350-401 Wireless Infrastructure — Timed 30 Questions

Question 1

A network engineer is deploying a new wireless LAN controller (WLC) in a campus network. The WLC must manage 200 access points across three buildings. The engineer configures the WLC with a management IP address and enables CAPWAP. However, the access points fail to join the WLC. The APs are in the same VLAN as the WLC and can ping the WLC's management IP. What is the most likely cause of the APs not joining?

Accepted Answer

The WLC does not have a CAPWAP source interface configured.. The correct answer is that the APs are unable to discover the WLC via CAPWAP because the WLC's CAPWAP source interface is not configured or is misconfigured. Even though the APs can ping the management IP, CAPWAP discovery requires the WLC to respond from a consistent source IP. The other options are less likely: DHCP option 43 is not needed if APs are in the same subnet, APs do not need a specific IOS version to join, and APs do not need a static IP if they can obtain one via DHCP.

Answer

The APs are not configured with DHCP option 43 to point to the WLC.

Answer

The APs are running an incompatible IOS version that does not support CAPWAP.

Answer

The APs must be assigned a static IP address to join the WLC.

Question 2

A company is deploying a new wireless network in a large warehouse. The network engineer must choose between using a centralized WLC architecture (with CAPWAP tunnels) or a converged access (SD-Access) wireless architecture. The warehouse has high-density client areas and requires low latency for real-time applications like voice and video. Which architecture should the engineer choose and why?

Accepted Answer

Converged access (SD-Access) wireless, because it allows local switching of traffic at the access layer, reducing latency.. The correct answer is converged access (SD-Access) because it enables local switching of traffic at the access layer, reducing latency and improving performance for real-time applications. Centralized CAPWAP tunnels would force all traffic back to the WLC, increasing latency. The other options are incorrect because centralized architecture does not inherently provide better RF management, and SD-Access does not require more APs or more WLCs.

Answer

Centralized WLC architecture, because it provides better RF management and security.

Answer

Centralized WLC architecture, because it requires fewer access points to cover the warehouse.

Answer

Converged access (SD-Access) wireless, because it requires fewer WLCs to manage the network.

Question 3

A network engineer is troubleshooting a wireless network where clients in a conference room experience intermittent connectivity. The engineer notices that the access point in that room is showing a high number of CRC errors on its uplink interface. The AP is connected to a Cisco 9300 switch via a copper cable. What is the most likely cause of the CRC errors?

Accepted Answer

The Ethernet cable is faulty or of poor quality.. CRC errors typically indicate physical layer issues such as faulty cabling, bad connectors, or electromagnetic interference. Since the AP is connected via copper, a faulty cable is the most likely cause. Duplex mismatch would cause alignment errors, not just CRC. AP overload would not cause CRC errors on the uplink. PoE issues would cause power problems, not CRC errors.

Answer

The AP is overloaded with too many clients.

Answer

The switch port is configured with a duplex mismatch.

Answer

The AP is not receiving enough power from Power over Ethernet (PoE).

Question 4

An engineer is configuring a new Cisco 9800 WLC in a branch office. The WLC will manage 50 APs and must provide guest access with a captive portal. The engineer configures a guest SSID with open authentication and a redirect ACL for the captive portal. However, after the configuration, clients can associate to the guest SSID but cannot reach the captive portal page. What is the most likely cause?

Accepted Answer

The redirect ACL is missing entries for DNS and HTTP traffic to the captive portal server.. The correct answer is that the redirect ACL is not properly configured to allow DNS and HTTP traffic to the captive portal server. Without proper ACL entries, the client's HTTP request is not redirected to the portal. The other options are incorrect because open authentication does not require a pre-shared key, the WLC does not need a specific interface for guest traffic (it can use a service port or management interface), and captive portal does not require RADIUS authentication by default.

Answer

The guest SSID is configured with open authentication, which does not support captive portal.

Answer

The WLC does not have a dedicated guest interface configured.

Answer

The captive portal requires a RADIUS server to be configured on the WLC.

Question 5

A network engineer is deploying a wireless mesh network using outdoor access points. The mesh APs are configured to use 802.11a/n on the 5 GHz band for backhaul and 802.11b/g/n on the 2.4 GHz band for client access. The engineer notices that the mesh backhaul links are unstable and have high packet loss. What is the most likely cause of the instability?

Accepted Answer

The 5 GHz band is being used for both backhaul and client access, causing co-channel interference.. The correct answer is that the backhaul and client access channels are overlapping, causing interference. Using the same band for both backhaul and client access can lead to co-channel interference, especially if channels are not carefully planned. The other options are less likely: 802.11a/n is not obsolete, mesh backhaul does not require a wired connection, and 5 GHz generally has better range than 2.4 GHz for backhaul.

