Wireless Infrastructure practice questions

Drag and drop each WAN transport type on the left to its matching SD-WAN characteristic on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Predictable latency and SLA, private Layer 3 VPN

Low cost, best-effort, public IP addressing

Wireless backup, variable throughput, cellular network

High latency, global coverage, limited bandwidth

High bandwidth, low latency, metro-area Layer 2 connectivity

Question 2mediummatching

Drag and drop each NFV component on the left to its matching role on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Virtualized network function software (e.g., virtual router)

Physical and virtual resources (compute, storage, networking)

Orchestration and lifecycle management framework

Manages NFVI resources (e.g., OpenStack)

Manages lifecycle of individual VNFs

Question 3hardmulti select

Which three statements about 802.1X port-based authentication are true? (Choose three.)

Trap 1: The supplicant is the device that provides authentication services,…

Incorrect; the supplicant is the client requesting access, not the authentication server.

Trap 2: 802.1X is only supported on wireless networks and cannot be used on…

Incorrect; 802.1X is widely used on both wired and wireless networks.

A
The supplicant communicates with the authenticator using EAP over LAN (EAPoL) frames.
Correct; EAPoL is the encapsulation used for 802.1X on wired LANs.
B
The authenticator is typically a network switch or wireless access point.
Correct; the authenticator enforces access control and relays EAP messages.
C
The supplicant is the device that provides authentication services, such as a RADIUS server.
Why wrong: Incorrect; the supplicant is the client requesting access, not the authentication server.
D
The authentication server is usually a RADIUS server that validates credentials.
Correct; RADIUS is the standard protocol for 802.1X authentication servers.
E
802.1X is only supported on wireless networks and cannot be used on wired switches.
Why wrong: Incorrect; 802.1X is widely used on both wired and wireless networks.

Question 4mediumdrag order

Drag and drop the steps of the hierarchical campus network design process into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 5mediummatching

Drag and drop each infrastructure hardening technique on the left to its matching configuration command on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

interface range GigabitEthernet0/1-24 ; shutdown

banner login ^C Authorized access only ^C

ip ssh version 2

no cdp run

service password-encryption

Question 6mediummulti select

Which two statements about Cisco Wireless LAN Controller (WLC) high availability (SSO) are true? (Choose two.)

Trap 1: During a failover event, all client sessions are dropped and must…

Incorrect because SSO provides stateful failover; client sessions are preserved without requiring re-association.

Trap 2: SSO can be configured between any two WLC models regardless of…

Incorrect because both WLCs must be from the same platform family (e.g., both 9800-40 or both 9800-80) to support SSO.

Trap 3: SSO supports only a single AP per WLC pair.

Incorrect because SSO supports the full AP capacity of the active WLC; the standby mirrors the same capacity.

A
In an SSO pair, the standby WLC maintains synchronized client and AP state information via a dedicated link.
Correct because SSO uses a dedicated redundancy link to keep the standby WLC fully synchronized with the active WLC.
B
SSO requires both WLCs to be connected to the same Layer 2 network for the redundant management interface.
Correct because the redundant management interface must be on the same subnet to allow seamless failover.
C
During a failover event, all client sessions are dropped and must re-associate with the new active WLC.
Why wrong: Incorrect because SSO provides stateful failover; client sessions are preserved without requiring re-association.
D
SSO can be configured between any two WLC models regardless of hardware platform.
Why wrong: Incorrect because both WLCs must be from the same platform family (e.g., both 9800-40 or both 9800-80) to support SSO.
E
SSO supports only a single AP per WLC pair.
Why wrong: Incorrect because SSO supports the full AP capacity of the active WLC; the standby mirrors the same capacity.

Question 7easymultiple choice

A network engineer is using the Cisco Meraki REST API to update the SSID settings for a wireless network. The engineer sends a PUT request to 'https://api.meraki.com/api/v1/networks/{networkId}/wireless/ssids/{ssidNumber}' with a JSON payload containing the new settings. The API returns a 429 Too Many Requests error. What should the engineer do to resolve this issue?

Trap 1: Change the HTTP method to POST because PUT is not supported for…

Incorrect because PUT is the correct method for updating a resource; the error is rate limiting.

Trap 2: Add an 'X-Cisco-Meraki-API-Key' header with a higher rate limit key.

Incorrect because rate limits are per API key; there is no 'higher rate limit key'.

Trap 3: Use a different API endpoint, such as…

Incorrect because the endpoint is correct; the issue is request frequency.

