Examkin

Network Access

400 questions

All types400Multiple choice204Multiple select91Matching23Ordering82
Question 261Question →

A network engineer needs to configure a dedicated Cisco lightweight Access Point (AP) to continuously scan all channels for wireless intrusion detection (WIDS) signatures and rogue access points without servicing client associations. Which operational AP mode should be configured on the access point?

Show answer & explanation

Answer: Monitor mode

Answer

Monitor mode
Monitor mode configures a Cisco lightweight Access Point as a dedicated security sensor. In this mode, the AP radios refrain from broadcasting SSIDs or serving client associations, and instead continuously cycle through all configured channels to detect rogue access points, intrusion attempts (WIDS), and radio frequency interference.

Step-by-Step Solution

1
Identify the primary operational requirement.
The access point must continuously scan all channels for security threats and rogue devices without serving client connections.
The requirement specifies a dedicated monitoring role.
2
Evaluate Cisco lightweight AP modes against the requirement.
Monitor mode disables client association functions and enables continuous channel scanning for WIDS and rogue detection.
Local and FlexConnect modes service client connections, whereas Sniffer mode focuses on single-channel packet capturing.

Key Concept

Cisco Lightweight AP Modes (Monitor Mode)
Question 262Question →

An enterprise network infrastructure utilizes a Cisco centralized wireless architecture. A network engineer is connecting a Lightweight Access Point (AP) operating in Local mode to an access switch and configuring the Wireless LAN Controller (WLC) Management Interface on a distribution switch trunk. Which TWO statements accurately describe the switchport configuration and interface connectivity requirements for this deployment?

Select all that apply

Show answer & explanation

Answer: The access switch port connected to the Local mode AP should be configured as an access port assigned to the AP management VLAN.; The WLC Management Interface handles in-band CAPWAP tunnel management and control traffic between the AP and WLC as well as controller GUI/CLI administrative access.

Answer

The correct statements are: (1) The access switch port connected to the Local mode AP should be configured as an access port assigned to the AP management VLAN, and (2) The WLC Management Interface handles in-band CAPWAP tunnel management and control traffic between the AP and WLC as well as controller GUI/CLI administrative access.
In a Cisco centralized deployment, Local mode APs send all control and data traffic through CAPWAP tunnels to the controller. Consequently, the access layer switchport connecting to a Local mode AP needs only to be an access port in the AP management VLAN. Additionally, the WLC Management Interface serves as the primary in-band interface, handling both CAPWAP tunnel termination from APs and administrative management traffic (GUI/CLI).

Step-by-Step Solution

1
Analyze AP deployment mode requirements (Local mode vs. FlexConnect mode).
In Cisco centralized architecture, a Local mode AP encapsulates all client wireless frames inside IP/CAPWAP tunnel packets sent to the WLC. The AP requires only a single IP address on the management network.
Since client traffic is tunneled over L3 CAPWAP, the switch port facing a Local mode AP does not need 802.1Q trunking or multi-VLAN configuration; a standard access port on the AP management VLAN is sufficient.
2
Evaluate WLC logical interface functionality (Management Interface vs. Service Port).
The WLC Management Interface is an in-band, routed logical interface that terminates CAPWAP tunnels from APs and supports HTTP/HTTPS/SSH administrative access.
Out-of-band management uses the dedicated physical Service Port, whereas the Management Interface handles both AP CAPWAP management/control and in-band management traffic.
3
Identify misconfigurations regarding VLAN trunking and native VLAN settings.
Configuring trunk ports for Local mode APs confuses Local mode with FlexConnect local switching, and mismatching native VLAN settings breaks 802.1Q trunk operation.
FlexConnect mode requires trunking for local VLAN mapping. Mismatching native VLANs generates STP/CDP errors and disrupts reachability.

Key Concept

AP and WLC Management Access Connections
Question 263Question →

An administrator is connecting a Cisco Lightweight Access Point (LAP) operating in Local mode to an enterprise access switch. The Wireless LAN Controller (WLC) hosts multiple WLANs mapped to different client VLANs, including VLAN 10 for Corporate and VLAN 20 for Guest traffic. How should the switch port directly connected to this Local mode Access Point be configured on the access switch?

Show answer & explanation

Answer: Configure the switch port as an access port assigned to the AP management VLAN, because all client traffic is encapsulated within CAPWAP and tunneled to the WLC.

Answer

The switch port connected to the AP should be configured as an access port assigned to the AP management VLAN because all client traffic is encapsulated within CAPWAP tunnels and sent directly to the WLC.
When a Cisco Access Point is configured in Local mode, all wireless user traffic is encapsulated within CAPWAP data tunnels and sent directly to the Wireless LAN Controller. The WLC handles mapping the wireless SSIDs to their respective VLANs (such as Corporate and Guest) on its own physical/dynamic interfaces connected to the core/distribution switch. Consequently, the access switch port connecting the AP needs only to belong to the AP management VLAN, which is best configured as a standard access port.

Step-by-Step Solution

1
Analyze the operational mode of the Access Point.
The Access Point operates in Local mode.
Local mode is the default Cisco AP mode where all wireless client traffic, control messages, and management traffic are encapsulated in CAPWAP tunnels between the AP and the WLC.
2
Evaluate the VLAN mapping and switching requirements for Local mode APs.
Client VLAN tags are processed inside the CAPWAP payload at the WLC, not at the AP's switch port.
Because the AP does not locally break out or switch client traffic onto the local switch, the switch port connected to the AP only needs to provide IP reachability for the AP's own management interface via CAPWAP.
3
Determine the appropriate switch port configuration.
Configure the switch port as a L2 access port in the AP management VLAN.
An access port provides standard untagged connectivity for the AP to receive an IP address and form a CAPWAP tunnel with the WLC management interface.

