Examkin

Network Access

400 questions

All types400Multiple choice204Multiple select91Matching23Ordering82
Question 321Question →

A network administrator is creating a new WLAN on a Cisco Wireless LAN Controller (WLC) using the web GUI. The WLAN must support 802.1X authentication using a centralized RADIUS server and allow the RADIUS server to dynamically assign VLANs to clients upon successful authentication. Which TWO configuration settings must be enabled on the WLC GUI for this WLAN? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Under the Security > Layer 2 tab, select WPA2/WPA3 parameters and set Key Management to 802.1X.; Under the Advanced tab, check the Allow AAA Override checkbox.

Answer

To configure 802.1X enterprise authentication with dynamic VLAN assignment via RADIUS, the administrator must configure 802.1X under the Security > Layer 2 tab and enable 'Allow AAA Override' under the Advanced tab.
To support RADIUS-based 802.1X authentication, 802.1X Key Management must be selected under the Security > Layer 2 tab. To allow the RADIUS server to dynamically assign clients to specific VLANs based on user credentials, the 'Allow AAA Override' setting must be explicitly enabled under the Advanced tab.

Step-by-Step Solution

1
Configure Layer 2 Security for 802.1X Enterprise Authentication.
Navigating to Security > Layer 2 allows selecting WPA2/WPA3 and setting Authentication Key Management (AKM) to 802.1X.
802.1X integrates the WLC with a RADIUS server for EAP-based client authentication.
2
Enable AAA Override for Dynamic VLAN Assignment.
Navigating to the Advanced tab and selecting 'Allow AAA Override' permits the WLC to override the default WLAN interface.
Without AAA Override, VLAN assignment attributes sent by RADIUS are ignored by the controller.

Key Concept

WLC GUI WLAN Security and AAA Override Configuration
Question 322Question →

A network administrator is deploying Link Layer Discovery Protocol (LLDP) across a multi-vendor switch infrastructure. Which two statements correctly describe the default operational characteristics and CLI configuration of LLDP on Cisco Catalyst switches compared to CDP? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: LLDP is globally disabled by default on Cisco Catalyst switches and requires the global configuration command `lldp run` to be enabled.; LLDP allows granular, independent control of message transmission and reception on specific interfaces using `lldp transmit` and `lldp receive` interface commands.

Answer

LLDP is globally disabled by default on Cisco Catalyst switches requiring `lldp run`, and LLDP provides independent control over transmit and receive states per interface using `lldp transmit` and `lldp receive`.
The correct choices accurately state that LLDP is disabled globally by default on Cisco Catalyst switches (requiring `lldp run` in global configuration mode) and that LLDP supports independent interface-level transmit and receive controls (`lldp transmit` / `lldp receive`).

Step-by-Step Solution

1
Analyze global protocol state defaults
Cisco Catalyst switches ship with CDP globally enabled by default (`cdp run`), whereas LLDP is globally disabled by default and requires `lldp run` to start discovery processes.
CDP is Cisco proprietary and enabled by default, while IEEE 802.1AB LLDP must be explicitly activated globally on Cisco Catalyst platforms.
2
Evaluate interface-level control capabilities
LLDP allows separate commands for sending (`lldp transmit`) and listening (`lldp receive`), providing granular directional control that CDP (`cdp enable`) does not offer.
LLDP's standard specification allows interfaces to act as receive-only, transmit-only, or bidirectional discovery nodes.
3
Verify protocol default timers
CDP uses a 60-second advertisement interval and a 180-second holdtime. LLDP on Cisco devices uses a 30-second advertisement interval and a 120-second holdtime.
Confusing LLDP default timers with CDP default timers is a common misconception when analyzing discovery protocol operational states.

Key Concept

CDP vs LLDP Operational Differences and CLI Configuration
Question 323Question →

A network engineer attempts to configure a Cisco switch running Rapid PVST+ to serve as a primary root bridge by issuing the command `spanning-tree vlan 100 priority 8000` in global configuration mode. Which outcome will occur on the switch upon executing this command?

Show answer & explanation

Answer: The switch rejects the command because bridge priority values must be specified in increments of 4096.

Answer

The switch rejects the command because bridge priority values must be specified in increments of 4096.
In Rapid PVST+, the Bridge ID incorporates a 12-bit System ID Extension containing the VLAN ID. Consequently, only the 4 most significant bits of the 16-bit priority field are configurable by the administrator, mandating that bridge priority values must be configured in multiples of 4096 (such as 0, 4096, 8192, 12288, up to 61440). Entering a value like 8000 violates this requirement, causing the switch CLI to reject the command immediately with an error message.

