Wireless Infrastructure practice questions

A network administrator is deploying Cisco Application Centric Infrastructure (ACI) and needs to allow two endpoint groups (EPGs) in different bridge domains to communicate while applying a contract that permits only TCP port 443. Which ACI construct provides the policy enforcement point where the contract is applied?

Trap 1: The VXLAN tunnel interface on the spine

Spine switches in an ACI fabric forward VXLAN-encapsulated traffic based on the fabric's forwarding tables but do not host EPG-level contract enforcement. Contract policy is enforced at the leaf where endpoints attach, so the spine tunnel interface is not the enforcement point described.

Trap 2: The bridge domain subnet SVI on the border leaf

A bridge domain SVI provides default gateway functionality for a subnet, not contract enforcement between EPGs. Contracts are applied at the leaf access policy layer using the EPG and contract relationship, so the SVI is not where the permitted TCP port 443 rule is enforced.

Trap 3: The APIC controller cluster policy compiler

The APIC cluster compiles and distributes policy to the leaves but does not sit in the data path, so it cannot enforce the TCP 443 permit rule on live traffic. Enforcement occurs on the leaf switch hardware, making APIC the policy source rather than the enforcement point.

A
The VXLAN tunnel interface on the spine
Why it fails: Spine switches in an ACI fabric forward VXLAN-encapsulated traffic based on the fabric's forwarding tables but do not host EPG-level contract enforcement. Contract policy is enforced at the leaf where endpoints attach, so the spine tunnel interface is not the enforcement point described.
B
The bridge domain subnet SVI on the border leaf
Why it fails: A bridge domain SVI provides default gateway functionality for a subnet, not contract enforcement between EPGs. Contracts are applied at the leaf access policy layer using the EPG and contract relationship, so the SVI is not where the permitted TCP port 443 rule is enforced.
C
The policy enforcement point on the leaf where the EPGs reside
In ACI, the leaf switch acts as the policy enforcement point, translating contracts into hardware ACL and forwarding rules applied to the EPG interfaces. When a contract permitting TCP 443 is attached between EPGs, the leaf enforces that filter for traffic between them, which is exactly the construct required.
D
The APIC controller cluster policy compiler
Why it fails: The APIC cluster compiles and distributes policy to the leaves but does not sit in the data path, so it cannot enforce the TCP 443 permit rule on live traffic. Enforcement occurs on the leaf switch hardware, making APIC the policy source rather than the enforcement point.

Question 2hardmultiple choice

A company is deploying a new Cisco wireless LAN controller (WLC) and wants to use RADIUS for authenticating wireless users. The WLC is configured with the RADIUS server IP, shared secret, and authentication port 1812. However, users are unable to authenticate. The network engineer checks the RADIUS server logs and sees that the server is receiving authentication requests from the WLC but is responding with an 'Access-Reject' message. The WLC logs show 'RADIUS server not responding' for the same server. What is the most likely cause?

Trap 1: The WLC is configured with the wrong authentication port; RADIUS…

This is incorrect because RADIUS authentication uses UDP port 1812 as the IANA-assigned standard port; port 1645 is a legacy alternative from early RADIUS implementations that has been deprecated due to conflicts with the datametrics service. More importantly, the server logs in the scenario show that the WLC's Access-Request messages are being received, which proves the WLC is sending to the correct destination port (1812). If the WLC were mistakenly configured for 1645, the requests would never reach the RADIUS listener on 1812, and no Access-Reject entries would appear in the server logs.

Trap 2: The WLC's RADIUS server configuration has the wrong shared secret,…

Incorrect because the server logs show 'Access-Reject', which indicates the server received the request and processed it; a shared secret mismatch would typically result in no response or a 'Access-Challenge' but not necessarily a reject. However, the server could still reject if the secret is wrong, but the WLC would still see a response, not 'server not responding'.

Trap 3: The WLC is not configured with a valid management interface IP…

This is incorrect because the RADIUS server logs show that it is receiving Access-Request packets from the WLC, which proves the WLC's management interface has a valid IP address and can route to the server. An invalid management interface IP (or missing route) would prevent the WLC from sourcing or sending any RADIUS traffic, so the server would see nothing at all. The real issue is asymmetric routing or a source-address mismatch: the server replies from a different IP than the configured RADIUS server address, causing the WLC to drop those responses and log 'server not responding'.

A
The RADIUS server is configured to use a different source IP address for RADIUS responses than the IP address configured on the WLC, causing the WLC to drop the responses.
Correct because the WLC typically expects RADIUS responses to come from the same IP address as the configured server; if the server uses a different source IP (e.g., a loopback or secondary IP), the WLC may not recognize the response and logs 'server not responding'.
B
The WLC is configured with the wrong authentication port; RADIUS uses port 1645, not 1812.
Why it fails: This is incorrect because RADIUS authentication uses UDP port 1812 as the IANA-assigned standard port; port 1645 is a legacy alternative from early RADIUS implementations that has been deprecated due to conflicts with the datametrics service. More importantly, the server logs in the scenario show that the WLC's Access-Request messages are being received, which proves the WLC is sending to the correct destination port (1812). If the WLC were mistakenly configured for 1645, the requests would never reach the RADIUS listener on 1812, and no Access-Reject entries would appear in the server logs.
C
The WLC's RADIUS server configuration has the wrong shared secret, causing the server to reject requests.
Why it fails: Incorrect because the server logs show 'Access-Reject', which indicates the server received the request and processed it; a shared secret mismatch would typically result in no response or a 'Access-Challenge' but not necessarily a reject. However, the server could still reject if the secret is wrong, but the WLC would still see a response, not 'server not responding'.
D
The WLC is not configured with a valid management interface IP address to reach the RADIUS server.
Why it fails: This is incorrect because the RADIUS server logs show that it is receiving Access-Request packets from the WLC, which proves the WLC's management interface has a valid IP address and can route to the server. An invalid management interface IP (or missing route) would prevent the WLC from sourcing or sending any RADIUS traffic, so the server would see nothing at all. The real issue is asymmetric routing or a source-address mismatch: the server replies from a different IP than the configured RADIUS server address, causing the WLC to drop those responses and log 'server not responding'.

Question 3hardmultiple choice

An enterprise is migrating from a traditional three-tier campus design to a software-defined access (SD-Access) fabric. The engineer needs to ensure that the existing wireless infrastructure integrates seamlessly. Which component of SD-Access is responsible for integrating wireless and wired policies?

