Cisco 350-101 Implementing and Operating Cisco Wireless Core Technologies (350-101 WLCOR)v1.0 Exam Practice Test

For Cisco Catalyst 9176 APs deployed at remote sites without DHCP option 43, automatic WLC discovery can be accomplished using DNS-based CAPWAP controller discovery. By creating a DNS A record namedcisco-capwap-controller. < domain > that resolves to the WLC management IP address, APs can query DNS and locate their centralized controller automatically, eliminating the need for site visits or manual configuration. This method is preferred for large-scale or satellite deployments where APs may exist on different subnets and traditional DHCP-based discovery is unavailable. Option A is impractical because manually assigning static IPs to hundreds of APs is operationally complex and error-prone. Option B, using a multicast group, is not supported for cross-subnet controller discovery in CAPWAP; multicast is limited to local subnets. Option D (ap-discovery) is not a recognized standard for WLC discovery; Cisco specifically documentscisco-capwap-controlleras the required DNS entry for CAPWAP-based automatic discovery. This approach ensures zero-touch provisioning, simplifies network operations, and guarantees that APs join the correct controller, supporting centralized management and consistent configuration across multiple campuses. Reference topics:Wireless Network Implementation — CAPWAP discovery, DNS-based controller discovery, Catalyst 9800 WLC onboarding, zero-touch provisioning.

Optimized roaming is a Cisco WLC feature designed to reduce sticky-client behavior. A sticky client remains associated to an AP even after moving far enough away that another AP would provide better RF service. Cisco describes optimized roaming as actively monitoring client data RSSI and disconnecting clients when received signal strength falls below the configured threshold. The official Catalyst 9800 documentation states that optimized roaming “disassociates client when the RSSI is lower than the set threshold,” which directly matches option A.

This function does not calculate device location through peer-to-peer beaconing, does not depend on external experience services, and is not static load balancing. It is an RF/client-roaming enforcement mechanism controlled by the wireless infrastructure. In practical operation, the AP/WLC evaluates client signal quality and, when the configured optimized roaming criteria are met, forces the client to disconnect so it can reassess the RF environment and roam to a better AP. Cisco also notes that optimized roaming helps maintain client connectivity by managing disassociationn based on RSSI and data-rate thresholds. Reference topics:Client Connectivity Configuration — client roaming behavior, sticky-client mitigation, RSSI thresholds, and WLC roaming optimization

Optimized roaming is a Cisco WLC feature designed to reduce sticky-client behavior. A sticky client remains associated to an AP even after moving far enough away that another AP would provide better RF service. Cisco describes optimized roaming as actively monitoring client data RSSI and disconnecting clients when received signal strength falls below the configured threshold. The official Catalyst 9800 documentation states that optimized roaming “disassociates client when the RSSI is lower than the set threshold,” which directly matches option A.

This function does not calculate device location through peer-to-peer beaconing, does not depend on external experience services, and is not static load balancing. It is an RF/client-roaming enforcement mechanism controlled by the wireless infrastructure. In practical operation, the AP/WLC evaluates client signal quality and, when the configured optimized roaming criteria are met, forces the client to disconnect so it can reassess the RF environment and roam to a better AP. Cisco also notes that optimized roaming helps maintain client connectivity by managing disassociationn based on RSSI and data-rate thresholds. Reference topics:Client Connectivity Configuration — client roaming behavior, sticky-client mitigation, RSSI thresholds, and WLC roaming optimization

The correct action is to create a dedicated guest interface/VLAN and bind it to the guest WLAN through the Catalyst 9800 policy profile. In Catalyst 9800 architecture, the WLAN defines the SSID and wireless security parameters, while the policy profile defines client forwarding policy, VLAN mapping, DHCP-related behavior, and access policy. Cisco’s Catalyst 9800 VLAN configuration procedure places the VLAN selection under thePolicy Profile > Access Policiessection, where a VLAN or VLAN group is mapped to the WLAN policy profile. Cisco also documents that DHCP can be configured per interface or per WLAN and recommends using the DHCP server address assigned to the relevant interface for WLAN client addressing.