Step-by-Step Solution

1
Analyze the Bridge ID structure under Rapid PVST+.
The 16-bit Bridge Priority field consists of a 4-bit Priority field and a 12-bit System ID Extension (VLAN ID).
Because only the 4 most significant bits are allocated for configurable priority, valid base values must be multiples of 212=40962^{12} = 4096.
2
Evaluate the entered CLI value of 8000.
8000 is not a multiple of 4096 (the nearest valid multiples are 4096 and 8192).
Cisco IOS enforces strict syntax validation that rejects invalid priority increments.
3
Determine the switch response.
The CLI displays an error message specifying valid increments (0, 4096, 8192, ..., 61440) and rejects the command.
Invalid inputs cannot be processed or saved into the running configuration.

Key Concept

Rapid PVST+ System ID Extension and Bridge Priority 4096 Increment Rule
Estimated Time:1m 0s
Question 324Question →

An enterprise network administration team is evaluating wireless deployment options to connect several regional offices. They are comparing a traditional Cisco Centralized Wireless Architecture using Lightweight Access Points (APs) operating in default Local mode against a Cisco Cloud-Managed Wireless Architecture (such as Cisco Meraki). Which statement correctly describes the fundamental difference in data plane traffic processing between these two architectures?

Show answer & explanation

Answer: In the cloud-managed architecture, client data traffic is switched locally at the access point onto the LAN, whereas in the centralized architecture, client data traffic is encapsulated in CAPWAP data tunnels and forwarded to a central controller.

Answer

In the cloud-managed architecture, client data traffic is switched locally at the access point onto the LAN, whereas in the centralized architecture, client data traffic is encapsulated in CAPWAP data tunnels and forwarded to a central controller.
In a Cisco Centralized deployment with APs in default Local mode, split-MAC functionality is used where all user data is encapsulated in CAPWAP tunnels and sent directly to the centralized Wireless LAN Controller (WLC). Conversely, in a Cloud-Managed architecture (such as Cisco Meraki), management is out-of-band via the cloud, but the data plane is locally switched directly by the AP onto the local switch interface.

Step-by-Step Solution

1
Analyze the data plane behavior of Cisco Centralized Wireless Architecture in default Local mode.
Local mode APs use a split-MAC architecture where all user data frames are encapsulated into CAPWAP data tunnels (using UDP port 5247) and sent to the centralized WLC for switching and policy enforcement.
Centralized control and data processing require all traffic to terminate at the physical Wireless LAN Controller.
2
Analyze the data plane behavior of Cisco Cloud-Managed Wireless Architecture.
Cloud-managed APs use out-of-band cloud management. Management/control traffic goes to the cloud dashboard, while user data traffic is bridged locally directly onto the access switch network.
Cloud management platforms do not route or process user data frames to preserve performance and bandwidth.
3
Compare the two deployment models to select the correct statement.
The statement highlighting local switching at the AP for cloud-managed deployments versus central CAPWAP tunneling to a controller for centralized Local mode deployments is correct.
This captures the primary data plane traffic flow difference between the two deployment types.

Key Concept

Data Plane Traffic Handling in Centralized vs Cloud-Managed Wireless Architectures
Question 325Question →

A network engineer receives an security alert regarding an unexpected network device connected to interface GigabitEthernet1/0/5 on a Cisco switch. To inspect the neighboring device details via Link Layer Discovery Protocol (LLDP), the engineer executes the `show lldp entry Switch-B` command and receives the following output:

Capability codes:
(R) Router, (B) Bridge, (T) Telephone, (W) WLAN Access Point, (P) Repeater

Local Intf: Gi1/0/5
Chassis id: 0026.99a1.b2c0
Port id: Gi0/1
Port Description: Uplink-to-Core
System Name: Switch-B

System Capabilities: B, R
Enabled Capabilities: B

Management Addresses:
IP: 192.168.10.50

Based on this command output, which statement accurately describes the remote neighbor device?

Show answer & explanation

Answer: The remote device is identified as Switch-B, connected via its own GigabitEthernet0/1 interface, and is currently operating with Layer 2 bridging capability enabled.

Answer

The remote device is identified as Switch-B, connected via its own GigabitEthernet0/1 interface, and is currently operating with Layer 2 bridging capability enabled.
The correct answer accurately interprets the LLDP entry output fields: 'System Name: Switch-B' identifies the neighbor hostname, 'Port id: Gi0/1' specifies the remote interface, and 'Enabled Capabilities: B' confirms the neighbor is currently functioning as a Layer 2 bridge/switch.

