mediumMultiple Choice
350-401 Practice Question: Given the following configuration snippet on a…
Given the following configuration snippet on a Cisco 9800 WLC:
wireless profile policy test-policy
no security ft aaa-override no mac-filtering no wlan-switch
central-switching
What is the effect of this configuration?
⚠ Common exam trap
Cisco often tests the confusion between `central-switching` and `local-switching`, where candidates mistakenly think `central-switching` means traffic is switched at the AP, or they overlook that `no wlan-switch` explicitly disables local switching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client traffic is centrally switched through the WLC.
The `central-switching` command in the wireless profile policy forces all client traffic to be tunneled back to the WLC for processing, rather than being bridged locally at the AP. This is the definition of central switching, making option B correct. The `no wlan-switch` command further confirms that local switching is disabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client traffic is locally switched at the AP.
Why it's wrong here
The 'central-switching' command under the wireless policy profile explicitly configures client data traffic to be tunneled back to the WLC, meaning the AP does not bridge the traffic locally. A local-switched design would use 'local-switching' or FlexConnect with local switching enabled. Because the command in question enables central switching, classifying this as locally switched is incorrect.
- ✓
Client traffic is centrally switched through the WLC.
Why this is correct
When the 'central-switching' command is present, the AP encapsulates all client 802.11 frames in CAPWAP and sends them to the WLC for forwarding at the network layer. This central switching model places the WLC in the data path for all client traffic, which is exactly the behavior described in this correct option. Therefore, client traffic flows through the WLC rather than being bridged at the access point.
- ✗
Fast roaming (802.11r) is enabled for this policy.
Why it's wrong here
The configuration includes 'no security ft,' which explicitly disables 802.11r Fast Transition for the policy profile. Fast roaming via 802.11r would require the 'security ft' command to be present, allowing over-the-air or over-the-DS key management and proactive key caching. Since the command is negated, 802.11r is not enabled, making this option incorrect.
- ✗
MAC filtering is enabled for client authentication.
Why it's wrong here
MAC filtering is a legacy authentication method that would be enabled with the 'mac-filtering' command, but here we see 'no mac-filtering' in the configuration. This negates MAC-based access control, so the AP and WLC will not use the client's MAC address as an authentication credential. Consequently, claiming that MAC filtering is enabled contradicts the explicit command and is wrong.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.