Key Concept

Local Mode AP switchport requirements versus FlexConnect Mode
Estimated Time:1m 15s
Question 264Question →

A network administrator issue the `show etherchannel summary` command on a Cisco Catalyst switch to inspect an operational Link Aggregation Control Protocol (LACP) link bundle. The output displays the following status:

text
Flags: D - down P - bundled in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use

Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SD) LACP Gi0/1(I) Gi0/2(I)

Which configuration issue is the primary cause of the bundle remaining inactive with member ports in an independent state?

Show answer & explanation

Answer: Both the local and neighbor switches are configured in LACP passive negotiation mode on member interfaces.

Answer

Both the local and neighbor switches are configured in LACP passive negotiation mode on member interfaces.
LACP requires at least one switch interface to be in 'active' mode to send LACP negotiation frames (PDUs). When both sides are set to 'passive' mode, neither switch initiates LACP messages. As a result, negotiation never occurs, physical interfaces remain in an independent/stand-alone (I) state, and the port-channel interface stays down (SD).

Step-by-Step Solution

1
Analyze the CLI output flags and port states.
Port-channel 1 has flags (SD), indicating it is Layer 2 and Down. Interfaces GigabitEthernet0/1 and 0/2 have flag (I), meaning they are operating as independent physical ports rather than bundled members.
LACP negotiation has failed to form a channel aggregator.
2
Evaluate LACP operational mode behaviors.
LACP 'active' mode sends LACP PDUs continuously. LACP 'passive' mode only responds to received LACP PDUs and never initiates negotiation.
If both connected switches are set to passive mode, neither switch sends initiating LACP frames, preventing negotiation entirely.
3
Determine the root cause of the independent (I) state.
Passive-to-passive LACP configuration leaves all physical interfaces in stand-alone (I) mode because zero LACP negotiation frames are exchanged.
At least one side must be set to 'active' mode for LACP negotiation to take place.

Key Concept

LACP Negotiation Modes (Active vs. Passive)
Question 265Question →

An administrator is configuring a new Wireless LAN (WLAN) using the Cisco Wireless LAN Controller (WLC) web GUI. Which two settings must be configured on the WLANs > Edit 'General' tab to enable basic client connectivity and map wireless traffic to the wired network? (Select two.)

Select all that apply

Show answer & explanation

Answer: Check the Enabled box under Status to activate the WLAN.; Select the appropriate Interface or Interface Group name from the drop-down menu.

Answer

The two required configurations on the General tab are enabling the WLAN Status checkbox and selecting the target Interface/Interface Group.
On a Cisco WLC GUI, the WLANs > Edit 'General' tab is used to establish core settings: enabling the WLAN Status checkbox makes the network active, and selecting the Interface/Interface Group ties wireless clients to the appropriate wired network interface.

Step-by-Step Solution

1
Navigate to the WLANs menu in the Cisco WLC GUI and open the General tab for the specific WLAN.
The General tab displays primary parameters including Profile Name, SSID, Status, and Interface/Interface Group.
This tab establishes fundamental WLAN administrative identity and traffic mapping.
2
Select the Enabled checkbox under Status.
The WLAN transitions to an active state across joining access points.
By default, new WLANs are created in a disabled state to prevent unexpected broadcasts before full setup.
3
Select the designated dynamic interface or interface group from the Interface/Interface Group menu.
Wireless client data frames are bridged onto the corresponding wired VLAN.
A WLAN must be tied to a controller interface to map client traffic into the underlying local network infrastructure.

Key Concept

WLC GUI WLAN General Tab Configuration
Question 266Question →

A network administrator needs to manually provision a new VLAN for guest wireless traffic (VLAN 88 named GUEST_WIFI) and configure switch port GigabitEthernet1/0/22 as a dedicated access port in this VLAN on a Cisco Catalyst switch. Place the Cisco IOS CLI commands in the correct administrative order of execution starting from global configuration mode.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with defining VLAN 88 in global configuration mode ('vlan 88'), naming the VLAN ('name GUEST_WIFI'), navigating to the target port ('interface gigabitethernet 1/0/22'), setting static access mode ('switchport mode access'), and assigning the access VLAN membership ('switchport access vlan 88').
Cisco IOS command syntax requires configuring global parameters (VLAN ID and name in VLAN subconfiguration mode) prior to entering interface subconfiguration mode to establish static access mode and assign the access VLAN membership.

Step-by-Step Solution

1
Execute 'vlan 88' in global configuration mode (Switch(config)#).
Initializes VLAN 88 in the local VLAN database and shifts prompt context to Switch(config-vlan)#.
Defining the VLAN ID is required to instantiate the subconfiguration context for setting VLAN attributes.
2
Execute 'name GUEST_WIFI' within VLAN subconfiguration mode.
Assigns the label 'GUEST_WIFI' to VLAN 88.
The 'name' command is a VLAN subconfiguration command that can only be issued under the Switch(config-vlan)# prompt.
3
Navigate to interface configuration mode via 'interface gigabitethernet 1/0/22'.
Changes prompt context to Switch(config-if)# for GigabitEthernet1/0/22.
Port configuration commands require entering the interface-specific configuration mode from global configuration mode.
4
Execute 'switchport mode access' on the interface.
Disables Dynamic Trunking Protocol (DTP) negotiation and locks the port into permanent access mode.
Explicitly enforcing access mode prevents trunk negotiation vulnerabilities before binding the port to a VLAN.
5
Execute 'switchport access vlan 88' on the interface.
Assigns untagged frames received on GigabitEthernet1/0/22 to broadcast domain VLAN 88.
Maps the physical interface to the configured broadcast domain.