Step-by-Step Solution

1
Identify the local and remote interface mapping from the LLDP output.
'Local Intf: Gi1/0/5' indicates the port on the local switch executing the command, while 'Port id: Gi0/1' indicates the connected port on the remote neighbor.
LLDP outputs separate local receiving ports from remote transmitting port IDs.
2
Evaluate system capabilities versus enabled capabilities.
'System Capabilities: B, R' indicates the hardware supports Bridge and Router functions, but 'Enabled Capabilities: B' proves only Layer 2 bridging is active.
Operational status is determined strictly by enabled capabilities, not total supported capabilities.
3
Verify device identity and protocol context.
The device name is Switch-B, and the information is obtained via standard LLDP TLVs.
System Name displays the hostname configured on the remote LLDP neighbor.

Key Concept

Interpretation of LLDP neighbor entry outputs, distinguishing local vs. remote interfaces and system vs. enabled capabilities.
Question 326Question →

A network administrator is configuring Cisco Lightweight Access Points (LAPs) across various remote and campus environments to meet specific operational requirements. Match each Cisco Access Point operational mode to its primary traffic processing or monitoring behavior.

Click a left item, then click its matching right item

Items

FlexConnect Mode
Monitor Mode
Rogue Detector Mode
Sniffer Mode

Matches

Show answer & explanation

Answer

FlexConnect Mode pairs with switching data locally while tunneling control traffic; Monitor Mode pairs with dedicated WIDS and rogue detection without serving clients; Rogue Detector Mode pairs with monitoring wired ARP/MAC traffic to correlate rogue devices; Sniffer Mode pairs with capturing and forwarding raw 802.11 wireless frames to an analyzer.
Each mode corresponds directly to its specialized function: FlexConnect handles local switching with central control, Monitor mode provides dedicated wireless security/WIDS scanning, Rogue Detector analyzes wired network ARP/MAC addresses for rogue correlation, and Sniffer mode captures wireless channel packets for protocol analysis.

Step-by-Step Solution

1
Identify the data forwarding capabilities of FlexConnect Mode.
FlexConnect mode is designed for branch deployments where client data is switched locally onto the local switch VLAN while CAPWAP control packets travel to the central WLC.
This minimizes WAN bandwidth consumption while keeping centralized management intact.
2
Evaluate non-client serving monitoring modes (Monitor vs. Rogue Detector vs. Sniffer).
Monitor mode performs wireless intrusion detection (WIDS) and wireless rogue scanning. Rogue Detector mode operates on wired switchports listening for ARP/MAC traffic. Sniffer mode streams raw RF packet captures to external packet analysis tools.
Each monitoring AP mode fills a distinct role in network security auditing, troubleshooting, and network management.

Key Concept

Operational behaviors and traffic patterns of Cisco AP modes
Question 327Question →

A network technician is troubleshooting an issue where a workstation connected to interface FastEthernet 0/5 is failing to reach resources in VLAN 50. VLAN 50 already exists in the VLAN database. The technician executes `show interfaces fastEthernet 0/5 switchport` and observes the following output:

Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)

Which command set must be entered on interface FastEthernet 0/5 to force the port statically into access mode and assign it to VLAN 50?

Show answer & explanation

Answer: switchport mode access
switchport access vlan 50

Answer

The correct sequence under interface configuration mode is 'switchport mode access' followed by 'switchport access vlan 50'.
To properly configure an access port on Cisco IOS, the interface must be explicitly configured with 'switchport mode access' to turn off DTP negotiation and 'switchport access vlan 50' to assign the port to the designated broadcast domain.

Step-by-Step Solution

1
Examine the current switchport state from the show output.
Administrative Mode is dynamic auto and Access Mode VLAN is 1.
Default Cisco Catalyst interface settings leave ports ready to negotiate trunks via DTP and assigned to default VLAN 1.
2
Explicitly disable DTP negotiation for trunking by setting static access mode.
Interface command 'switchport mode access' sets Administrative Mode to static access.
Access ports connecting to end-user workstations should always be statically configured as access ports for stability and security.
3
Assign the interface to the target VLAN.
Interface command 'switchport access vlan 50' modifies Access Mode VLAN to 50.
Places untagged host traffic from FastEthernet 0/5 into broadcast domain VLAN 50.

Key Concept

Static Access Port Configuration and Access VLAN Assignment
Question 328Question →

A network administrator is setting up a wireless network for guest access on a Cisco Wireless LAN Controller (WLC). The Profile Name and SSID have already been defined. To ensure that all client traffic associated with this WLAN is assigned to VLAN 30, which action must the administrator take within the WLAN edit settings in the WLC GUI?

Show answer & explanation

Answer: Select the interface mapped to VLAN 30 from the Interface/Interface Group drop-down list on the General tab.

