CCNP Architecture Practice Question
A network engineer is configuring a Cisco wireless LAN controller (WLC) to support a new wireless network for guests. The requirement is that guest clients must be isolated from the corporate network and only have internet access. Which feature should be configured on the WLC?
⚠ Common exam trap
The trap here is assuming that FlexConnect local switching provides guest isolation, when it actually just changes the data path for wireless traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Guest anchor controller
To isolate guest wireless traffic from the corporate network and provide only internet access, a guest anchor controller is used. The guest anchor controller is typically placed in a DMZ and handles all guest traffic, while the foreign controller tunnels guest client traffic to the anchor. This design ensures that guest clients cannot reach internal corporate resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Radio Resource Management (RRM)
Why it's wrong here
RRM is a set of algorithms that automatically manage radio parameters such as channel and transmit power for access points. It optimizes wireless coverage and performance but has no role in segregating guest traffic from the corporate network. Therefore, it is not the correct feature for guest isolation.
- ✗
FlexConnect local switching
Why it's wrong here
FlexConnect local switching allows wireless traffic to be switched locally at the access point instead of being tunneled to the WLC. This is useful for branch deployments but does not inherently isolate guest traffic from the corporate network. Additional ACLs or VLANs would be needed to achieve isolation, so it is not the specific feature for guest isolation.
- ✗
Quality of Service (QoS) profile
Why it's wrong here
QoS profiles on the WLC are used to prioritize traffic types, such as voice or video, over the wireless medium. They do not provide network isolation or restrict guest clients from accessing corporate resources. While QoS can be part of a guest network design, it is not the feature that enforces isolation.
- ✓
Guest anchor controller
Why this is correct
A guest anchor controller is a dedicated WLC that handles guest traffic separately from the corporate network. Guest clients are tunneled from the foreign controller to the anchor controller, which typically resides in a DMZ. This provides isolation and ensures that guest traffic only has internet access, not corporate network access. This is the standard design for guest wireless.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.