backhaul and 802.11b/g/n on the 2.4 GHz band for client access. The engineer notices that the mesh backhaul links are unstable and have high packet loss. What is the most likely cause of the instability?

Accepted Answer

The 5 GHz band is being used for both backhaul and client access, causing co-channel interference.. The correct answer is that the backhaul and client access channels are overlapping, causing interference. Using the same band for both backhaul and client access can lead to co-channel interference, especially if channels are not carefully planned. The other options are less likely: 802.11a/n is not obsolete, mesh backhaul does not require a wired connection, and 5 GHz generally has better range than 2.4 GHz for backhaul.

Answer

The 802.11a/n standard is obsolete and does not support mesh networking.

Answer

The mesh APs require a wired Ethernet connection to the root AP.

Answer

The 2.4 GHz band provides better range for backhaul than the 5 GHz band.

Question 6

An engineer is configuring a Cisco 9800 WLC for high availability using a pair of WLCs in an active/standby configuration. The engineer configures the same SSID and security settings on both WLCs. However, when the active WLC fails, clients that were connected to the active WLC do not automatically reconnect to the standby WLC. What is the most likely cause?

Accepted Answer

The APs are not configured with the standby WLC's IP address as a backup controller.. The correct answer is that the APs are not configured to use the standby WLC as a backup. In a high availability setup, APs must be configured with both primary and secondary WLC IP addresses. The other options are incorrect: client roaming is not required for failover, SSID names can be the same, and APs do not need to be rebooted after failover if properly configured.

Answer

Clients must be configured to roam between WLCs, which is not supported in active/standby mode.

Answer

The SSID name must be different on the standby WLC to avoid conflicts.

Answer

The APs must be rebooted after the active WLC fails to recognize the standby WLC.

Question 7

A network engineer is troubleshooting a wireless network where clients in a specific area report slow speeds and frequent disconnections. The engineer uses a spectrum analyzer and finds high utilization on channel 11 in the 2.4 GHz band. The engineer also notices that several neighboring access points are using channel 11. What is the most likely cause of the issue?

Accepted Answer

Co-channel interference from neighboring access points using the same channel.. The correct answer is co-channel interference from neighboring APs using the same channel. This causes contention and collisions, degrading performance. Adjacent channel interference would occur if channels overlapped (e.g., channels 10 and 11), but the scenario specifies same channel. Non-WiFi interference is possible but not indicated. Client load on a single AP would cause high utilization but not necessarily disconnections.

Answer

Adjacent channel interference from access points using channels 10 and 12.

Answer

Non-WiFi interference from devices like microwaves or cordless phones.

Answer

The access point is overloaded with too many clients.

Question 8

An engineer is deploying a wireless network in a hospital that requires strict security and client isolation. The network must support 802.1X authentication for employees and a separate guest SSID with a captive portal. The engineer configures the WLC with RADIUS servers for 802.1X and a local web server for the captive portal. However, guest users can access the internal network after authentication. What configuration change is needed?

Accepted Answer

Enable client isolation (peer-to-peer blocking) on the guest SSID.. The correct answer is to enable client isolation (or peer-to-peer blocking) on the guest SSID. This prevents guest clients from communicating with each other and with internal resources. The other options are incorrect: 802.1X is not needed for guests, VLAN ACLs would be more complex, and guest traffic should be on a separate VLAN, but isolation must also be enforced at the wireless level.

Answer

Configure 802.1X authentication for the guest SSID as well.

Answer

Apply a VLAN ACL on the guest VLAN to block access to internal subnets.

Answer

Place the guest SSID on the same VLAN as the employee SSID.

Question 9

A network engineer is upgrading a legacy wireless network that uses autonomous access points to a centralized WLC-based architecture. The engineer has installed a Cisco 9800 WLC and is converting the autonomous APs to lightweight mode. After the conversion, the APs join the WLC, but the engineer notices that the APs are not broadcasting any SSIDs. What is the most likely cause?

Accepted Answer

The APs are in discovery mode and have not yet downloaded their configuration from the WLC.. The correct answer is that the APs are in discovery mode and have not yet received their configuration from the WLC. In lightweight mode, APs download their configuration from the WLC, including SSID settings. The other options are incorrect: APs do not need a separate management IP, the WLC does not need a specific IOS version for basic operation, and APs do not need to be rebooted again after joining.

Answer

The APs require a separate management IP address to broadcast SSIDs.

Answer

The WLC is running an IOS version that does not support the AP model.

Answer

The APs must be rebooted after joining the WLC to start broadcasting SSIDs.

Question 10

A network engineer runs the following command on a Cisco WLC:

WLC# show ap inventory all

AP Inventory Information
-----------------------
AP Name: AP-1
Base MAC: aabb.cc00.0100
Model: AIR-CAP3702I-A-K9
Software: 8.5.151.0

AP Name: AP-2
Base MAC: aabb.cc00.0200
Model: AIR-AP2802I-B-K9
Software: 8.5.151.0

AP Name: AP-3
Base MAC: aabb.cc00.0300
Model: AIR-AP3802I-A-K9
Software: 8.5.151.0

Based on this output, what can be concluded?

Accepted Answer

All APs are running the same software version and are compatible with the WLC.. The show ap inventory all command displays the model and software version of each AP. The output shows three APs with different models but the same software version. The key point is that the CAP3702I is a legacy AP that requires a specific software version, while the 2800 and 3800 series are newer. The output indicates all APs are running the same software, which is compatible with the WLC version.

Answer

AP-1 is a lightweight AP and AP-2 and AP-3 are autonomous APs.

Answer

AP-3 has a hardware failure because its model is different.

Answer

The WLC is running a software version that only supports AP-2 and AP-3.