Network Access

400 soru

Tüm türler400 Çoktan seçmeli204 Çoklu seçim91 Eşleştirme23 Sıralama82

A network administrator is creating a new WLAN on a Cisco Wireless LAN Controller (WLC) using the web GUI. The WLAN must support 802.1X authentication using a centralized RADIUS server and allow the RADIUS server to dynamically assign VLANs to clients upon successful authentication. Which TWO configuration settings must be enabled on the WLC GUI for this WLAN? (Select TWO.)

Geçerli olan tümünü seçin

Under the Security > Layer 2 tab, select WPA2/WPA3 parameters and set Key Management to 802.1X.

Under the Advanced tab, check the Allow AAA Override checkbox.

Under the Security > Layer 3 tab, set the Authentication Policy to RADIUS 802.1X.

Under the General tab, set the Interface/Interface Group to FlexConnect Local Switching to enable AAA VLAN override.

Cevabı ve açıklamayı göster

Cevap: Under the Security > Layer 2 tab, select WPA2/WPA3 parameters and set Key Management to 802.1X.; Under the Advanced tab, check the Allow AAA Override checkbox.

Cevap

To configure 802.1X enterprise authentication with dynamic VLAN assignment via RADIUS, the administrator must configure 802.1X under the Security > Layer 2 tab and enable 'Allow AAA Override' under the Advanced tab.

To support RADIUS-based 802.1X authentication, 802.1X Key Management must be selected under the Security > Layer 2 tab. To allow the RADIUS server to dynamically assign clients to specific VLANs based on user credentials, the 'Allow AAA Override' setting must be explicitly enabled under the Advanced tab.

Adım Adım Çözüm

Configure Layer 2 Security for 802.1X Enterprise Authentication.

Navigating to Security > Layer 2 allows selecting WPA2/WPA3 and setting Authentication Key Management (AKM) to 802.1X.

802.1X integrates the WLC with a RADIUS server for EAP-based client authentication.

Enable AAA Override for Dynamic VLAN Assignment.

Navigating to the Advanced tab and selecting 'Allow AAA Override' permits the WLC to override the default WLAN interface.

Without AAA Override, VLAN assignment attributes sent by RADIUS are ignored by the controller.

Anahtar Kavram

WLC GUI WLAN Security and AAA Override Configuration

Soru 322Soru →

A network administrator is deploying Link Layer Discovery Protocol (LLDP) across a multi-vendor switch infrastructure. Which two statements correctly describe the default operational characteristics and CLI configuration of LLDP on Cisco Catalyst switches compared to CDP? (Select TWO.)

Geçerli olan tümünü seçin

LLDP is globally disabled by default on Cisco Catalyst switches and requires the global configuration command `lldp run` to be enabled.

LLDP allows granular, independent control of message transmission and reception on specific interfaces using `lldp transmit` and `lldp receive` interface commands.

LLDP operates with default timers of a 60-second advertisement frequency and a 180-second holdtime, matching the default timer values of CDP.

LLDP automatically resolves native VLAN mismatches across trunk links by dynamically renegotiating 802.1Q tagging attributes.

Cevabı ve açıklamayı göster

Cevap: LLDP is globally disabled by default on Cisco Catalyst switches and requires the global configuration command `lldp run` to be enabled.; LLDP allows granular, independent control of message transmission and reception on specific interfaces using `lldp transmit` and `lldp receive` interface commands.

Cevap

LLDP is globally disabled by default on Cisco Catalyst switches requiring `lldp run`, and LLDP provides independent control over transmit and receive states per interface using `lldp transmit` and `lldp receive`.

The correct choices accurately state that LLDP is disabled globally by default on Cisco Catalyst switches (requiring `lldp run` in global configuration mode) and that LLDP supports independent interface-level transmit and receive controls (`lldp transmit` / `lldp receive`).

Adım Adım Çözüm

Analyze global protocol state defaults

Cisco Catalyst switches ship with CDP globally enabled by default (`cdp run`), whereas LLDP is globally disabled by default and requires `lldp run` to start discovery processes.

CDP is Cisco proprietary and enabled by default, while IEEE 802.1AB LLDP must be explicitly activated globally on Cisco Catalyst platforms.

Evaluate interface-level control capabilities

LLDP allows separate commands for sending (`lldp transmit`) and listening (`lldp receive`), providing granular directional control that CDP (`cdp enable`) does not offer.

LLDP's standard specification allows interfaces to act as receive-only, transmit-only, or bidirectional discovery nodes.

Verify protocol default timers

CDP uses a 60-second advertisement interval and a 180-second holdtime. LLDP on Cisco devices uses a 30-second advertisement interval and a 120-second holdtime.

Confusing LLDP default timers with CDP default timers is a common misconception when analyzing discovery protocol operational states.

Anahtar Kavram

CDP vs LLDP Operational Differences and CLI Configuration

Soru 323Soru →

A network engineer attempts to configure a Cisco switch running Rapid PVST+ to serve as a primary root bridge by issuing the command `spanning-tree vlan 100 priority 8000` in global configuration mode. Which outcome will occur on the switch upon executing this command?

The switch rejects the command because bridge priority values must be specified in increments of 4096.

The switch accepts the command and adds the VLAN ID (100) to 8000, resulting in a total priority of 8100.

The switch accepts the command and automatically rounds the value down to 4096, the nearest valid increment.

The switch accepts the command but places all interconnect trunk ports into the discarding state to prevent loops.

