350-401 Architecture Practice Question
A network administrator is configuring a Cisco Wireless LAN Controller (WLC) for a new office building. The company requires that guest users be isolated from internal users and that guest traffic be tunneled directly to the DMZ. Which feature should the administrator configure on the WLC?
⚠ Common exam trap
The trap here is assuming that FlexConnect local switching or mobility groups alone can isolate guest traffic to the DMZ, but they do not provide the required tunneling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Guest anchor controller
A guest anchor controller tunnels guest traffic from the foreign controller to an anchor controller in the DMZ, isolating guest traffic from internal networks. This is the standard Cisco WLC design for guest access, ensuring that guest traffic does not traverse internal networks and is directly routed to the DMZ.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Auto-anchor with dynamic VLAN assignment
Why it's wrong here
Auto-anchor is a feature that automatically assigns guest clients to an anchor controller, but it is not a standalone configuration; it requires a guest anchor controller to be set up. Dynamic VLAN assignment alone does not tunnel traffic to the DMZ.
- ✗
FlexConnect with local switching
Why it's wrong here
FlexConnect with local switching allows traffic to be switched locally at the access point, which is useful for branch offices but does not tunnel guest traffic to a central DMZ. It would not provide the required isolation and tunneling for guest users.
- ✗
Mobility group with default settings
Why it's wrong here
A mobility group allows controllers to share client information for roaming, but it does not automatically tunnel guest traffic to a DMZ. Additional configuration such as guest anchor is needed to achieve isolation and DMZ tunneling.
- ✓
Guest anchor controller
Why this is correct
A guest anchor controller allows guest traffic to be tunneled from the foreign controller to a designated anchor controller in the DMZ. This isolates guest traffic from internal networks and fulfills the requirement to tunnel guest traffic directly to the DMZ.
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.