A dedicated guest VLAN backed by the 10.20.30.0/24 DHCP scope provides up to 254 usable addresses, satisfying the 200-client requirement while keeping guest users separated from corporate users at Layer 3/VLAN boundaries. Option A and C are wrong because a shared DHCP pool violates the requirement for a guest-only subnet; DHCP option 43 is for AP/controller discovery, not client addressing. Option D is not scalable and does not define DHCP allocation. Reference topics:Catalyst 9800 policy profiles, WLAN-to-policy mapping, guest VLAN segmentation, DHCP scopes, and guest network isolation.

The failure is occurring during WPA/WPA2 key management, not during mobility anchoring. The radioactive trace showsFailed to validate eapol mic. MIC mismatchfollowed byFailed to validate eapol key m2, which means the authenticator and supplicant derived different key material during the PSK handshake. Cisco’s Catalyst 9800 client-connectivity troubleshooting maps this log pattern directly to a wrong password condition and lists the corrective actions as fixing the password on the endpoint or on the SSID/WLAN. The11r MIC validation failedphrase does not automatically make 802.11r the root cause; it only shows that the failed MIC validation occurred while Fast Transition key logic was in use. Disabling 802.11r would be a workaround only for client capability or FT interoperability issues, but the trace points to PSK mismatch. Removing the anchor WLC would break the intended DMZ anchoring design, and matching WLANs on foreign and anchor is required for anchor deployments, but it would not produce this EAPOL M2 MIC failure. The correct remediation is to ensure the client-entered PSK matches the WLAN PSK. Reference topics: WPA/WPA2-PSK authentication, EAPOL 4-way handshake, Catalyst 9800 radioactive trace analysis, and client connectivity troubleshooting.

TACACS+ is used for device administration, especially for GUI and CLI access to infrastructure platforms such as Cisco Catalyst 9800 WLCs, switches, and routers. Cisco defines TACACS+ as a security application that provides centralized validation for users attempting to access a device or network access server, and it separates authentication, authorization, and accounting functions for administrative control. Cisco ISE device administration documentation further states that TACACS+ is used to control and audit network device configuration, allowing devices to query ISE for administrator authentication and authorization while sending accounting records for logging administrator actions.

Therefore, the primary benefit is streamlined administrator access across platforms. Instead of maintaining local administrator accounts independently on every WLC or network device, TACACS+ enables centralized identity validation, role-based authorization, and consistent audit trails. Option A is incorrect because TACACS+ supports differentiated authorization rather than static grouping. Option B is the opposite of centralized accounting. Option D is inaccurate because TACACS+ is mainly for device administration, whereas client or endpoint network access is typically handled with RADIUS. Reference topics:Wireless Monitoring and Management — AAA for WLC administration, TACACS+ device administration, role-based access, and centralized audit control.

RSSI, or Received Signal Strength Indicator, is a measure of the detected power level of a radio signal at the receiver, expressed in dBm. It reflects the strength of the wireless signal received by the client or access point and is a critical metric for assessing coverage, link quality, and roaming decisions. Higher RSSI values (closer to 0 dBm) indicate stronger signals, while lower values (more negative) represent weaker signals. RSSI is used by Cisco wireless controllers and clients to make roaming decisions, select access points, and optimize transmit power levels. Option B, noise generated by interference, affects signal-to-noise ratio but does not define RSSI. Option C, QoS packet marking, pertains to network traffic prioritization, not RF measurements. Option D, wireless radio service ID, refers to identifying services on a network and is unrelated to signal strength measurement. Understanding RSSI is fundamental in RF planning, AP placement, and troubleshooting wireless coverage issues. Cisco Wireless Core Technologies emphasize monitoring RSSI to maintain adequate signal levels across the deployment, ensuring seamless connectivity and performance in high-density or challenging RF environments. Reference topics:RF Fundamentals — RSSI, signal strength, link quality, roaming, RF planning.

The exhibit creates WLAN profileguest-networkwith WLAN ID20and enables web authentication, but it does not yet define the client VLAN or bind the WLAN to a deployable policy. On Catalyst 9800 controllers, the WLAN profile defines SSID and wireless/security characteristics, while thepolicy profiledefines client-facing network policy, including VLAN assignment, AAA, ACLs, and switching behavior. Cisco’s web authentication configuration guide states that the policy profile specifies client VLAN, AAA, ACLs, timeout settings, and related policy, and the VLAN is assigned under the policy profile.

