Examkin

Network Access

400 questions

All types400Multiple choice204Multiple select91Matching23Ordering82
Question 281Question →

A network engineer is configuring a newly created WLAN on a Cisco Wireless LAN Controller (WLC) using the web GUI. The engineer needs to bind this WLAN to a specific dynamic interface so that connecting wireless clients are assigned to the correct IP subnet VLAN. On which tab within the WLANs > Edit menu is the Interface/Interface Group drop-down list located?

Show answer & explanation

Answer: General

Answer

The Interface/Interface Group drop-down list is located under the General tab of the WLAN edit menu.
On a Cisco Wireless LAN Controller (WLC) GUI, the General tab under WLANs > Edit is where core operational attributes are defined. This includes the Profile Name, SSID, Status enablement, Radio Policy, and the Interface/Interface Group mapping that links the WLAN to a specific dynamic interface/VLAN.

Step-by-Step Solution

1
Navigate to WLANs menu in the Cisco WLC web GUI
Displays the list of configured WLAN IDs and Profile Names.
Allows selection of the specific WLAN requiring modification.
2
Click the target WLAN ID to access the Edit menu
Opens the WLAN Edit window displaying multiple configuration tabs (General, Security, QoS, Policy-Mapping, Advanced).
Provides access to the settings of the selected WLAN.
3
Locate the Interface/Interface Group (GNS) drop-down menu on the General tab
Maps the wireless traffic of clients connecting to this SSID to the corresponding controller dynamic interface and backend VLAN.
The General tab houses essential WLAN parameters including Profile Name, SSID, Status checkbox, and Interface association.

Key Concept

WLAN Interface Association in Cisco WLC GUI
Estimated Time:45s
Question 282Question →

An engineer has globally defined an external RADIUS server under Controller > AAA > RADIUS > Authentication on a Cisco Wireless LAN Controller (WLC). The engineer then creates a new enterprise WLAN with Layer 2 Security set to WPA2 using 802.1X authentication. However, wireless clients attempting to connect are unable to authenticate, and debug logs indicate that no authentication requests are being transmitted to the RADIUS server. Which configuration action within the WLANs > Edit menu must be performed to resolve this client authentication failure?

Show answer & explanation

Answer: Select the active RADIUS server under the AAA Servers tab of the specific WLAN configuration.

Answer

Selecting the active RADIUS server under the AAA Servers tab of the specific WLAN configuration enables the WLC to route 802.1X client authentication requests to the RADIUS server.
Global RADIUS server configuration under the Controller menu merely registers the server with the WLC. To enable client authentication for a specific WLAN using 802.1X, an administrator must navigate to WLANs > Edit > AAA Servers tab and select the desired RADIUS server from the Authentication Servers drop-down menu.

Step-by-Step Solution

1
Analyze the prerequisite global configuration versus WLAN-specific mapping on Cisco WLC GUI.
Global configuration makes the RADIUS server available, but individual WLANs must be explicitly bound to the server.
Different WLANs may require different RADIUS servers or authentication server groups.
2
Identify the specific GUI tab in the WLANs > Edit menu responsible for authentication server assignment.
The AAA Servers tab contains drop-down menus for Authentication and Accounting servers.
This tab connects the WLAN's 802.1X security configuration to the desired RADIUS server index.
3
Select the primary RADIUS server from the Authentication Servers drop-down list.
The controller now forwards EAP-Request/Response packets between wireless clients and the designated RADIUS server.
Without this mapping, the WLC has no target server configured for client 802.1X requests on that WLAN.

Key Concept

WLAN AAA Server Mapping in Cisco WLC GUI
Estimated Time:1m 30s
Question 283Question →

An engineer issues the `show etherchannel summary` command on Switch-A and observes that the logical interface `Port-channel 1` displays a status flag of `SD` (Layer 2, Down), with all member physical interfaces marked with the flag `I` (Stand-alone). Physical connectivity between the switches is up and running. Which configuration on the interconnected switches is the root cause of this operational state?

Show answer & explanation

Answer: Both switches are configured with `channel-group 1 mode passive` on their respective physical member interfaces.

Answer

Both switches are configured with LACP passive mode on their connected physical member interfaces.
Link Aggregation Control Protocol (LACP) requires at least one participating switch interface to actively initiate negotiation. When both endpoints are set to `passive` mode (`channel-group mode passive`), neither device sends LACP packets. Consequently, LACP negotiation never completes, leaving the port-channel interface down (`SD`) and placing the individual member interfaces in stand-alone (`I`) operational state.

Step-by-Step Solution

1
Analyze the reported flags in `show etherchannel summary`.
The `SD` flag indicates Layer 2 and Down status for the Port-channel, while `I` indicates that the physical member ports are operating independently (Stand-alone).
Physical interfaces fall back to stand-alone mode when LACP bundle negotiation fails to complete successfully.
2
Evaluate LACP mode interaction behavior.
LACP `passive` ports only respond to LACP packets and never initiate negotiation.
If both sides are set to `passive`, neither switch initiates LACP frame exchange, preventing EtherChannel establishment.