Trap 1: Fabric Control node

The Fabric Control node is the LISP control plane responsible for maintaining the Endpoint Identifier (EID) to Routing Locator (RLOC) mappings. It does not physically attach to any endpoints; wireless clients are registered with the Control node through the Fabric Edge, which discovers them. Since it only provides mapping and registration services, it cannot directly integrate or enforce policies on user traffic.

Trap 2: Fabric Border node

The Fabric Border node serves as the exit or entry point between the SD-Access fabric and external networks such as a WAN or the Internet. It translates VXLAN encapsulated traffic to traditional IP routing and applies inter-VRF routing policies for north-south flows, but it never terminates wireless user connections. Wireless endpoints are always attached to a Fabric Edge node, not a Border node.

Trap 3: Wireless LAN Controller (WLC)

While the Wireless LAN Controller (WLC) manages access points, handles RF, and supports roaming, in an SD-Access deployment it does not enforce segmentation or policy on wireless clients. The WLC forwards wireless traffic to the Fabric Edge, which applies VXLAN encapsulation, SGT-based policy, and anycast gateway features. Therefore, the WLC is a management component, not the policy-integration point for wireless users.

A
Fabric Edge node
The Fabric Edge node is the ingress point for every endpoint—wired or wireless—into the SD-Access fabric. It terminates VXLAN tunnels from access switches and wireless APs, hosts the anycast gateway for the subnet, and enforces policy via Cisco TrustSec (SGT-based segmentation) and ACLs. All user traffic enters here, making it the correct component for integrating policies and providing connectivity.
B
Fabric Control node
Why it fails: The Fabric Control node is the LISP control plane responsible for maintaining the Endpoint Identifier (EID) to Routing Locator (RLOC) mappings. It does not physically attach to any endpoints; wireless clients are registered with the Control node through the Fabric Edge, which discovers them. Since it only provides mapping and registration services, it cannot directly integrate or enforce policies on user traffic.
C
Fabric Border node
Why it fails: The Fabric Border node serves as the exit or entry point between the SD-Access fabric and external networks such as a WAN or the Internet. It translates VXLAN encapsulated traffic to traditional IP routing and applies inter-VRF routing policies for north-south flows, but it never terminates wireless user connections. Wireless endpoints are always attached to a Fabric Edge node, not a Border node.
D
Wireless LAN Controller (WLC)
Why it fails: While the Wireless LAN Controller (WLC) manages access points, handles RF, and supports roaming, in an SD-Access deployment it does not enforce segmentation or policy on wireless clients. The WLC forwards wireless traffic to the Fabric Edge, which applies VXLAN encapsulation, SGT-based policy, and anycast gateway features. Therefore, the WLC is a management component, not the policy-integration point for wireless users.

Read the full DHCP explanation →

Question 4mediummultiple choice

An architect is planning a virtualized infrastructure for a branch office that will host a Cisco ISRv router and a local DHCP server. The architect wants to minimize management overhead and ensure the VMs can be easily backed up. Which hypervisor deployment model is most appropriate?

Trap 1: Use a Type 2 hypervisor on a desktop PC at the branch.

A Type 2 hypervisor, such as VirtualBox or VMware Workstation, runs as an application on top of a desktop operating system, competing with other processes for CPU, memory, and I/O. This introduces additional latency and reduces stability, making it unsuitable for hosting production network functions like a Cisco ISRv that require predictable throughput and high availability. Furthermore, a desktop PC lacks the server-grade components (redundant power, ECC memory, remote management) and the centralized enterprise management capabilities that are mandatory for branch network infrastructure.

Trap 2: Run the ISRv and DHCP server as containers on the same host.

Containers share the host OS kernel and lack a full guest operating system, so they cannot run a Cisco ISRv router, which requires its own dedicated kernel and hypervisor-level isolation to support network functions like routing protocols. This option is tempting because containerisation reduces overhead and simplifies deployment for stateless applications, and would be correct if the scenario involved lightweight microservices rather than a virtual router needing full OS resources.

Trap 3: Install the ISRv directly on physical hardware without…

Cisco ISRv is distributed as a virtual appliance or disk image that expects to run under a hypervisor; it does not install as a standalone OS on bare-metal hardware like a traditional physical router. Installing it directly on physical hardware would be unsupported and would also forfeit the core reasons for virtualization in the first place—snapshots for rollback, cloning for rapid provisioning, resource overcommit, and encrypted VM backups. A physical installation would tie the ISRv to one machine, eliminating the flexibility to migrate or restore the router after hardware failure without reconfiguration.

A
Deploy a Type 1 hypervisor on the branch server and manage VMs via a centralized vCenter or similar tool.
A Type 1 hypervisor runs directly on the branch server's hardware without a host OS, delivering near-native performance for production VM workloads. Centralized management via vCenter or a similar tool provides enterprise-grade features such as live migration, centralized logging, role-based access control, and snapshot-based backup—essential for managing a branch ISRv and DHCP server. This approach maintains the isolation and resource control needed for a virtual router while giving administrators a single pane of glass for the entire branch environment.
B
Use a Type 2 hypervisor on a desktop PC at the branch.
Why it fails: A Type 2 hypervisor, such as VirtualBox or VMware Workstation, runs as an application on top of a desktop operating system, competing with other processes for CPU, memory, and I/O. This introduces additional latency and reduces stability, making it unsuitable for hosting production network functions like a Cisco ISRv that require predictable throughput and high availability. Furthermore, a desktop PC lacks the server-grade components (redundant power, ECC memory, remote management) and the centralized enterprise management capabilities that are mandatory for branch network infrastructure.
C
Run the ISRv and DHCP server as containers on the same host.
Why it fails: Containers share the host OS kernel and lack a full guest operating system, so they cannot run a Cisco ISRv router, which requires its own dedicated kernel and hypervisor-level isolation to support network functions like routing protocols. This option is tempting because containerisation reduces overhead and simplifies deployment for stateless applications, and would be correct if the scenario involved lightweight microservices rather than a virtual router needing full OS resources.
D
Install the ISRv directly on physical hardware without virtualization.
Why it fails: Cisco ISRv is distributed as a virtual appliance or disk image that expects to run under a hypervisor; it does not install as a standalone OS on bare-metal hardware like a traditional physical router. Installing it directly on physical hardware would be unsupported and would also forfeit the core reasons for virtualization in the first place—snapshots for rollback, cloning for rapid provisioning, resource overcommit, and encrypted VM backups. A physical installation would tie the ISRv to one machine, eliminating the flexibility to migrate or restore the router after hardware failure without reconfiguration.