Answer

Select the interface mapped to VLAN 30 from the Interface/Interface Group drop-down list on the General tab.
When configuring client network access on a Cisco WLC via the GUI, binding a WLAN to a dynamic interface (which corresponds to a specific VLAN such as VLAN 30) is performed under the General tab using the Interface/Interface Group drop-down menu.

Step-by-Step Solution

1
Navigate to the WLANs menu in the WLC GUI and open the target WLAN edit page.
The WLANs > Edit screen opens showing configuration tabs.
WLAN-specific parameters are managed within the WLAN edit view.
2
Locate the General tab settings.
Access profile parameters including Profile Name, SSID, Status, and Interface/Interface Group.
The General tab contains core WLAN settings including state and interface binding.
3
Select the desired dynamic interface bound to VLAN 30 from the Interface/Interface Group drop-down list.
The WLAN is associated with the selected dynamic interface.
Binding the interface maps wireless client traffic to the appropriate Layer 2 VLAN/subnet.

Key Concept

WLAN Interface Mapping in Cisco WLC GUI
Question 329Question →

A network administrator is creating a wireless LAN for corporate clients using the Cisco Wireless LAN Controller (WLC) GUI. Which TWO actions must be completed within the WLAN edit parameters to ensure client traffic is bound to the appropriate network segment and the WLAN becomes operational for client association? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Map the WLAN to the designated client dynamic interface or interface group on the General tab.; Check the Status box on the General tab to enable the WLAN.

Answer

Mapping the WLAN to the designated dynamic interface on the General tab and checking the Status checkbox to enable the WLAN are both required steps.
When configuring a WLAN in the Cisco WLC GUI, client connectivity requires assigning the WLAN to a dynamic interface (or interface group) under the General tab so that traffic is mapped to the correct VLAN. Additionally, because new WLAN profiles are disabled by default, selecting the Status checkbox on the General tab is mandatory to broadcast the SSID and accept client associations.

Step-by-Step Solution

1
Identify interface mapping requirements in WLC GUI
Dynamic interface is configured under WLANs > Edit > General tab > Interface/Interface Group dropdown.
This binds the wireless network (SSID) to a specific Layer 2 VLAN/subnet on the wired infrastructure.
2
Identify WLAN operational status requirement
Check the Enabled box next to Status on the General tab.
Cisco WLC WLAN profiles are created in a disabled state by default and will not broadcast or accept associations until explicitly enabled.

Key Concept

WLC GUI WLAN Basic Parameters and Enablement
Question 330Question →

An enterprise network administrator is evaluating Layer 2 protocol operations after migrating the switch infrastructure to Rapid PVST+. Which two statements correctly describe Rapid PVST+ port roles and operational state behaviors?

Select all that apply

Show answer & explanation

Answer: Rapid PVST+ consolidates the legacy 802.1D Disabled, Blocking, and Listening port states into a single Discarding state.; An Alternate port receives BPDUs from neighboring switches and acts as a backup path to the Root Bridge.

Answer

Rapid PVST+ consolidates the legacy Disabled, Blocking, and Listening states into a single Discarding state, and an Alternate port acts as a backup path to the Root Bridge by receiving BPDUs from other switches.
Rapid PVST+ simplifies the standard 802.1D spanning tree model by merging the Disabled, Blocking, and Listening states into a single Discarding state. Furthermore, an Alternate port receives superior BPDUs from neighbor switches, allowing it to immediately assume the Root Port role if the active Root Port loses connectivity.

Step-by-Step Solution

1
Analyze port state changes from standard 802.1D to Rapid PVST+ (802.1w).
Identify that Rapid PVST+ simplifies port states down to Discarding, Learning, and Forwarding.
Combining Disabled, Blocking, and Listening into Discarding streamlines state evaluation.
2
Evaluate the definition and function of the Alternate port role in Rapid PVST+.
Confirm that an Alternate port offers an alternate path toward the Root Bridge when it receives BPDUs from neighboring switches.
Alternate ports provide rapid uplink failover without requiring a full re-convergence cycle.
3
Identify misconceptions regarding PortFast misconfiguration and Bridge Priority increments.
Reject the options asserting arbitrary priority integers (like 8000) and PortFast deployment on inter-switch trunks.
Bridge priorities require increments of 4096 due to the System ID Extension, and PortFast on trunks risks broadcast storms.

Key Concept

Rapid PVST+ Operational States, Port Roles, and Priority Increments
Question 331Question →

A network technician is configuring a newly created WLAN on a Cisco Wireless LAN Controller (WLC) via the web interface. To ensure wireless clients are placed onto the correct IP subnet upon association, the WLAN must be mapped to a specific dynamic interface instead of using the default management interface. Under which tab within the WLANs > Edit menu is this Interface/Interface Group mapping configured?