Key Concept

LACP Operational Modes and Negotiation Rules
Estimated Time:1m 15s
Question 284Question →

A Cisco switch operating with Rapid PVST+ receives multiple BPDUs across several redundant trunk links connecting toward the Root Bridge. To elect its single Root Port for a given VLAN instance, the switch executes a standardized four-step tie-breaking sequence to select the best path.

In what chronological sequence does the switch evaluate these criteria, starting from the first criterion evaluated (highest precedence) to the final criterion evaluated (lowest precedence)?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for electing a Root Port in Rapid PVST+ evaluates: 1) Lowest cumulative Root Path Cost, 2) Lowest Sender Bridge ID, 3) Lowest Sender Port ID, and 4) Lowest Local Port ID.
In Rapid PVST+ (and standard 802.1D/802.1w STP), a non-root switch selects its single Root Port by comparing BPDU criteria in strict order: first, the lowest cumulative Root Path Cost; second, the lowest Sender (Designated) Bridge ID; third, the lowest Sender (Designated) Port ID; and fourth, the lowest Local (Receiver) Port ID.

Step-by-Step Solution

1
Evaluate candidate path metrics toward the elected Root Bridge.
The interface receiving the BPDU with the lowest cumulative Root Path Cost is preferred.
STP path selection prioritizes optimal forwarding efficiency to the Root Bridge.
2
Compare upstream neighbor identities if path costs match.
The interface connected to the neighbor switch possessing the lowest Bridge ID (Priority + MAC address) is chosen.
Sender BID serves as the primary tie-breaker when multiple paths yield identical path costs.
3
Compare upstream neighbor port identifiers if connecting to the same neighbor switch across parallel links.
The interface receiving BPDUs from the lower Sender Port ID (Port Priority + Port Index) is selected.
The upstream switch's Designated Port ID breaks ties when path cost and neighbor BID are identical.
4
Evaluate local receiving interface identifiers as the final tie-breaker.
The local port with the lowest internal Port ID (Port Priority + Port Number) becomes the Root Port.
When all external BPDU parameters match, the local switch uses its own port numerical priority as the final determinant.

Key Concept

Rapid PVST+ Root Port Decision Sequence
Question 285Question →

When implementing Link Aggregation (LAG) between a Cisco Wireless LAN Controller and an upstream switch, specific configuration rules apply to the physical interfaces and channel grouping. Which two statements describe valid operational characteristics or configuration requirements for this LAG deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Every physical distribution port on the wireless controller is combined into one single logical interface.; The switch ports attached to the controller must be statically bundled into an EtherChannel using mode 'on'.

Answer

Enabling LAG on a Wireless LAN Controller bundles all physical distribution system ports into a single logical interface, and the connected switch ports must be statically configured in EtherChannel mode 'on'.
Enabling Link Aggregation (LAG) on a Cisco Wireless LAN Controller aggregates all physical distribution system ports into a single logical EtherChannel. Because the controller does not participate in dynamic negotiation protocols like LACP or PAgP, the corresponding switch ports must be statically configured using EtherChannel mode 'on'.

Step-by-Step Solution

1
Identify the multi-port bundling behavior on a Cisco WLC when LAG is enabled.
Recognize that enabling LAG aggregates all physical distribution system ports into a single logical interface.
Cisco WLC architecture requires all distribution ports to form one unified EtherChannel pipe rather than multiple independent links.
2
Determine the supported EtherChannel negotiation mode on the connected switch interfaces.
Confirm that switch ports must be configured manually using 'channel-group mode on'.
The controller does not send or process LACP or PAgP negotiation frames when LAG is active.

Key Concept

WLAN Infrastructure Link Aggregation (LAG) Requirements
Question 286Question →

A network engineer is configuring a routed (Layer 3) EtherChannel bundle on a Cisco switch using LACP active mode across physical interfaces GigabitEthernet 0/1 and 0/2. Place the CLI configuration commands in the correct sequential order from initial interface selection to final Layer 3 IP address assignment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct configuration sequence is: enter physical interface range mode ('interface range GigabitEthernet 0/1 - 2'), convert physical member links to Layer 3 ('no switchport'), configure LACP mode ('channel-group 1 mode active'), enter port-channel interface mode ('interface Port-channel 1'), and assign the IP address ('ip address 10.1.1.1 255.255.255.252').
To deploy a routed (Layer 3) EtherChannel using LACP, the physical interfaces must first be selected ('interface range GigabitEthernet 0/1 - 2') and explicitly converted to routed ports ('no switchport'). Next, the LACP active negotiation mode is configured ('channel-group 1 mode active'), creating the logical bundle. Finally, the administrator navigates into the port-channel interface ('interface Port-channel 1') and assigns the IP address ('ip address 10.1.1.1 255.255.255.252').