The second required object is thepolicy tag, because a policy tag maps the WLAN profile to the policy profile. Cisco also notes that the default policy tag automatically maps only WLAN IDs1 through 16; WLAN ID17 or highercannot use that default mapping. Since this WLAN is ID 20, a custom policy tag mapping is required. Mesh bridging, STP, AP group naming, or physical-interface isolation do not complete the Catalyst 9800 WLAN-to-VLAN policy model. Reference topics:Wireless Network Implementation — Catalyst 9800 configuration model, WLAN profiles, policy profiles, policy tags, guest VLAN assignment, and web authentication.

The correct Cisco technology isAI Network Analytics. Cisco describes Cisco AI Network Analytics as a Catalyst Center capability that uses machine learning and machine reasoning to generate deployment-specific insights, identify operational issues, and accelerate troubleshooting. Cisco’s official Catalyst Center Assurance documentation states that Cisco AI Network Analytics uses advanced machine learning techniques and an advanced cloud learning platform with deidentified network event data to identify critical issues in the network.

This makes option D the only precise match. Catalyst Center Assurance is the broader assurance and monitoring framework where AI Network Analytics is surfaced, but it is not the specific technology named in the question. Network Services is a generic platform function area, not the AI/ML analytics feature. Catalyst Center LLM Insights is not the established Cisco wireless assurance feature associated with cloud-based machine learning for issue detection. AI Network Analytics provides AI-driven baselining, anomaly detection, root-cause assistance, trends, insights, and comparative benchmarking. Cisco also documents that the AI Network Analytics cloud runs machine learning models using deidentified network event data and returns issues and insights back into Catalyst Center. Reference topics:Automation and AI — Cisco Catalyst Center, AI Network Analytics, AI-driven baselining, anomaly detection, and wireless assurance intelligence.

In Cisco Catalyst 9800 WLAN configurations, assigning a VLAN to a WLAN is done using theaccess vlan < vlan-id > command under the WLAN context. This ensures that clients associating with the guest SSID are placed in the correct Layer 2 VLAN for proper segmentation and network access. The exhibit shows that security features are removed and the WLAN is operational, but no VLAN is yet assigned. Option A correctly usesaccess vlan 10under the WLAN configuration, enabling client traffic to be tagged or untagged into VLAN 10 for site A deployment. Option B is invalid syntax; simply usingvlan 10is insufficient and not recognized in IOS XE WLAN configuration. Options C and D involvepolicy profilecommands, which define WLAN policies but do not directly assign the VLAN to the guest WLAN itself. Cisco Wireless Core Technologies emphasize that proper VLAN assignment ensures guest isolation, correct DHCP assignment, and traffic segregation, which is critical for security and compliance in enterprise deployments. Assigning the VLAN in this manner also allows downstream switches to correctly forward traffic to the intended network segment. Reference topics:Client Connectivity Configuration — WLAN VLAN assignment, guest SSID, access vlan, Cisco Catalyst 9800.

The command that enables web-based client authentication on the WLAN issecurity web-auth. Cisco’s Catalyst 9800 Web-Based Authentication guide shows the WLAN configuration workflow: enter WLAN configuration mode, disable WPA security for the open Layer 2 guest WLAN, then “Enable web authentication for WLAN” usingsecurity web-auth. Cisco then applies the authentication list and parameter map withsecurity web-auth authentication-list ...andsecurity web-auth parameter-map ..., which refine the WebAuth method and portal behavior after WebAuth itself is enabled.

Cisco’s LDAP authentication example mirrors the exhibit exactly:wlan webauth 2 webauth, removal of WPA/802.1X Layer 2 security,security web-auth,security web-auth authentication-list ldapauth, andsecurity web-auth parameter-map global. Option B only creates or enters the WLAN profile with WLAN ID 2 and SSID name. Options C and D disable WPA2 and 802.1X AKM; they do not authenticate clients. Reference topics:Client Connectivity Configuration — guest WLAN authentication, WebAuth, Layer 3 security, authentication lists, parameter maps, and Catalyst 9800 WLAN security configuration.