Question 5easymultiple choice

A network engineer executes the following command on Router R2:

R2# show ip sla configuration 1

IP SLAs Infrastructure Engine-II

Entry number: 1 Owner: admin Tag: Type of operation to perform: icmp-echo Target address: 192.168.2.10 Source address: 192.168.2.1 Type Of Service parameter: 0x0 Request size (ARR data portion): 28 Operation timeout (milliseconds): 5000 Frequency (seconds): 60 Next Scheduled Start Time: Start Time already passed Group Scheduled : FALSE Life (seconds): Forever Entry Ageout (seconds): never Recurring (Starting Everyday, Starting Time: 00:00:01) Status of entry (SNMP RowStatus): Active Threshold (milliseconds): 5000 Distribution Statistics: Number of statistic hours kept: 2 Number of statistic distribution buckets kept: 1 Statistic distribution interval (milliseconds): 20 Enhanced History:

Based on this output, what is the frequency of the IP SLA operation?

Trap 1: 30 seconds

The output explicitly lists Frequency (seconds): 60, so 30 seconds contradicts the configured value. Thirty seconds is tempting because it is half the frequency and matches nothing else in the entry, whereas the correct figure is read directly from the Frequency field, not derived from timeout or threshold values.

Trap 2: 120 seconds

120 seconds appears nowhere in the output; Frequency (seconds) is 60. Doubling the value is tempting if you misread the two-hour distribution statistics window or assume a 60-second timeout plus 60-second frequency, but the frequency field is the authoritative source.

Trap 3: 5000 milliseconds

5000 milliseconds is the Operation timeout and Threshold value, not the frequency; the Frequency field states 60 seconds. The timeout is tempting because it is the largest millisecond figure shown, but it governs how long a single probe waits for a reply, not how often probes are sent.

A
30 seconds
Why it fails: The output explicitly lists Frequency (seconds): 60, so 30 seconds contradicts the configured value. Thirty seconds is tempting because it is half the frequency and matches nothing else in the entry, whereas the correct figure is read directly from the Frequency field, not derived from timeout or threshold values.
B
60 seconds
The output line "Frequency (seconds): 60" directly states the interval at which the icmp-echo probe to 192.168.2.10 repeats, satisfying the stem's request for the operation's frequency. Frequency governs how often each cycle restarts, distinct from the 5000 ms timeout and threshold values shown.
C
120 seconds
Why it fails: 120 seconds appears nowhere in the output; Frequency (seconds) is 60. Doubling the value is tempting if you misread the two-hour distribution statistics window or assume a 60-second timeout plus 60-second frequency, but the frequency field is the authoritative source.
D
5000 milliseconds
Why it fails: 5000 milliseconds is the Operation timeout and Threshold value, not the frequency; the Frequency field states 60 seconds. The timeout is tempting because it is the largest millisecond figure shown, but it governs how long a single probe waits for a reply, not how often probes are sent.

Question 6mediumdrag order

Open the full VLAN trunking answer →

Drag and drop the steps of the hierarchical campus network design process into the correct order, from first to last.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 7mediummultiple choice

An organization is implementing 802.1X for wireless users using Cisco ISE as the RADIUS server. The network engineer configures the wireless LAN controller (WLC) with 802.1X authentication. Users report that they can connect to the SSID but cannot access any network resources. The engineer checks the WLC and sees that users are authenticated and assigned to VLAN 100. The engineer also checks the switchport connecting the WLC and sees it is a trunk. What is the most likely issue?

Trap 1: The RADIUS server is not sending the correct VLAN ID in the…

This is incorrect because the symptom is that client devices receive an IP address in VLAN 100 and can associate, but cannot reach resources beyond the access switch. If the RADIUS server were sending an incorrect VLAN ID, the clients would either be placed in a different VLAN than intended (e.g., a guest VLAN) or authentication would fail outright. The problem is not on the RADIUS side; the Access-Accept is valid and correctly specifies VLAN 100 for the wireless clients.

Trap 2: The WLC is not configured for 802.1X on the uplink to the switch.

This is incorrect because 802.1X is a port-based access control method designed for point-to-point links and is not used on the uplink between a WLC and a switch. The WLC-to-switch link is normally configured as a trunk or an access port carrying multiple or a single VLAN, and it should not run 802.1X. Even if 802.1X were misconfigured on the uplink, it would not affect the drop of tagged VLAN 100 frames, because the issue is with VLAN pruning, not with port authentication.

Trap 3: The users' devices are not configured for MAB.

This is incorrect because MAB (MAC Authentication Bypass) is a fallback mechanism for devices that do not support 802.1X supplicants, such as printers or legacy devices. Wireless clients using 802.1X authenticate via the WLC, which acts as the authenticator (or passes EAP frames to the RADIUS server), and they do not require MAB. The problem described is about VLAN tagging on the trunk, not about the inability of the clients to perform 802.1X; MAB is irrelevant and would be a redundant fallback on the WLC, not a client-side setting.

A
The RADIUS server is not sending the correct VLAN ID in the Access-Accept.
Why it fails: This is incorrect because the symptom is that client devices receive an IP address in VLAN 100 and can associate, but cannot reach resources beyond the access switch. If the RADIUS server were sending an incorrect VLAN ID, the clients would either be placed in a different VLAN than intended (e.g., a guest VLAN) or authentication would fail outright. The problem is not on the RADIUS side; the Access-Accept is valid and correctly specifies VLAN 100 for the wireless clients.
B
The switch trunk port does not have VLAN 100 allowed.
This is the correct root cause. The WLC is configured to tag wireless client traffic on VLAN 100 and sends it over the uplink to the switch. The switch trunk port carrying this uplink must have VLAN 100 explicitly allowed in its allowed VLAN list; otherwise, the switch drops the tagged frames, preventing client traffic from reaching the rest of the network. Since the clients get IP addresses from a DHCP server reachable through the trunk (or at least associate successfully), the failure is at the trunk's egress filtering, not at the authentication phase.
C
The WLC is not configured for 802.1X on the uplink to the switch.
Why it fails: This is incorrect because 802.1X is a port-based access control method designed for point-to-point links and is not used on the uplink between a WLC and a switch. The WLC-to-switch link is normally configured as a trunk or an access port carrying multiple or a single VLAN, and it should not run 802.1X. Even if 802.1X were misconfigured on the uplink, it would not affect the drop of tagged VLAN 100 frames, because the issue is with VLAN pruning, not with port authentication.
D
The users' devices are not configured for MAB.
Why it fails: This is incorrect because MAB (MAC Authentication Bypass) is a fallback mechanism for devices that do not support 802.1X supplicants, such as printers or legacy devices. Wireless clients using 802.1X authenticate via the WLC, which acts as the authenticator (or passes EAP frames to the RADIUS server), and they do not require MAB. The problem described is about VLAN tagging on the trunk, not about the inability of the clients to perform 802.1X; MAB is irrelevant and would be a redundant fallback on the WLC, not a client-side setting.

