Examkin

Network Access

400 soru

Tüm türler400Çoktan seçmeli204Çoklu seçim91Eşleştirme23Sıralama82
Soru 281Soru →

A network engineer is configuring a newly created WLAN on a Cisco Wireless LAN Controller (WLC) using the web GUI. The engineer needs to bind this WLAN to a specific dynamic interface so that connecting wireless clients are assigned to the correct IP subnet VLAN. On which tab within the WLANs > Edit menu is the Interface/Interface Group drop-down list located?

Cevabı ve açıklamayı göster

Cevap: General

Cevap

The Interface/Interface Group drop-down list is located under the General tab of the WLAN edit menu.
On a Cisco Wireless LAN Controller (WLC) GUI, the General tab under WLANs > Edit is where core operational attributes are defined. This includes the Profile Name, SSID, Status enablement, Radio Policy, and the Interface/Interface Group mapping that links the WLAN to a specific dynamic interface/VLAN.

Adım Adım Çözüm

1
Navigate to WLANs menu in the Cisco WLC web GUI
Displays the list of configured WLAN IDs and Profile Names.
Allows selection of the specific WLAN requiring modification.
2
Click the target WLAN ID to access the Edit menu
Opens the WLAN Edit window displaying multiple configuration tabs (General, Security, QoS, Policy-Mapping, Advanced).
Provides access to the settings of the selected WLAN.
3
Locate the Interface/Interface Group (GNS) drop-down menu on the General tab
Maps the wireless traffic of clients connecting to this SSID to the corresponding controller dynamic interface and backend VLAN.
The General tab houses essential WLAN parameters including Profile Name, SSID, Status checkbox, and Interface association.

Anahtar Kavram

WLAN Interface Association in Cisco WLC GUI
Tahmini Süre:45s
Soru 282Soru →

An engineer has globally defined an external RADIUS server under Controller > AAA > RADIUS > Authentication on a Cisco Wireless LAN Controller (WLC). The engineer then creates a new enterprise WLAN with Layer 2 Security set to WPA2 using 802.1X authentication. However, wireless clients attempting to connect are unable to authenticate, and debug logs indicate that no authentication requests are being transmitted to the RADIUS server. Which configuration action within the WLANs > Edit menu must be performed to resolve this client authentication failure?

Cevabı ve açıklamayı göster

Cevap: Select the active RADIUS server under the AAA Servers tab of the specific WLAN configuration.

Cevap

Selecting the active RADIUS server under the AAA Servers tab of the specific WLAN configuration enables the WLC to route 802.1X client authentication requests to the RADIUS server.
Global RADIUS server configuration under the Controller menu merely registers the server with the WLC. To enable client authentication for a specific WLAN using 802.1X, an administrator must navigate to WLANs > Edit > AAA Servers tab and select the desired RADIUS server from the Authentication Servers drop-down menu.

Adım Adım Çözüm

1
Analyze the prerequisite global configuration versus WLAN-specific mapping on Cisco WLC GUI.
Global configuration makes the RADIUS server available, but individual WLANs must be explicitly bound to the server.
Different WLANs may require different RADIUS servers or authentication server groups.
2
Identify the specific GUI tab in the WLANs > Edit menu responsible for authentication server assignment.
The AAA Servers tab contains drop-down menus for Authentication and Accounting servers.
This tab connects the WLAN's 802.1X security configuration to the desired RADIUS server index.
3
Select the primary RADIUS server from the Authentication Servers drop-down list.
The controller now forwards EAP-Request/Response packets between wireless clients and the designated RADIUS server.
Without this mapping, the WLC has no target server configured for client 802.1X requests on that WLAN.

Anahtar Kavram

WLAN AAA Server Mapping in Cisco WLC GUI
Tahmini Süre:1m 30s
Soru 283Soru →

An engineer issues the `show etherchannel summary` command on Switch-A and observes that the logical interface `Port-channel 1` displays a status flag of `SD` (Layer 2, Down), with all member physical interfaces marked with the flag `I` (Stand-alone). Physical connectivity between the switches is up and running. Which configuration on the interconnected switches is the root cause of this operational state?

Cevabı ve açıklamayı göster

Cevap: Both switches are configured with `channel-group 1 mode passive` on their respective physical member interfaces.

Cevap

Both switches are configured with LACP passive mode on their connected physical member interfaces.
Link Aggregation Control Protocol (LACP) requires at least one participating switch interface to actively initiate negotiation. When both endpoints are set to `passive` mode (`channel-group mode passive`), neither device sends LACP packets. Consequently, LACP negotiation never completes, leaving the port-channel interface down (`SD`) and placing the individual member interfaces in stand-alone (`I`) operational state.