Step-by-Step Solution

1
Select physical member interfaces
Enters interface range configuration mode for GigabitEthernet 0/1 and 0/2.
Configuration changes must be applied across both physical candidate interfaces simultaneously.
2
Disable Layer 2 functionality on member interfaces
Executes 'no switchport' on member interfaces.
Member interfaces must match the Layer 3 operation requirement before joining a routed EtherChannel.
3
Configure channel-group and LACP mode
Executes 'channel-group 1 mode active'.
Binds physical interfaces to channel-group 1 and actively initiates LACP negotiation.
4
Navigate to the logical port-channel interface
Enters 'interface Port-channel 1'.
Enables logical interface parameter configuration.
5
Assign Layer 3 IPv4 address
Executes 'ip address 10.1.1.1 255.255.255.252'.
Layer 3 IP addresses are configured directly on the port-channel interface, not on the individual physical member interfaces.

Key Concept

Layer 3 EtherChannel LACP Configuration Sequence
Estimated Time:1m 30s
Question 287Question →

An administrator enables Cisco STP PortFast on edge access ports connected to end-user workstations. Which two operational benefits or behaviors result from enabling PortFast on these interfaces? (Select two.)

Select all that apply

Show answer & explanation

Answer: The interface transitions immediately to the Forwarding state upon linkup, bypassing the 802.1D Listening and Learning states.; Link state changes on the interface do not trigger Spanning Tree Protocol Topology Change Notifications (TCNs).

Answer

Enabling PortFast on edge access ports allows the interface to bypass the Listening and Learning states to reach Forwarding immediately, and prevents link state changes on that port from triggering Topology Change Notifications (TCNs).
Enabling PortFast on an edge access port allows it to immediately enter the Forwarding state upon link activation without waiting through the Listening and Learning states. Additionally, link status transitions on PortFast ports do not generate Topology Change Notifications (TCNs), keeping MAC address tables stable across the switched network.

Step-by-Step Solution

1
Analyze standard 802.1D convergence states.
Standard STP ports spend 15 seconds in Listening and 15 seconds in Learning before Forwarding, totaling a 30-second delay.
PortFast bypasses Listening and Learning for edge devices so DHCP and other initial network communications do not time out.
2
Analyze topology change notification impact.
Edge port state changes do not indicate a core topology failure.
Suppressing TCNs on PortFast ports stops switches across the LAN from reducing MAC table aging timers unnecessarily.

Key Concept

STP PortFast operational mechanics and TCN suppression
Question 288Question →

A network engineer is analyzing a Layer 2 topology operating with Cisco Rapid PVST+ for VLAN 10. Switch-1 is the Root Bridge. Switch-2 connects to Switch-1 via interface Gi0/1 and to Switch-3 via interface Gi0/2. Both links are full-duplex point-to-point connections. Currently, interface Gi0/1 on Switch-2 is the Root Port, and interface Gi0/2 on Switch-2 is selected as an Alternate port. Which two statements accurately describe the operational behavior and roles of interface Gi0/2 on Switch-2? (Select two.)

Select all that apply

Show answer & explanation

Answer: Interface Gi0/2 operates in the Discarding port state while actively receiving BPDUs and maintaining a backup path to the Root Bridge.; If interface Gi0/1 loses connectivity, interface Gi0/2 can immediately transition to the Root Port role and move directly into the Forwarding state.

Answer

Interface Gi0/2 operates in the Discarding port state while actively receiving BPDUs, and if interface Gi0/1 fails, interface Gi0/2 can immediately transition to the Root Port role and enter the Forwarding state.
In Rapid PVST+ (802.1w), an Alternate port provides a redundant path to the Root Bridge and remains in the Discarding state during normal operations. If the current Root Port fails, Rapid PVST+ allows the Alternate port to immediately assume the Root Port role and transition directly into the Forwarding state without undergoing timer-driven Listening and Learning delays.

Step-by-Step Solution

1
Identify the Rapid PVST+ role and state for interface Gi0/2 under normal conditions.
Interface Gi0/2 is an Alternate port, which in Rapid PVST+ maps to the Discarding port state while processing incoming BPDUs from Switch-3.
802.1w consolidates Disabled, Blocking, and Listening states into the single Discarding state.
2
Determine the failover behavior of an Alternate port upon loss of the active Root Port (Gi0/1).
Interface Gi0/2 immediately transitions to the Root Port role and enters the Forwarding state.
Rapid PVST+ enables instant convergence for Alternate ports without waiting for traditional 802.1D Forward Delay (Listening/Learning) timers.