Question 8mediummulti select

Which three statements about VRF path isolation in a service provider network are true? (Choose three.)

Trap 1: VRF can be used to replace VLANs for Layer 2 isolation.

VRF provides Layer 3 routing table separation, not Layer 2 broadcast-domain isolation, so it cannot replace VLANs. It is tempting because VRFs and VLANs are both isolation mechanisms and are often mapped together, but VLANs segment Ethernet frames while VRFs segment IP routing instances.

Trap 2: In VRF-lite, path isolation is achieved using MPLS labels.

VRF-lite achieves path isolation through separate routing and forwarding tables on the same device, without MPLS labels; label-based isolation belongs to full MPLS L3VPN. It is tempting because both approaches separate customer traffic, but VRF-lite is specifically the label-free variant.

A
VRFs allow multiple customers to share the same physical infrastructure while keeping their traffic isolated.
VRFs provide logical separation at Layer 3 by maintaining independent routing and forwarding tables per customer on shared hardware. This satisfies the stem's path isolation requirement, letting overlapping address space coexist without leakage between tenants across the same physical service provider infrastructure.
B
In MPLS VPN, VRFs are combined with route targets to control route distribution between PE routers.
In MPLS VPN, route targets are extended BGP community attributes attached to VPNv4 routes, determining which VRFs import or export them. This controls route distribution between PE routers, satisfying the stem's requirement for combining VRFs with route targets.
C
VRF-aware features such as NAT, QoS, and ACLs can be applied per VRF to enforce path isolation policies.
VRF-aware NAT, QoS and ACLs operate within each routing table's forwarding context, so policy is enforced per tenant rather than globally. This satisfies the stem's path isolation requirement by keeping traffic separated end to end, letting each VRF carry independent filtering, marking and translation rules without leaking between customers.
D
VRF can be used to replace VLANs for Layer 2 isolation.
Why it fails: VRF provides Layer 3 routing table separation, not Layer 2 broadcast-domain isolation, so it cannot replace VLANs. It is tempting because VRFs and VLANs are both isolation mechanisms and are often mapped together, but VLANs segment Ethernet frames while VRFs segment IP routing instances.
E
In VRF-lite, path isolation is achieved using MPLS labels.
Why it fails: VRF-lite achieves path isolation through separate routing and forwarding tables on the same device, without MPLS labels; label-based isolation belongs to full MPLS L3VPN. It is tempting because both approaches separate customer traffic, but VRF-lite is specifically the label-free variant.

Question 9mediummatching

Drag and drop each wireless roaming method on the left to its matching 802.11 standard on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

802.11r

802.11k

802.11v

Question 10hardmultiple choice

An enterprise network uses TACACS+ for device administration and RADIUS for network access (VPN and wireless). The TACACS+ server is configured to authorize commands. A network engineer notices that after a recent upgrade of the TACACS+ server software, some commands that were previously authorized are now being denied. The engineer checks the router configuration and sees 'aaa authorization commands 15 default group tacacs+'. The TACACS+ server logs show that the authorization requests are being sent and responded to. What is the most likely cause?

Trap 1: The router's 'aaa authorization commands 15 default group tacacs+'…

Incorrect because the engineer wants TACACS+ to authorize commands, and the issue is that TACACS+ is responding with a deny, not that the router is failing to fall back. Adding 'local' would not help if TACACS+ explicitly denies.

Trap 2: The router's privilege level 15 is not correctly assigned to the…

This is not the cause because the user is already operating at privilege level 15, as evidenced by the 'aaa authorization commands 15' statement in the router's configuration. The router's privilege level determines which commands require authorization and what local permissions exist, but in this scenario, the final decision lies with the TACACS+ server, which is explicitly denying the commands. A correct privilege level assignment does not guarantee that TACACS+ will authorize every command; the server's rules are separate and must allow the command regardless of the user's privilege level.

Trap 3: The TACACS+ server is not reachable due to a firewall change,…

The issue is not with reachability because the TACACS+ server logs confirm that it is receiving authorization requests and sending responses back to the router. If a firewall were blocking traffic, the router would not receive responses and would either time out or fall back to a default authorization method, which is not what the logs show. The fact that the server is responding indicates the network path is functional, so the problem must be in the server's authorization policy, not in connectivity.

A
The router's 'aaa authorization commands 15 default group tacacs+' command is missing the 'local' keyword, so if TACACS+ denies, there is no fallback.
Why it fails: Incorrect because the engineer wants TACACS+ to authorize commands, and the issue is that TACACS+ is responding with a deny, not that the router is failing to fall back. Adding 'local' would not help if TACACS+ explicitly denies.
B
The TACACS+ server upgrade changed the default authorization behavior from permissive to restrictive, requiring explicit 'permit' statements for each command, and the existing rules may not cover all commands.
The TACACS+ server's command authorization policy is the decisive factor here. When the server was upgraded, the default authorization behavior for commands likely changed from permissive to restrictive, meaning that without explicit 'permit' statements for each command, the server will respond with a denial. The existing rules on the TACACS+ server may not cover all commands that the user is trying to execute, so even though the router correctly forwards authorization requests, the server's deny response blocks the commands. The fix is to update the TACACS+ server's rule set to explicitly permit the required commands at privilege level 15.
C
The router's privilege level 15 is not correctly assigned to the user.
Why it fails: This is not the cause because the user is already operating at privilege level 15, as evidenced by the 'aaa authorization commands 15' statement in the router's configuration. The router's privilege level determines which commands require authorization and what local permissions exist, but in this scenario, the final decision lies with the TACACS+ server, which is explicitly denying the commands. A correct privilege level assignment does not guarantee that TACACS+ will authorize every command; the server's rules are separate and must allow the command regardless of the user's privilege level.
D
The TACACS+ server is not reachable due to a firewall change, causing the router to deny all commands.
Why it fails: The issue is not with reachability because the TACACS+ server logs confirm that it is receiving authorization requests and sending responses back to the router. If a firewall were blocking traffic, the router would not receive responses and would either time out or fall back to a default authorization method, which is not what the logs show. The fact that the server is responding indicates the network path is functional, so the problem must be in the server's authorization policy, not in connectivity.