Adım Adım Çözüm

1
Analyze the reported flags in `show etherchannel summary`.
The `SD` flag indicates Layer 2 and Down status for the Port-channel, while `I` indicates that the physical member ports are operating independently (Stand-alone).
Physical interfaces fall back to stand-alone mode when LACP bundle negotiation fails to complete successfully.
2
Evaluate LACP mode interaction behavior.
LACP `passive` ports only respond to LACP packets and never initiate negotiation.
If both sides are set to `passive`, neither switch initiates LACP frame exchange, preventing EtherChannel establishment.

Anahtar Kavram

LACP Operational Modes and Negotiation Rules
Tahmini Süre:1m 15s
Soru 284Soru →

A Cisco switch operating with Rapid PVST+ receives multiple BPDUs across several redundant trunk links connecting toward the Root Bridge. To elect its single Root Port for a given VLAN instance, the switch executes a standardized four-step tie-breaking sequence to select the best path.

In what chronological sequence does the switch evaluate these criteria, starting from the first criterion evaluated (highest precedence) to the final criterion evaluated (lowest precedence)?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for electing a Root Port in Rapid PVST+ evaluates: 1) Lowest cumulative Root Path Cost, 2) Lowest Sender Bridge ID, 3) Lowest Sender Port ID, and 4) Lowest Local Port ID.
In Rapid PVST+ (and standard 802.1D/802.1w STP), a non-root switch selects its single Root Port by comparing BPDU criteria in strict order: first, the lowest cumulative Root Path Cost; second, the lowest Sender (Designated) Bridge ID; third, the lowest Sender (Designated) Port ID; and fourth, the lowest Local (Receiver) Port ID.

Adım Adım Çözüm

1
Evaluate candidate path metrics toward the elected Root Bridge.
The interface receiving the BPDU with the lowest cumulative Root Path Cost is preferred.
STP path selection prioritizes optimal forwarding efficiency to the Root Bridge.
2
Compare upstream neighbor identities if path costs match.
The interface connected to the neighbor switch possessing the lowest Bridge ID (Priority + MAC address) is chosen.
Sender BID serves as the primary tie-breaker when multiple paths yield identical path costs.
3
Compare upstream neighbor port identifiers if connecting to the same neighbor switch across parallel links.
The interface receiving BPDUs from the lower Sender Port ID (Port Priority + Port Index) is selected.
The upstream switch's Designated Port ID breaks ties when path cost and neighbor BID are identical.
4
Evaluate local receiving interface identifiers as the final tie-breaker.
The local port with the lowest internal Port ID (Port Priority + Port Number) becomes the Root Port.
When all external BPDU parameters match, the local switch uses its own port numerical priority as the final determinant.

Anahtar Kavram

Rapid PVST+ Root Port Decision Sequence
Soru 285Soru →

When implementing Link Aggregation (LAG) between a Cisco Wireless LAN Controller and an upstream switch, specific configuration rules apply to the physical interfaces and channel grouping. Which two statements describe valid operational characteristics or configuration requirements for this LAG deployment? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Every physical distribution port on the wireless controller is combined into one single logical interface.; The switch ports attached to the controller must be statically bundled into an EtherChannel using mode 'on'.

Cevap

Enabling LAG on a Wireless LAN Controller bundles all physical distribution system ports into a single logical interface, and the connected switch ports must be statically configured in EtherChannel mode 'on'.
Enabling Link Aggregation (LAG) on a Cisco Wireless LAN Controller aggregates all physical distribution system ports into a single logical EtherChannel. Because the controller does not participate in dynamic negotiation protocols like LACP or PAgP, the corresponding switch ports must be statically configured using EtherChannel mode 'on'.

Adım Adım Çözüm

1
Identify the multi-port bundling behavior on a Cisco WLC when LAG is enabled.
Recognize that enabling LAG aggregates all physical distribution system ports into a single logical interface.
Cisco WLC architecture requires all distribution ports to form one unified EtherChannel pipe rather than multiple independent links.
2
Determine the supported EtherChannel negotiation mode on the connected switch interfaces.
Confirm that switch ports must be configured manually using 'channel-group mode on'.
The controller does not send or process LACP or PAgP negotiation frames when LAG is active.

Anahtar Kavram

WLAN Infrastructure Link Aggregation (LAG) Requirements
Soru 286Soru →

A network engineer is configuring a routed (Layer 3) EtherChannel bundle on a Cisco switch using LACP active mode across physical interfaces GigabitEthernet 0/1 and 0/2. Place the CLI configuration commands in the correct sequential order from initial interface selection to final Layer 3 IP address assignment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct configuration sequence is: enter physical interface range mode ('interface range GigabitEthernet 0/1 - 2'), convert physical member links to Layer 3 ('no switchport'), configure LACP mode ('channel-group 1 mode active'), enter port-channel interface mode ('interface Port-channel 1'), and assign the IP address ('ip address 10.1.1.1 255.255.255.252').
To deploy a routed (Layer 3) EtherChannel using LACP, the physical interfaces must first be selected ('interface range GigabitEthernet 0/1 - 2') and explicitly converted to routed ports ('no switchport'). Next, the LACP active negotiation mode is configured ('channel-group 1 mode active'), creating the logical bundle. Finally, the administrator navigates into the port-channel interface ('interface Port-channel 1') and assigns the IP address ('ip address 10.1.1.1 255.255.255.252').