Migrating a Cisco Catalyst AP to Meraki cloud management requires issuing a specific CLI command on the WLC to switch the AP's management mode. The correct syntax isap management mode meraki force noprompt, which instructs the controller to transition the AP to Meraki mode, bypassing validation prompts that normally require manual confirmation. Theforcekeyword ensures the command is executed even if the AP is actively associated or configured, andnopromptsuppresses confirmation dialogues for unattended migration. Options A, C, and D are invalid syntax or improperly order the parameters, which would result in a CLI error. Cisco Wireless Core Technologies recommend this approach during enterprise migration scenarios where multiple APs are moved from Catalyst WLC management to cloud-based Meraki management, enabling centralized configuration and monitoring in a large-scale deployment. Using this command ensures a seamless transition without service disruption, while maintaining inventory consistency and supporting automation for mass AP migrations. Reference topics:Wireless Network Implementation — AP management mode migration, Meraki cloud integration, CLI AP management, Catalyst 9176 WLC migration.

The correct answer isreduction of co-channel interference. AI-RRM in Cisco Catalyst Center is designed for RF optimization, not IP addressing, software scheduling, or user identity classification. Cisco describes AI-enhanced RRM as applying artificial intelligence and machine learning to optimize RF environments and automate/adapt RF parameter tuning for Cisco wireless networks. This is directly tied to operational RF outcomes such as improved channel planning, transmit power behavior, channel width decisions, and better spectrum utilization.

Co-channel interference occurs when multiple AP radios operate on the same channel within hearing range, forcing devices to share airtime and increasing contention. AI-RRM uses telemetry, analytics, and learned RF behavior to recommend or apply more optimal RF configurations. Cisco specifically states that AI-enhanced RRM optimization can produce improvements such as up to a40 percent reduction in co-channel interferenceand SNR gains for wireless clients. Cisco’s AI-RRM deployment guidance also identifies AP radio distribution and utilization analysis as critical for minimizing co-channel interference and optimizing wireless performance.

Therefore, option B is the only operational outcome aligned with AI-RRM’s purpose. Reference topic:Automation and AI — Cisco Catalyst Center AI-RRM, RF analytics, RRM automation, channel optimization, and wireless AIOps.

To implement a guest Wi-Fi network on a Cisco 9800 WLC with the requirements mentioned, the solution must ensure that guests are isolated from the corporate LAN and are redirected to a login page before being able to access the internet. Additionally, access needs to be restricted to web browsing only, with no need for preshared keys or certificates.

Option A: "Create a WLAN that uses a web policy and points to a consent parameter map."This is necessary to enforce the login page and redirect users to a webauth page. By creating a WLAN with web policy, you ensure that users are redirected to a captive portal where they can accept the terms and conditions or login to the network. This solution also helps in segregating the guest network from the corporate network, as users are contained within their VLAN.

Option E: "Deploy a WLAN policy that points wireless users to a webauth parameter map."Web authentication (webauth) is an essential part of guest access. Deploying a WLAN policy with webauth ensures that users are directed to the login page (a webauth parameter map), allowing them to authenticate before browsing the internet.

Other options:

Option Bwould block mDNS, but it does not directly address the need for a login page or VLAN segregation.

Option Cis important for enforcing access control policies, but it doesn't fulfill all the requirements of the login page and limited access (web browsing only).

Option Dis unrelated to the requirement of providing access only to web browsing, as it primarily addresses peer-to-peer traffic blocking, which is not directly tied to web access control.

Therefore, the correct solution involves combining a web policy with a webauth parameter map for login page redirection (A and E).

The exhibit creates WLAN profileguest-networkwith WLAN ID20and enables web authentication, but it does not yet define the client VLAN or bind the WLAN to a deployable policy. On Catalyst 9800 controllers, the WLAN profile defines SSID and wireless/security characteristics, while thepolicy profiledefines client-facing network policy, including VLAN assignment, AAA, ACLs, and switching behavior. Cisco’s web authentication configuration guide states that the policy profile specifies client VLAN, AAA, ACLs, timeout settings, and related policy, and the VLAN is assigned under the policy profile.

The second required object is thepolicy tag, because a policy tag maps the WLAN profile to the policy profile. Cisco also notes that the default policy tag automatically maps only WLAN IDs1 through 16; WLAN ID17 or highercannot use that default mapping. Since this WLAN is ID 20, a custom policy tag mapping is required. Mesh bridging, STP, AP group naming, or physical-interface isolation do not complete the Catalyst 9800 WLAN-to-VLAN policy model. Reference topics:Wireless Network Implementation — Catalyst 9800 configuration model, WLAN profiles, policy profiles, policy tags, guest VLAN assignment, and web authentication.