Key Concept

Rapid PVST+ Port Roles (Alternate vs Backup) and Fast Transition Convergence Mechanics
Question 289Question →

A network architect is designing a wireless solution for a remote branch connected to a main campus via a WAN link. The design requires wireless client data traffic to be switched locally onto the branch switch, while control and management traffic are directed to a centralized Wireless LAN Controller (WLC). Which two statements accurately describe the behavior of the access points at the branch when operating in FlexConnect mode? (Select two.)

Select all that apply

Show answer & explanation

Answer: The access point maintains a CAPWAP control tunnel to the WLC while switching client data frames locally onto the branch network.; If the WAN link to the central controller fails, the access point enters standalone mode and continues to switch client traffic locally.

Answer

In FlexConnect mode configured for local switching, the access point maintains a CAPWAP control tunnel to the Wireless LAN Controller for management while bridging client data traffic locally onto the branch VLAN. If WAN connectivity to the controller is lost, the access point transitions to standalone mode to continue switching local traffic for existing clients.
FlexConnect mode is designed for branch office scenarios. It allows the access point to maintain a CAPWAP control tunnel to the centralized Wireless LAN Controller for management purposes while switching client data traffic locally directly onto the branch VLAN. Furthermore, if the WAN link drops and contact with the central controller is lost, FlexConnect access points transition into standalone mode, allowing them to continue switching data locally for existing clients without disruption.

Step-by-Step Solution

1
Analyze the operational requirements for remote branch access point deployment across a WAN.
The requirement calls for centralized management coupled with local data switching.
FlexConnect mode is specifically designed for branch office environments to prevent client data traffic from unnecessarily consuming WAN bandwidth.
2
Evaluate CAPWAP tunnel separation in FlexConnect local switching mode.
The CAPWAP control plane tunnel terminates at the central controller, whereas client data frames bypass the CAPWAP data tunnel and are bridged directly onto the local Ethernet switch port.
This split-MAC capability allows control functions to remain central while keeping high-volume data traffic local.
3
Determine access point resiliency during controller disconnection.
FlexConnect access points switch from connected mode to standalone mode upon losing WLC heartbeat packets.
Standalone mode ensures business continuity at branch sites by keeping local switching functional.

Key Concept

Cisco FlexConnect AP Mode Operations and Resiliency
Question 290Question →

A network administrator enables Link Aggregation (LAG) on a Cisco Wireless LAN Controller (WLC) to combine its physical distribution system ports into a single logical interface. How must the connected ports on the upstream switch be configured to establish this link aggregation successfully?

Show answer & explanation

Answer: Configured as a static EtherChannel using the command channel-group mode on without dynamic negotiation protocols.

Answer

The switch ports connected to the Wireless LAN Controller must be configured as a static EtherChannel using the channel-group mode on command.
When Link Aggregation (LAG) is enabled on a Cisco Wireless LAN Controller, all physical distribution system ports are bundled into a single logical channel that carries all VLANs as an 802.1Q trunk. Because the controller does not use dynamic negotiation protocols such as LACP or PAgP, the corresponding connected interfaces on the adjacent switch must be configured as a static EtherChannel using the `channel-group mode on` command.

Step-by-Step Solution

1
Identify WLC Link Aggregation (LAG) operational characteristics
Determine that Cisco WLC LAG bundles all physical distribution ports into a single logical interface that acts as an 802.1Q trunk.
WLC LAG does not run dynamic link aggregation negotiation protocols (LACP or PAgP).
2
Determine the matching switch port configuration requirements
Select static EtherChannel configuration (channel-group mode on) for all member switch interfaces connected to the WLC.
Because the controller does not transmit negotiation packets, the switch ports must force the EtherChannel into an operational state unconditionally.

Key Concept

WLC Link Aggregation (LAG) Switchport Configuration
Question 291Question →

A network administrator is creating a new WLAN on a Cisco Wireless LAN Controller (WLC) via the web GUI to support corporate users. The WLAN must map client traffic to the dynamic interface associated with VLAN 20 and authenticate clients using WPA2-Enterprise (802.1X) against a central external RADIUS server that has already been globally configured on the controller. Which two configuration actions must the administrator perform within the WLAN configuration tabs in the WLC GUI to successfully complete this setup? (Select two.)

Select all that apply

Show answer & explanation

Answer: Under the General tab, select the dynamic interface mapped to VLAN 20 from the Interface/Interface Group dropdown menu and check the Enabled box for Status.; Under the Security > AAA Servers tab, select the pre-configured RADIUS server from the Server 1 dropdown list in the Authentication Servers section.