Adım Adım Çözüm

1
Select physical member interfaces
Enters interface range configuration mode for GigabitEthernet 0/1 and 0/2.
Configuration changes must be applied across both physical candidate interfaces simultaneously.
2
Disable Layer 2 functionality on member interfaces
Executes 'no switchport' on member interfaces.
Member interfaces must match the Layer 3 operation requirement before joining a routed EtherChannel.
3
Configure channel-group and LACP mode
Executes 'channel-group 1 mode active'.
Binds physical interfaces to channel-group 1 and actively initiates LACP negotiation.
4
Navigate to the logical port-channel interface
Enters 'interface Port-channel 1'.
Enables logical interface parameter configuration.
5
Assign Layer 3 IPv4 address
Executes 'ip address 10.1.1.1 255.255.255.252'.
Layer 3 IP addresses are configured directly on the port-channel interface, not on the individual physical member interfaces.

Anahtar Kavram

Layer 3 EtherChannel LACP Configuration Sequence
Tahmini Süre:1m 30s
Soru 287Soru →

An administrator enables Cisco STP PortFast on edge access ports connected to end-user workstations. Which two operational benefits or behaviors result from enabling PortFast on these interfaces? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The interface transitions immediately to the Forwarding state upon linkup, bypassing the 802.1D Listening and Learning states.; Link state changes on the interface do not trigger Spanning Tree Protocol Topology Change Notifications (TCNs).

Cevap

Enabling PortFast on edge access ports allows the interface to bypass the Listening and Learning states to reach Forwarding immediately, and prevents link state changes on that port from triggering Topology Change Notifications (TCNs).
Enabling PortFast on an edge access port allows it to immediately enter the Forwarding state upon link activation without waiting through the Listening and Learning states. Additionally, link status transitions on PortFast ports do not generate Topology Change Notifications (TCNs), keeping MAC address tables stable across the switched network.

Adım Adım Çözüm

1
Analyze standard 802.1D convergence states.
Standard STP ports spend 15 seconds in Listening and 15 seconds in Learning before Forwarding, totaling a 30-second delay.
PortFast bypasses Listening and Learning for edge devices so DHCP and other initial network communications do not time out.
2
Analyze topology change notification impact.
Edge port state changes do not indicate a core topology failure.
Suppressing TCNs on PortFast ports stops switches across the LAN from reducing MAC table aging timers unnecessarily.

Anahtar Kavram

STP PortFast operational mechanics and TCN suppression
Soru 288Soru →

A network engineer is analyzing a Layer 2 topology operating with Cisco Rapid PVST+ for VLAN 10. Switch-1 is the Root Bridge. Switch-2 connects to Switch-1 via interface Gi0/1 and to Switch-3 via interface Gi0/2. Both links are full-duplex point-to-point connections. Currently, interface Gi0/1 on Switch-2 is the Root Port, and interface Gi0/2 on Switch-2 is selected as an Alternate port. Which two statements accurately describe the operational behavior and roles of interface Gi0/2 on Switch-2? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Interface Gi0/2 operates in the Discarding port state while actively receiving BPDUs and maintaining a backup path to the Root Bridge.; If interface Gi0/1 loses connectivity, interface Gi0/2 can immediately transition to the Root Port role and move directly into the Forwarding state.

Cevap

Interface Gi0/2 operates in the Discarding port state while actively receiving BPDUs, and if interface Gi0/1 fails, interface Gi0/2 can immediately transition to the Root Port role and enter the Forwarding state.
In Rapid PVST+ (802.1w), an Alternate port provides a redundant path to the Root Bridge and remains in the Discarding state during normal operations. If the current Root Port fails, Rapid PVST+ allows the Alternate port to immediately assume the Root Port role and transition directly into the Forwarding state without undergoing timer-driven Listening and Learning delays.

Adım Adım Çözüm

1
Identify the Rapid PVST+ role and state for interface Gi0/2 under normal conditions.
Interface Gi0/2 is an Alternate port, which in Rapid PVST+ maps to the Discarding port state while processing incoming BPDUs from Switch-3.
802.1w consolidates Disabled, Blocking, and Listening states into the single Discarding state.
2
Determine the failover behavior of an Alternate port upon loss of the active Root Port (Gi0/1).
Interface Gi0/2 immediately transitions to the Root Port role and enters the Forwarding state.
Rapid PVST+ enables instant convergence for Alternate ports without waiting for traditional 802.1D Forward Delay (Listening/Learning) timers.