The correct answer isRF technical standards. In Japan, wireless LAN and other radio equipment must operate under national RF regulatory requirements controlled by the Ministry of Internal Affairs and Communications, commonly referenced as MIC. TELEC, a registered certification body in Japan, states that specified radio equipment such as wireless LAN equipment used in Japan must conform to technical regulations regulated by MIC, and that radio equipment conformity certification validates conformance to the technical standards under Japan’s Radio Act.

This aligns directly with Cisco wireless regulatory-domain behavior. Cisco’s Catalyst 9800 country-code documentation explains that APs use legal frequencies approved for their regulatory domain, and for Japan regulatory-domain devices, Japan country codes must be configured so the controller and APs operate within permitted channel and power constraints. Cisco also states that country codes are assigned and verified on APs or wireless controllers to ensure regulatory compliance for wireless operation. Manufacturing batch inspection, customer onboarding, and supplier-chain evaluation are not RF spectrum regulatory functions. Reference topics:RF Fundamentals — regulatory domains, country codes, channel legality, transmit-power limits, and wireless compliance.

WPA2 Personal (PSK) authentication relies on a shared secret (preshared key) configured on both the wireless LAN controller (WLC) and the client device. In the exhibit, the WLAN is configured with WPA2 and PSK (set-key ascii MyKey123), which means the network expects clients to use the same preshared key to authenticate. To enable client connectivity, the preshared key must be manually entered on each client device; this aligns the client and WLC authentication parameters. Options B, C, and D are unrelated to WPA2 Personal: MAC filtering is a security policy mechanism, Active Directory integration supports WPA2 Enterprise with 802.1X authentication, and client certificates are used for certificate-based EAP methods, not PSK. Cisco Wireless Core Technologies emphasize that PSK deployments require consistent key configuration across the WLAN and clients, and that the preshared key is the critical element for successful authentication. This ensures secure, encrypted communication while providing simple setup for small or branch deployments without an enterprise RADIUS infrastructure. Reference topics:Client Connectivity Configuration — WPA2 Personal, preshared key authentication, WLAN configuration, branch deployment WLAN security.

The correct answer isRF technical standards. In Japan, wireless LAN and other radio equipment must operate under national RF regulatory requirements controlled by the Ministry of Internal Affairs and Communications, commonly referenced as MIC. TELEC, a registered certification body in Japan, states that specified radio equipment such as wireless LAN equipment used in Japan must conform to technical regulations regulated by MIC, and that radio equipment conformity certification validates conformance to the technical standards under Japan’s Radio Act.

This aligns directly with Cisco wireless regulatory-domain behavior. Cisco’s Catalyst 9800 country-code documentation explains that APs use legal frequencies approved for their regulatory domain, and for Japan regulatory-domain devices, Japan country codes must be configured so the controller and APs operate within permitted channel and power constraints. Cisco also states that country codes are assigned and verified on APs or wireless controllers to ensure regulatory compliance for wireless operation. Manufacturing batch inspection, customer onboarding, and supplier-chain evaluation are not RF spectrum regulatory functions. Reference topics:RF Fundamentals — regulatory domains, country codes, channel legality, transmit-power limits, and wireless compliance.

Central Web Authentication is the correct design for an open guest SSID that redirects users to a captive portal before allowing network access. Cisco describes CWA as a guest-redirection method where the redirect URL and redirect ACL are centrally controlled and communicated to the WLC through RADIUS, with the external authentication system handling the login workflow. On a Catalyst 9800 WLAN, Cisco’s configuration flow for Central Web Authentication requires AAA/ACL configuration, including the AAA server list and an ACL tied to the WLAN so client access can be controlled before and after authentication.

Option D is the only answer that satisfies all requirements: captive portal redirection, post-authentication restriction to Internet-only access, and policy enforcement through ACLs. VLAN-level segmentation is implemented through the WLAN policy profile, which maps guest clients to the guest VLAN rather than the staff VLAN. WPA2-PSK is invalid because the guest SSID must not require a password. A local web server alone does not enforce Internet-only authorization or staff-network isolation. mDNS is unrelated to captive portal authentication or guest segmentation. Reference topics:Guest WLAN design, Central Web Authentication, Catalyst 9800 policy profiles, ACL enforcement, VLAN segmentation, and captive portal client onboarding.