Key Concept

Cisco IOS CLI prompt hierarchy for VLAN creation, naming, static access port configuration, and VLAN membership assignment
Question 267Question →

A network administrator is organizing interface roles on a standalone Cisco Wireless LAN Controller (WLC) to support enterprise network access operations. Match each WLC logical or physical interface type on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Items

Service Port
Management Interface
Virtual Interface
Dynamic Interface

Matches

Show answer & explanation

Answer

Service Port matches the out-of-band management connection; Management Interface matches in-band CAPWAP termination and administrative access; Virtual Interface matches internal web authentication and mobility services; Dynamic Interface matches WLAN-to-VLAN client data traffic mapping.
Each WLC interface fulfills a specific role in Cisco unified wireless architecture: the Service Port handles out-of-band management; the Management Interface processes in-band CAPWAP tunnels and admin access; the Virtual Interface manages internal features like WebAuth and DHCP proxying; and Dynamic Interfaces handle user data traffic segmentation on trunked VLANs.

Step-by-Step Solution

1
Identify out-of-band administration interface.
The Service Port is physical, un-routed via distribution ports, and dedicated exclusively to out-of-band management access.
Out-of-band management provides isolated administrative control during production network disruptions.
2
Identify in-band CAPWAP and administrative access interface.
The Management Interface handles CAPWAP control and data tunnels from APs alongside administrative GUI/SSH access.
This interface requires a routable IP address and default gateway within the distribution network.
3
Identify internal service and redirection logical interface.
The Virtual Interface supports web auth redirection, DHCP relay, and mobility communication using a non-routable dummy IP.
It does not route traffic directly to the physical network but manages internal controller-to-client operations.
4
Identify client payload routing interface.
Dynamic Interfaces function as logical sub-interfaces mapped to 802.1Q trunk VLANs for client wireless traffic.
They segment wireless client traffic onto corresponding wired enterprise VLANs.

Key Concept

Cisco WLC Physical and Logical Interface Functions
Question 268Question →

Match each Cisco Wireless LAN Controller (WLC) interface to its primary functional role and operational requirement.

Click a left item, then click its matching right item

Items

Service Port Interface
Management Interface
Virtual Interface
Dynamic Interface

Matches

Show answer & explanation

Answer

Service Port Interface matches with providing isolated out-of-band management access using an independent routing table; Management Interface matches with serving as the primary in-band Layer 3 interface for CAPWAP management tunnels and administration; Virtual Interface matches with supporting non-routable Layer 3 operations such as web authentication redirection and DHCP relay; Dynamic Interface matches with binding specific Wireless LANs to backend 802.1Q VLANs.
Each WLC interface has a distinct architectural purpose: the Service Port provides dedicated out-of-band administration with its own routing table; the Management Interface manages in-band CAPWAP tunnels and controller management; the Virtual Interface handles non-routable client redirection and DHCP relay; and Dynamic Interfaces map SSIDs to backend wired VLANs.

Step-by-Step Solution

1
Analyze out-of-band management requirements on Cisco WLC platforms.
Identify that the Service Port Interface provides physical out-of-band (OOB) administrative connectivity and uses a dedicated, isolated routing table separate from the data plane.
Out-of-band ports must remain reachable independently of distribution port trunking or Layer 2/Layer 3 data network status.
2
Evaluate in-band controller control plane and tunnel termination requirements.
Identify that the Management Interface is responsible for handling CAPWAP tunnel termination from Lightweight APs, mobility control messaging, and in-band HTTPS/SSH sessions.
The Management Interface resides on distribution system ports connected to the main enterprise switched network.
3
Examine internal logical client-facing helper services.
Identify the Virtual Interface as the non-routable interface handling guest web portal redirection (web auth) and wireless client DHCP relay processing.
The Virtual Interface IP address is never advertised or routed across the enterprise network infrastructure.
4
Determine how wireless user payloads are segregated across the wired infrastructure.
Identify Dynamic Interfaces as the logical mappings between WLAN SSIDs and destination 802.1Q VLAN IDs.
Dynamic interfaces act similarly to router subinterfaces to segregate user traffic into distinct Layer 2 broadcast domains.

Key Concept

Cisco WLC Logical and Physical Interface Architecture
Question 269Question →

A network engineer executes the command `spanning-tree portfast trunk` on interface GigabitEthernet0/1 of a Cisco Catalyst switch. This interface acts as an active 802.1Q trunk link connected to another switch. Which operational risk is introduced by enabling PortFast on this trunk interface?

Show answer & explanation

Answer: The interface immediately transitions to the Forwarding state upon link setup, creating a risk of transient Layer 2 loops.

Answer

The interface immediately transitions to the Forwarding state upon link setup, creating a risk of transient Layer 2 loops.
Enabling PortFast forces a switch port to bypass the 802.1D Listening and Learning states (30 seconds total default delay) and immediately enter the Forwarding state when the link becomes active. When applied to switch-to-switch interswitch connections, this behavior exposes the network to temporary bridging loops and broadcast storms during interface startup.