Question 11mediummultiple choice

A network administrator is using Cisco DNA Center Assurance to monitor the health of a wireless network. The administrator notices that a particular access point is reporting a high number of client association failures. Which Cisco DNA Center Assurance feature should be used to correlate these failures with client device types and identify the root cause?

Trap 1: Network Health dashboard

The Network Health dashboard provides an overall view of network device health, including wired and wireless devices, but it does not drill down into specific client association failures or correlate them with client device types. It is more suited for high-level monitoring rather than detailed troubleshooting of client issues.

Trap 2: Path Trace

Path Trace is a tool used to trace the path of a packet through the network, showing the forwarding path and any drops. It is not designed to analyze wireless client association failures or correlate them with client device types. It is more relevant for wired network path analysis and policy verification.

Trap 3: Application Health dashboard

The Application Health dashboard focuses on application performance and network latency for critical applications. It does not provide details about wireless client association failures or device types. This dashboard is used for monitoring application experience, not for troubleshooting client onboarding issues.

A
Network Health dashboard
Why it fails: The Network Health dashboard provides an overall view of network device health, including wired and wireless devices, but it does not drill down into specific client association failures or correlate them with client device types. It is more suited for high-level monitoring rather than detailed troubleshooting of client issues.
B
Client 360
Client 360 provides a comprehensive view of a specific client's experience, including connection history, onboarding issues, and performance metrics. It correlates data such as association failures with client device type, operating system, and location, enabling the administrator to identify patterns and root causes of wireless connectivity problems.
C
Path Trace
Why it fails: Path Trace is a tool used to trace the path of a packet through the network, showing the forwarding path and any drops. It is not designed to analyze wireless client association failures or correlate them with client device types. It is more relevant for wired network path analysis and policy verification.
D
Application Health dashboard
Why it fails: The Application Health dashboard focuses on application performance and network latency for critical applications. It does not provide details about wireless client association failures or device types. This dashboard is used for monitoring application experience, not for troubleshooting client onboarding issues.

Question 12mediummulti select

A network engineer is analyzing Cisco DNA Center Assurance data to troubleshoot a wireless client's poor performance. The engineer observes that the client's health score is low due to high retry rates and low SNR. Which TWO Assurance metrics should the engineer examine to further diagnose the issue? (Choose two.)

Trap 1: Switch CPU utilization

Switch CPU utilization is a wired network metric that does not directly affect wireless client SNR or retry rates. While high switch CPU can impact overall network performance, it is not a primary cause of wireless signal quality issues. The engineer should focus on wireless-specific metrics like RF conditions and channel utilization.

Trap 2: DHCP pool utilization

DHCP pool utilization indicates how many IP addresses are in use but does not impact wireless signal quality or retry rates. While DHCP issues can affect connectivity, they do not cause high retry rates or low SNR. This metric is irrelevant to the RF-related symptoms described.

Trap 3: WAN latency and jitter

WAN latency and jitter affect application performance over the wide area but are not directly related to wireless client SNR or retry rates. These metrics are relevant for WAN troubleshooting, not local wireless RF issues. The client's poor performance is likely due to local RF conditions, not WAN characteristics.

A
AP channel utilization and interference
AP channel utilization and interference metrics show how congested the wireless channel is and whether external interference is present. High channel utilization or interference can cause high retry rates and low SNR. DNA Center Assurance provides these metrics per AP and band, enabling the engineer to identify if the issue is due to co-channel interference or a noisy environment.
B
Switch CPU utilization
Why it fails: Switch CPU utilization is a wired network metric that does not directly affect wireless client SNR or retry rates. While high switch CPU can impact overall network performance, it is not a primary cause of wireless signal quality issues. The engineer should focus on wireless-specific metrics like RF conditions and channel utilization.
C
DHCP pool utilization
Why it fails: DHCP pool utilization indicates how many IP addresses are in use but does not impact wireless signal quality or retry rates. While DHCP issues can affect connectivity, they do not cause high retry rates or low SNR. This metric is irrelevant to the RF-related symptoms described.
D
WAN latency and jitter
Why it fails: WAN latency and jitter affect application performance over the wide area but are not directly related to wireless client SNR or retry rates. These metrics are relevant for WAN troubleshooting, not local wireless RF issues. The client's poor performance is likely due to local RF conditions, not WAN characteristics.
E
Client RSSI and SNR trends
Client RSSI and SNR trends in DNA Center Assurance provide historical and real-time signal quality data. Low SNR directly impacts retry rates and throughput. Examining these trends helps determine if the client is moving out of range or experiencing interference, which are common causes of poor wireless performance. This metric is directly relevant to the observed symptoms.

Read the full DHCP explanation →

Question 13mediummultiple choice

A network administrator is using the Cisco DNA Center Assurance application to troubleshoot a user's slow wireless experience. The administrator notices that the client's onboarding time is high and wants to see a detailed timeline of the client's onboarding process, including association, authentication, and DHCP phases. Which Cisco DNA Center Assurance feature provides this information?

Trap 1: Path Trace

Path Trace is a tool used to trace the path of packets between two endpoints, showing the hop-by-hop forwarding and any ACL or QoS policies applied. It does not capture wireless onboarding events such as association, authentication, or DHCP. Therefore, it cannot provide the detailed onboarding timeline the administrator needs.

Trap 2: Application Health Dashboard

The Application Health Dashboard focuses on application performance and network latency for specific applications. It does not track client onboarding phases or wireless association details. The administrator needs client-centric onboarding data, not application-level metrics, so this dashboard would not provide the required timeline.

Trap 3: Network Health Dashboard

The Network Health Dashboard gives an aggregate view of network health across sites, devices, and clients. It does not provide per-client onboarding timelines or detailed phase breakdowns. While it can highlight that onboarding time is generally high, it lacks the drill-down capability to see individual client events, making it unsuitable for this specific troubleshooting task.