Answer

The administrator must map the WLAN to the dynamic interface for VLAN 20 and enable the WLAN status under the General tab, as well as select the pre-configured RADIUS server under the Security > AAA Servers tab.
To complete WLAN client connectivity configuration for WPA2-Enterprise with VLAN tagging: 1) Under the General tab, the WLAN must be associated with the appropriate dynamic interface (VLAN 20) and the Status box must be checked to enable SSID broadcasting and association. 2) Under the Security > AAA Servers tab, the specific external RADIUS server must be bound to the WLAN so authentication traffic is forwarded correctly.

Step-by-Step Solution

1
Navigate to the WLANs tab in the WLC GUI and edit the target WLAN.
Access the multi-tab configuration interface for the specific WLAN.
WLAN settings are organized into General, Security, AAA Servers, QoS, and Advanced tabs.
2
Select the dynamic interface for VLAN 20 and check the Enabled checkbox under the General tab.
Traffic from clients associating to this WLAN is mapped to VLAN 20, and the WLAN is brought administratively online.
Without enabling Status, the WLAN remains inactive; without binding the dynamic interface, client traffic cannot reach VLAN 20.
3
Navigate to Security > AAA Servers tab and select the globally configured RADIUS server under Authentication Servers.
The WLAN is instructed to send 802.1X authentication requests to the designated external RADIUS server.
Global RADIUS definitions must be explicitly assigned to individual WLANs under the WLAN AAA Servers tab for 802.1X Enterprise security.

Key Concept

WLC GUI WLAN Client Connectivity and Security Configuration Parameters
Estimated Time:2m 0s
Question 292Question →

A network engineer is operating a remote branch office where Lightweight Access Points are deployed in FlexConnect mode with local switching and central authentication. If the WAN link connecting the branch AP to the central Wireless LAN Controller (WLC) fails, how does the AP process existing connected client data traffic and new 802.1X client authentication attempts?

Show answer & explanation

Answer: Existing client data traffic continues to be bridged locally, but new 802.1X client authentication attempts fail.

Answer

Existing client data traffic continues to be bridged locally, but new 802.1X client authentication attempts fail.
When a FlexConnect AP configured for local switching loses CAPWAP connectivity to its controlling WLC, it enters standalone mode. Existing clients using local switching continue to have their data traffic bridged directly onto the local network interface. However, because authentication is set to central authentication, the AP cannot process new 802.1X client requests without WLC access to reach the RADIUS server, causing new authentications to fail.

Step-by-Step Solution

1
Analyze the FlexConnect mode configuration parameters.
The AP is operating with local switching for data frames and central authentication for control/security operations via the WLC.
FlexConnect separates the data plane and control plane according to configured WLAN profiles.
2
Evaluate the impact of WAN link failure on existing active client sessions.
Data traffic for already authenticated clients is switched directly to the local Ethernet switch port of the AP without passing through the CAPWAP data tunnel.
Local switching allows the AP to continue forwarding client VLAN traffic locally during WLC standalone mode.
3
Evaluate the impact of WAN link failure on new 802.1X authentication requests.
New authentication requests fail because central authentication relies on the active CAPWAP control tunnel to reach the central WLC and RADIUS infrastructure.
Without active CAPWAP control connectivity or configured local backup authentication methods, the AP cannot process 802.1X EAP exchanges.

Key Concept

FlexConnect Standalone Mode Operations for Central Authentication and Local Switching
Estimated Time:2m 0s
Question 293Question →

A Cisco switch receives an Ethernet frame on a port configured as an 802.1Q trunk link. In what sequential order does the switch process this incoming frame from initial ingress parsing to its final forwarding decision?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with inspecting the ingress frame header for an 802.1Q tag, assigning the VLAN ID based on tag presence or native VLAN configuration, checking the VLAN against the allowed VLAN list, and finally forwarding or dropping the frame.
When a frame arrives on an 802.1Q trunk interface, the switch performs ingress processing in a strict order: First, it examines the Ethernet header to detect whether an 802.1Q tag (EtherType 0x8100) is present. Second, it determines the internal VLAN ID—reading the 12-bit VLAN ID for tagged frames or mapping untagged frames to the interface's configured native VLAN. Third, it checks whether that VLAN ID is included in the interface's allowed VLAN list. Fourth, if the VLAN is permitted, the switch looks up the MAC table and forwards the frame to destination ports in that VLAN; if the VLAN is disallowed, the frame is dropped.

Step-by-Step Solution

1
Parse frame header for 802.1Q tag
Determines if an 802.1Q EtherType (0x8100) and 4-byte tag exist within the frame.
The switch must identify encapsulation formatting before reading VLAN metadata.
2
Assign internal VLAN ID
Tagged frames are assigned the 12-bit VLAN ID from the tag; untagged frames are assigned to the port's native VLAN.
All ingress frames inside an 802.1Q switch must be mapped to a specific internal VLAN context.
3
Verify allowed VLAN status
The target VLAN ID is checked against the list defined by 'switchport trunk allowed vlan'.
Filtering rules must confirm that the trunk interface allows traffic for that specific VLAN.
4
Execute switching decision
The frame is switched toward matching destination interfaces or dropped if the VLAN is pruned.
The MAC address table lookup and allowed VLAN check dictate final egress behavior.