TheSignal-to-Noise Ratio (SNR)is an important metric used to determine the quality of a wireless signal. It compares the strength of the signal to the level of background noise. A low SNR indicates that the signal is weak relative to the noise, leading to poor signal quality.

Option D: Decreased data integrity with possible errorsis the correct answer. When SNR is low, the quality of the data transmission is compromised. The noise interferes with the signal, leading to potential data errors and a decrease in data integrity. This can cause packets to be lost or corrupted, requiring retransmissions, and reducing the overall performance and reliability of the network.

Option A: Scheduling of firmware maintenance windowsis not directly related to SNR. Firmware maintenance is unrelated to signal quality, though it might be necessary for other reasons, such as performance optimization or bug fixes.

Option B: Activation of automatic failover featuresis typically used in scenarios where there is network equipment failure or poor connection quality, but it is not directly triggered by low SNR values.

Option C: Improved channel reliabilityis the opposite of what happens when SNR is low. Low SNR leads to unreliable communication, not improved reliability.

Therefore,Option Dis correct, as a low SNR results in decreased data integrity due to possible errors in the transmission process.

On Cisco Catalyst 9800 Series WLCs running IOS XE 17.x, WLAN-specific client management parameters are configured under thewlan configuration context. To increase the number of client connections on the XYZ-Guest WLAN, the correct command iswlan XYZ-Guest 1 XYZ-Guest client association limit 50(orclient max-association 50depending on IOS XE version), which explicitly sets the maximum number of clients allowed per AP on this WLAN. To extend session durations and prevent frequent disconnections, theclient session timeoutcommand is applied under the same WLAN context with the desired timeout in seconds, e.g.,wlan XYZ-Guest 1 XYZ-Guest client session timeout 2800.

Profile-based session commands (options B and D) are part of wireless policy profiles, which define broader policy elements like QoS, radio settings, and security, butdo not directly enforce client association limits or session timeouts on the WLAN itself. Configuring these parameters at the WLAN level ensures that all APs associated with this WLAN apply the limits and timeout settings consistently. This approach aligns with Cisco best practices forClient Connectivity Configuration — WLAN client limits, session management, and IOS XE WLC optimization for guest networks.

To enable WPA2-Enterprise with RADIUS authentication on a Cisco Catalyst 9800 WLC, the WLAN configuration must specify the use of 802.1X as the authentication mechanism. The commandsecurity wpa wpa2 akm dot1xexplicitly instructs the WLAN to use WPA2 encryption with the 802.1X authentication key management (AKM), which leverages the configured RADIUS server group for client authentication. Option B (security dot1x authentication-list) and Option C (security dot1x method-list) are legacy or IOS-style commands that define AAA method lists but do not directly bind the WLAN to WPA2-Enterprise security. Option A (security wpa enable) only enables WPA but does not define the authentication mode or RADIUS integration, which is insufficient for WPA2-Enterprise deployments. Cisco Wireless design guides emphasize that for staff or enterprise-class WLANs using external RADIUS servers, the WLAN’s security profile must use WPA2 with AKM set to 802.1X. This ensures clients perform EAP authentication with the external server, supporting secure credential exchange and proper authorization. Correctly applyingsecurity wpa wpa2 akm dot1xin the WLAN configuration guarantees the WLC enforces encryption and authentication policies in line with enterprise security requirements. Reference topics:Client Connectivity Configuration — WPA2-Enterprise, 802.1X, AKM, RADIUS integration on Cisco WLCs.

Central Web Authentication is the correct design for an open guest SSID that redirects users to a captive portal before allowing network access. Cisco describes CWA as a guest-redirection method where the redirect URL and redirect ACL are centrally controlled and communicated to the WLC through RADIUS, with the external authentication system handling the login workflow. On a Catalyst 9800 WLAN, Cisco’s configuration flow for Central Web Authentication requires AAA/ACL configuration, including the AAA server list and an ACL tied to the WLAN so client access can be controlled before and after authentication.

