Question

Difficulty: HardWireless Principles and Architecture

An enterprise network administrator is deploying Cisco Lightweight Access Points (LAPs) across various branch offices and corporate facilities. Match each Cisco AP operational mode on the left with its correct functional description on the right.

  • Monitor ModeDedicates radios strictly to scanning RF channels for rogue detection, CleanAir spectrum analysis, and IDS telemetry while suppressing client association.
  • Sniffer ModeCaptures raw 802.11 wireless frames on a specified channel and encapsulates them in 802.3 frames to send to a designated network analyzer.
  • Rogue Detector ModeMonitors wired broadcast domain ARP frames to cross-reference MAC addresses with rogue AP lists reported by wireless scanning APs.
  • FlexConnect ModeAllows a remote branch AP to locally switch client data traffic onto the local VLAN while maintaining CAPWAP control connection to a central WLC.

Answer

Monitor Mode pairs with the description detailing dedicated RF scanning for rogues, CleanAir, and IDS without client associations. Sniffer Mode pairs with capturing raw 802.11 frames on a specified channel for forwarding to a packet analyzer. Rogue Detector Mode pairs with listening to wired ARP traffic to correlate MAC addresses against rogue lists. FlexConnect Mode pairs with local traffic switching for remote branch APs.
Each access point operational mode serves a targeted operational purpose within Cisco wireless architecture: Monitor mode focuses purely on RF scanning and security metrics without serving clients; Sniffer mode performs targeted 802.11 packet capture; Rogue Detector operates on the wired network to validate rogue device connections; and FlexConnect facilitates local switching for remote site deployment efficiency.

Step-by-Step Solution

1
Analyze non-client-serving specialized scanning modes
Identify that Monitor mode dedicates its radios to RF environment scanning, CleanAir, and security detection without accepting client connections.
Monitor mode APs do not transmit SSIDs or process client associations.
2
Differentiate packet capture functionality
Map Sniffer mode to over-the-air packet capture sent directly to an external analyzer tool.
Sniffer mode requires setting a target channel and destination IP address for packet stream monitoring.
3
Identify wired-side rogue mitigation roles
Associate Rogue Detector mode with monitoring wired ARP broadcasts.
Rogue Detector APs turn off their wireless radios and connect directly to switch trunk ports to monitor layer 2 broadcasts.
4
Evaluate branch architecture survivability mode
Match FlexConnect mode with local data switching capabilities.
FlexConnect allows client traffic to bypass the CAPWAP data tunnel across the WAN while maintaining central controller management.

Key Concept

Cisco Lightweight Access Point Operational Modes
Rate this question