A
Path Trace
Why it fails: Path Trace is a tool used to trace the path of packets between two endpoints, showing the hop-by-hop forwarding and any ACL or QoS policies applied. It does not capture wireless onboarding events such as association, authentication, or DHCP. Therefore, it cannot provide the detailed onboarding timeline the administrator needs.
B
Application Health Dashboard
Why it fails: The Application Health Dashboard focuses on application performance and network latency for specific applications. It does not track client onboarding phases or wireless association details. The administrator needs client-centric onboarding data, not application-level metrics, so this dashboard would not provide the required timeline.
C
Network Health Dashboard
Why it fails: The Network Health Dashboard gives an aggregate view of network health across sites, devices, and clients. It does not provide per-client onboarding timelines or detailed phase breakdowns. While it can highlight that onboarding time is generally high, it lacks the drill-down capability to see individual client events, making it unsuitable for this specific troubleshooting task.
D
Client 360 view
The Client 360 view in Cisco DNA Center Assurance provides a comprehensive, detailed timeline of a specific client's onboarding and connectivity events. It includes granular data on association, authentication, DHCP, and other phases, allowing the administrator to pinpoint delays. This is exactly the tool needed to analyze the onboarding process step by step.

Question 14mediummultiple choice

A network engineer is troubleshooting a wireless connectivity issue in a campus network managed by Cisco DNA Center. The Assurance module shows that several access points have high client association failures. The engineer checks the wireless controller configuration and finds that the APs are registered and functional. What is the most likely cause of the association failures?

Trap 1: The APs are not running the recommended firmware version.

Registered, functional APs on a supported controller release associate clients normally; firmware mismatches typically cause AP join or CAPWAP failures, which the stem rules out. Firmware checks are correct when APs repeatedly deregister or fail to join the controller.

Trap 2: The wireless controller has reached its maximum number of APs.

The stem confirms the APs are registered, so the controller accepted them; an AP licence or capacity ceiling would block registration itself. Capacity exhaustion is the correct diagnosis when new APs cannot join while existing ones remain online.

Trap 3: The DNA Center Assurance module is not properly configured to…

Assurance already reports the association failures, proving it collects wireless telemetry; misconfiguration would produce missing or blank data, not specific failure counts. Assurance misconfiguration is the right diagnosis when dashboards show no client or AP data at all.

A
RF interference or poor signal-to-noise ratio on the affected APs.
With APs registered and functional, association failures point to the radio layer. RF interference or a poor signal-to-noise ratio prevents clients from completing association, which Cisco DNA Center Assurance surfaces as high client association failure counts on the affected APs.
B
The APs are not running the recommended firmware version.
Why it fails: Registered, functional APs on a supported controller release associate clients normally; firmware mismatches typically cause AP join or CAPWAP failures, which the stem rules out. Firmware checks are correct when APs repeatedly deregister or fail to join the controller.
C
The wireless controller has reached its maximum number of APs.
Why it fails: The stem confirms the APs are registered, so the controller accepted them; an AP licence or capacity ceiling would block registration itself. Capacity exhaustion is the correct diagnosis when new APs cannot join while existing ones remain online.
D
The DNA Center Assurance module is not properly configured to monitor wireless events.
Why it fails: Assurance already reports the association failures, proving it collects wireless telemetry; misconfiguration would produce missing or blank data, not specific failure counts. Assurance misconfiguration is the right diagnosis when dashboards show no client or AP data at all.

Question 15easymultiple choice

A network engineer is configuring a Cisco Wireless LAN Controller (WLC) for a new wireless network. The engineer wants to ensure that client traffic is tunneled back to the WLC and that the WLC is the single point of management for the access points. Which mode should the access points be configured in?

Trap 1: Sniffer mode

Sniffer mode configures an access point to capture and forward all wireless traffic to a packet analyzer, such as Wireshark. It does not serve clients or tunnel client data to the WLC for normal network access. This mode is strictly for troubleshooting and analysis, not for providing wireless connectivity.

Trap 2: FlexConnect mode

FlexConnect mode allows access points to switch client traffic locally at the branch while still being managed by the WLC. This mode is used for branch offices with limited WAN bandwidth, where tunneling all traffic back to the WLC is not desirable. In this scenario, the requirement is to tunnel client traffic back to the WLC, so FlexConnect is not appropriate.

Trap 3: Monitor mode

Monitor mode is used for dedicated monitoring access points that only scan the air for security and interference, without serving clients. These access points do not provide client connectivity, so they cannot tunnel client traffic to the WLC. This mode is used for IDS/IPS and location services, not for general client access.

A
Sniffer mode
Why it fails: Sniffer mode configures an access point to capture and forward all wireless traffic to a packet analyzer, such as Wireshark. It does not serve clients or tunnel client data to the WLC for normal network access. This mode is strictly for troubleshooting and analysis, not for providing wireless connectivity.
B
FlexConnect mode
Why it fails: FlexConnect mode allows access points to switch client traffic locally at the branch while still being managed by the WLC. This mode is used for branch offices with limited WAN bandwidth, where tunneling all traffic back to the WLC is not desirable. In this scenario, the requirement is to tunnel client traffic back to the WLC, so FlexConnect is not appropriate.
C
Monitor mode
Why it fails: Monitor mode is used for dedicated monitoring access points that only scan the air for security and interference, without serving clients. These access points do not provide client connectivity, so they cannot tunnel client traffic to the WLC. This mode is used for IDS/IPS and location services, not for general client access.
D
Local mode
In local mode, access points establish a Control and Provisioning of Wireless Access Points (CAPWAP) tunnel to the WLC for both management and client data traffic. This allows the WLC to be the single point of management and ensures client traffic is tunneled back to the WLC. Local mode is the default and most common deployment mode for centralized wireless networks.

Question 16mediummultiple choice

A network architect is designing a new branch office that requires a controller-based wireless solution with centralized management, but the branch has limited bandwidth and must continue forwarding client traffic locally even if the WAN link to the headquarters controller fails. The branch has a single Cisco Catalyst 9800-L controller and several Cisco Catalyst 9100 access points. Which deployment mode should the architect choose for the access points?

Trap 1: Local mode with CAPWAP control and data tunnels to the controller

In local mode, both control and data traffic are tunneled to the controller via CAPWAP, so if the WAN link fails, client traffic cannot be forwarded locally. This does not meet the requirement for local forwarding during WAN failure. Local mode is suitable for centralized forwarding, but not for branch survivability with limited bandwidth.