Step-by-Step Solution

1
Analyze the function of Cisco PortFast.
PortFast allows an interface to bypass the 802.1D STP Listening (15s) and Learning (15s) states, transitioning immediately from Blocking to Forwarding.
It is designed for edge ports connected to single end-user devices (like PCs or printers) where topology loops cannot occur.
2
Evaluate the risk of applying PortFast to switch-to-switch trunk links.
When applied to interswitch links using `spanning-tree portfast trunk`, the port skips loop-prevention delay states, creating potential transient broadcast storms/loops before STP converges.
Switch-to-switch links form topology loops that depend on STP Listening and Learning states to determine block/forward roles.

Key Concept

STP PortFast operational behavior and interswitch configuration risk
Question 270Question →

A network administrator connects a PC to a Cisco switch access port configured with standard IEEE 802.1D Spanning Tree Protocol (STP) without PortFast enabled. Place the STP port states in the correct chronological order from the moment the physical link comes up until the port actively processes end-user network traffic.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of 802.1D STP port state transitions from link initiation to active forwarding is: Blocking State, Listening State, Learning State, and Forwarding State.
Under standard IEEE 802.1D Spanning Tree Protocol, an access interface without PortFast undergoes a 30-second convergence delay through specific sequential states: Blocking state (loop prevention), Listening state (15s to exchange BPDUs and determine port roles), Learning state (15s to populate MAC tables), and finally Forwarding state (active user traffic processing).

Step-by-Step Solution

1
Identify the starting state when the physical interface transitions to up.
The port initializes in the Blocking state to prevent layer 2 loops.
Before topology calculations occur, all data frame processing and MAC learning are disabled.
2
Determine the state transition after the initial blocking evaluation.
The port moves to the Listening state for the duration of the Forward Delay timer (15 seconds).
In Listening, the switch participates in BPDUs exchange to determine spanning-tree topology roles without learning MAC addresses or forwarding frames.
3
Determine the state transition after port roles are settled.
The port enters the Learning state for a second Forward Delay interval (15 seconds).
In Learning, the port populates its MAC address table from frame headers to avoid excessive unicast flooding once forwarding begins.
4
Identify the final operational state.
The port transitions to the Forwarding state after completing both Forward Delay periods (30 seconds total convergence delay).
The port is now permitted to actively forward user data plane frames.

Key Concept

IEEE 802.1D STP Port State Transition Sequence
Estimated Time:1m 0s
Question 271Question →

A network administrator configures a WPA2-Enterprise wireless network on a Cisco Wireless LAN Controller (WLC) GUI. On the WLANs > Edit page, the administrator sets the Interface/Interface Group on the General tab to a default VLAN dynamic interface, configures RADIUS authentication under the Security > AAA Servers tab, and confirms 802.1X Key Management under the Security > Layer 2 tab. During testing, wireless clients successfully authenticate against the external RADIUS server, but all clients are assigned to the default dynamic interface specified on the General tab rather than the individual per-user VLAN IDs returned in the RADIUS server IETF attributes (Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID). Which GUI configuration change on the WLC is required to enforce the dynamic VLAN assignments supplied by the RADIUS server?

Show answer & explanation

Answer: Navigate to the Advanced tab of the WLAN edit page and enable the Allow AAA Override option.

Answer

Enable the Allow AAA Override option under the Advanced tab of the WLAN configuration page on the WLC GUI.
On a Cisco WLC, the 'Allow AAA Override' setting on the WLAN's Advanced tab must be enabled for the controller to accept client-specific attributes returned by a RADIUS server during 802.1X authentication. Without this setting checked, the WLC ignores RADIUS IETF attributes (such as Tunnel-Private-Group-ID for dynamic VLAN placement) and forces all authenticated clients onto the static interface configured on the WLAN's General tab.

Step-by-Step Solution

1
Analyze the client connectivity issue.
802.1X authentication succeeds, but RADIUS-supplied attributes (VLAN IDs) are ignored, defaulting clients to the WLAN's mapped interface.
By default, Cisco WLC ignores user-specific AAA parameters returned in RADIUS Access-Accept messages unless explicitly configured to apply them.
2
Locate the required configuration feature in the WLC GUI.
Identify that feature overrides (AAA Override) reside under WLANs > Edit > Advanced tab.
The Advanced tab controls policy override capabilities, including Allow AAA Override, Coverage Hole Detection, and Client Band Select.
3
Enable 'Allow AAA Override'.
The WLC overrides the default dynamic interface on the General tab with the RADIUS IETF attributes 64 (Tunnel-Type), 65 (Tunnel-Medium-Type), and 81 (Tunnel-Private-Group-ID).
This setting instructs the controller to dynamically place authenticated clients into their assigned VLANs based on RADIUS authorization profiles.

Key Concept

WLAN AAA Override Configuration for Dynamic RADIUS VLAN Assignment via WLC GUI
Question 272Question →

A network engineer needs to configure management connectivity for a newly deployed Cisco Wireless LAN Controller (WLC). The design requires out-of-band (OOB) administrative management access isolated from production traffic, alongside in-band CAPWAP tunnel management for access point (AP) registration. Which interface assignment and switch port configuration correctly satisfies these requirements?

Show answer & explanation

Answer: Connect the WLC Service Port to an isolated switch access port for out-of-band administrative management, and map the WLC Management Interface to an 802.1Q trunk port to handle in-band CAPWAP control and management traffic.