Show answer & explanation

Answer: General tab

Answer

The Interface/Interface Group dropdown menu for binding a WLAN to a dynamic interface is located under the General tab in the Cisco WLC GUI.
In the Cisco WLC web GUI, navigating to WLANs > Edit displays the General tab by default. This tab contains fundamental settings including the WLAN Profile Name, broadcast SSID, WLAN Status enablement, and the 'Interface/Interface Group' drop-down list which maps client traffic on that SSID to a specific dynamic interface and associated VLAN.

Step-by-Step Solution

1
Identify the required configuration task in the WLC GUI
The goal is to map a WLAN to a dynamic interface/VLAN to ensure correct client IP subnet placement.
By default, new WLANs inherit the management interface unless explicitly configured otherwise.
2
Locate the primary menu tab for core WLAN identification and interface parameters
In the Cisco WLC web GUI (WLANs > Edit), the General tab houses the Profile Name, SSID, Status enablement checkbox, and the Interface/Interface Group (Gradients) setting.
Interface binding is a core attribute of the WLAN profile configuration located under General settings.

Key Concept

Cisco WLC GUI WLAN Configuration and Interface Mapping
Estimated Time:1m 0s
Question 332Question →

A network administrator executes a command on a Cisco Catalyst switch to inspect details about a newly connected neighbor switch running Link Layer Discovery Protocol (LLDP). The command produces the following output:

text
Switch-Core# show lldp entry Switch-Access-01

Capability codes:
(R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device
(W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

-----------------------------------------------
Local Interface: Gi1/0/12
Chassis id: 0026.98a1.4b80
Port id: Gi0/1
Port Description: GigabitEthernet0/1
System Name: Switch-Access-01

System Description:
Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9-M), Version 15.0(2)SE11, RELEASE SOFTWARE (fc3)

Time remaining: 92 seconds
System Capabilities: B, R
Enabled Capabilities: B

Management Addresses:
IP: 192.168.10.5

Based on the output above, which statement accurately describes the connected neighbor device and interface topology?

Show answer & explanation

Answer: The neighbor device is connected to local port GigabitEthernet1/0/12 and is operating with Bridge capabilities enabled.

Answer

The neighbor device is connected to local port GigabitEthernet1/0/12 and is operating with Bridge capabilities enabled.
The output explicitly shows 'Local Interface: Gi1/0/12' as the local switch port and 'Enabled Capabilities: B' as the active bridging capability of the connected neighbor Switch-Access-01.

Step-by-Step Solution

1
Identify the local switch interface from the CLI output
The field 'Local Interface: Gi1/0/12' shows that the cable from the neighbor connects directly into port GigabitEthernet1/0/12 on the local switch.
LLDP output explicitly distinguishes between the local receiving interface and the remote neighbor's transmitting port ID.
2
Examine the capabilities fields for the neighbor device
'System Capabilities: B, R' indicates the device supports both Bridge and Router functions, but 'Enabled Capabilities: B' shows only Bridge capability is active.
System capabilities indicate full hardware/software support, whereas enabled capabilities reflect current operational role.
3
Verify holdtime vs transmit frequency definitions
'Time remaining: 92 seconds' is the remaining holdtime before the entry expires if no further LLDP updates arrive (default holdtime is 120 seconds, calculated as 30s retransmit x 4 holdtime multiplier).
The time remaining field counts down from the holdtime timer, not the transmission interval.

Key Concept

Interpreting LLDP Neighbor Details and Capabilities
Estimated Time:1m 15s
Question 333Question →

A network engineer is analyzing the rapid convergence mechanism of Rapid PVST+ (IEEE 802.1w) on a point-to-point link between two Cisco Catalyst switches. Place the steps of the Rapid PVST+ Proposal-Agreement handshake sequence in the correct chronological order from first event to final event.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of events in the Rapid PVST+ Proposal-Agreement handshake sequence is: 1) The upstream switch transmits a BPDU with the Proposal bit set. 2) The downstream switch selects the port as its new Root Port and blocks non-edge Designated Ports (synchronization). 3) The downstream switch sends an Agreement BPDU back to the upstream switch. 4) The upstream switch immediately transitions its Designated Port to the Forwarding state.
Rapid PVST+ (IEEE 802.1w) achieves rapid convergence on point-to-point links through an active handshake sequence between switch ports. First, the upstream switch transmits a proposal BPDU on its Designated Port. Second, the downstream switch recognizes the superior BPDU, adopts the receiving interface as its Root Port, and blocks all non-edge Designated Ports to synchronize the switch topology. Third, once synchronized, the downstream switch responds with an Agreement BPDU on its new Root Port. Finally, the upstream switch receives this agreement and immediately transitions its Designated Port to the Forwarding state without waiting for legacy forward delay timers.