Key Concept

802.1Q Ingress Frame Processing Logic
Estimated Time:1m 30s
Question 294Question →

A network administrator is provisioning a routed Layer 3 EtherChannel bundle between a core switch and a distribution switch using the Link Aggregation Control Protocol (LACP). Which two configuration requirements or operational conditions must be met for the Layer 3 EtherChannel bundle to successfully form and forward traffic? (Select two.)

Select all that apply

Show answer & explanation

Answer: The 'no switchport' command must be executed on both the logical port-channel interface and all physical member interfaces before configuring an IP address on the port-channel.; At least one side of the connection must have its member interfaces configured in LACP 'active' mode to actively send LACP control packets.

Answer

The two correct requirements are: executing the 'no switchport' command on both the logical port-channel and physical member interfaces before assigning an IP address to the port-channel, and ensuring that at least one switch is set to LACP 'active' mode to initiate LACP negotiations.
To operationalize a Layer 3 EtherChannel, all member interfaces and the logical port-channel interface must be configured with 'no switchport' to disable Layer 2 switching before assigning an IP address to the port-channel. Additionally, LACP negotiation requires at least one end to actively transmit LACP frames by using 'active' mode.

Step-by-Step Solution

1
Verify Layer 3 port conversion requirements
Confirm that physical member ports and the port-channel interface must have switchport functionality disabled using 'no switchport'.
Layer 3 EtherChannels act as routed interfaces. The logical port-channel interface holds the IP address, and member ports must be converted to routed ports to participate.
2
Evaluate LACP negotiation mode rules
Identify valid LACP mode pairings: active-active or active-passive.
LACP active mode sends LACP frames proactively, whereas passive mode only listens and responds. If both sides are passive, no frames are sent and the EtherChannel will not form.

Key Concept

Layer 3 EtherChannel Configuration and LACP Mode Negotiation Rules
Question 295Question →

A network engineer is configuring a high-security WLAN on a Cisco Wireless LAN Controller (WLC) via the web GUI to support modern client devices using WPA3-Personal (SAE) key management. Under the WLANs > Edit > Security > Layer 2 tab, the engineer selects WPA3 Policy but leaves the Protected Management Frames (PMF) setting at 'Disabled'. When attempting to save and enable the WLAN, the WLC displays a configuration error and refuses to save the profile. Which setting change in the WLC GUI is mandatory to resolve this error?

Show answer & explanation

Answer: Set Protected Management Frames (PMF) to Required under the Security > Layer 2 tab

Answer

Set Protected Management Frames (PMF) to Required under the Security > Layer 2 tab
Under the Wi-Fi Alliance WPA3 specification, Protected Management Frames (PMF / IEEE 802.11w) are strictly mandatory. When configuring a WLAN on a Cisco Wireless LAN Controller via the web GUI (WLANs > Edit > Security > Layer 2), selecting WPA3 Policy forces the administrator to set Protected Management Frames to 'Required'. Leaving PMF set to 'Disabled' results in an immediate GUI validation failure because the controller enforces WPA3 security standard compliance.

Step-by-Step Solution

1
Identify the mandatory prerequisite for WPA3 operation on Cisco WLCs
Recognize that the Wi-Fi Alliance WPA3 specification mandates IEEE 802.11w Protected Management Frames (PMF).
PMF prevents management frame spoofing attacks such as deauthentication and disassociation attacks.
2
Locate the PMF configuration field in the WLC GUI
Navigate to WLANs > Edit > Security > Layer 2 tab where WPA+WPA2/WPA3 parameters reside.
PMF is a Layer 2 security mechanism configured on the same sub-tab as WPA3 Policy.
3
Adjust the PMF parameter to satisfy WPA3 policy validation
Change Protected Management Frames dropdown from Disabled to Required.
Selecting WPA3 Policy without enabling PMF as Required generates a WLC GUI validation error when applying changes.

Key Concept

WLC GUI Layer 2 Security and WPA3 PMF Prerequisite Configuration
Estimated Time:2m 0s
Question 296Question →

Match each Cisco Lightweight Access Point (AP) operational mode to its precise operational characteristics and traffic handling behavior within an enterprise deployment.