Answer

Connect the WLC Service Port to an isolated switch access port for out-of-band administrative management, and map the WLC Management Interface to an 802.1Q trunk port to handle in-band CAPWAP control and management traffic.
The WLC Service Port is a dedicated, out-of-band physical interface designed specifically for network administration (CLI/SSH and Web GUI access) completely separate from data plane traffic. Conversely, the WLC Management Interface handles in-band management functions, including CAPWAP control and data tunnels from lightweight APs, inter-controller communication, and in-band GUI/CLI management. Connecting the Service Port to an isolated access port and the Management Interface to an 802.1Q trunk port fulfills all segregation and trunking requirements.

Step-by-Step Solution

1
Identify out-of-band management requirements
Recognize that the WLC Service Port is a dedicated, out-of-band physical interface used solely for administrative management (HTTP/HTTPS/SSH) and operates outside the production data plane.
Out-of-band management must remain physically and logically isolated from wireless user data and access point communication traffic.
2
Identify in-band CAPWAP tunnel management requirements
Determine that the WLC Management Interface is the default permanent in-band interface used for CAPWAP tunnel termination between lightweight APs and the WLC.
APs require IP connectivity to the WLC Management Interface (or AP-Manager interface) to establish CAPWAP tunnels for control and management.
3
Evaluate required switch port configurations
Select an isolated access port configuration for the Service Port and an 802.1Q trunk link for the Management Interface to support tagged VLANs across the wireless infrastructure.
The Service Port connects to an access port on an isolated management VLAN, whereas the main WLC distribution ports connect via 802.1Q trunks to pass multiple user and management VLANs.

Key Concept

WLC Management and Service Port Interface Roles
Question 273Question →

Match each Cisco Lightweight Access Point (AP) mode to its primary operational behavior.

Click a left item, then click its matching right item

Items

FlexConnect Mode
Monitor Mode
Sniffer Mode
Rogue Detector Mode

Matches

Show answer & explanation

Answer

FlexConnect Mode matches with switching client traffic locally during WAN failure; Monitor Mode matches with serving as a dedicated WIDS and rogue detection sensor; Sniffer Mode matches with capturing raw 802.11 frames for network analysis; Rogue Detector Mode matches with listening to wired switch trunks for ARP/MAC correlation.
Each Cisco AP mode is designed for a specific operational capability. FlexConnect mode provides local data switching and WAN fault tolerance for remote offices. Monitor mode provides dedicated over-the-air WIDS and rogue scanning without serving client traffic. Sniffer mode captures wireless frames on specified channels and streams them to a packet analyzer. Rogue Detector mode connects to wired switch trunk ports to cross-reference rogue wireless MAC addresses with wired network traffic.

Step-by-Step Solution

1
Identify the role of FlexConnect Mode
FlexConnect handles local traffic switching for remote branch deployments, maintaining client connectivity during WAN connection drops.
It avoids sending branch client data traffic over CAPWAP across WAN links to a centralized controller.
2
Identify the role of Monitor Mode
Monitor mode APs do not broadcast SSIDs or connect clients; they act purely as monitoring sensors across RF channels.
This mode is dedicated to threat detection and location tracking.
3
Identify the role of Sniffer Mode
Sniffer mode captures over-the-air raw 802.11 frames on a designated channel.
The captured traffic is encapsulated and forwarded to specialized network packet analysis software like Wireshark.
4
Identify the role of Rogue Detector Mode
Rogue Detector mode checks wired broadcast ARP traffic on switch trunks to find rogue AP MACs.
It correlates rogue wireless BSSIDs reported by other APs with MAC addresses seen on the wired infrastructure.

Key Concept

Cisco Wireless Access Point Operational Modes
Question 274Question →

Two Cisco Catalyst switches, SW1 and SW2, are connected via their GigabitEthernet0/2 interfaces. SW1 is configured with `switchport mode dynamic auto` and allows VLANs 10, 20, and 30 on its trunk. SW2 is configured with `switchport mode dynamic desirable` and has its allowed VLAN list manually pruned using `switchport trunk allowed vlan 10,20`. Both switches share native VLAN 10. Which behavior occurs when a host on VLAN 30 attached to SW1 sends a broadcast frame destined across this switch interconnect?

Show answer & explanation

Answer: The trunk link negotiates successfully, but SW2 drops the VLAN 30 broadcast frame because VLAN 30 is absent from SW2's allowed VLAN list.

Answer

The trunk link negotiates successfully via DTP, but SW2 drops the VLAN 30 broadcast frame because VLAN 30 is absent from SW2's allowed VLAN list.
Dynamic Trunking Protocol (DTP) successfully forms an 802.1Q trunk link when one side is configured as 'dynamic auto' and the other as 'dynamic desirable'. However, VLAN allowed lists on trunk interfaces filter traffic independently on each switch. Because SW1 sends a tagged VLAN 30 frame and SW2 only permits VLANs 10 and 20 on its trunk interface, SW2 drops the VLAN 30 frame upon ingress.