Cevabı ve açıklamayı göster

Cevap: The switch rejects the command because bridge priority values must be specified in increments of 4096.

Cevap

The switch rejects the command because bridge priority values must be specified in increments of 4096.

In Rapid PVST+, the Bridge ID incorporates a 12-bit System ID Extension containing the VLAN ID. Consequently, only the 4 most significant bits of the 16-bit priority field are configurable by the administrator, mandating that bridge priority values must be configured in multiples of 4096 (such as 0, 4096, 8192, 12288, up to 61440). Entering a value like 8000 violates this requirement, causing the switch CLI to reject the command immediately with an error message.

Adım Adım Çözüm

Analyze the Bridge ID structure under Rapid PVST+.

The 16-bit Bridge Priority field consists of a 4-bit Priority field and a 12-bit System ID Extension (VLAN ID).

Because only the 4 most significant bits are allocated for configurable priority, valid base values must be multiples of

2^{12} = 4096

Evaluate the entered CLI value of 8000.

8000 is not a multiple of 4096 (the nearest valid multiples are 4096 and 8192).

Cisco IOS enforces strict syntax validation that rejects invalid priority increments.

Determine the switch response.

The CLI displays an error message specifying valid increments (0, 4096, 8192, ..., 61440) and rejects the command.

Invalid inputs cannot be processed or saved into the running configuration.

Anahtar Kavram

Rapid PVST+ System ID Extension and Bridge Priority 4096 Increment Rule

Tahmini Süre:1m 0s

Soru 324Soru →

An enterprise network administration team is evaluating wireless deployment options to connect several regional offices. They are comparing a traditional Cisco Centralized Wireless Architecture using Lightweight Access Points (APs) operating in default Local mode against a Cisco Cloud-Managed Wireless Architecture (such as Cisco Meraki). Which statement correctly describes the fundamental difference in data plane traffic processing between these two architectures?

In the cloud-managed architecture, client data traffic is switched locally at the access point onto the LAN, whereas in the centralized architecture, client data traffic is encapsulated in CAPWAP data tunnels and forwarded to a central controller.

In the cloud-managed architecture, client data traffic is tunneled to the cloud management portal for policy processing, whereas in the centralized architecture, client data traffic is switched locally by the access point.

In the centralized architecture, both the control plane and data plane are processed locally at the access point, whereas in the cloud-managed architecture, both planes are encapsulated within CAPWAP data tunnels.

In the cloud-managed architecture, control plane traffic is tunneled to an on-premises physical controller, whereas in the centralized architecture, control plane traffic is managed directly from a cloud dashboard.

Cevabı ve açıklamayı göster

Cevap: In the cloud-managed architecture, client data traffic is switched locally at the access point onto the LAN, whereas in the centralized architecture, client data traffic is encapsulated in CAPWAP data tunnels and forwarded to a central controller.

Cevap

In a Cisco Centralized deployment with APs in default Local mode, split-MAC functionality is used where all user data is encapsulated in CAPWAP tunnels and sent directly to the centralized Wireless LAN Controller (WLC). Conversely, in a Cloud-Managed architecture (such as Cisco Meraki), management is out-of-band via the cloud, but the data plane is locally switched directly by the AP onto the local switch interface.

Adım Adım Çözüm

Analyze the data plane behavior of Cisco Centralized Wireless Architecture in default Local mode.

Local mode APs use a split-MAC architecture where all user data frames are encapsulated into CAPWAP data tunnels (using UDP port 5247) and sent to the centralized WLC for switching and policy enforcement.

Centralized control and data processing require all traffic to terminate at the physical Wireless LAN Controller.

Analyze the data plane behavior of Cisco Cloud-Managed Wireless Architecture.

Cloud-managed APs use out-of-band cloud management. Management/control traffic goes to the cloud dashboard, while user data traffic is bridged locally directly onto the access switch network.

Cloud management platforms do not route or process user data frames to preserve performance and bandwidth.

Compare the two deployment models to select the correct statement.

The statement highlighting local switching at the AP for cloud-managed deployments versus central CAPWAP tunneling to a controller for centralized Local mode deployments is correct.

This captures the primary data plane traffic flow difference between the two deployment types.

Anahtar Kavram

Data Plane Traffic Handling in Centralized vs Cloud-Managed Wireless Architectures

Soru 325Soru →

A network engineer receives an security alert regarding an unexpected network device connected to interface GigabitEthernet1/0/5 on a Cisco switch. To inspect the neighboring device details via Link Layer Discovery Protocol (LLDP), the engineer executes the `show lldp entry Switch-B` command and receives the following output:

Capability codes:
(R) Router, (B) Bridge, (T) Telephone, (W) WLAN Access Point, (P) Repeater

Local Intf: Gi1/0/5
Chassis id: 0026.99a1.b2c0
Port id: Gi0/1
Port Description: Uplink-to-Core
System Name: Switch-B

System Capabilities: B, R
Enabled Capabilities: B

Management Addresses:
IP: 192.168.10.50

Based on this command output, which statement accurately describes the remote neighbor device?

The remote device is identified as Switch-B, connected via its own GigabitEthernet0/1 interface, and is currently operating with Layer 2 bridging capability enabled.

The local switch receives LLDP messages on interface GigabitEthernet0/1 from the remote device's local port GigabitEthernet1/0/5.