Answer

The 802.11a/n standard is obsolete and does not support mesh networking.

Answer

The mesh APs require a wired Ethernet connection to the root AP.

Answer

The 2.4 GHz band provides better range for backhaul than the 5 GHz band.

Question 6

An engineer is configuring a Cisco 9800 WLC for high availability using a pair of WLCs in an active/standby configuration. The engineer configures the same SSID and security settings on both WLCs. However, when the active WLC fails, clients that were connected to the active WLC do not automatically reconnect to the standby WLC. What is the most likely cause?

Accepted Answer

The APs are not configured with the standby WLC's IP address as a backup controller.. The correct answer is that the APs are not configured to use the standby WLC as a backup. In a high availability setup, APs must be configured with both primary and secondary WLC IP addresses. The other options are incorrect: client roaming is not required for failover, SSID names can be the same, and APs do not need to be rebooted after failover if properly configured.

Answer

Clients must be configured to roam between WLCs, which is not supported in active/standby mode.

Answer

The SSID name must be different on the standby WLC to avoid conflicts.

Answer

The APs must be rebooted after the active WLC fails to recognize the standby WLC.

Question 7

A network engineer is troubleshooting a wireless network where clients in a specific area report slow speeds and frequent disconnections. The engineer uses a spectrum analyzer and finds high utilization on channel 11 in the 2.4 GHz band. The engineer also notices that several neighboring access points are using channel 11. What is the most likely cause of the issue?

Accepted Answer

Co-channel interference from neighboring access points using the same channel.. The correct answer is co-channel interference from neighboring APs using the same channel. This causes contention and collisions, degrading performance. Adjacent channel interference would occur if channels overlapped (e.g., channels 10 and 11), but the scenario specifies same channel. Non-WiFi interference is possible but not indicated. Client load on a single AP would cause high utilization but not necessarily disconnections.

Answer

Adjacent channel interference from access points using channels 10 and 12.

Answer

Non-WiFi interference from devices like microwaves or cordless phones.

Answer

The access point is overloaded with too many clients.

Question 8

An engineer is deploying a wireless network in a hospital that requires strict security and client isolation. The network must support 802.1X authentication for employees and a separate guest SSID with a captive portal. The engineer configures the WLC with RADIUS servers for 802.1X and a local web server for the captive portal. However, guest users can access the internal network after authentication. What configuration change is needed?

Accepted Answer

Enable client isolation (peer-to-peer blocking) on the guest SSID.. The correct answer is to enable client isolation (or peer-to-peer blocking) on the guest SSID. This prevents guest clients from communicating with each other and with internal resources. The other options are incorrect: 802.1X is not needed for guests, VLAN ACLs would be more complex, and guest traffic should be on a separate VLAN, but isolation must also be enforced at the wireless level.

Answer

Configure 802.1X authentication for the guest SSID as well.

Answer

Apply a VLAN ACL on the guest VLAN to block access to internal subnets.

Answer

Place the guest SSID on the same VLAN as the employee SSID.

Question 9

A network engineer is upgrading a legacy wireless network that uses autonomous access points to a centralized WLC-based architecture. The engineer has installed a Cisco 9800 WLC and is converting the autonomous APs to lightweight mode. After the conversion, the APs join the WLC, but the engineer notices that the APs are not broadcasting any SSIDs. What is the most likely cause?

Accepted Answer

The APs are in discovery mode and have not yet downloaded their configuration from the WLC.. The correct answer is that the APs are in discovery mode and have not yet received their configuration from the WLC. In lightweight mode, APs download their configuration from the WLC, including SSID settings. The other options are incorrect: APs do not need a separate management IP, the WLC does not need a specific IOS version for basic operation, and APs do not need to be rebooted again after joining.

Answer

The APs require a separate management IP address to broadcast SSIDs.

Answer

The WLC is running an IOS version that does not support the AP model.

Answer

The APs must be rebooted after joining the WLC to start broadcasting SSIDs.

Question 10

A network engineer runs the following command on a Cisco WLC:

WLC# show ap inventory all

AP Inventory Information
-----------------------
AP Name: AP-1
Base MAC: aabb.cc00.0100
Model: AIR-CAP3702I-A-K9
Software: 8.5.151.0

AP Name: AP-2
Base MAC: aabb.cc00.0200
Model: AIR-AP2802I-B-K9
Software: 8.5.151.0

AP Name: AP-3
Base MAC: aabb.cc00.0300
Model: AIR-AP3802I-A-K9
Software: 8.5.151.0

Based on this output, what can be concluded?