Click a left item, then click its matching right item

Items

Local Mode
FlexConnect Mode
Rogue Detector Mode
SE-Connect Mode

Matches

Show answer & explanation

Answer

Local Mode pairs with centralized CAPWAP encapsulation of data traffic; FlexConnect Mode pairs with local traffic switching and remote control plane communication; Rogue Detector Mode pairs with disabling radios to monitor wired trunk ARP/MAC tables for rogue correlation; SE-Connect Mode pairs with dedicating radios to raw RF spectrum data collection for external tools.
Each AP operational mode serves a distinct network role: Local mode tunnels all data to the WLC; FlexConnect mode allows local data switching at remote sites; Rogue Detector mode operates on the wired network without transmitting on wireless radios to spot rogue MACs on the switch topology; SE-Connect streams detailed raw RF spectrum diagnostics to dedicated diagnostic software.

Step-by-Step Solution

1
Analyze the operational traffic forwarding mechanics of default AP deployments.
Identify Local mode as requiring centralized CAPWAP data tunneling to the WLC.
In default Local mode, the AP does not switch data locally; all 802.11 traffic is encapsulated into CAPWAP data tunnels.
2
Examine remote branch deployment models where WAN link conservation is required.
Identify FlexConnect mode as enabling local data switching at the branch while maintaining remote WLC management.
FlexConnect segregates data switching to the local VLAN while maintaining CAPWAP control signaling with the controller.
3
Determine which AP mode specializes in wired network security cross-referencing.
Identify Rogue Detector mode as disabling radios and sniffing wired trunk port ARP traffic.
Rogue Detector APs correlate wired MAC/ARP broadcasts with rogue MAC addresses reported by active wireless APs to identify unauthorized wired connections.
4
Evaluate specialized RF troubleshooting modes.
Identify SE-Connect mode as streaming raw physical layer RF spectrum data to diagnostic software.
SE-Connect mode connects directly to Cisco Spectrum Expert for advanced non-Wi-Fi interference analysis.

Key Concept

Cisco Wireless Lightweight Access Point Modes and Traffic Forwarding Architectures
Question 297Question →

A network technician is installing a new Cisco Lightweight Access Point (LAP) that will operate in default Local mode. The access point connects directly to an access-layer Catalyst switch port and will tunnel all user traffic back to the central Wireless LAN Controller (WLC) via CAPWAP. Which switch port configuration is required to properly support this access point connection?

Show answer & explanation

Answer: An access port assigned to the dedicated VLAN used for AP management traffic.

Answer

An access port assigned to the dedicated VLAN used for AP management traffic.
When a Cisco Access Point operates in standard Local mode, all client traffic is encapsulated within CAPWAP tunnels and sent directly to the Wireless LAN Controller (WLC). The AP itself only requires an IP address on the management network to build the CAPWAP control and data tunnels. Therefore, the connected switch port should be configured as a standard access port assigned to the AP management VLAN.

Step-by-Step Solution

1
Identify the operating mode of the Cisco Lightweight Access Point.
The AP operates in Local mode.
Local mode APs encapsulate all wireless client data inside CAPWAP tunnels back to the WLC.
2
Determine the physical infrastructure switch port requirements for a Local mode AP.
The AP only sends and receives untagged management traffic to establish its CAPWAP tunnel.
Because client VLANs are not locally bridged at the access layer switch, an 802.1Q trunk is unnecessary.
3
Select the correct switch port configuration mode.
Configure the switch interface as an access port in the AP management VLAN.
This provides IP reachability for the AP to discover and join the WLC.

Key Concept

Switch port configuration requirements for Local mode lightweight AP infrastructure connections
Estimated Time:45s
Question 298Question →

An engineer is diagnosing network initialization delays for point-of-sale terminals connected to a switch. Output from the switch CLI reveals the following interface status:

Switch# show spanning-tree interface gigabitEthernet 1/0/5

Vlan Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
VLAN0020 Desg LRN 4 128.5 P2p

Which primary operational benefit is provided by enabling Cisco PortFast on this access port?

Show answer & explanation

Answer: It allows the port to immediately transition from Blocking to Forwarding, avoiding the standard delays associated with Listening and Learning states.

Answer

Enabling PortFast allows an access port connected to an end device to bypass the 802.1D Listening (15s) and Learning (15s) states, transitioning directly from Blocking to Forwarding upon link activation.
In standard 802.1D Spanning Tree Protocol, an interface transitions through Listening (15 seconds) and Learning (15 seconds) states before reaching Forwarding. The CLI output shows the port in the Learning ('LRN') state. Enabling Cisco PortFast on edge ports connected to single end-user devices allows the port to immediately enter the Forwarding state upon linkup, preventing boot and network assignment timeouts.

Step-by-Step Solution

1
Analyze the CLI output for interface status
The interface status code 'LRN' indicates the port is currently in the 802.1D STP Learning state.
Standard 802.1D STP transitions ports through Blocking (20s max age), Listening (15s forward delay), and Learning (15s forward delay) before reaching Forwarding.
2
Determine the impact of PortFast on port state transitions
PortFast immediately places access ports into the Forwarding state upon link up, bypassing Listening and Learning.
End-user devices do not create Layer 2 loops, so waiting 30 seconds for Listening and Learning causes application timeouts (such as DHCP or POS terminal boot routines).