The remote device is actively routing IP packets across subnets because both Router (R) and Bridge (B) system capabilities are listed.

The remote device is transmitting Cisco Discovery Protocol (CDP) Type-Length-Value (TLV) attributes to advertise management address 192.168.10.50.

Cevabı ve açıklamayı göster

Cevap: The remote device is identified as Switch-B, connected via its own GigabitEthernet0/1 interface, and is currently operating with Layer 2 bridging capability enabled.

Cevap

The remote device is identified as Switch-B, connected via its own GigabitEthernet0/1 interface, and is currently operating with Layer 2 bridging capability enabled.

The correct answer accurately interprets the LLDP entry output fields: 'System Name: Switch-B' identifies the neighbor hostname, 'Port id: Gi0/1' specifies the remote interface, and 'Enabled Capabilities: B' confirms the neighbor is currently functioning as a Layer 2 bridge/switch.

Adım Adım Çözüm

Identify the local and remote interface mapping from the LLDP output.

'Local Intf: Gi1/0/5' indicates the port on the local switch executing the command, while 'Port id: Gi0/1' indicates the connected port on the remote neighbor.

LLDP outputs separate local receiving ports from remote transmitting port IDs.

Evaluate system capabilities versus enabled capabilities.

'System Capabilities: B, R' indicates the hardware supports Bridge and Router functions, but 'Enabled Capabilities: B' proves only Layer 2 bridging is active.

Operational status is determined strictly by enabled capabilities, not total supported capabilities.

Verify device identity and protocol context.

The device name is Switch-B, and the information is obtained via standard LLDP TLVs.

System Name displays the hostname configured on the remote LLDP neighbor.

Anahtar Kavram

Interpretation of LLDP neighbor entry outputs, distinguishing local vs. remote interfaces and system vs. enabled capabilities.

Soru 326Soru →

A network administrator is configuring Cisco Lightweight Access Points (LAPs) across various remote and campus environments to meet specific operational requirements. Match each Cisco Access Point operational mode to its primary traffic processing or monitoring behavior.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

FlexConnect Mode pairs with switching data locally while tunneling control traffic; Monitor Mode pairs with dedicated WIDS and rogue detection without serving clients; Rogue Detector Mode pairs with monitoring wired ARP/MAC traffic to correlate rogue devices; Sniffer Mode pairs with capturing and forwarding raw 802.11 wireless frames to an analyzer.

Each mode corresponds directly to its specialized function: FlexConnect handles local switching with central control, Monitor mode provides dedicated wireless security/WIDS scanning, Rogue Detector analyzes wired network ARP/MAC addresses for rogue correlation, and Sniffer mode captures wireless channel packets for protocol analysis.

Adım Adım Çözüm

Identify the data forwarding capabilities of FlexConnect Mode.

FlexConnect mode is designed for branch deployments where client data is switched locally onto the local switch VLAN while CAPWAP control packets travel to the central WLC.

This minimizes WAN bandwidth consumption while keeping centralized management intact.

Evaluate non-client serving monitoring modes (Monitor vs. Rogue Detector vs. Sniffer).

Monitor mode performs wireless intrusion detection (WIDS) and wireless rogue scanning. Rogue Detector mode operates on wired switchports listening for ARP/MAC traffic. Sniffer mode streams raw RF packet captures to external packet analysis tools.

Each monitoring AP mode fills a distinct role in network security auditing, troubleshooting, and network management.

Anahtar Kavram

Operational behaviors and traffic patterns of Cisco AP modes

Soru 327Soru →

A network technician is troubleshooting an issue where a workstation connected to interface FastEthernet 0/5 is failing to reach resources in VLAN 50. VLAN 50 already exists in the VLAN database. The technician executes `show interfaces fastEthernet 0/5 switchport` and observes the following output:

Administrative Mode: dynamic auto
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)

Which command set must be entered on interface FastEthernet 0/5 to force the port statically into access mode and assign it to VLAN 50?

switchport mode access
switchport access vlan 50

switchport access vlan 50

switchport trunk native vlan 50
switchport mode trunk

vlan 50
switchport access vlan 50

Cevabı ve açıklamayı göster

Cevap: switchport mode access
switchport access vlan 50

Cevap

The correct sequence under interface configuration mode is 'switchport mode access' followed by 'switchport access vlan 50'.

To properly configure an access port on Cisco IOS, the interface must be explicitly configured with 'switchport mode access' to turn off DTP negotiation and 'switchport access vlan 50' to assign the port to the designated broadcast domain.

Adım Adım Çözüm

Examine the current switchport state from the show output.

Administrative Mode is dynamic auto and Access Mode VLAN is 1.

Default Cisco Catalyst interface settings leave ports ready to negotiate trunks via DTP and assigned to default VLAN 1.

Explicitly disable DTP negotiation for trunking by setting static access mode.

Interface command 'switchport mode access' sets Administrative Mode to static access.

Access ports connecting to end-user workstations should always be statically configured as access ports for stability and security.

Assign the interface to the target VLAN.

Interface command 'switchport access vlan 50' modifies Access Mode VLAN to 50.

Places untagged host traffic from FastEthernet 0/5 into broadcast domain VLAN 50.

Anahtar Kavram

Static Access Port Configuration and Access VLAN Assignment

Soru 328Soru →

A network administrator is setting up a wireless network for guest access on a Cisco Wireless LAN Controller (WLC). The Profile Name and SSID have already been defined. To ensure that all client traffic associated with this WLAN is assigned to VLAN 30, which action must the administrator take within the WLAN edit settings in the WLC GUI?

