mediumMultiple Choice
350-401 Practice Question: Examine the following configuration on a Cisco…
Examine the following configuration on a Cisco 9800 WLC:
wireless profile policy test-policy
no security wpa no security wpa2
security wpa3 security wpa3 akm sae security ft over-the-ds
What is the effect of the 'security ft over-the-ds' command?
⚠ Common exam trap
Cisco often tests the distinction between 'over-the-air' and 'over-the-ds' keywords, trapping candidates who assume 'over-the-ds' refers to wireless DS (like mesh backhaul) rather than the wired distribution system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It enables 802.11r fast roaming using the distribution system for key exchange.
The 'security ft over-the-ds' command enables 802.11r Fast Transition (FT) using the Distribution System (DS) for key exchange. In this mode, the client and target AP communicate via the current AP over the wired network (DS) rather than over the air, reducing over-the-air overhead and improving roaming efficiency. This is in contrast to 'over-the-air' mode, where the client directly exchanges FT authentication messages with the target AP wirelessly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It enables 802.11r fast roaming using over-the-air messaging.
Why it's wrong here
The command explicitly configures 802.11r fast roaming to use the distribution system for key delivery, not the over-the-air messaging. Over-the-air is the default mechanism where the target AP sends the key to the client over the wireless medium. Since the command specifies a different distribution path, this option is incorrect.
- ✓
It enables 802.11r fast roaming using the distribution system for key exchange.
Why this is correct
In 802.11r fast roaming, the over-the-DS mode enables key exchange between the client and target AP via the distribution system (usually the wired network), rather than directly over the air. This reduces roaming latency because the target AP's key is provided before the client reassociates. The command in question specifically turns on this behavior, making this the correct answer.
- ✗
It disables fast roaming for this policy.
Why it's wrong here
The command does not disable fast roaming; it actually enables one of the 802.11r operating modes (over-the-DS). Disabling fast roaming would involve removing or negating the 802.11r configuration, such as using the 'no' form of the command or setting it to a different value. Since the command activates a fast roaming method, this option is incorrect.
- ✗
It configures the AP to use a different radio band.
Why it's wrong here
The 802.11r command is unrelated to radio band selection (2.4 GHz vs. 5 GHz). Radio band configuration is handled separately via radio parameters, such as channel and transmit power settings. The command in question only affects the fast roaming key exchange mechanism, not which radio band an AP uses. Therefore, this option is incorrect.
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.