Trap 2: Sniffer mode with packet capture to a remote server

Sniffer mode is used for capturing wireless packets and sending them to a remote analyzer; it does not provide client access. Access points in sniffer mode cannot serve clients or forward their traffic. This mode is a troubleshooting tool, not a deployment mode for production client access.

Trap 3: Monitor mode with dedicated air monitoring on all access points

Monitor mode is used for wireless intrusion prevention and spectrum analysis, not for serving client traffic. Access points in monitor mode do not provide client connectivity, so they cannot forward client traffic locally or centrally. This mode is inappropriate for a branch office that needs to serve wireless clients.

A
Local mode with CAPWAP control and data tunnels to the controller
Why it fails: In local mode, both control and data traffic are tunneled to the controller via CAPWAP, so if the WAN link fails, client traffic cannot be forwarded locally. This does not meet the requirement for local forwarding during WAN failure. Local mode is suitable for centralized forwarding, but not for branch survivability with limited bandwidth.
B
Sniffer mode with packet capture to a remote server
Why it fails: Sniffer mode is used for capturing wireless packets and sending them to a remote analyzer; it does not provide client access. Access points in sniffer mode cannot serve clients or forward their traffic. This mode is a troubleshooting tool, not a deployment mode for production client access.
C
FlexConnect mode with local switching enabled on the access points
FlexConnect mode allows the access point to switch client traffic locally at the branch while still being managed by the controller. If the WAN link fails, the AP enters standalone mode and continues to serve clients with local switching, meeting the requirement for local forwarding and reduced WAN bandwidth usage. This is the correct choice for branch survivability.
D
Monitor mode with dedicated air monitoring on all access points
Why it fails: Monitor mode is used for wireless intrusion prevention and spectrum analysis, not for serving client traffic. Access points in monitor mode do not provide client connectivity, so they cannot forward client traffic locally or centrally. This mode is inappropriate for a branch office that needs to serve wireless clients.

Question 17hardmultiple choice

A network engineer is designing a Cisco SD-Access fabric for a campus network. The fabric must support both wired and wireless clients, and the engineer wants to ensure that traffic from wired endpoints is encapsulated and forwarded through the fabric without requiring the endpoints to change their IP addresses. Which component of the SD-Access architecture is responsible for encapsulating traffic from wired endpoints and forwarding it to the fabric edge?

Trap 1: Control plane node

The control plane node maintains the mapping of endpoint identities to fabric edge nodes using LISP. It does not encapsulate or forward data traffic from wired endpoints. Its role is to provide the control plane database for endpoint location, not to perform VXLAN encapsulation of user traffic.

Trap 2: Fabric intermediate node

The fabric intermediate node is a Layer 3 underlay device that forwards VXLAN-encapsulated traffic between fabric edge and border nodes. It does not encapsulate traffic from wired endpoints; it only transports the encapsulated packets based on the outer IP header. It has no knowledge of endpoint identities or fabric encapsulation functions.

Trap 3: Fabric border node

The fabric border node connects the SD-Access fabric to external networks such as the data center or WAN. It does not encapsulate traffic from wired endpoints; instead, it handles traffic entering or leaving the fabric. While it may de-encapsulate VXLAN traffic for external destinations, it is not the first point of encapsulation for wired endpoints.

A
Control plane node
Why it fails: The control plane node maintains the mapping of endpoint identities to fabric edge nodes using LISP. It does not encapsulate or forward data traffic from wired endpoints. Its role is to provide the control plane database for endpoint location, not to perform VXLAN encapsulation of user traffic.
B
Fabric edge node
The fabric edge node is responsible for encapsulating traffic from wired endpoints using VXLAN and forwarding it to the fabric. It acts as the first-hop router for endpoints and registers them with the control plane node. This component is essential for wired client integration in SD-Access, as it provides the anycast gateway and encapsulation functions.
C
Fabric intermediate node
Why it fails: The fabric intermediate node is a Layer 3 underlay device that forwards VXLAN-encapsulated traffic between fabric edge and border nodes. It does not encapsulate traffic from wired endpoints; it only transports the encapsulated packets based on the outer IP header. It has no knowledge of endpoint identities or fabric encapsulation functions.
D
Fabric border node
Why it fails: The fabric border node connects the SD-Access fabric to external networks such as the data center or WAN. It does not encapsulate traffic from wired endpoints; instead, it handles traffic entering or leaving the fabric. While it may de-encapsulate VXLAN traffic for external destinations, it is not the first point of encapsulation for wired endpoints.

Question 18mediummultiple choice

A network engineer is configuring a Cisco wireless LAN controller (WLC) to support a new wireless network for guests. The requirement is that guest clients must be isolated from the corporate network and only have internet access. Which feature should be configured on the WLC?

Trap 1: Radio Resource Management (RRM)

RRM is a set of algorithms that automatically manage radio parameters such as channel and transmit power for access points. It optimizes wireless coverage and performance but has no role in segregating guest traffic from the corporate network. Therefore, it is not the correct feature for guest isolation.

Trap 2: FlexConnect local switching

FlexConnect local switching allows wireless traffic to be switched locally at the access point instead of being tunneled to the WLC. This is useful for branch deployments but does not inherently isolate guest traffic from the corporate network. Additional ACLs or VLANs would be needed to achieve isolation, so it is not the specific feature for guest isolation.

Trap 3: Quality of Service (QoS) profile

QoS profiles on the WLC are used to prioritize traffic types, such as voice or video, over the wireless medium. They do not provide network isolation or restrict guest clients from accessing corporate resources. While QoS can be part of a guest network design, it is not the feature that enforces isolation.

A
Radio Resource Management (RRM)
Why it fails: RRM is a set of algorithms that automatically manage radio parameters such as channel and transmit power for access points. It optimizes wireless coverage and performance but has no role in segregating guest traffic from the corporate network. Therefore, it is not the correct feature for guest isolation.
B
FlexConnect local switching
Why it fails: FlexConnect local switching allows wireless traffic to be switched locally at the access point instead of being tunneled to the WLC. This is useful for branch deployments but does not inherently isolate guest traffic from the corporate network. Additional ACLs or VLANs would be needed to achieve isolation, so it is not the specific feature for guest isolation.
C
Quality of Service (QoS) profile
Why it fails: QoS profiles on the WLC are used to prioritize traffic types, such as voice or video, over the wireless medium. They do not provide network isolation or restrict guest clients from accessing corporate resources. While QoS can be part of a guest network design, it is not the feature that enforces isolation.
D
Guest anchor controller
A guest anchor controller is a dedicated WLC that handles guest traffic separately from the corporate network. Guest clients are tunneled from the foreign controller to the anchor controller, which typically resides in a DMZ. This provides isolation and ensures that guest traffic only has internet access, not corporate network access. This is the standard design for guest wireless.