Select the interface mapped to VLAN 30 from the Interface/Interface Group drop-down list on the General tab.

Specify VLAN 30 in the Helper IP Address field on the Advanced tab.

Enable 802.1Q Trunk Tagging under the Security Layer 2 configuration tab.

Change the AP Mode to FlexConnect and configure VLAN 30 on the Wireless General tab.

Cevabı ve açıklamayı göster

Cevap: Select the interface mapped to VLAN 30 from the Interface/Interface Group drop-down list on the General tab.

Cevap

Select the interface mapped to VLAN 30 from the Interface/Interface Group drop-down list on the General tab.

When configuring client network access on a Cisco WLC via the GUI, binding a WLAN to a dynamic interface (which corresponds to a specific VLAN such as VLAN 30) is performed under the General tab using the Interface/Interface Group drop-down menu.

Adım Adım Çözüm

Navigate to the WLANs menu in the WLC GUI and open the target WLAN edit page.

The WLANs > Edit screen opens showing configuration tabs.

WLAN-specific parameters are managed within the WLAN edit view.

Locate the General tab settings.

Access profile parameters including Profile Name, SSID, Status, and Interface/Interface Group.

The General tab contains core WLAN settings including state and interface binding.

Select the desired dynamic interface bound to VLAN 30 from the Interface/Interface Group drop-down list.

The WLAN is associated with the selected dynamic interface.

Binding the interface maps wireless client traffic to the appropriate Layer 2 VLAN/subnet.

Anahtar Kavram

WLAN Interface Mapping in Cisco WLC GUI

Soru 329Soru →

A network administrator is creating a wireless LAN for corporate clients using the Cisco Wireless LAN Controller (WLC) GUI. Which TWO actions must be completed within the WLAN edit parameters to ensure client traffic is bound to the appropriate network segment and the WLAN becomes operational for client association? (Select TWO.)

Geçerli olan tümünü seçin

Map the WLAN to the designated client dynamic interface or interface group on the General tab.

Check the Status box on the General tab to enable the WLAN.

Configure TACACS+ server credentials under the AAA Servers tab to authenticate 802.1X wireless client associations.

Enable Local Mode operation on the Advanced tab so client traffic continues switching locally if WLC connectivity is lost.

Cevabı ve açıklamayı göster

Cevap: Map the WLAN to the designated client dynamic interface or interface group on the General tab.; Check the Status box on the General tab to enable the WLAN.

Cevap

Mapping the WLAN to the designated dynamic interface on the General tab and checking the Status checkbox to enable the WLAN are both required steps.

When configuring a WLAN in the Cisco WLC GUI, client connectivity requires assigning the WLAN to a dynamic interface (or interface group) under the General tab so that traffic is mapped to the correct VLAN. Additionally, because new WLAN profiles are disabled by default, selecting the Status checkbox on the General tab is mandatory to broadcast the SSID and accept client associations.

Adım Adım Çözüm

Identify interface mapping requirements in WLC GUI

Dynamic interface is configured under WLANs > Edit > General tab > Interface/Interface Group dropdown.

This binds the wireless network (SSID) to a specific Layer 2 VLAN/subnet on the wired infrastructure.

Identify WLAN operational status requirement

Check the Enabled box next to Status on the General tab.

Cisco WLC WLAN profiles are created in a disabled state by default and will not broadcast or accept associations until explicitly enabled.

Anahtar Kavram

WLC GUI WLAN Basic Parameters and Enablement

Soru 330Soru →

An enterprise network administrator is evaluating Layer 2 protocol operations after migrating the switch infrastructure to Rapid PVST+. Which two statements correctly describe Rapid PVST+ port roles and operational state behaviors?

Geçerli olan tümünü seçin

Rapid PVST+ consolidates the legacy 802.1D Disabled, Blocking, and Listening port states into a single Discarding state.

An Alternate port receives BPDUs from neighboring switches and acts as a backup path to the Root Bridge.

Enabling PortFast on switch-to-switch trunk links accelerates convergence without risking transient Layer 2 loops.

The bridge priority value for a VLAN can be configured to any arbitrary integer between 0 and 65535, such as 8000.

Cevabı ve açıklamayı göster

Cevap: Rapid PVST+ consolidates the legacy 802.1D Disabled, Blocking, and Listening port states into a single Discarding state.; An Alternate port receives BPDUs from neighboring switches and acts as a backup path to the Root Bridge.

Cevap

Rapid PVST+ consolidates the legacy Disabled, Blocking, and Listening states into a single Discarding state, and an Alternate port acts as a backup path to the Root Bridge by receiving BPDUs from other switches.

Rapid PVST+ simplifies the standard 802.1D spanning tree model by merging the Disabled, Blocking, and Listening states into a single Discarding state. Furthermore, an Alternate port receives superior BPDUs from neighbor switches, allowing it to immediately assume the Root Port role if the active Root Port loses connectivity.

Adım Adım Çözüm

Analyze port state changes from standard 802.1D to Rapid PVST+ (802.1w).

Identify that Rapid PVST+ simplifies port states down to Discarding, Learning, and Forwarding.

Combining Disabled, Blocking, and Listening into Discarding streamlines state evaluation.

Evaluate the definition and function of the Alternate port role in Rapid PVST+.