A
Implement exponential backoff and retry the request after a delay.
Correct because rate limiting requires the client to slow down and retry after a delay.
B
Change the HTTP method to POST because PUT is not supported for this endpoint.
Why wrong: Incorrect because PUT is the correct method for updating a resource; the error is rate limiting.
C
Add an 'X-Cisco-Meraki-API-Key' header with a higher rate limit key.
Why wrong: Incorrect because rate limits are per API key; there is no 'higher rate limit key'.
D
Use a different API endpoint, such as 'https://api.meraki.com/api/v1/organizations/{orgId}/ssids'.
Why wrong: Incorrect because the endpoint is correct; the issue is request frequency.

Question 8mediummatching

Drag and drop each infrastructure hardening technique on the left to its matching configuration command on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

shutdown

banner login

ip ssh version 2

access-class

security passwords min-length

Question 9mediummulti select

Which two statements about Network Function Virtualization (NFV) architecture are true? (Choose two.)

Trap 1: NFV requires specialized ASICs to achieve line-rate performance.

Incorrect because NFV uses general-purpose servers; performance is achieved through software optimization and data plane acceleration technologies like DPDK, not specialized ASICs.

Trap 2: The VNF Manager is solely responsible for resource orchestration…

Incorrect because resource orchestration across multiple VIMs is performed by the NFV Orchestrator (NFVO), not the VNF Manager, which focuses on VNF lifecycle management.

Trap 3: NFV mandates the use of virtual machines and cannot use…

Incorrect because NFV supports both virtual machines and containers; container-based VNFs are increasingly common, especially with platforms like Kubernetes.

A
NFV decouples network functions from proprietary hardware appliances.
Correct because the core principle of NFV is to run network functions as software on standard servers, eliminating dependence on dedicated hardware.
B
NFV requires specialized ASICs to achieve line-rate performance.
Why wrong: Incorrect because NFV uses general-purpose servers; performance is achieved through software optimization and data plane acceleration technologies like DPDK, not specialized ASICs.
C
Virtual Network Functions (VNFs) run on top of the NFV Infrastructure (NFVI).
Correct because VNFs are software implementations of network functions that execute on the NFVI, which includes compute, storage, and networking resources.
D
The VNF Manager is solely responsible for resource orchestration across multiple VIMs.
Why wrong: Incorrect because resource orchestration across multiple VIMs is performed by the NFV Orchestrator (NFVO), not the VNF Manager, which focuses on VNF lifecycle management.
E
NFV mandates the use of virtual machines and cannot use container-based deployments.
Why wrong: Incorrect because NFV supports both virtual machines and containers; container-based VNFs are increasingly common, especially with platforms like Kubernetes.

Question 10mediummultiple choice

A network engineer is troubleshooting a wireless connectivity issue in a campus network managed by Cisco DNA Center. The Assurance module shows that several access points have high client association failures. The engineer checks the wireless controller configuration and finds that the APs are registered and functional. What is the most likely cause of the association failures?

Trap 1: The APs are not running the recommended firmware version.

Incorrect while firmware can cause issues, the APs are registered and functional; association failures are more likely RF-related.

Trap 2: The wireless controller has reached its maximum number of APs.

Incorrect because if the controller were full, APs would not register; the scenario states APs are registered and functional.

Trap 3: The DNA Center Assurance module is not properly configured to…

Incorrect because the engineer is already seeing association failure data in Assurance, so monitoring is working.

A
RF interference or poor signal-to-noise ratio on the affected APs.
Correct because high association failures are often due to RF issues, which DNA Center Assurance can detect and report.
B
The APs are not running the recommended firmware version.
Why wrong: Incorrect while firmware can cause issues, the APs are registered and functional; association failures are more likely RF-related.
C
The wireless controller has reached its maximum number of APs.
Why wrong: Incorrect because if the controller were full, APs would not register; the scenario states APs are registered and functional.
D
The DNA Center Assurance module is not properly configured to monitor wireless events.
Why wrong: Incorrect because the engineer is already seeing association failure data in Assurance, so monitoring is working.

Read the full DHCP explanation →

Question 11mediumdrag order

Drag and drop the steps of Wireless client IP address assignment via DHCP bridging into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummatching

Match each wireless standard to its frequency band and maximum data rate.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

5 GHz, up to 6.9 Gbps

2.4/5 GHz, up to 9.6 Gbps

2.4/5 GHz, up to 600 Mbps

2.4 GHz, up to 54 Mbps

5 GHz, up to 54 Mbps

Trap 1: 802.11b: 5 GHz, 54 Mbps

Incorrect — 802.11b does not use 5 GHz; its max rate is 11 Mbps on 2.4 GHz.

Trap 2: 802.11g: 2.4 GHz, 11 Mbps

Incorrect — 802.11g supports up to 54 Mbps, not 11 Mbps.