Step-by-Step Solution

1
Identify the initial proposal transmission.
The upstream switch sends a BPDU with the Proposal bit set.
Rapid PVST+ uses explicit handshake messages rather than timer-based transitions on point-to-point links. The process starts when a switch sends a Proposal BPDU out of a Designated Port.
2
Determine the downstream switch state synchronization.
The downstream switch selects the port as Root Port and puts non-edge Designated Ports into Discarding.
To prevent transient Layer 2 loops while agreeing to the new topology, the downstream switch performs synchronization by isolating (discarding on) all non-edge Designated ports.
3
Identify the agreement response mechanism.
The downstream switch sends an Agreement BPDU back on its new Root Port.
Once all interfaces are verified synchronous, the downstream switch confirms loop-free readiness by transmitting an Agreement BPDU.
4
Determine the final port state transition.
The upstream switch transitions its Designated Port directly into Forwarding.
Upon receiving the Agreement BPDU, the upstream switch immediately moves its Designated Port to Forwarding without waiting for traditional 15-second Listening/Learning timers.

Key Concept

Rapid PVST+ Proposal-Agreement Handshake Convergence
Question 334Question →

A network engineer needs to capture raw 802.11 wireless frames over the air on a specific channel to troubleshoot client connectivity failures in a manufacturing warehouse. The dedicated access point used for this operation must stop serving wireless clients and send all captured 802.11 traffic directly to a remote network analyzer tool such as Wireshark. Which Cisco Access Point mode must be configured to accomplish this objective?

Show answer & explanation

Answer: Sniffer mode

Answer

Sniffer mode is the dedicated AP mode used to capture raw 802.11 frames on a specified channel and forward them to a remote packet analyzer tool like Wireshark.
Sniffer mode dedicates the access point radio to listening on a specific channel, capturing raw 802.11 frames, and encapsulation-tunneling those captured frames to a designated IP address running a network packet analyzer such as Wireshark.

Step-by-Step Solution

1
Identify the primary operational requirement in the scenario.
The AP must capture raw 802.11 over-the-air frames on a dedicated channel and forward them to a packet analyzer (Wireshark) without servicing clients.
Troubleshooting complex 802.11 Layer 2 issues requires dedicated frame-level capture capabilities.
2
Evaluate Cisco AP modes against the required capability.
Sniffer mode turns the AP into a dedicated wireless packet capture device tied to a designated channel and target analyzer IP address.
Other modes either continue to service clients (FlexConnect, Local) or perform non-streaming security monitoring functions (Monitor, Rogue Detector).

Key Concept

Cisco Lightweight AP Operational Modes and Sniffer Mode Functionality
Question 335Question →

Match each Cisco Lightweight Access Point (AP) operational mode to its correct functional behavior and network traffic handling characteristic.

Click a left item, then click its matching right item

Items

Local Mode
FlexConnect Mode
Rogue Detector Mode
SE-Connect Mode

Matches

Show answer & explanation

Answer

Local Mode maps to central CAPWAP data encapsulation; FlexConnect Mode maps to local switching and branch WAN outage resilience; Rogue Detector Mode maps to wired network MAC tracking with disabled radios; SE-Connect Mode maps to dedicated RF spectrum analysis using external tools.
Each AP mode serves a distinct operational purpose in Cisco wireless networks. Local Mode performs central switching via CAPWAP. FlexConnect Mode provides local traffic switching and WAN fault tolerance for branch environments. Rogue Detector Mode disables wireless radios and monitors wired switch tables to detect rogue devices physically connected to the network. SE-Connect Mode dedicates AP radios to collecting RF spectrum data for external analysis software.

Step-by-Step Solution

1
Evaluate Local Mode traffic handling
Local Mode uses CAPWAP data and control tunnels for all traffic back to the centralized WLC.
This is the default behavior in centralized Cisco wireless architectures.
2
Evaluate FlexConnect Mode traffic handling and resilience
FlexConnect allows local traffic switching at the branch switch port, supporting standalone operation when WLC WAN connectivity drops.
Designed specifically for remote branch offices to avoid routing local traffic across the WAN.
3
Evaluate Rogue Detector Mode functionality
Rogue Detector mode disables radios and monitors wired LAN broadcasts to match MAC addresses of rogue devices.
Focuses strictly on verifying if rogue wireless devices are connected to the physical wired infrastructure.
4
Evaluate SE-Connect Mode functionality
SE-Connect streams raw RF data to external spectrum analysis applications.
Used for dedicated spectrum troubleshooting rather than serving clients or sniffing 802.11 frames.