Confirm that an Alternate port offers an alternate path toward the Root Bridge when it receives BPDUs from neighboring switches.

Alternate ports provide rapid uplink failover without requiring a full re-convergence cycle.

Identify misconceptions regarding PortFast misconfiguration and Bridge Priority increments.

Reject the options asserting arbitrary priority integers (like 8000) and PortFast deployment on inter-switch trunks.

Bridge priorities require increments of 4096 due to the System ID Extension, and PortFast on trunks risks broadcast storms.

Anahtar Kavram

Rapid PVST+ Operational States, Port Roles, and Priority Increments

Soru 331Soru →

A network technician is configuring a newly created WLAN on a Cisco Wireless LAN Controller (WLC) via the web interface. To ensure wireless clients are placed onto the correct IP subnet upon association, the WLAN must be mapped to a specific dynamic interface instead of using the default management interface. Under which tab within the WLANs > Edit menu is this Interface/Interface Group mapping configured?

General tab

Security tab, under the Layer 2 sub-tab

Advanced tab

Security tab, under the AAA Servers sub-tab

Cevabı ve açıklamayı göster

Cevap: General tab

Cevap

The Interface/Interface Group dropdown menu for binding a WLAN to a dynamic interface is located under the General tab in the Cisco WLC GUI.

In the Cisco WLC web GUI, navigating to WLANs > Edit displays the General tab by default. This tab contains fundamental settings including the WLAN Profile Name, broadcast SSID, WLAN Status enablement, and the 'Interface/Interface Group' drop-down list which maps client traffic on that SSID to a specific dynamic interface and associated VLAN.

Adım Adım Çözüm

Identify the required configuration task in the WLC GUI

The goal is to map a WLAN to a dynamic interface/VLAN to ensure correct client IP subnet placement.

By default, new WLANs inherit the management interface unless explicitly configured otherwise.

Locate the primary menu tab for core WLAN identification and interface parameters

In the Cisco WLC web GUI (WLANs > Edit), the General tab houses the Profile Name, SSID, Status enablement checkbox, and the Interface/Interface Group (Gradients) setting.

Interface binding is a core attribute of the WLAN profile configuration located under General settings.

Anahtar Kavram

Cisco WLC GUI WLAN Configuration and Interface Mapping

Tahmini Süre:1m 0s

Soru 332Soru →

A network administrator executes a command on a Cisco Catalyst switch to inspect details about a newly connected neighbor switch running Link Layer Discovery Protocol (LLDP). The command produces the following output:

text
Switch-Core# show lldp entry Switch-Access-01

Capability codes:
(R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device
(W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

-----------------------------------------------
Local Interface: Gi1/0/12
Chassis id: 0026.98a1.4b80
Port id: Gi0/1
Port Description: GigabitEthernet0/1
System Name: Switch-Access-01

System Description:
Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9-M), Version 15.0(2)SE11, RELEASE SOFTWARE (fc3)

Time remaining: 92 seconds
System Capabilities: B, R
Enabled Capabilities: B

Management Addresses:
IP: 192.168.10.5

Based on the output above, which statement accurately describes the connected neighbor device and interface topology?

The neighbor device is connected to local port GigabitEthernet1/0/12 and is operating with Bridge capabilities enabled.

The neighbor device is physically attached to local interface GigabitEthernet0/1 and has Router capabilities enabled.

The local switch sends LLDP advertisement updates to the neighbor every 92 seconds by default.

The LLDP system description TLV signals an active native VLAN mismatch on local interface GigabitEthernet1/0/12.

Cevabı ve açıklamayı göster

Cevap: The neighbor device is connected to local port GigabitEthernet1/0/12 and is operating with Bridge capabilities enabled.

Cevap

The neighbor device is connected to local port GigabitEthernet1/0/12 and is operating with Bridge capabilities enabled.

The output explicitly shows 'Local Interface: Gi1/0/12' as the local switch port and 'Enabled Capabilities: B' as the active bridging capability of the connected neighbor Switch-Access-01.

Adım Adım Çözüm

Identify the local switch interface from the CLI output

The field 'Local Interface: Gi1/0/12' shows that the cable from the neighbor connects directly into port GigabitEthernet1/0/12 on the local switch.

LLDP output explicitly distinguishes between the local receiving interface and the remote neighbor's transmitting port ID.

Examine the capabilities fields for the neighbor device

'System Capabilities: B, R' indicates the device supports both Bridge and Router functions, but 'Enabled Capabilities: B' shows only Bridge capability is active.

System capabilities indicate full hardware/software support, whereas enabled capabilities reflect current operational role.

Verify holdtime vs transmit frequency definitions

'Time remaining: 92 seconds' is the remaining holdtime before the entry expires if no further LLDP updates arrive (default holdtime is 120 seconds, calculated as 30s retransmit x 4 holdtime multiplier).

The time remaining field counts down from the holdtime timer, not the transmission interval.

Anahtar Kavram

Interpreting LLDP Neighbor Details and Capabilities

Tahmini Süre:1m 15s

Soru 333Soru →

A network engineer is analyzing the rapid convergence mechanism of Rapid PVST+ (IEEE 802.1w) on a point-to-point link between two Cisco Catalyst switches. Place the steps of the Rapid PVST+ Proposal-Agreement handshake sequence in the correct chronological order from first event to final event.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of events in the Rapid PVST+ Proposal-Agreement handshake sequence is: 1) The upstream switch transmits a BPDU with the Proposal bit set. 2) The downstream switch selects the port as its new Root Port and blocks non-edge Designated Ports (synchronization). 3) The downstream switch sends an Agreement BPDU back to the upstream switch. 4) The upstream switch immediately transitions its Designated Port to the Forwarding state.