A
802.11b: 2.4 GHz, 11 Mbps
802.11b operates in the 2.4 GHz band with a maximum data rate of 11 Mbps.
B
802.11g: 2.4 GHz, 54 Mbps
802.11g also uses 2.4 GHz but supports up to 54 Mbps.
C
802.11n: 2.4/5 GHz, 600 Mbps
802.11n can operate in both 2.4 and 5 GHz bands with a theoretical max of 600 Mbps.
D
802.11ac: 5 GHz, 1.3 Gbps
802.11ac operates exclusively in the 5 GHz band with a typical maximum data rate of 1.3 Gbps.
E
802.11b: 5 GHz, 54 Mbps
Why wrong: Incorrect — 802.11b does not use 5 GHz; its max rate is 11 Mbps on 2.4 GHz.
F
802.11g: 2.4 GHz, 11 Mbps
Why wrong: Incorrect — 802.11g supports up to 54 Mbps, not 11 Mbps.

Question 13mediummulti select

Which two statements about 802.1X port-based authentication on a Cisco switch are true? (Choose two.)

Trap 1: The RADIUS server acts as the authenticator in the 802.1X framework.

Incorrect because the RADIUS server is the authentication server, not the authenticator. The authenticator is the network device (e.g., switch).

Trap 2: 802.1X can only be configured on router interfaces, not on switch…

Incorrect because 802.1X is commonly configured on switch ports, especially for wired network access control.

Trap 3: 802.1X authentication is only applicable to wireless networks.

Incorrect because 802.1X is used for both wired and wireless network access control.

A
The switch acts as the authenticator in the 802.1X framework.
Correct because in 802.1X, the switch (or wireless controller) is the authenticator that controls access to the network.
B
The RADIUS server acts as the authenticator in the 802.1X framework.
Why wrong: Incorrect because the RADIUS server is the authentication server, not the authenticator. The authenticator is the network device (e.g., switch).
C
802.1X can only be configured on router interfaces, not on switch ports.
Why wrong: Incorrect because 802.1X is commonly configured on switch ports, especially for wired network access control.
D
EAP over LAN (EAPoL) is used between the supplicant and the authenticator.
Correct because EAPoL encapsulates EAP frames for transmission over Ethernet between the client (supplicant) and the switch (authenticator).
E
802.1X authentication is only applicable to wireless networks.
Why wrong: Incorrect because 802.1X is used for both wired and wireless network access control.

Question 14mediummulti select

Which two statements about Cisco SD-Access fabric wireless integration are true? (Choose two.)

Trap 1: The wireless LAN controller in SD-Access must be a dedicated fabric…

Incorrect because the WLC can be integrated as a fabric edge or border node; there is no separate dedicated role.

Trap 2: CAPWAP tunnels are used between the access point and the fabric…

Incorrect because CAPWAP is used only between the AP and the WLC in the underlay; the fabric edge uses VXLAN for data traffic.

Trap 3: The fabric uses a separate wireless overlay network for wireless…

Incorrect because SD-Access uses a single VXLAN-based fabric overlay for both wired and wireless traffic.

A
Wireless clients are assigned to the same virtual network (VN) as wired clients for consistent policy.
Correct because SD-Access unifies wired and wireless policy by placing both types of endpoints into the same VN.
B
The wireless LAN controller in SD-Access must be a dedicated fabric role separate from the fabric edge.
Why wrong: Incorrect because the WLC can be integrated as a fabric edge or border node; there is no separate dedicated role.
C
CAPWAP tunnels are used between the access point and the fabric edge for data traffic.
Why wrong: Incorrect because CAPWAP is used only between the AP and the WLC in the underlay; the fabric edge uses VXLAN for data traffic.
D
The fabric uses a separate wireless overlay network for wireless traffic.
Why wrong: Incorrect because SD-Access uses a single VXLAN-based fabric overlay for both wired and wireless traffic.
E
The access point encapsulates wireless traffic directly into VXLAN when the WLC is fabric-enabled.
Correct because when the WLC is fabric-enabled, the AP can encapsulate wireless client traffic directly into VXLAN, reducing overhead.

Question 15mediumdrag order

Drag and drop the steps of the 802.1X/EAP authentication process for a wireless client into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

A
Client sends EAPoL-Start to AP
Correct first step. The client initiates the 802.1X process by sending an EAPoL-Start frame to the access point.
B
AP sends EAP-Request Identity
Correct second step. The AP responds by sending an EAP-Request Identity frame to request the client's identity.
C
Client sends EAP-Response Identity
Correct third step. The client sends its identity in an EAP-Response Identity frame to the AP, which forwards it to the RADIUS server.
D
RADIUS sends EAP-Request credentials
Correct fourth step. The RADIUS server sends an EAP-Request for credentials (such as a password) to the client via the AP.
E
Client sends EAP-Response credentials
Correct fifth step. The client sends its credentials in an EAP-Response to the RADIUS server via the AP.