Open the full VLAN trunking answer →

Question 19mediummultiple choice

A network architect is designing a new branch office that must support wired and wireless users on the same Layer 2 segment while enforcing consistent security policy regardless of where a user connects. The design must minimize the number of VLANs and IP subnets that must be provisioned as users move between floors. Which Cisco architecture feature should be used to meet these requirements?

Trap 1: Cisco StackWise Virtual on the distribution switches

StackWise Virtual combines two physical switches into one logical switch for control-plane and management simplification, but it does not decouple user identity from location or reduce VLAN and subnet provisioning across floors. Users still need VLANs and subnets tied to their access ports, so this does not satisfy the stated design requirement.

Trap 2: Cisco Software-Defined Access with traditional VLAN trunking to the…

Trunking VLANs to a wireless controller keeps the wireless traffic tied to physical VLAN and subnet boundaries, which is exactly the sprawl the design is trying to avoid. Although SD-Access is mentioned, pairing it with legacy VLAN trunking defeats the overlay model and does not provide location-independent identity or consistent policy across wired and wireless.

Trap 3: Cisco TrustSec with static SGACL enforcement on access ports

TrustSec provides group-based policy using security group tags, which addresses consistent policy, but it does not by itself eliminate VLAN and subnet sprawl or unify wired and wireless access into one logical segment. Without an overlay fabric, the branch still requires separate VLANs and subnets for each floor, so it only partially meets the requirement.

A
Cisco StackWise Virtual on the distribution switches
Why it fails: StackWise Virtual combines two physical switches into one logical switch for control-plane and management simplification, but it does not decouple user identity from location or reduce VLAN and subnet provisioning across floors. Users still need VLANs and subnets tied to their access ports, so this does not satisfy the stated design requirement.
B
Cisco Software-Defined Access with traditional VLAN trunking to the WLC
Why it fails: Trunking VLANs to a wireless controller keeps the wireless traffic tied to physical VLAN and subnet boundaries, which is exactly the sprawl the design is trying to avoid. Although SD-Access is mentioned, pairing it with legacy VLAN trunking defeats the overlay model and does not provide location-independent identity or consistent policy across wired and wireless.
C
Cisco SD-Access fabric with VXLAN overlay and policy-based segmentation
SD-Access decouples identity from location by using a VXLAN overlay, so a user keeps the same IP subnet and security group tag whether wired or wireless. This eliminates per-floor VLAN/subnet sprawl and enforces consistent group-based policy through the fabric, which directly matches the stated requirement for unified wired/wireless policy with minimal VLAN provisioning.
D
Cisco TrustSec with static SGACL enforcement on access ports
Why it fails: TrustSec provides group-based policy using security group tags, which addresses consistent policy, but it does not by itself eliminate VLAN and subnet sprawl or unify wired and wireless access into one logical segment. Without an overlay fabric, the branch still requires separate VLANs and subnets for each floor, so it only partially meets the requirement.

Question 20mediummultiple choice

A network architect is designing a Cisco SD-Access fabric for a hospital campus. The hospital requires that guest wireless users be allowed access only to the internet, while clinical staff devices must reach internal EHR servers. The fabric uses Cisco DNA Center and Cisco Identity Services Engine for policy. Which fabric component enforces the group-based policy between these user groups?

Trap 1: The Cisco DNA Center Intent API translating business intent into…

DNA Center is the management and automation platform that translates intent into fabric device configuration, but it does not sit in the data path. Once it provisions the edge nodes, policy enforcement happens on the network devices, not in the controller. Relying on DNA Center itself for per-packet enforcement of guest versus clinical traffic would fail because management-plane systems do not forward or filter user traffic.

Trap 2: The fabric control plane node running LISP map-server functions

The control plane node maintains the LISP mapping database of endpoint-to-routing-locator associations so fabric devices can resolve destinations. It does not inspect or enforce traffic policy between endpoint groups; it only provides reachability information. In this hospital scenario, it would help staff devices locate EHR servers, but it would not prevent guest users from reaching those servers, so it is not the enforcement point.

Trap 3: The fabric intermediate node forwarding VXLAN-encapsulated traffic…

Intermediate nodes are underlay routers or switches that transport VXLAN-encapsulated packets between fabric edge nodes; they operate on the outer header and do not inspect the original endpoint traffic or its security group tags. They provide scalable transit but no policy decisions. In the hospital design, an intermediate node would forward guest traffic toward an EHR server just as readily as clinical traffic, so it cannot enforce the isolation requirement.

A
The Cisco DNA Center Intent API translating business intent into device configuration
Why it fails: DNA Center is the management and automation platform that translates intent into fabric device configuration, but it does not sit in the data path. Once it provisions the edge nodes, policy enforcement happens on the network devices, not in the controller. Relying on DNA Center itself for per-packet enforcement of guest versus clinical traffic would fail because management-plane systems do not forward or filter user traffic.
B
The fabric control plane node running LISP map-server functions
Why it fails: The control plane node maintains the LISP mapping database of endpoint-to-routing-locator associations so fabric devices can resolve destinations. It does not inspect or enforce traffic policy between endpoint groups; it only provides reachability information. In this hospital scenario, it would help staff devices locate EHR servers, but it would not prevent guest users from reaching those servers, so it is not the enforcement point.
C
The fabric intermediate node forwarding VXLAN-encapsulated traffic between edge nodes
Why it fails: Intermediate nodes are underlay routers or switches that transport VXLAN-encapsulated packets between fabric edge nodes; they operate on the outer header and do not inspect the original endpoint traffic or its security group tags. They provide scalable transit but no policy decisions. In the hospital design, an intermediate node would forward guest traffic toward an EHR server just as readily as clinical traffic, so it cannot enforce the isolation requirement.
D
The fabric edge node applying Cisco TrustSec group-based access control lists
Fabric edge nodes encapsulate traffic in VXLAN and enforce group-based policy using Cisco TrustSec security group tags and scalable group ACLs derived from ISE policy. When a guest wireless user tries to reach an EHR server, the ingress edge node drops the packet based on the source and destination security group tags. This directly delivers the required isolation between guest and clinical traffic in the SD-Access fabric.