Rapid PVST+ (IEEE 802.1w) achieves rapid convergence on point-to-point links through an active handshake sequence between switch ports. First, the upstream switch transmits a proposal BPDU on its Designated Port. Second, the downstream switch recognizes the superior BPDU, adopts the receiving interface as its Root Port, and blocks all non-edge Designated Ports to synchronize the switch topology. Third, once synchronized, the downstream switch responds with an Agreement BPDU on its new Root Port. Finally, the upstream switch receives this agreement and immediately transitions its Designated Port to the Forwarding state without waiting for legacy forward delay timers.

Adım Adım Çözüm

Identify the initial proposal transmission.

The upstream switch sends a BPDU with the Proposal bit set.

Rapid PVST+ uses explicit handshake messages rather than timer-based transitions on point-to-point links. The process starts when a switch sends a Proposal BPDU out of a Designated Port.

Determine the downstream switch state synchronization.

The downstream switch selects the port as Root Port and puts non-edge Designated Ports into Discarding.

To prevent transient Layer 2 loops while agreeing to the new topology, the downstream switch performs synchronization by isolating (discarding on) all non-edge Designated ports.

Identify the agreement response mechanism.

The downstream switch sends an Agreement BPDU back on its new Root Port.

Once all interfaces are verified synchronous, the downstream switch confirms loop-free readiness by transmitting an Agreement BPDU.

Determine the final port state transition.

The upstream switch transitions its Designated Port directly into Forwarding.

Upon receiving the Agreement BPDU, the upstream switch immediately moves its Designated Port to Forwarding without waiting for traditional 15-second Listening/Learning timers.

Anahtar Kavram

Rapid PVST+ Proposal-Agreement Handshake Convergence

Soru 334Soru →

A network engineer needs to capture raw 802.11 wireless frames over the air on a specific channel to troubleshoot client connectivity failures in a manufacturing warehouse. The dedicated access point used for this operation must stop serving wireless clients and send all captured 802.11 traffic directly to a remote network analyzer tool such as Wireshark. Which Cisco Access Point mode must be configured to accomplish this objective?

Sniffer mode

Monitor mode

Rogue Detector mode

FlexConnect mode

Cevabı ve açıklamayı göster

Cevap: Sniffer mode

Cevap

Sniffer mode is the dedicated AP mode used to capture raw 802.11 frames on a specified channel and forward them to a remote packet analyzer tool like Wireshark.

Sniffer mode dedicates the access point radio to listening on a specific channel, capturing raw 802.11 frames, and encapsulation-tunneling those captured frames to a designated IP address running a network packet analyzer such as Wireshark.

Adım Adım Çözüm

Identify the primary operational requirement in the scenario.

The AP must capture raw 802.11 over-the-air frames on a dedicated channel and forward them to a packet analyzer (Wireshark) without servicing clients.

Troubleshooting complex 802.11 Layer 2 issues requires dedicated frame-level capture capabilities.

Evaluate Cisco AP modes against the required capability.

Sniffer mode turns the AP into a dedicated wireless packet capture device tied to a designated channel and target analyzer IP address.

Other modes either continue to service clients (FlexConnect, Local) or perform non-streaming security monitoring functions (Monitor, Rogue Detector).

Anahtar Kavram

Cisco Lightweight AP Operational Modes and Sniffer Mode Functionality

Soru 335Soru →

Match each Cisco Lightweight Access Point (AP) operational mode to its correct functional behavior and network traffic handling characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Local Mode maps to central CAPWAP data encapsulation; FlexConnect Mode maps to local switching and branch WAN outage resilience; Rogue Detector Mode maps to wired network MAC tracking with disabled radios; SE-Connect Mode maps to dedicated RF spectrum analysis using external tools.

Each AP mode serves a distinct operational purpose in Cisco wireless networks. Local Mode performs central switching via CAPWAP. FlexConnect Mode provides local traffic switching and WAN fault tolerance for branch environments. Rogue Detector Mode disables wireless radios and monitors wired switch tables to detect rogue devices physically connected to the network. SE-Connect Mode dedicates AP radios to collecting RF spectrum data for external analysis software.

Adım Adım Çözüm

Evaluate Local Mode traffic handling

Local Mode uses CAPWAP data and control tunnels for all traffic back to the centralized WLC.

This is the default behavior in centralized Cisco wireless architectures.

Evaluate FlexConnect Mode traffic handling and resilience

FlexConnect allows local traffic switching at the branch switch port, supporting standalone operation when WLC WAN connectivity drops.

Designed specifically for remote branch offices to avoid routing local traffic across the WAN.

Evaluate Rogue Detector Mode functionality

Rogue Detector mode disables radios and monitors wired LAN broadcasts to match MAC addresses of rogue devices.

Focuses strictly on verifying if rogue wireless devices are connected to the physical wired infrastructure.

Evaluate SE-Connect Mode functionality

SE-Connect streams raw RF data to external spectrum analysis applications.

Used for dedicated spectrum troubleshooting rather than serving clients or sniffing 802.11 frames.