Step-by-Step Solution

1
Analyze DTP negotiation state between SW1 and SW2.
SW1 is in dynamic auto mode and SW2 is in dynamic desirable mode. Dynamic desirable actively initiates negotiation, while dynamic auto responds to negotiation requests. This results in an operational 802.1Q trunk.
DTP mode compatibility rules dictate that auto + desirable successfully forms a trunk link.
2
Evaluate frame tagging and egress behavior on SW1 for VLAN 30.
Since VLAN 30 is not the native VLAN (which is VLAN 10), SW1 encapsulates the broadcast frame with an 802.1Q tag for VLAN 30 and forwards it out GigabitEthernet0/2.
802.1Q trunking tags all non-native VLAN traffic passing across the trunk link.
3
Evaluate ingress filtering on SW2 for the incoming tagged VLAN 30 frame.
SW2 receives the tagged VLAN 30 frame. SW2 checks its local trunk allowed VLAN list (`10,20`). Because VLAN 30 is not in SW2's allowed list, SW2 drops the frame at ingress.
Trunk allowed VLAN pruning is enforced locally by receiving switches to restrict unneeded broadcast domains.

Key Concept

802.1Q Trunking DTP Negotiation and Ingress Allowed VLAN Pruning Logic
Estimated Time:1m 15s
Question 275Question →

A network engineer connects interface GigabitEthernet0/1 on Switch-A to interface GigabitEthernet0/1 on Switch-B. Switch-A is configured with `switchport mode trunk` and `switchport trunk native vlan 50`. Switch-B retains default Cisco IOS switchport settings. Which two operational outcomes will occur on this interswitch connection? (Select two.)

Select all that apply

Show answer & explanation

Answer: Switch-B operational mode transitions to an 802.1Q trunk through Dynamic Trunking Protocol (DTP) negotiation.; CDP generates system log messages reporting a native VLAN mismatch between Switch-A and Switch-B.

Answer

The interswitch link operational outcomes are: Switch-B operational mode transitions to an 802.1Q trunk through Dynamic Trunking Protocol (DTP) negotiation, and CDP generates system log messages reporting a native VLAN mismatch between Switch-A and Switch-B.
Default Cisco Catalyst interface settings use `switchport mode dynamic auto` and native VLAN 1. When connected to a port configured with `switchport mode trunk`, DTP negotiates an operational 802.1Q trunk link. Concurrently, because Switch-A is explicitly set to native VLAN 50 while Switch-B remains on VLAN 1, CDP exchanges uncover the configuration discrepancy and issue native VLAN mismatch error logs.

Step-by-Step Solution

1
Analyze the Dynamic Trunking Protocol (DTP) operational states.
Switch-A is in static `trunk` mode (which actively sends DTP frames). Switch-B is in default `dynamic auto` mode. The combination of `trunk` and `dynamic auto` results in a negotiated 802.1Q trunk.
Ports configured as `dynamic auto` passively listen for DTP trunking requests and will agree to negotiate trunking if requested by `trunk` or `dynamic desirable` modes.
2
Analyze the Native VLAN configuration on both sides of the trunk.
Switch-A has native VLAN set to 50, whereas Switch-B retains the default native VLAN 1. This creates a native VLAN mismatch.
802.1Q trunks send untagged frames for the configured native VLAN. When native VLAN IDs differ across a link, CDP exchanges TLVs that detect the discrepancy and log native VLAN mismatch warnings.

Key Concept

802.1Q Trunk Negotiation & Native VLAN Mismatch Diagnostics
Question 276Question →

An enterprise network uses Rapid PVST+ across four switches (SW1, SW2, SW3, SW4) configured for VLAN 50. All switches operate with default STP settings except for the bridge priority values specified below:

- SW1: Bridge Priority = 2457624576, MAC = 0001.0000.00110001.0000.0011
- SW2: Bridge Priority = 3276832768, MAC = 0001.0000.00220001.0000.0022
- SW3: Bridge Priority = 3276832768, MAC = 0001.0000.00330001.0000.0033
- SW4: Bridge Priority = 3276832768, MAC = 0001.0000.00440001.0000.0044

The physical interconnections and short path costs for VLAN 50 are as follows:
- SW1 connects to SW2 via Gi1/0/1 (1 Gbps1\text{ Gbps} link, STP cost = 44) and to SW3 via Gi1/0/2 (10 Gbps10\text{ Gbps} link, STP cost = 22).
- SW2 connects to SW3 via Gi1/0/2 (10 Gbps10\text{ Gbps} link, STP cost = 22).
- SW4 connects to SW2 via Gi1/0/1 (1 Gbps1\text{ Gbps} link, STP cost = 44) and to SW3 via Gi1/0/2 (1 Gbps1\text{ Gbps} link, STP cost = 44).

After Rapid PVST+ converges, what are the port role and port state of interface Gi1/0/1 on SW4 for VLAN 50?

Show answer & explanation

Answer: Alternate port in the Discarding state

Answer

Alternate port in the Discarding state
SW1 is elected Root Bridge because it has the lowest Bridge Priority (2457624576). SW3's Root Path Cost to SW1 is 22 (via its direct 10 Gbps10\text{ Gbps} link), while SW2's Root Path Cost to SW1 is 44 (via its direct 1 Gbps1\text{ Gbps} link). When evaluating SW4, its path through SW3 yields a total cost of 66 (4+24 + 2), whereas its path through SW2 yields a total cost of 88 (4+44 + 4). SW4 chooses Gi1/0/2 as its Root Port in the Forwarding state. For the segment between SW2 and SW4, SW2 advertises a lower Root Path Cost (44) than SW4 (66), making SW2 the Designated Bridge. Consequently, SW4's interface Gi1/0/1 is non-designated and operates as an Alternate port in the Discarding state.