Anahtar Kavram

Rapid PVST+ Port Roles (Alternate vs Backup) and Fast Transition Convergence Mechanics
Soru 289Soru →

A network architect is designing a wireless solution for a remote branch connected to a main campus via a WAN link. The design requires wireless client data traffic to be switched locally onto the branch switch, while control and management traffic are directed to a centralized Wireless LAN Controller (WLC). Which two statements accurately describe the behavior of the access points at the branch when operating in FlexConnect mode? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The access point maintains a CAPWAP control tunnel to the WLC while switching client data frames locally onto the branch network.; If the WAN link to the central controller fails, the access point enters standalone mode and continues to switch client traffic locally.

Cevap

In FlexConnect mode configured for local switching, the access point maintains a CAPWAP control tunnel to the Wireless LAN Controller for management while bridging client data traffic locally onto the branch VLAN. If WAN connectivity to the controller is lost, the access point transitions to standalone mode to continue switching local traffic for existing clients.
FlexConnect mode is designed for branch office scenarios. It allows the access point to maintain a CAPWAP control tunnel to the centralized Wireless LAN Controller for management purposes while switching client data traffic locally directly onto the branch VLAN. Furthermore, if the WAN link drops and contact with the central controller is lost, FlexConnect access points transition into standalone mode, allowing them to continue switching data locally for existing clients without disruption.

Adım Adım Çözüm

1
Analyze the operational requirements for remote branch access point deployment across a WAN.
The requirement calls for centralized management coupled with local data switching.
FlexConnect mode is specifically designed for branch office environments to prevent client data traffic from unnecessarily consuming WAN bandwidth.
2
Evaluate CAPWAP tunnel separation in FlexConnect local switching mode.
The CAPWAP control plane tunnel terminates at the central controller, whereas client data frames bypass the CAPWAP data tunnel and are bridged directly onto the local Ethernet switch port.
This split-MAC capability allows control functions to remain central while keeping high-volume data traffic local.
3
Determine access point resiliency during controller disconnection.
FlexConnect access points switch from connected mode to standalone mode upon losing WLC heartbeat packets.
Standalone mode ensures business continuity at branch sites by keeping local switching functional.

Anahtar Kavram

Cisco FlexConnect AP Mode Operations and Resiliency
Soru 290Soru →

A network administrator enables Link Aggregation (LAG) on a Cisco Wireless LAN Controller (WLC) to combine its physical distribution system ports into a single logical interface. How must the connected ports on the upstream switch be configured to establish this link aggregation successfully?

Cevabı ve açıklamayı göster

Cevap: Configured as a static EtherChannel using the command channel-group mode on without dynamic negotiation protocols.

Cevap

The switch ports connected to the Wireless LAN Controller must be configured as a static EtherChannel using the channel-group mode on command.
When Link Aggregation (LAG) is enabled on a Cisco Wireless LAN Controller, all physical distribution system ports are bundled into a single logical channel that carries all VLANs as an 802.1Q trunk. Because the controller does not use dynamic negotiation protocols such as LACP or PAgP, the corresponding connected interfaces on the adjacent switch must be configured as a static EtherChannel using the `channel-group mode on` command.

Adım Adım Çözüm

1
Identify WLC Link Aggregation (LAG) operational characteristics
Determine that Cisco WLC LAG bundles all physical distribution ports into a single logical interface that acts as an 802.1Q trunk.
WLC LAG does not run dynamic link aggregation negotiation protocols (LACP or PAgP).
2
Determine the matching switch port configuration requirements
Select static EtherChannel configuration (channel-group mode on) for all member switch interfaces connected to the WLC.
Because the controller does not transmit negotiation packets, the switch ports must force the EtherChannel into an operational state unconditionally.

Anahtar Kavram

WLC Link Aggregation (LAG) Switchport Configuration
Soru 291Soru →

A network administrator is creating a new WLAN on a Cisco Wireless LAN Controller (WLC) via the web GUI to support corporate users. The WLAN must map client traffic to the dynamic interface associated with VLAN 20 and authenticate clients using WPA2-Enterprise (802.1X) against a central external RADIUS server that has already been globally configured on the controller. Which two configuration actions must the administrator perform within the WLAN configuration tabs in the WLC GUI to successfully complete this setup? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Under the General tab, select the dynamic interface mapped to VLAN 20 from the Interface/Interface Group dropdown menu and check the Enabled box for Status.; Under the Security > AAA Servers tab, select the pre-configured RADIUS server from the Server 1 dropdown list in the Authentication Servers section.