Key Concept

Cisco Lightweight AP Operational Modes and Traffic Encapsulation Mechanics
Question 336Question →

A network administrator needs to create a new enterprise wireless network on a Cisco Wireless LAN Controller (WLC) using the GUI. The network must use WPA2-Enterprise with 802.1X authentication via an external RADIUS server and be mapped to an existing dynamic interface. Place the configuration steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence to configure the enterprise WLAN via the Cisco WLC GUI is: 1) Create the new WLAN profile and SSID, 2) Map the WLAN to the dynamic interface on the General tab, 3) Select WPA2 and 802.1X key management on the Security > Layer 2 tab, 4) Choose the RADIUS server under the Security > AAA Servers tab, and 5) Select the Status checkbox on the General tab and click Apply.
The proper administrative workflow in the Cisco WLC GUI requires creating the WLAN profile first, mapping the Layer 2/3 dynamic interface on the General tab, configuring Layer 2 security for WPA2 802.1X authentication, defining the RADIUS authentication server under Security > AAA Servers, and finally checking the Status checkbox on the General tab and applying the settings.

Step-by-Step Solution

1
Initiate new WLAN creation.
Access the WLAN creation screen to assign the Profile Name and SSID.
Creating the basic WLAN profile creates the configuration object in the controller database.
2
Assign the dynamic interface on the General tab.
Associates wireless client connections with the specified IP subnet and VLAN.
Interface binding ensures wireless clients receive network connectivity on the appropriate subnet upon association.
3
Configure Layer 2 security policies under Security > Layer 2.
Enables WPA2-Enterprise with 802.1X Key Management.
Selecting 802.1X key management defines that client authentication relies on EAP and external AAA infrastructure.
4
Assign RADIUS server settings under Security > AAA Servers.
Links the WLAN to the active RADIUS server for identity verification.
Selecting the active RADIUS authentication server directs 802.1X authentication requests to the network access server.
5
Enable the WLAN status on the General tab and apply changes.
Activates the WLAN across connected Access Points.
Cisco WLCs leave newly created WLANs disabled by default to prevent broadcast before security and routing configurations are complete.

Key Concept

WLC GUI WLAN Configuration Sequence
Estimated Time:1m 30s
Question 337Question →

An enterprise switch, Switch-A, is connected to neighboring switches via 802.1Q802.1\text{Q} trunk links running Rapid PVST+. An administrator executes the command `spanning-tree vlan 10 priority 24576` on Switch-A, while all other switches in the network retain default STP settings. Which two statements correctly describe the Rapid PVST+ operations and port roles for VLAN 1010 on Switch-A?

Select all that apply

Show answer & explanation

Answer: Switch-A advertises a total Bridge ID priority of 2458624586 for VLAN 1010 by combining the configured priority with the System ID Extension.; All active non-edge switch ports on Switch-A participating in VLAN 1010 assume the Designated Port role in the Forwarding state.

Answer

Switch-A advertises a total Bridge ID priority of 2458624586 for VLAN 1010 by combining the configured priority with the System ID Extension, and all active non-edge switch ports on Switch-A participating in VLAN 1010 assume the Designated Port role in the Forwarding state.
Rapid PVST+ calculates the total bridge priority by adding the 12-bit System ID Extension (VLAN ID 1010) to the 4-bit configured priority value (2457624576), producing an advertised priority of 2458624586. Because default switch priority is 32768+10=3277832768 + 10 = 32778, Switch-A wins the Root Bridge election for VLAN 1010. On the Root Bridge, every active forwarding port is assigned the Designated Port role.

Step-by-Step Solution

1
Calculate the total Bridge ID priority for Switch-A in VLAN 1010.
Configured base priority (2457624576) + System ID Extension (1010) = 2458624586.
Rapid PVST+ appends the 12-bit VLAN ID (System ID Extension) to the 4-bit priority field (in steps of 40964096) to form the 16-bit Bridge Priority.
2
Determine Root Bridge election outcome for VLAN 1010.
Switch-A has the lowest Bridge ID (24586<3277824586 < 32778) and becomes the Root Bridge for VLAN 1010.
Spanning tree elects the switch with the lowest numeric Bridge ID (Priority + MAC address) as the Root Bridge.
3
Determine port roles for Switch-A as the Root Bridge.
All active interfaces on Switch-A for VLAN 1010 become Designated Ports in the Forwarding state.
The Root Bridge is the central point of the spanning tree topology; none of its ports point toward another root, so it has no Root Ports, and all its active ports serve down-tree segments as Designated Ports.

Key Concept

Rapid PVST+ Bridge Priority Calculation and Root Bridge Port Roles
Question 338Question →

A network administrator is provisioning interface GigabitEthernet0/1 on a Cisco Catalyst switch to connect a newly deployed workstation. The workstation must belong to VLAN 15. Which two configuration steps are required under the interface configuration mode to correctly establish this interface as a static access port in VLAN 15? (Select two.)