Step-by-Step Solution

1
Determine the Root Bridge for VLAN 50.
SW1 has the lowest Bridge Priority (2457624576) and is elected as the Root Bridge.
Bridge ID comparison evaluates Bridge Priority + System ID Extension first, then MAC address.
2
Calculate the Root Path Cost for SW2, SW3, and SW4 to SW1.
SW3 Root Path Cost = 22 (via Gi1/0/2 direct 10 Gbps10\text{ Gbps} link). SW2 Root Path Cost = 44 (via Gi1/0/1 direct 1 Gbps1\text{ Gbps} link).
SW3 uses its direct 10 Gbps10\text{ Gbps} link (cost 2). SW2 uses its direct 1 Gbps1\text{ Gbps} link (cost 4).
3
Evaluate SW4's root path options to select SW4's Root Port.
Path via SW3: SW4 Gi1/0/2 cost (44) + SW3 Root Path Cost (22) = 66. Path via SW2: SW4 Gi1/0/1 cost (44) + SW2 Root Path Cost (44) = 88. SW4 selects Gi1/0/2 as its Root Port.
Rapid PVST+ selects the port leading to the lowest cumulative Root Path Cost.
4
Determine the Designated Bridge and port roles on the SW2-SW4 link (SW4 Gi1/0/1).
SW2 advertises Root Path Cost = 44, while SW4 advertises Root Path Cost = 66. SW2 wins Designated Bridge status on the segment. SW4 Gi1/0/1 becomes an Alternate port in the Discarding state.
The switch with the lower advertised Root Path Cost becomes the Designated Bridge on a shared segment. The non-designated port on the non-root switch receives BPDUs and transitions to the Alternate role in the Discarding state.

Key Concept

Rapid PVST+ Root Port Election and Alternate Port Role Determination
Question 277Question →

A network administrator is deploying Cisco Lightweight Access Points (APs) operating in default Local mode within a centralized wireless architecture. Which two statements accurately describe the switchport configuration and CAPWAP management access requirements for these APs?

Select all that apply

Show answer & explanation

Answer: The switch port connecting the Local mode AP is typically configured as a standard Layer 2 access port assigned to the AP management VLAN.; The AP uses CAPWAP control packets to discover the controller and establish an encapsulated management and data path to the WLC Management Interface.

Answer

In a centralized wireless architecture using Local mode APs, the AP switch port should be configured as a standard Layer 2 access port assigned to the AP management VLAN. Additionally, the AP establishes CAPWAP control and data tunnels back to the WLC Management Interface.
Lightweight APs operating in default Local mode encapsulate all wireless client traffic and management communications inside CAPWAP tunnels. Because all frames leave the AP as unicast IP packets on a single management address, the switch port connecting the AP only needs to be a standard access port in the AP management VLAN. The CAPWAP control and data tunnels terminate on the WLC Management Interface.

Step-by-Step Solution

1
Identify the operation mode of the Lightweight Access Point.
The AP is in default Local mode, meaning all client traffic is backhauled over CAPWAP tunnels to the controller rather than being switched locally.
Local mode APs do not tag or bridge client VLANs directly onto the access switch.
2
Determine switchport requirements for Local mode APs.
Since all traffic is encapsulated inside CAPWAP packets on a single AP management IP address, a simple access port assigned to the AP management VLAN is appropriate.
Trunking is unnecessary for Local mode APs because client VLAN tagging happens at the controller.
3
Verify WLC interface roles for AP management access.
APs form CAPWAP tunnels to the WLC Management Interface (in-band), while the Service Port is strictly reserved for out-of-band controller management.
CAPWAP tunnels terminate on the WLC Management Interface.

Key Concept

Switchport placement and CAPWAP connectivity for Cisco Lightweight APs in Local mode
Question 278Question →

A network engineer is deploying a centralized Cisco Wireless LAN Controller (WLC) connected to an upstream Cisco Catalyst switch port configured as an 802.1Q trunk. The WLC Management Interface is assigned the IP address 192.168.10.10/24192.168.10.10/24 with VLAN ID 10. The upstream switch trunk interface has a native VLAN configured as VLAN 10. Cisco Lightweight Access Points (APs) operating in Local mode are connected to remote access switchports in VLAN 20 (192.168.20.0/24192.168.20.0/24) and successfully acquire DHCP IP addresses. However, the APs fail to establish CAPWAP tunnels with the WLC management interface. Diagnostic captures confirm that the WLC sends tagged 802.1Q frames for VLAN 10, but the switch drops them because VLAN 10 is configured as the native VLAN on the trunk interface. Which configuration change will resolve this CAPWAP management connectivity issue?

Show answer & explanation

Answer: Change the native VLAN on the switch trunk port to an unused VLAN (e.g., VLAN 999) or set the WLC Management Interface VLAN ID to 0 (untagged).

Answer

Change the native VLAN on the switch trunk port to an unused VLAN (such as VLAN 999) or configure the WLC Management Interface VLAN ID to 0 (untagged).
When a Cisco Wireless LAN Controller management interface is explicitly configured with a VLAN identifier like VLAN 10, it appends an 802.1Q tag to all egress traffic. If the connected switch trunk port has native VLAN 10 configured, the switch expects untagged traffic for VLAN 10 and drops incoming tagged frames for that native VLAN. Changing the switch trunk native VLAN to an unused VLAN ID ensures VLAN 10 frames are tagged and accepted, or changing the WLC VLAN ID to 0 instructs the controller to transmit untagged frames, resolving the CAPWAP connectivity failure.