Cevap

The administrator must map the WLAN to the dynamic interface for VLAN 20 and enable the WLAN status under the General tab, as well as select the pre-configured RADIUS server under the Security > AAA Servers tab.
To complete WLAN client connectivity configuration for WPA2-Enterprise with VLAN tagging: 1) Under the General tab, the WLAN must be associated with the appropriate dynamic interface (VLAN 20) and the Status box must be checked to enable SSID broadcasting and association. 2) Under the Security > AAA Servers tab, the specific external RADIUS server must be bound to the WLAN so authentication traffic is forwarded correctly.

Adım Adım Çözüm

1
Navigate to the WLANs tab in the WLC GUI and edit the target WLAN.
Access the multi-tab configuration interface for the specific WLAN.
WLAN settings are organized into General, Security, AAA Servers, QoS, and Advanced tabs.
2
Select the dynamic interface for VLAN 20 and check the Enabled checkbox under the General tab.
Traffic from clients associating to this WLAN is mapped to VLAN 20, and the WLAN is brought administratively online.
Without enabling Status, the WLAN remains inactive; without binding the dynamic interface, client traffic cannot reach VLAN 20.
3
Navigate to Security > AAA Servers tab and select the globally configured RADIUS server under Authentication Servers.
The WLAN is instructed to send 802.1X authentication requests to the designated external RADIUS server.
Global RADIUS definitions must be explicitly assigned to individual WLANs under the WLAN AAA Servers tab for 802.1X Enterprise security.

Anahtar Kavram

WLC GUI WLAN Client Connectivity and Security Configuration Parameters
Tahmini Süre:2m 0s
Soru 292Soru →

A network engineer is operating a remote branch office where Lightweight Access Points are deployed in FlexConnect mode with local switching and central authentication. If the WAN link connecting the branch AP to the central Wireless LAN Controller (WLC) fails, how does the AP process existing connected client data traffic and new 802.1X client authentication attempts?

Cevabı ve açıklamayı göster

Cevap: Existing client data traffic continues to be bridged locally, but new 802.1X client authentication attempts fail.

Cevap

Existing client data traffic continues to be bridged locally, but new 802.1X client authentication attempts fail.
When a FlexConnect AP configured for local switching loses CAPWAP connectivity to its controlling WLC, it enters standalone mode. Existing clients using local switching continue to have their data traffic bridged directly onto the local network interface. However, because authentication is set to central authentication, the AP cannot process new 802.1X client requests without WLC access to reach the RADIUS server, causing new authentications to fail.

Adım Adım Çözüm

1
Analyze the FlexConnect mode configuration parameters.
The AP is operating with local switching for data frames and central authentication for control/security operations via the WLC.
FlexConnect separates the data plane and control plane according to configured WLAN profiles.
2
Evaluate the impact of WAN link failure on existing active client sessions.
Data traffic for already authenticated clients is switched directly to the local Ethernet switch port of the AP without passing through the CAPWAP data tunnel.
Local switching allows the AP to continue forwarding client VLAN traffic locally during WLC standalone mode.
3
Evaluate the impact of WAN link failure on new 802.1X authentication requests.
New authentication requests fail because central authentication relies on the active CAPWAP control tunnel to reach the central WLC and RADIUS infrastructure.
Without active CAPWAP control connectivity or configured local backup authentication methods, the AP cannot process 802.1X EAP exchanges.

Anahtar Kavram

FlexConnect Standalone Mode Operations for Central Authentication and Local Switching
Tahmini Süre:2m 0s
Soru 293Soru →

A Cisco switch receives an Ethernet frame on a port configured as an 802.1Q trunk link. In what sequential order does the switch process this incoming frame from initial ingress parsing to its final forwarding decision?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with inspecting the ingress frame header for an 802.1Q tag, assigning the VLAN ID based on tag presence or native VLAN configuration, checking the VLAN against the allowed VLAN list, and finally forwarding or dropping the frame.
When a frame arrives on an 802.1Q trunk interface, the switch performs ingress processing in a strict order: First, it examines the Ethernet header to detect whether an 802.1Q tag (EtherType 0x8100) is present. Second, it determines the internal VLAN ID—reading the 12-bit VLAN ID for tagged frames or mapping untagged frames to the interface's configured native VLAN. Third, it checks whether that VLAN ID is included in the interface's allowed VLAN list. Fourth, if the VLAN is permitted, the switch looks up the MAC table and forwards the frame to destination ports in that VLAN; if the VLAN is disallowed, the frame is dropped.

Adım Adım Çözüm

1
Parse frame header for 802.1Q tag
Determines if an 802.1Q EtherType (0x8100) and 4-byte tag exist within the frame.
The switch must identify encapsulation formatting before reading VLAN metadata.
2
Assign internal VLAN ID
Tagged frames are assigned the 12-bit VLAN ID from the tag; untagged frames are assigned to the port's native VLAN.
All ingress frames inside an 802.1Q switch must be mapped to a specific internal VLAN context.
3
Verify allowed VLAN status
The target VLAN ID is checked against the list defined by 'switchport trunk allowed vlan'.
Filtering rules must confirm that the trunk interface allows traffic for that specific VLAN.
4
Execute switching decision
The frame is switched toward matching destination interfaces or dropped if the VLAN is pruned.
The MAC address table lookup and allowed VLAN check dictate final egress behavior.