Key Concept

STP Port States and PortFast Benefits
Estimated Time:1m 30s
Question 299Question →

A network administrator configures a dynamic interface named 'GUEST_DATA' on VLAN 30 on a Cisco Wireless LAN Controller (WLC). The administrator attempts to initiate an SSH session to the IP address assigned to the 'GUEST_DATA' interface for administrative tasks, but the connection is refused. However, SSH access to the WLC Management Interface IP address on VLAN 10 functions properly from the same administrative workstation. Which condition explains why administrative SSH access to the dynamic interface IP address is failing?

Show answer & explanation

Answer: By default, administrative management protocols like SSH are permitted only on the Management Interface and Service Port, whereas dynamic interfaces are restricted to payload traffic for wireless client VLANs.

Answer

By default, administrative management protocols like SSH are permitted only on the Management Interface and Service Port, whereas dynamic interfaces are restricted to payload traffic for wireless client VLANs.
On Cisco Wireless LAN Controllers, administrative access protocols (such as SSH, HTTPS, Telnet, and SNMP) are restricted by default to the Management Interface and the out-of-band Service Port. Dynamic interfaces are created to connect wireless client WLANs to specific wired VLANs, and by default, management traffic directed to dynamic interface IP addresses is ignored/refused for security reasons.

Step-by-Step Solution

1
Identify the functions and roles of WLC logical interfaces (Management Interface, Service Port, and Dynamic Interfaces).
The Management Interface is the primary in-band interface used for controller management and AP CAPWAP tunnels. Dynamic interfaces function like VLAN interfaces for carrying user client traffic.
Understanding interface segregation on Cisco WLCs helps determine where administrative services (SSH/HTTPS) are listening.
2
Analyze default access control rules for management protocols on Cisco WLC interfaces.
Management access over dynamic interfaces is disabled by default to prevent wireless clients on guest or data VLANs from reaching management daemons on the WLC.
Restricting management connections strictly to dedicated management paths maintains security hygiene across wireless segments.

Key Concept

WLC Management Interface Access vs Dynamic Interface Roles
Question 300Question →

A network engineer is tasked with deploying a new WPA2-Enterprise wireless network on a Cisco Wireless LAN Controller (WLC) using the web GUI. The WLAN must enforce 802.1X authentication via an external RADIUS server and support dynamic VLAN assignment using AAA override. What is the correct chronological sequence of steps to configure this WLAN on the WLC GUI from initial creation to feature enablement?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for configuring a WPA2-Enterprise WLAN with AAA Override on a Cisco WLC GUI is: 1) Create New WLAN (define Profile Name/SSID), 2) Set Interface and Enable Status under General tab, 3) Set WPA2-AES and 802.1X under Security > Layer 2 tab, 4) Select RADIUS Server under Security > AAA Servers tab, and 5) Enable Allow AAA Override under Advanced tab.
The correct procedural order follows standard Cisco WLC administration logic: First, create the WLAN instance with its Profile Name and SSID. Next, configure fundamental interface mapping and admin status on the General tab. Then, configure Layer 2 security for WPA2-Enterprise (802.1X AKM) on the Security > Layer 2 tab. Fourth, link the global RADIUS server under the Security > AAA Servers tab. Finally, navigate to the Advanced tab to enable 'Allow AAA Override' for dynamic VLAN steering.

Step-by-Step Solution

1
Initiate WLAN creation in WLC GUI
WLAN ID is allocated and initial Profile Name and SSID parameters are bound to the controller database.
You cannot configure specific WLAN sub-tabs until the WLAN instance is created via WLANs > Create New.
2
Configure General tab settings
The WLAN is associated with a distribution interface/interface group and marked administratively enabled.
Binding to an interface provides network pathing for client traffic.
3
Configure Layer 2 Security parameters
Layer 2 security policy is set to WPA2 with AES cipher and 802.1X key management.
Specifying 802.1X key management is a prerequisite for utilizing RADIUS EAP-based client authentication.
4
Bind RADIUS Server under AAA Servers tab
The WLAN targets the specific external RADIUS server for client EAP authentication transactions.
Without selecting an active RADIUS server under AAA Servers, 802.1X authentication requests will fail.
5
Enable AAA Override on Advanced tab
The controller honors RADIUS-returned VLAN attributes (IETF 64, 65, 81) to override the default WLAN interface assignment per user.
AAA Override functionality is disabled by default and resides specifically under the WLAN Advanced settings tab.

Key Concept

WLC GUI WLAN Configuration Workflow and Feature Navigation
Estimated Time:2m 30s
PreviousPage 15 / 20Next
Network Access Practice Questions — Cisco CCNA — Page 15 | Examkin