Option D is the only answer that satisfies all requirements: captive portal redirection, post-authentication restriction to Internet-only access, and policy enforcement through ACLs. VLAN-level segmentation is implemented through the WLAN policy profile, which maps guest clients to the guest VLAN rather than the staff VLAN. WPA2-PSK is invalid because the guest SSID must not require a password. A local web server alone does not enforce Internet-only authorization or staff-network isolation. mDNS is unrelated to captive portal authentication or guest segmentation. Reference topics:Guest WLAN design, Central Web Authentication, Catalyst 9800 policy profiles, ACL enforcement, VLAN segmentation, and captive portal client onboarding.

The correct answer is D. Cisco Spaces connector deployments often require a VLAN on which the connector is reachable for management or data, and Cisco Spaces wired gateway guidance identifies the connector VLAN as the VLAN used for communication to the connector. The same guidance also supports multiple source VLANs for monitored wired devices, which aligns with the requirement for future analytics-service scalability.

A trunk port is the proper design choice because it can carry multiple VLANs over the same physical interface. Cisco Catalyst switch documentation states that an access port carries traffic for only one VLAN, while an IEEE 802.1Q trunk carries multiple VLANs and supports tagged traffic. The command switchport trunk allowed vlan 30 limits the trunk initially to VLAN 30, satisfying the current management VLAN requirement without changing the native VLAN or other default VLAN settings. Cisco also documents that an allowed VLAN list limits VLAN membership only on the associated trunk port, so it does not affect other switch ports.

Option A works only for a single untagged VLAN and is less scalable. Options B and C mix access mode with trunk-only commands and are syntactically or operationally invalid. Reference topic: Wireless Monitoring and Management — Cisco Spaces connector deployment, VLAN reachability, trunking, and analytics service scalability.

In a Cisco wireless fabric architecture, fabric edge nodes are responsible for terminating user data traffic at the network edge. These nodes act as the first point of contact for client devices, handling tasks such as encryption/decryption, VLAN tagging, Quality of Service (QoS) enforcement, and traffic forwarding to the appropriate destination within the fabric. The design centralizes control-plane functions in fabric control nodes, while edge nodes focus on data-plane operations to reduce latency and optimize network performance. Option A, authenticating TLS connections for management, is handled by management or control-plane components rather than edge nodes. Option B, enabling multicast snooping, is a network switch function but not a core responsibility of fabric edge nodes. Option D, converting Layer 2 to Layer 3 addresses, is part of routing functions and not a dedicated role of the wireless fabric edge node in client data processing. Cisco Wireless Core Technologies emphasize that by terminating user data at the edge, fabric edge nodes enable efficient traffic handling, secure processing, and scalable wireless deployment, which is critical in high-density enterprise environments. Reference topics:Wireless Network Operation — Cisco wireless fabric architecture, fabric edge node role, user data termination, data-plane operations.

The command that enables web-based client authentication on the WLAN issecurity web-auth. Cisco’s Catalyst 9800 Web-Based Authentication guide shows the WLAN configuration workflow: enter WLAN configuration mode, disable WPA security for the open Layer 2 guest WLAN, then “Enable web authentication for WLAN” usingsecurity web-auth. Cisco then applies the authentication list and parameter map withsecurity web-auth authentication-list ...andsecurity web-auth parameter-map ..., which refine the WebAuth method and portal behavior after WebAuth itself is enabled.

Cisco’s LDAP authentication example mirrors the exhibit exactly:wlan webauth 2 webauth, removal of WPA/802.1X Layer 2 security,security web-auth,security web-auth authentication-list ldapauth, andsecurity web-auth parameter-map global. Option B only creates or enters the WLAN profile with WLAN ID 2 and SSID name. Options C and D disable WPA2 and 802.1X AKM; they do not authenticate clients. Reference topics:Client Connectivity Configuration — guest WLAN authentication, WebAuth, Layer 3 security, authentication lists, parameter maps, and Catalyst 9800 WLAN security configuration.

AI Enhanced RRM is not a static-threshold tuning feature and it is not designed to simply raise AP transmit power. Cisco defines AI Enhanced RRM as a radio resource management technology that applies artificial intelligence and machine learning to optimize RF environments, uses distributed data collection from Cisco wireless controllers with cloud-based analytics, and automates adaptive RF parameter tuning for Cisco wireless networks.