Anahtar Kavram

802.1Q Ingress Frame Processing Logic
Tahmini Süre:1m 30s
Soru 294Soru →

A network administrator is provisioning a routed Layer 3 EtherChannel bundle between a core switch and a distribution switch using the Link Aggregation Control Protocol (LACP). Which two configuration requirements or operational conditions must be met for the Layer 3 EtherChannel bundle to successfully form and forward traffic? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The 'no switchport' command must be executed on both the logical port-channel interface and all physical member interfaces before configuring an IP address on the port-channel.; At least one side of the connection must have its member interfaces configured in LACP 'active' mode to actively send LACP control packets.

Cevap

The two correct requirements are: executing the 'no switchport' command on both the logical port-channel and physical member interfaces before assigning an IP address to the port-channel, and ensuring that at least one switch is set to LACP 'active' mode to initiate LACP negotiations.
To operationalize a Layer 3 EtherChannel, all member interfaces and the logical port-channel interface must be configured with 'no switchport' to disable Layer 2 switching before assigning an IP address to the port-channel. Additionally, LACP negotiation requires at least one end to actively transmit LACP frames by using 'active' mode.

Adım Adım Çözüm

1
Verify Layer 3 port conversion requirements
Confirm that physical member ports and the port-channel interface must have switchport functionality disabled using 'no switchport'.
Layer 3 EtherChannels act as routed interfaces. The logical port-channel interface holds the IP address, and member ports must be converted to routed ports to participate.
2
Evaluate LACP negotiation mode rules
Identify valid LACP mode pairings: active-active or active-passive.
LACP active mode sends LACP frames proactively, whereas passive mode only listens and responds. If both sides are passive, no frames are sent and the EtherChannel will not form.

Anahtar Kavram

Layer 3 EtherChannel Configuration and LACP Mode Negotiation Rules
Soru 295Soru →

A network engineer is configuring a high-security WLAN on a Cisco Wireless LAN Controller (WLC) via the web GUI to support modern client devices using WPA3-Personal (SAE) key management. Under the WLANs > Edit > Security > Layer 2 tab, the engineer selects WPA3 Policy but leaves the Protected Management Frames (PMF) setting at 'Disabled'. When attempting to save and enable the WLAN, the WLC displays a configuration error and refuses to save the profile. Which setting change in the WLC GUI is mandatory to resolve this error?

Cevabı ve açıklamayı göster

Cevap: Set Protected Management Frames (PMF) to Required under the Security > Layer 2 tab

Cevap

Set Protected Management Frames (PMF) to Required under the Security > Layer 2 tab
Under the Wi-Fi Alliance WPA3 specification, Protected Management Frames (PMF / IEEE 802.11w) are strictly mandatory. When configuring a WLAN on a Cisco Wireless LAN Controller via the web GUI (WLANs > Edit > Security > Layer 2), selecting WPA3 Policy forces the administrator to set Protected Management Frames to 'Required'. Leaving PMF set to 'Disabled' results in an immediate GUI validation failure because the controller enforces WPA3 security standard compliance.

Adım Adım Çözüm

1
Identify the mandatory prerequisite for WPA3 operation on Cisco WLCs
Recognize that the Wi-Fi Alliance WPA3 specification mandates IEEE 802.11w Protected Management Frames (PMF).
PMF prevents management frame spoofing attacks such as deauthentication and disassociation attacks.
2
Locate the PMF configuration field in the WLC GUI
Navigate to WLANs > Edit > Security > Layer 2 tab where WPA+WPA2/WPA3 parameters reside.
PMF is a Layer 2 security mechanism configured on the same sub-tab as WPA3 Policy.
3
Adjust the PMF parameter to satisfy WPA3 policy validation
Change Protected Management Frames dropdown from Disabled to Required.
Selecting WPA3 Policy without enabling PMF as Required generates a WLC GUI validation error when applying changes.

Anahtar Kavram

WLC GUI Layer 2 Security and WPA3 PMF Prerequisite Configuration
Tahmini Süre:2m 0s
Soru 296Soru →

Match each Cisco Lightweight Access Point (AP) operational mode to its precise operational characteristics and traffic handling behavior within an enterprise deployment.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Local Mode
FlexConnect Mode
Rogue Detector Mode
SE-Connect Mode

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Local Mode pairs with centralized CAPWAP encapsulation of data traffic; FlexConnect Mode pairs with local traffic switching and remote control plane communication; Rogue Detector Mode pairs with disabling radios to monitor wired trunk ARP/MAC tables for rogue correlation; SE-Connect Mode pairs with dedicating radios to raw RF spectrum data collection for external tools.
Each AP operational mode serves a distinct network role: Local mode tunnels all data to the WLC; FlexConnect mode allows local data switching at remote sites; Rogue Detector mode operates on the wired network without transmitting on wireless radios to spot rogue MACs on the switch topology; SE-Connect streams detailed raw RF spectrum diagnostics to dedicated diagnostic software.