Step-by-Step Solution

1
Analyze the encapsulation behavior of Cisco WLC management interfaces on 802.1Q trunks.
When a WLC management interface is assigned a specific VLAN ID (e.g., VLAN 10), the WLC tags all outgoing frame headers with an 802.1Q VLAN 10 tag.
The WLC expects explicit 802.1Q tagging when a non-zero VLAN ID is configured.
2
Evaluate the upstream switch trunk port native VLAN configuration conflict.
The upstream switch trunk port has VLAN 10 configured as its native VLAN. Standard switch behavior expects untagged frames for the native VLAN and drops tagged frames arriving for the configured native VLAN ID.
Matching tagged frames to the native VLAN ID creates an 802.1Q native VLAN tagging mismatch.
3
Determine the corrective configuration change.
Changing the switch trunk native VLAN to an unused VLAN ID (e.g., VLAN 999) allows VLAN 10 traffic to remain tagged end-to-end, or setting WLC Management VLAN ID to 0 forces the WLC to transmit untagged frames that match native VLAN 10.
Aligning frame encapsulation between the WLC and switch restores bi-directional Layer 3 CAPWAP reachability.

Key Concept

802.1Q Native VLAN Matching for WLC Management Interfaces
Question 279Question →

In Cisco Rapid PVST+, a switch constructs an 8-byte (64-bit) Bridge ID (BID) for each VLAN instance to participate in Root Bridge election. Arrange the three components of the Rapid PVST+ Bridge ID in order from most significant bits (leftmost) to least significant bits (rightmost).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most significant bits to least significant bits is: 4-bit Bridge Priority, 12-bit System ID Extension (VLAN ID), and 48-bit MAC Address.
The 8-byte (64-bit) Rapid PVST+ Bridge ID is ordered from most significant to least significant bits as follows: 4-bit Bridge Priority (bits 63–60), 12-bit System ID Extension representing the VLAN ID (bits 59–48), and the 48-bit switch MAC Address (bits 47–0).

Step-by-Step Solution

1
Examine the 2-byte (16-bit) Priority field structure in the Rapid PVST+ Bridge ID.
The upper 4 bits represent the configurable Bridge Priority, making them the most significant bits of the entire 64-bit Bridge ID.
This layout ensures that user-defined priority configurations take precedence over VLAN IDs and MAC addresses.
2
Identify the remaining sub-field of the 2-byte Priority field.
The lower 12 bits of the Priority field carry the System ID Extension (VLAN ID).
Carrying the VLAN ID within these 12 bits allows Rapid PVST+ to maintain unique Bridge IDs per VLAN without requiring separate MAC addresses for each instance.
3
Identify the final 6 bytes (48 bits) of the Bridge ID.
The lowest 48 bits consist of the switch's burned-in MAC address.
The MAC address serves as the final tie-breaker during Root Bridge election when Bridge Priority and VLAN ID values are equal.

Key Concept

Rapid PVST+ Bridge ID (BID) Structure and System ID Extension
Question 280Question →

An enterprise network deployment includes Lightweight Access Points (LAPs) managed by a centralized Wireless LAN Controller (WLC). During a scheduled link maintenance event, WAN connectivity between a branch office LAP and the centralized WLC is temporarily lost. The branch LAP is operating in FlexConnect mode with local switching and local authentication enabled for the employee SSID. Meanwhile, a campus LAP connected to the main network operates in default Local mode. Upon loss of the CAPWAP connection, clients connected to the FlexConnect AP continue transmitting data to local resources, whereas clients connected to the Local mode AP immediately lose network access. Which architectural requirement causes the Local mode AP to cease forwarding client data traffic when controller connectivity is lost?

Show answer & explanation

Answer: Local mode APs require an active CAPWAP data tunnel to encapsulate all client 802.11 payload into 802.3 frames at the WLC, preventing autonomous local Layer 2 frame switching at the AP level.

Answer

Local mode APs encapsulate all client traffic within CAPWAP data tunnels that terminate at the Wireless LAN Controller (WLC). When controller connectivity is lost, the CAPWAP data tunnel drops, making local switching impossible for Local mode APs.
In Cisco centralized wireless architectures, access points in default Local mode enforce central switching. All wireless client payload is encapsulated in CAPWAP data packets and forwarded over the network to terminate directly at the Wireless LAN Controller. If controller reachability is lost, the CAPWAP data tunnel drops, and because Local mode APs are not provisioned with local VLAN-to-SSID mappings, client traffic cannot be forwarded locally.

Step-by-Step Solution

1
Analyze the functional difference between Cisco LAP operational modes.
Local mode APs use Centralized Switching, sending all control and data traffic through CAPWAP tunnels to the WLC. FlexConnect APs support Local Switching, allowing traffic to bypass the CAPWAP tunnel at the branch switch interface.
Understanding data plane encapsulation is essential to evaluating behavior during controller connectivity outages.
2
Evaluate the impact of a lost CAPWAP tunnel on Local mode AP operations.
Without an reachable WLC to decapsulate CAPWAP packets and bridge client traffic onto local VLANs, a Local mode AP cannot locally switch 802.11 frames to 802.3 Ethernet frames.
Local mode APs lack the local VLAN mapping and switching configuration resident on FlexConnect APs.
3
Identify the option correctly describing CAPWAP data tunnel dependence.
The option specifying that Local mode APs require an active CAPWAP data tunnel for central frame processing and encapsulation is correct.
This directly explains why loss of WLC communication prevents Local mode APs from sustaining client data transmission.

Key Concept

Cisco Split-MAC Architecture and AP Modes (Local vs. FlexConnect)
PreviousPage 14 / 20Next