Accepted Answer

All APs are running the same software version and are compatible with the WLC.. The show ap inventory all command displays the model and software version of each AP. The output shows three APs with different models but the same software version. The key point is that the CAP3702I is a legacy AP that requires a specific software version, while the 2800 and 3800 series are newer. The output indicates all APs are running the same software, which is compatible with the WLC version.

Answer

AP-1 is a lightweight AP and AP-2 and AP-3 are autonomous APs.

Answer

AP-3 has a hardware failure because its model is different.

Answer

The WLC is running a software version that only supports AP-2 and AP-3.

Question 11

A network administrator issues the following command on a Cisco WLC:

WLC# show ap config general AP-1

AP Name: AP-1
MAC Address: aabb.cc00.0100
Country Code: US - United States
Regulatory Domain: 802.11bg: -A 802.11a: -A
AP Submode: Normal
AP Mode: Local
AP Join Priority: 1
Primary Controller: WLC-1
Secondary Controller: WLC-2
Tertiary Controller: WLC-3

Based on this output, what can be concluded?

Accepted Answer

The AP will attempt to join the primary controller WLC-1 first.. The output shows the AP is in Local mode (not FlexConnect or Monitor). It has a primary, secondary, and tertiary controller configured, which is typical for high availability. The AP will attempt to join the primary controller first.

Answer

The AP is operating in FlexConnect mode.

Answer

The AP is in Monitor mode and will not serve clients.

Answer

The AP has a join priority of 1, meaning it is the highest priority.

Question 12

A network engineer runs the following command on a Cisco WLC:

WLC# show ap rf-profile summary

RF-Profile Name: default-rf-profile
Description: Default RF Profile
Band: 5 GHz
Channel Width: 20/40/80 MHz
Data Rates: 6,9,12,18,24,36,48,54 Mbps
Power Level: 1 (max)

RF-Profile Name: high-density
Description: High Density RF Profile
Band: 5 GHz
Channel Width: 20 MHz
Data Rates: 12,18,24,36,48,54 Mbps
Power Level: 3

Based on this output, what can be concluded?

Accepted Answer

The high-density profile is designed to support more clients by using narrower channels and lower power.. The output shows two RF profiles. The default profile uses wider channel widths (up to 80 MHz) and higher power, while the high-density profile uses only 20 MHz channels and lower power to reduce interference and support more clients.

Answer

The default profile uses only 20 MHz channels.

Answer

The high-density profile disables all data rates below 12 Mbps.

Answer

The default profile is used for 2.4 GHz band.

Question 13

A network engineer runs the following command on a Cisco WLC:

WLC# show client summary

Client MAC Address   AP Name     WLAN   State   Protocol   RSSI   SNR
00:11:22:33:44:55   AP-1       1      Run     802.11ac   -65    25
00:11:22:33:44:66   AP-2       2      Run     802.11n    -70    20
00:11:22:33:44:77   AP-1       1      Run     802.11ac   -60    30
00:11:22:33:44:88   AP-3       3      Probe   802.11ax   -75    15

Based on this output, what can be concluded?

Accepted Answer

The client with MAC 00:11:22:33:44:88 is attempting to associate but is not yet connected.. The output shows client states: 'Run' means associated and active, 'Probe' means the client is probing but not yet associated. The client with MAC ending 88 is in Probe state, indicating it is not fully connected.

Answer

All clients are fully associated and passing traffic.

Answer

The client with MAC 00:11:22:33:44:55 has the best signal strength.

Answer

All clients are using 802.11ac or higher.

Question 14

A network engineer runs the following command on a Cisco WLC:

WLC# show ap stats ap-name AP-1

AP Statistics for AP-1
----------------------
Channel Utilization: 45%
Interference: 10%
Noise Floor: -95 dBm
Total Packets Received: 15000
Total Packets Sent: 12000
Total Errors: 200

Based on this output, what can be concluded?

Accepted Answer

The channel utilization is moderate and the noise floor is low.. The output shows channel utilization at 45%, which is moderate but not extremely high. The noise floor is -95 dBm, which is good (low noise). The error rate is 200 out of 15000 received, which is about 1.3%, acceptable.

Answer

The channel is heavily congested with utilization above 80%.

Answer

The noise floor is high, indicating potential interference.

Answer

The AP is experiencing a significant number of errors relative to packets received.