Adım Adım Çözüm

1
Analyze the operational traffic forwarding mechanics of default AP deployments.
Identify Local mode as requiring centralized CAPWAP data tunneling to the WLC.
In default Local mode, the AP does not switch data locally; all 802.11 traffic is encapsulated into CAPWAP data tunnels.
2
Examine remote branch deployment models where WAN link conservation is required.
Identify FlexConnect mode as enabling local data switching at the branch while maintaining remote WLC management.
FlexConnect segregates data switching to the local VLAN while maintaining CAPWAP control signaling with the controller.
3
Determine which AP mode specializes in wired network security cross-referencing.
Identify Rogue Detector mode as disabling radios and sniffing wired trunk port ARP traffic.
Rogue Detector APs correlate wired MAC/ARP broadcasts with rogue MAC addresses reported by active wireless APs to identify unauthorized wired connections.
4
Evaluate specialized RF troubleshooting modes.
Identify SE-Connect mode as streaming raw physical layer RF spectrum data to diagnostic software.
SE-Connect mode connects directly to Cisco Spectrum Expert for advanced non-Wi-Fi interference analysis.

Anahtar Kavram

Cisco Wireless Lightweight Access Point Modes and Traffic Forwarding Architectures
Soru 297Soru →

A network technician is installing a new Cisco Lightweight Access Point (LAP) that will operate in default Local mode. The access point connects directly to an access-layer Catalyst switch port and will tunnel all user traffic back to the central Wireless LAN Controller (WLC) via CAPWAP. Which switch port configuration is required to properly support this access point connection?

Cevabı ve açıklamayı göster

Cevap: An access port assigned to the dedicated VLAN used for AP management traffic.

Cevap

An access port assigned to the dedicated VLAN used for AP management traffic.
When a Cisco Access Point operates in standard Local mode, all client traffic is encapsulated within CAPWAP tunnels and sent directly to the Wireless LAN Controller (WLC). The AP itself only requires an IP address on the management network to build the CAPWAP control and data tunnels. Therefore, the connected switch port should be configured as a standard access port assigned to the AP management VLAN.

Adım Adım Çözüm

1
Identify the operating mode of the Cisco Lightweight Access Point.
The AP operates in Local mode.
Local mode APs encapsulate all wireless client data inside CAPWAP tunnels back to the WLC.
2
Determine the physical infrastructure switch port requirements for a Local mode AP.
The AP only sends and receives untagged management traffic to establish its CAPWAP tunnel.
Because client VLANs are not locally bridged at the access layer switch, an 802.1Q trunk is unnecessary.
3
Select the correct switch port configuration mode.
Configure the switch interface as an access port in the AP management VLAN.
This provides IP reachability for the AP to discover and join the WLC.

Anahtar Kavram

Switch port configuration requirements for Local mode lightweight AP infrastructure connections
Tahmini Süre:45s
Soru 298Soru →

An engineer is diagnosing network initialization delays for point-of-sale terminals connected to a switch. Output from the switch CLI reveals the following interface status:

Switch# show spanning-tree interface gigabitEthernet 1/0/5

Vlan Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
VLAN0020 Desg LRN 4 128.5 P2p

Which primary operational benefit is provided by enabling Cisco PortFast on this access port?

Cevabı ve açıklamayı göster

Cevap: It allows the port to immediately transition from Blocking to Forwarding, avoiding the standard delays associated with Listening and Learning states.

Cevap

Enabling PortFast allows an access port connected to an end device to bypass the 802.1D Listening (15s) and Learning (15s) states, transitioning directly from Blocking to Forwarding upon link activation.
In standard 802.1D Spanning Tree Protocol, an interface transitions through Listening (15 seconds) and Learning (15 seconds) states before reaching Forwarding. The CLI output shows the port in the Learning ('LRN') state. Enabling Cisco PortFast on edge ports connected to single end-user devices allows the port to immediately enter the Forwarding state upon linkup, preventing boot and network assignment timeouts.

Adım Adım Çözüm

1
Analyze the CLI output for interface status
The interface status code 'LRN' indicates the port is currently in the 802.1D STP Learning state.
Standard 802.1D STP transitions ports through Blocking (20s max age), Listening (15s forward delay), and Learning (15s forward delay) before reaching Forwarding.
2
Determine the impact of PortFast on port state transitions
PortFast immediately places access ports into the Forwarding state upon link up, bypassing Listening and Learning.
End-user devices do not create Layer 2 loops, so waiting 30 seconds for Listening and Learning causes application timeouts (such as DHCP or POS terminal boot routines).

