Examkin

Soru

Zorluk: ZorCisco Wireless Architectures and AP Modes

A network administrator configures a Cisco Lightweight Access Point (LAP) to assist in identifying unauthorized rogue devices on the enterprise network. After updating the operational mode of the access point via the Wireless LAN Controller (WLC), the administrator observes that both the 2.4 GHz and 5 GHz radios on the access point are disabled, and no SSIDs are being broadcast. However, the device actively reports rogue device MAC address correlations back to the WLC. Which statement correctly explains the operational behavior of the access point in this scenario?

  1. The access point is operating in Rogue Detector mode, which turns off its wireless radios and uses its wired link to listen for broadcast ARP packets to match against rogue MAC lists.Cevap
  2. B
    The access point is operating in Monitor mode, which disables client association to dedicate radio channels exclusively to capturing wired ARP frames for WLC analysis.
  3. C
    The access point is operating in Sniffer mode, which disables wireless transmission and encapsulates incoming wired switch frames into a CAPWAP tunnel for remote Wireshark analysis.
  4. D
    The access point has entered FlexConnect Standalone mode due to a CAPWAP tunnel failure, causing it to shut down its transceivers until central WLC communication is restored.

Cevap

The access point is operating in Rogue Detector mode, which turns off its wireless radios and uses its wired link to listen for broadcast ARP packets to match against rogue MAC lists.
The correct answer accurately describes Rogue Detector mode. In this specialized mode, the AP's wireless radios are turned off completely. The AP uses its wired Ethernet connection (typically configured on a trunk port to see all VLANs) to listen to ARP broadcasts and match MAC addresses against the WLC's list of rogue APs and clients detected by other monitoring APs.

Adım Adım Çözüm

1
Analyze the reported operational state of the Lightweight AP.
The access point has disabled both 2.4 GHz and 5 GHz wireless radios (no SSIDs broadcast), yet it actively correlates rogue MAC addresses with the WLC.
Identifying radio status (disabled vs active) narrows down the operational AP mode.
2
Differentiate between Cisco Lightweight AP modes (Local, FlexConnect, Monitor, Sniffer, Rogue Detector).
Rogue Detector mode is the only mode where RF radios are shut off completely while the AP operates purely over its wired interface to inspect ARP broadcasts.
Monitor and Sniffer modes require active wireless radios to listen to 802.11 channels over the air.
3
Correlate wired inspection with WLC functionality.
The AP compares MAC addresses seen on wired broadcast frames against the list of rogue wireless clients reported by other APs to the WLC.
This determines if a rogue AP or rogue client connected wirelessly is also physically plugged into the enterprise wired network.

Anahtar Kavram

Cisco Lightweight Access Point Operational Modes
Bu soruyu puanla

Konular

Cisco Wireless Architectures and AP Modes

Bu konudan daha fazla soru