The operational model is telemetry-driven. RF telemetry is collected from APs by the Catalyst 9800 WLC, sent through Cisco Catalyst Center to the Cisco AI Analytics Cloud, analyzed by RRM algorithms, and then configuration-change information is returned through Catalyst Center toward the managed wireless infrastructure. Cisco’s AI-Enhanced RRM deployment guide further identifies DCA, TPC, FRA, and DBS as examples of optimizations performed, meaning the feature enhances dynamic RF control rather than disabling it.

Therefore, option D is the only correct answer. Options A, B, and C describe either legacy/static behavior, harmful power-only logic, or a fixed RF design model that contradicts Cisco AI Enhanced RRM. Reference topics:Automation and AI — AI/ML-driven RF optimization, Catalyst Center assurance, RRM telemetry, DCA, TPC, FRA, and DBS.

The correct expression isaccessPoints[0].interfaces[1] .macAddress. The JSON object contains a top-level key namedaccessPoints, whose value is an array. Array indexing begins at zero, soaccessPoints[0]selects the first access point object,ap-west-1. Inside that object, theinterfaceskey also contains an array. Therefore,interfaces[1] selects the second interface object, which hasslot: 1,status: "down", andmacAddress: "CC:FA:00:11:22:34". The final selector,.macAddress, returns that MAC address value.

This structure is directly aligned with Cisco automation workflows, where RESTCONF and Catalyst Center APIs exchange structured data in JSON. Cisco documents that Catalyst Center REST API payloads are JSON-formatted, and its example describes JSON as key-value data separated by colons. Cisco also states that Catalyst 9800 RESTCONF uses structured XML or JSON with YANG models for programmatic device access. Option B selectsap-east-2. Option C selects the first interface onap-west-1. Option D references a non-existent second interface onap-east-2. Reference topics:Automation and AI — JSON parsing, REST APIs, Catalyst Center programmability, RESTCONF, and wireless telemetry data structures.

The correct answer isreduction of co-channel interference. AI-RRM in Cisco Catalyst Center is designed for RF optimization, not IP addressing, software scheduling, or user identity classification. Cisco describes AI-enhanced RRM as applying artificial intelligence and machine learning to optimize RF environments and automate/adapt RF parameter tuning for Cisco wireless networks. This is directly tied to operational RF outcomes such as improved channel planning, transmit power behavior, channel width decisions, and better spectrum utilization.

Co-channel interference occurs when multiple AP radios operate on the same channel within hearing range, forcing devices to share airtime and increasing contention. AI-RRM uses telemetry, analytics, and learned RF behavior to recommend or apply more optimal RF configurations. Cisco specifically states that AI-enhanced RRM optimization can produce improvements such as up to a40 percent reduction in co-channel interferenceand SNR gains for wireless clients. Cisco’s AI-RRM deployment guidance also identifies AP radio distribution and utilization analysis as critical for minimizing co-channel interference and optimizing wireless performance.

Therefore, option B is the only operational outcome aligned with AI-RRM’s purpose. Reference topic:Automation and AI — Cisco Catalyst Center AI-RRM, RF analytics, RRM automation, channel optimization, and wireless AIOps.

The correct command isreceiver ip address 198.51.100.10 57555 protocol tls-native profile spaces-profilebecause it matches the Cisco IOS XE model-driven telemetry subscription syntax used on Catalyst 9800 controllers. Cisco documents the receiver statement under telemetry ietf subscription as receiver ip address ip-address receiver-port protocol protocol profile name, and describes it as the command that configures the receiver IP address, port, protocol, and profile for telemetry notifications.

In the exhibit, the subscription already defines the telemetry feed: encode-tdl encoding, a native stream, the TDL URI for ewlc/wlan_config, the WLC source address, and an on-change update policy. What is missing is the collector destination. For Cisco Spaces or Catalyst Center-style integrations, the WLC must know where to export telemetry and which secure transport profile to use. Cisco troubleshooting examples for Catalyst 9800 telemetry use the same command structure: receiver ip address X.X.X.X 25103 protocol tls-native profile ... under the telemetry subscription.

Options A, B, and D are invalid because they reorder the CLI keywords. IOS XE telemetry configuration is parser-order sensitive: the command begins with receiver ip address, followed by the receiver port, then protocol, then profile. Reference topic:Wireless Monitoring and Management — Catalyst 9800 streaming telemetry, Cisco Spaces integration, TLS transport, and telemetry receiver configuration.