Anahtar Kavram

STP Port States and PortFast Benefits
Tahmini Süre:1m 30s
Soru 299Soru →

A network administrator configures a dynamic interface named 'GUEST_DATA' on VLAN 30 on a Cisco Wireless LAN Controller (WLC). The administrator attempts to initiate an SSH session to the IP address assigned to the 'GUEST_DATA' interface for administrative tasks, but the connection is refused. However, SSH access to the WLC Management Interface IP address on VLAN 10 functions properly from the same administrative workstation. Which condition explains why administrative SSH access to the dynamic interface IP address is failing?

Cevabı ve açıklamayı göster

Cevap: By default, administrative management protocols like SSH are permitted only on the Management Interface and Service Port, whereas dynamic interfaces are restricted to payload traffic for wireless client VLANs.

Cevap

By default, administrative management protocols like SSH are permitted only on the Management Interface and Service Port, whereas dynamic interfaces are restricted to payload traffic for wireless client VLANs.
On Cisco Wireless LAN Controllers, administrative access protocols (such as SSH, HTTPS, Telnet, and SNMP) are restricted by default to the Management Interface and the out-of-band Service Port. Dynamic interfaces are created to connect wireless client WLANs to specific wired VLANs, and by default, management traffic directed to dynamic interface IP addresses is ignored/refused for security reasons.

Adım Adım Çözüm

1
Identify the functions and roles of WLC logical interfaces (Management Interface, Service Port, and Dynamic Interfaces).
The Management Interface is the primary in-band interface used for controller management and AP CAPWAP tunnels. Dynamic interfaces function like VLAN interfaces for carrying user client traffic.
Understanding interface segregation on Cisco WLCs helps determine where administrative services (SSH/HTTPS) are listening.
2
Analyze default access control rules for management protocols on Cisco WLC interfaces.
Management access over dynamic interfaces is disabled by default to prevent wireless clients on guest or data VLANs from reaching management daemons on the WLC.
Restricting management connections strictly to dedicated management paths maintains security hygiene across wireless segments.

Anahtar Kavram

WLC Management Interface Access vs Dynamic Interface Roles
Soru 300Soru →

A network engineer is tasked with deploying a new WPA2-Enterprise wireless network on a Cisco Wireless LAN Controller (WLC) using the web GUI. The WLAN must enforce 802.1X authentication via an external RADIUS server and support dynamic VLAN assignment using AAA override. What is the correct chronological sequence of steps to configure this WLAN on the WLC GUI from initial creation to feature enablement?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for configuring a WPA2-Enterprise WLAN with AAA Override on a Cisco WLC GUI is: 1) Create New WLAN (define Profile Name/SSID), 2) Set Interface and Enable Status under General tab, 3) Set WPA2-AES and 802.1X under Security > Layer 2 tab, 4) Select RADIUS Server under Security > AAA Servers tab, and 5) Enable Allow AAA Override under Advanced tab.
The correct procedural order follows standard Cisco WLC administration logic: First, create the WLAN instance with its Profile Name and SSID. Next, configure fundamental interface mapping and admin status on the General tab. Then, configure Layer 2 security for WPA2-Enterprise (802.1X AKM) on the Security > Layer 2 tab. Fourth, link the global RADIUS server under the Security > AAA Servers tab. Finally, navigate to the Advanced tab to enable 'Allow AAA Override' for dynamic VLAN steering.

Adım Adım Çözüm

1
Initiate WLAN creation in WLC GUI
WLAN ID is allocated and initial Profile Name and SSID parameters are bound to the controller database.
You cannot configure specific WLAN sub-tabs until the WLAN instance is created via WLANs > Create New.
2
Configure General tab settings
The WLAN is associated with a distribution interface/interface group and marked administratively enabled.
Binding to an interface provides network pathing for client traffic.
3
Configure Layer 2 Security parameters
Layer 2 security policy is set to WPA2 with AES cipher and 802.1X key management.
Specifying 802.1X key management is a prerequisite for utilizing RADIUS EAP-based client authentication.
4
Bind RADIUS Server under AAA Servers tab
The WLAN targets the specific external RADIUS server for client EAP authentication transactions.
Without selecting an active RADIUS server under AAA Servers, 802.1X authentication requests will fail.
5
Enable AAA Override on Advanced tab
The controller honors RADIUS-returned VLAN attributes (IETF 64, 65, 81) to override the default WLAN interface assignment per user.
AAA Override functionality is disabled by default and resides specifically under the WLAN Advanced settings tab.

Anahtar Kavram

WLC GUI WLAN Configuration Workflow and Feature Navigation
Tahmini Süre:2m 30s
ÖncekiSayfa 15 / 20Sonraki