Question 15

A network engineer runs the following command on a Cisco WLC:

WLC# show wlan summary

WLAN ID   SSID               Status   Security   Interface
1         Guest              Enabled  Open       guest-vlan
2         Corporate          Enabled  WPA2       corp-vlan
3         IoT                Disabled WPA2       iot-vlan
4         Management         Enabled  WPA2       mgmt-vlan

Based on this output, what can be concluded?

Accepted Answer

WLAN 3 is not operational because it is disabled.. The output shows WLANs and their status. WLAN 3 (IoT) is disabled, meaning it is not broadcasting or accepting clients. The other WLANs are enabled.

Answer

All WLANs are currently active and serving clients.

Answer

The Guest WLAN uses WPA2 security.

Answer

The Management WLAN is on the guest-vlan interface.

Question 16

A network engineer runs the following command on a Cisco WLC:

WLC# show ap config general AP-2

AP Name: AP-2
MAC Address: aabb.cc00.0200
Country Code: US - United States
Regulatory Domain: 802.11bg: -A 802.11a: -A
AP Submode: FlexConnect
AP Mode: FlexConnect
AP Join Priority: 2
Primary Controller: WLC-1
Secondary Controller: WLC-2
Tertiary Controller: WLC-3

Based on this output, what can be concluded?

Accepted Answer

The AP can locally switch client traffic and maintain connectivity even if the WLC is unreachable.. The output shows the AP is in FlexConnect mode, which means it can locally switch traffic and maintain connectivity to the WLC over a WAN. The AP has a primary, secondary, and tertiary controller configured.

Answer

The AP is operating in Local mode and will tunnel all traffic to the WLC.

Answer

The AP will only work if the WLC is directly connected at Layer 2.

Answer

The AP is in Monitor mode and will not serve clients.

Question 17

A network engineer runs the following command on a Cisco WLC:

WLC# show ap rf-profile summary

RF-Profile Name: default-rf-profile
Description: Default RF Profile
Band: 2.4 GHz
Channel Width: 20 MHz
Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps
Power Level: 1 (max)

RF-Profile Name: low-power
Description: Low Power Profile
Band: 2.4 GHz
Channel Width: 20 MHz
Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps
Power Level: 5

Based on this output, what can be concluded?

Accepted Answer

The low-power profile reduces the transmit power of the AP.. Both profiles use 2.4 GHz and 20 MHz channels. The low-power profile uses a higher power level number (5) which typically means lower power (since power level is inversely related to power output on Cisco APs). The default profile uses power level 1 (max power).

Answer

The default profile uses 40 MHz channels.

Answer

The low-power profile disables all data rates below 12 Mbps.

Answer

The low-power profile is for 5 GHz band.

Question 18

A network engineer runs the following command on a Cisco WLC:

WLC# show ap stats ap-name AP-3

AP Statistics for AP-3
----------------------
Channel Utilization: 75%
Interference: 30%
Noise Floor: -80 dBm
Total Packets Received: 5000
Total Packets Sent: 4500
Total Errors: 1500

Based on this output, what can be concluded?

Accepted Answer

The high error rate suggests possible co-channel interference or signal issues.. The output shows high channel utilization (75%), high interference (30%), and a relatively high noise floor (-80 dBm is noisy). The error rate is 1500 out of 5000 received, which is 30%, indicating a poor wireless environment.

Answer

The AP is operating in a clean environment with low interference.

Answer

The channel utilization is low, indicating spare capacity.

Answer

The noise floor is excellent at -80 dBm.

Question 19

Given the following configuration snippet on a Cisco 9800 WLC:

wireless profile policy test-policy
 no security ft
 aaa-override
 no mac-filtering
 no wlan-switch
 central-switching

What is the effect of this configuration?

Accepted Answer

Client traffic is centrally switched through the WLC.. The 'central-switching' command in a wireless profile policy forces all client traffic to be tunneled back to the WLC, overriding any per-WLAN switching decisions.

Answer

Client traffic is locally switched at the AP.

Answer

Fast roaming (802.11r) is enabled for this policy.

Answer

MAC filtering is enabled for client authentication.

Question 20

Examine the following configuration on a Cisco 9800 WLC:

ap profile default-ap-profile
 description "Default AP Profile"
 country US
 management-user admin

Which statement is true about this configuration?

Accepted Answer

The country code is set to the United States, affecting allowed channels and transmit power.. The 'country US' command sets the regulatory domain for the APs using this profile, which is required for proper channel and power settings.

Answer

This profile configures the SSID for the AP.

Answer

This profile enables 802.11r fast roaming.

Answer

The management user 'admin' is used for client authentication.