Select all that apply

Show answer & explanation

Answer: Execute the command switchport mode access to statically set the interface to access mode.; Execute the command switchport access vlan 15 to assign the interface to VLAN 15.

Answer

Configuring a static access port in Cisco IOS requires explicitly defining the interface mode using switchport mode access and specifying the VLAN membership using switchport access vlan 15 under interface configuration mode.
Configuring an end-user host connection on a Cisco switch requires establishing static access mode using 'switchport mode access' and assigning the specific VLAN membership using 'switchport access vlan 15'. Together, these two commands ensure untagged traffic from the connected host is correctly mapped into VLAN 15.

Step-by-Step Solution

1
Enter interface configuration mode for GigabitEthernet0/1.
Access the target interface CLI prompt: Switch(config-if)#
Configuration parameters for access port operation must be applied directly to the physical interface.
2
Set the administrative operational mode to access.
Run switchport mode access.
Ensures the switchport operates strictly as an access port and prevents DTP from negotiating a trunk link.
3
Assign the interface to the target VLAN.
Run switchport access vlan 15.
Places untagged host frames into broadcast domain VLAN 15.

Key Concept

Cisco IOS VLAN Access Port Configuration Syntax
Question 339Question →

An enterprise deploys a Cisco Lightweight Access Point (LAP) in FlexConnect mode at a remote branch location connected via WAN to a centralized Wireless LAN Controller (WLC). The branch WLAN is configured for local switching and local authentication. If the WAN link fails and the CAPWAP connection to the controller is disconnected, which behavior will the access point exhibit for clients on this WLAN?

Show answer & explanation

Answer: The access point operates in standalone mode, continuing to forward data traffic locally and processing new client authentication requests locally.

Answer

The access point operates in standalone mode, continuing to forward data traffic locally and processing new client authentication requests locally.
In Cisco wireless architectures, a FlexConnect AP configured for local switching and local authentication transitions into standalone mode when it loses its CAPWAP control connection to the WLC. In standalone mode, the AP continues to switch client traffic locally at the branch switch and can process new authentication requests locally without WLC intervention.

Step-by-Step Solution

1
Identify the AP operating mode and failure scenario.
The AP is in FlexConnect mode and loses its CAPWAP control tunnel to the centralized WLC due to a WAN outage.
FlexConnect mode is designed for branch deployments to handle WAN loss gracefully.
2
Evaluate the traffic switching configuration.
The WLAN is configured for local switching, meaning user data packets are bridged directly onto the local trunk/VLAN rather than encapsulated in CAPWAP to the WLC.
Local switching allows data plane forwarding to function independently of the CAPWAP data tunnel.
3
Evaluate the authentication configuration during standalone mode.
Because local authentication is configured, the FlexConnect AP acts as a local authenticator when disconnected from the controller.
Local authentication ensures both existing client sessions and new client join requests continue operating normally during a WAN link disruption.

Key Concept

Cisco FlexConnect AP Standalone Mode Operations
Question 340Question →

A network engineer is configuring a new WLAN on a Cisco Wireless LAN Controller (WLC) using the GUI to support wireless clients using WPA2-Personal authentication. Under which tab and sub-tab in the WLANs edit menu must the pre-shared key (PSK) format and secret key be configured?

Show answer & explanation

Answer: Security tab > Layer 2 sub-tab

Answer

Security tab > Layer 2 sub-tab
WPA2-Personal (PSK) is a Layer 2 security mechanism. On the Cisco WLC GUI, navigating to WLANs > Edit > Security > Layer 2 allows the administrator to select WPA+WPA2 security, check the PSK box under Auth Key Management, and specify the pre-shared key format and value.

Step-by-Step Solution

1
Navigate to the WLANs menu in the Cisco WLC GUI and click on the target WLAN ID.
The WLANs > Edit page opens with multiple configuration tabs.
Access to specific WLAN parameters requires opening the specific WLAN edit panel.
2
Select the Security tab and verify the Layer 2 sub-tab is active.
Layer 2 security protocols (such as WPA+WPA2) are accessible.
WPA2 encryption and key management operate at Layer 2 of the OSI model.
3
Enable WPA2 Policy, select PSK under Auth Key Management, and enter the pre-shared key.
The pre-shared key policy is assigned to the WLAN.
PSK key management requires entering the ASCII or Hex pre-shared key under Layer 2 security settings.

Key Concept

WLC GUI WLAN Layer 2 Security Configuration
Estimated Time:1m 0s
PreviousPage 17 / 20Next