Anahtar Kavram

Cisco Lightweight AP Operational Modes and Traffic Encapsulation Mechanics

Soru 336Soru →

A network administrator needs to create a new enterprise wireless network on a Cisco Wireless LAN Controller (WLC) using the GUI. The network must use WPA2-Enterprise with 802.1X authentication via an external RADIUS server and be mapped to an existing dynamic interface. Place the configuration steps in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence to configure the enterprise WLAN via the Cisco WLC GUI is: 1) Create the new WLAN profile and SSID, 2) Map the WLAN to the dynamic interface on the General tab, 3) Select WPA2 and 802.1X key management on the Security > Layer 2 tab, 4) Choose the RADIUS server under the Security > AAA Servers tab, and 5) Select the Status checkbox on the General tab and click Apply.

The proper administrative workflow in the Cisco WLC GUI requires creating the WLAN profile first, mapping the Layer 2/3 dynamic interface on the General tab, configuring Layer 2 security for WPA2 802.1X authentication, defining the RADIUS authentication server under Security > AAA Servers, and finally checking the Status checkbox on the General tab and applying the settings.

Adım Adım Çözüm

Initiate new WLAN creation.

Access the WLAN creation screen to assign the Profile Name and SSID.

Creating the basic WLAN profile creates the configuration object in the controller database.

Assign the dynamic interface on the General tab.

Associates wireless client connections with the specified IP subnet and VLAN.

Interface binding ensures wireless clients receive network connectivity on the appropriate subnet upon association.

Configure Layer 2 security policies under Security > Layer 2.

Enables WPA2-Enterprise with 802.1X Key Management.

Selecting 802.1X key management defines that client authentication relies on EAP and external AAA infrastructure.

Assign RADIUS server settings under Security > AAA Servers.

Links the WLAN to the active RADIUS server for identity verification.

Selecting the active RADIUS authentication server directs 802.1X authentication requests to the network access server.

Enable the WLAN status on the General tab and apply changes.

Activates the WLAN across connected Access Points.

Cisco WLCs leave newly created WLANs disabled by default to prevent broadcast before security and routing configurations are complete.

Anahtar Kavram

WLC GUI WLAN Configuration Sequence

Tahmini Süre:1m 30s

Soru 337Soru →

An enterprise switch, Switch-A, is connected to neighboring switches via $802.1\text{Q}$ trunk links running Rapid PVST+. An administrator executes the command `spanning-tree vlan 10 priority 24576` on Switch-A, while all other switches in the network retain default STP settings. Which two statements correctly describe the Rapid PVST+ operations and port roles for VLAN $10$ on Switch-A?

Geçerli olan tümünü seçin

Switch-A advertises a total Bridge ID priority of

24586

for VLAN

10

by combining the configured priority with the System ID Extension.

All active non-edge switch ports on Switch-A participating in VLAN

10

assume the Designated Port role in the Forwarding state.

Switch-A advertises a total Bridge ID priority of

24576

for VLAN

10

without modifying the value for the VLAN identifier.

Switch-A selects the root path with the lowest cumulative cost and transitions one of its trunk ports to the Root Port role.

Cevabı ve açıklamayı göster

Cevap: Switch-A advertises a total Bridge ID priority of $24586$ for VLAN $10$ by combining the configured priority with the System ID Extension.; All active non-edge switch ports on Switch-A participating in VLAN $10$ assume the Designated Port role in the Forwarding state.

Cevap

Switch-A advertises a total Bridge ID priority of

24586

for VLAN

10

by combining the configured priority with the System ID Extension, and all active non-edge switch ports on Switch-A participating in VLAN

10

assume the Designated Port role in the Forwarding state.

Rapid PVST+ calculates the total bridge priority by adding the 12-bit System ID Extension (VLAN ID

10

) to the 4-bit configured priority value (

24576

), producing an advertised priority of

24586

. Because default switch priority is

32768 + 10 = 32778

, Switch-A wins the Root Bridge election for VLAN

10

. On the Root Bridge, every active forwarding port is assigned the Designated Port role.

Adım Adım Çözüm

Calculate the total Bridge ID priority for Switch-A in VLAN

10

Configured base priority (

24576

) + System ID Extension (

10

) =

24586

Rapid PVST+ appends the 12-bit VLAN ID (System ID Extension) to the 4-bit priority field (in steps of

4096

) to form the 16-bit Bridge Priority.

Determine Root Bridge election outcome for VLAN

10

Switch-A has the lowest Bridge ID (

24586 < 32778

) and becomes the Root Bridge for VLAN

10

Spanning tree elects the switch with the lowest numeric Bridge ID (Priority + MAC address) as the Root Bridge.

Determine port roles for Switch-A as the Root Bridge.

All active interfaces on Switch-A for VLAN

10

become Designated Ports in the Forwarding state.

The Root Bridge is the central point of the spanning tree topology; none of its ports point toward another root, so it has no Root Ports, and all its active ports serve down-tree segments as Designated Ports.

Anahtar Kavram

Rapid PVST+ Bridge Priority Calculation and Root Bridge Port Roles

Soru 338Soru →

A network administrator is provisioning interface GigabitEthernet0/1 on a Cisco Catalyst switch to connect a newly deployed workstation. The workstation must belong to VLAN 15. Which two configuration steps are required under the interface configuration mode to correctly establish this interface as a static access port in VLAN 15? (Select two.)

Geçerli olan tümünü seçin

Execute the command switchport mode access to statically set the interface to access mode.

Execute the command switchport access vlan 15 to assign the interface to VLAN 15.

Execute the command switchport trunk native vlan 15 to map host traffic to VLAN 15.

Configure an IP address on interface GigabitEthernet0/1 because access ports require Layer 3 addresses to isolate broadcast domains.

Cevabı ve açıklamayı göster

Cevap: Execute the command switchport mode access to statically set the interface to access mode.; Execute the command switchport access vlan 15 to assign the interface to VLAN 15.

Cevap

Configuring a static access port in Cisco IOS requires explicitly defining the interface mode using switchport mode access and specifying the VLAN membership using switchport access vlan 15 under interface configuration mode.

Configuring an end-user host connection on a Cisco switch requires establishing static access mode using 'switchport mode access' and assigning the specific VLAN membership using 'switchport access vlan 15'. Together, these two commands ensure untagged traffic from the connected host is correctly mapped into VLAN 15.

Adım Adım Çözüm

Enter interface configuration mode for GigabitEthernet0/1.

Access the target interface CLI prompt: Switch(config-if)#

Configuration parameters for access port operation must be applied directly to the physical interface.

Set the administrative operational mode to access.

Run switchport mode access.

Ensures the switchport operates strictly as an access port and prevents DTP from negotiating a trunk link.

Assign the interface to the target VLAN.

Run switchport access vlan 15.

Places untagged host frames into broadcast domain VLAN 15.

Anahtar Kavram

Cisco IOS VLAN Access Port Configuration Syntax

Soru 339Soru →

An enterprise deploys a Cisco Lightweight Access Point (LAP) in FlexConnect mode at a remote branch location connected via WAN to a centralized Wireless LAN Controller (WLC). The branch WLAN is configured for local switching and local authentication. If the WAN link fails and the CAPWAP connection to the controller is disconnected, which behavior will the access point exhibit for clients on this WLAN?

The access point operates in standalone mode, continuing to forward data traffic locally and processing new client authentication requests locally.

The access point stops broadcasting all SSIDs and disassociates all connected clients until the CAPWAP tunnel to the central WLC is re-established.

The access point automatically converts to Local mode and buffers all wireless client data frames in memory until controller reachability is restored.

The access point continues forwarding existing client data traffic locally but rejects all new client authentication attempts while disconnected from the WLC.

Cevabı ve açıklamayı göster

Cevap: The access point operates in standalone mode, continuing to forward data traffic locally and processing new client authentication requests locally.

Cevap

The access point operates in standalone mode, continuing to forward data traffic locally and processing new client authentication requests locally.

In Cisco wireless architectures, a FlexConnect AP configured for local switching and local authentication transitions into standalone mode when it loses its CAPWAP control connection to the WLC. In standalone mode, the AP continues to switch client traffic locally at the branch switch and can process new authentication requests locally without WLC intervention.

Adım Adım Çözüm

Identify the AP operating mode and failure scenario.

The AP is in FlexConnect mode and loses its CAPWAP control tunnel to the centralized WLC due to a WAN outage.

FlexConnect mode is designed for branch deployments to handle WAN loss gracefully.

Evaluate the traffic switching configuration.

The WLAN is configured for local switching, meaning user data packets are bridged directly onto the local trunk/VLAN rather than encapsulated in CAPWAP to the WLC.

Local switching allows data plane forwarding to function independently of the CAPWAP data tunnel.

Evaluate the authentication configuration during standalone mode.

Because local authentication is configured, the FlexConnect AP acts as a local authenticator when disconnected from the controller.

Local authentication ensures both existing client sessions and new client join requests continue operating normally during a WAN link disruption.

Anahtar Kavram

Cisco FlexConnect AP Standalone Mode Operations

Soru 340Soru →

A network engineer is configuring a new WLAN on a Cisco Wireless LAN Controller (WLC) using the GUI to support wireless clients using WPA2-Personal authentication. Under which tab and sub-tab in the WLANs edit menu must the pre-shared key (PSK) format and secret key be configured?

Security tab > Layer 2 sub-tab

Security tab > Layer 3 sub-tab

General tab > Radio Policy dropdown

Advanced tab > Client Exclusion settings

Cevabı ve açıklamayı göster

Cevap: Security tab > Layer 2 sub-tab

Cevap

Security tab > Layer 2 sub-tab

WPA2-Personal (PSK) is a Layer 2 security mechanism. On the Cisco WLC GUI, navigating to WLANs > Edit > Security > Layer 2 allows the administrator to select WPA+WPA2 security, check the PSK box under Auth Key Management, and specify the pre-shared key format and value.

Adım Adım Çözüm

Navigate to the WLANs menu in the Cisco WLC GUI and click on the target WLAN ID.

The WLANs > Edit page opens with multiple configuration tabs.

Access to specific WLAN parameters requires opening the specific WLAN edit panel.

Select the Security tab and verify the Layer 2 sub-tab is active.

Layer 2 security protocols (such as WPA+WPA2) are accessible.

WPA2 encryption and key management operate at Layer 2 of the OSI model.

Enable WPA2 Policy, select PSK under Auth Key Management, and enter the pre-shared key.

The pre-shared key policy is assigned to the WLAN.

PSK key management requires entering the ASCII or Hex pre-shared key under Layer 2 security settings.

Anahtar Kavram

WLC GUI WLAN Layer 2 Security Configuration

Tahmini Süre:1m 0s

ÖncekiSayfa 17 / 20Sonraki

Network Access

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram