350-101 Implementing and Operating Cisco Wireless Core Technologies (350-101 WLCOR)v1.0 Questions and Answers

The correct answer isD. Cisco Catalyst Center provides a dedicatedscheduled maintenanceworkflow for managed network devices. Cisco documents that devices can be placed into maintenance mode from Catalyst Center, and that this is intended to prevent unnecessary operational noise during planned work. The same guide states that Catalyst Center does not process telemetry associated with a device while it is in maintenance mode, and that this prevents unnecessary alerts during the maintenance condition.

This directly aligns with a centrally managed maintenance process: the administrator defines the maintenance window, start and end time, and recurrence when required. Cisco also documents aManage Maintenanceworkflow where maintenance schedules can be reviewed, edited, or removed, and notes that devices can be removed from maintenance after planned work is complete. Device 360 and WLC dashboards are useful validation tools after maintenance, but they are monitoring views, not maintenance orchestration mechanisms. Cisco Spaces is also not the correct tool for WLC/device maintenance coordination; it is primarily used for location, IoT, and analytics services.

Therefore, the operationally correct process is to usescheduled maintenance for the devicein Catalyst Center, then validate post-maintenance health through Catalyst Center assurance views. Reference topic:Wireless Monitoring and Management — Catalyst Center Assurance, device health visibility, maintenance windows, alert handling, and operational lifecycle management.

The correct action is to expose only encrypted management services: HTTPS for WebUI administration and SSH for remote CLI administration. The exhibit confirms the WLC wireless management interface is VLAN 10 with IP address 10.10.1.2, but interface placement alone does not enforce secure management protocol policy. Cisco Catalyst 9800 documentation identifies web admin settings as controller management configuration that determines administrator access, protocols, and interfaces for remote management. Cisco further states that administrators can connect securely over HTTPS, while HTTP “is not a secure connection,” and that HTTPS encrypts data to and from the server.

For CLI access, Cisco’s Catalyst 9800 Secure Shell guidance states that SSH enables secure remote access, and usingtransport input sshprevents non-SSH Telnet connections, limiting the device to SSH-only access. Therefore, options A and B violate policy because they permit Telnet and/or HTTP. Option C fails because console access is local, not remote, and disabling only HTTP still leaves Telnet exposure unresolved. Reference topics:Wireless Monitoring and Management — WLC management access, secure administration, HTTPS, SSH, and management-plane hardening.

An RTS frame is an 802.11control frameused in the Request to Send/Clear to Send exchange. Cisco identifies RTS as a Request to Send frame and explains that 802.11 control frames assist in delivering data frames between stations. Cisco further states that the RTS/CTS function is optional, helps reduce collisions when hidden stations are associated to the same access point, and that a station sends an RTS frame as the first phase before transmitting a data frame.

Therefore, option B is correct because the RTS frame requests access to the wireless medium before data transmission. If the receiving station or AP replies with CTS, nearby stations defer transmission based on the duration information, reducing collision probability. This is especially relevant in hidden-node environments where two clients can hear the AP but cannot hear each other. Option A refers to RF spectral-mask compliance, which is a physical-layer regulatory concept. Option C confuses NAV behavior with roaming; RTS/CTS may influence virtual carrier sensing, not client roaming updates. Option D is unrelated because frame compression is not an RTS function. Reference topics:802.11 frame types, control frames, RTS/CTS, CSMA/CA, hidden-node mitigation, and medium reservation.

The command that enables web-based client authentication on the WLAN issecurity web-auth. Cisco’s Catalyst 9800 Web-Based Authentication guide shows the WLAN configuration workflow: enter WLAN configuration mode, disable WPA security for the open Layer 2 guest WLAN, then “Enable web authentication for WLAN” usingsecurity web-auth. Cisco then applies the authentication list and parameter map withsecurity web-auth authentication-list ...andsecurity web-auth parameter-map ..., which refine the WebAuth method and portal behavior after WebAuth itself is enabled.

Cisco’s LDAP authentication example mirrors the exhibit exactly:wlan webauth 2 webauth, removal of WPA/802.1X Layer 2 security,security web-auth,security web-auth authentication-list ldapauth, andsecurity web-auth parameter-map global. Option B only creates or enters the WLAN profile with WLAN ID 2 and SSID name. Options C and D disable WPA2 and 802.1X AKM; they do not authenticate clients. Reference topics:Client Connectivity Configuration — guest WLAN authentication, WebAuth, Layer 3 security, authentication lists, parameter maps, and Catalyst 9800 WLAN security configuration.

Cisco Catalyst Center uses its Event Notifications framework to alert operations teams when Assurance detects client, device, or wireless issues. The correct workflow is not a simple email-address entry under Issue Settings; it is an event subscription that binds selected issue events to a notification channel such as EMAIL. Cisco’s Catalyst Assurance documentation states that, when a specific Assurance issue is triggered and its status changes, Assurance can generate REST or email notifications, and the workflow opens thePlatform > Developer Toolkit > Event Notificationswindow from Manage Subscription. The same guide confirms that EMAIL is one of the supported notification channels and that the EMAIL notification details include sender, recipient, and subject fields. Cisco’s Platform User Guide also defines Event Notifications as the place to “view and subscribe to specific events” and gives the GUI path asPlatform > Developer Toolkit > Event Notifications. Therefore, option B is correct. SMTP/email destination configuration may be a prerequisite, but the required alerting action is creating the event notification subscription. Reference topics: Catalyst Center Assurance, Event Notifications, Wireless Monitoring and Management.

A line-of-sight (LOS) RF connection requires a clear, unobstructed path between the transmitter and receiver. This ensures that the transmitted signal reaches the receiving device without attenuation, reflection, or diffraction caused by physical obstacles such as walls, furniture, or other structures. LOS conditions are critical for high-frequency RF links, particularly in the 5 GHz band, where signals cannot easily penetrate objects. While multipath propagation (Option A) and MIMO (Option B) techniques enhance throughput and reliability in non-line-of-sight environments, they do not satisfy the definition of LOS. Reflections (Option C) actually introduce delays, fading, and interference, which can degrade signal quality. In Cisco Wireless Core Technologies, understanding LOS is foundational for designing point-to-point wireless backhaul links, outdoor Wi-Fi deployments, and high-performance campus networks. Ensuring LOS minimizes path loss, maximizes received signal strength, and supports predictable coverage patterns. Proper site surveys, RF planning, and AP placement are used to maintain LOS where required, particularly for directional antennas or high-gain links. Reference topics:RF Fundamentals — Line-of-Sight (LOS), RF propagation, path loss, multipath effects, MIMO considerations.

The missing command isradius server external-radius. On a Catalyst 9800 WLC, the external RADIUS server object must be declared first with radius server < server-name > . The following lines, address ipv4 10.10.10.100 auth-port 1812 acct-port 1813 and key radiuskey, are subcommands entered under that RADIUS server configuration mode. Cisco’s Catalyst 9800 802.1X configuration workflow starts by declaring the RADIUS server, then adding it to a RADIUS server group, then creating the authentication method list, and finally mapping that list to the WLAN. Cisco’s configuration guide example uses the same IOS XE structure: radius server < name > , followed by address ipv4 ... auth-port 1812 acct-port 1813 and key ....

The server group later references server name external-radius, so the RADIUS server object must be namedexternal-radiusexactly. Option C would incorrectly create a server named RADIUS-GRP, which is already the AAA server group name, not the RADIUS server object. Options B and D are invalid IOS XE syntax. PEAP-MSCHAPv2 itself is handled through the 802.1X/EAP exchange with the RADIUS server; the WLC acts as the authenticator and forwards authentication requests through the configured AAA method list. Reference topic:Client Connectivity Configuration — WPA2-Enterprise, 802.1X, RADIUS server objects, AAA groups, and WLAN authentication-list binding.

The correct configuration approach is to enableApplication Visibility and Controlon thepolicy profile. On the Catalyst 9800, WLANs are not configured as isolated monolithic objects; the WLAN profile is mapped to a policy profile through a policy tag, and many client traffic services are applied from that policy profile. Cisco defines AVC as the wireless feature set that identifies and monitors applications using DPI, creates rules to manage application bandwidth and usage, and integrates with Flexible NetFlow for per-application or per-protocol statistics. Cisco further states that AVC benefits from NBAR running on the AP or controller, and that the NBAR2 engine analyzes and recognizes traffic flows.

Operationally, Cisco’s 9800 AVC guide shows that AVC is enabled by navigating toConfiguration > Services > Application Visibilityand selecting the relevantPolicy Profile. It also shows the CLI form under the policy profile:wireless profile policy AVC_testingfollowed byip nbar protocol-discovery, with verification showingNBAR Protocol Discovery : Enabled. Options A and B are incorrect because the feature is not enabled directly on the WLAN. Option C is generic and incomplete; the Cisco feature construct is AVC. Reference topics:AVC, NBAR2, Flexible NetFlow, Catalyst 9800 policy profiles, and wireless application visibility.

Cisco Catalyst Center Assurance is the correct solution because the requirement is centralized, scalable, multi-site client monitoring with aggregated health and troubleshooting data. Cisco states that Catalyst Center Assurance provides aClient health dashboardand supports both wired and wireless clients. It is specifically used to obtain a global view of all client device health and determine whether issues require action.

This directly matches the need for monitoring clients across branch locations and responding faster during performance degradation. Catalyst Center Assurance also provides location-based visibility, health scoring, client trend analysis, onboarding failure reasons such as AAA or DHCP, and Client 360 views for detailed troubleshooting. Cisco documents that Client 360 provides detailed client connectivity troubleshooting, including what problem occurred, when it occurred, why it occurred, and whether the impact is isolated or widespread. Cisco’s Catalyst Center data sheet further describes Network and Client Health dashboards as giving administrators a high-level overview of every network device and client, with expansion by geographical site, device list, client list, or topology. Syslog, WLC CLI logging, and a local WLC dashboard are useful operational tools, but they do not provide enterprise-scale assurance analytics. Reference topics:Wireless Monitoring and Management — Catalyst Center Assurance, Client Health, Client 360, centralized wireless monitoring, and operational analytics.

In wireless antenna design, gain refers to the measure of an antenna’s ability to focus energy in a particular direction compared to a reference antenna, usually an isotropic radiator. Gain does not generate additional power; instead, it redistributes radiated energy to increase signal strength in the intended direction, enhancing the effective range and performance of the wireless link. This directional amplification is crucial in both point-to-point and point-to-multipoint deployments, as higher gain antennas can concentrate RF energy to overcome path loss and improve received signal strength at the target. Option A describes system loss calculation, which relates to link budgets, not antenna gain. Option B is unrelated, as checksum figures are part of digital error detection in wireless frames. Option D pertains to environmental tolerance, not RF signal characteristics. In Cisco Wireless Core Technologies, antenna gain is considered during RF planning, coverage modeling, and site surveys to ensure optimal signal distribution, proper overlap, and minimal interference, particularly for high-density deployments. Using high-gain directional antennas in corridors or long hallways, for instance, improves coverage and throughput while minimizing interference outside the target area. Reference topics:RF Fundamentals — Antenna gain, directional radiation patterns, link budget, site survey planning.

The correct method issoftware image management workflows, specifically Cisco Catalyst Center Software Image Management, commonly referenced as SWIM. Cisco documents SWIM as the mechanism used to manage software upgrades and maintain consistency of image versions across the network. It provides an image repository, golden-image assignment, image distribution, activation, readiness checks, and scheduled execution. Cisco’s wireless automation guidance specifically states that SWIM is used to update Catalyst 9800 Series Wireless Controller software by distributing the image from the Catalyst Center repository to wireless controllers and upgrading the images running on those controllers; both stages can run immediately or be scheduled for a defined maintenance window.

Option C is also validated by Catalyst Center’s update-status and workflow views. Cisco documentsImage Update Statusas the view that shows all update tasks, filters by in-progress, success, or failure, and displays a progress bar for active updates. The workflow view then exposes distribution and activation task status, timing, prechecks, postchecks, checksum verification, and AP pre-image download details. Inventory snapshots and templates do not execute controller firmware upgrades, and “lifecycle workflow” is too generic. Reference topics:Wireless Monitoring and Management — Catalyst Center SWIM, image compliance, golden images, controller upgrade automation, and update progress reporting.

An elevated noise floor indicates degraded RF conditions and directly reduces wireless link reliability. Cisco defines the noise floor as the ambient RF noise level, expressed in dBm, below which received signals are unintelligible. Cisco also defines SNR as the ratio of signal strength to the noise floor, meaning that when the noise floor rises, the usable separation between the desired signal and background RF energy decreases.

For a receiver to decode frames reliably, the received signal must remain sufficiently above the noise floor. Cisco site-survey guidance states that RF signals must be higher than the noise floor to be detectable as valid useful signals, and gives the common design example of -67 dBm signal with a -92 dBm noise floor to maintain 25 dB SNR. When the noise floor is elevated, SNR drops, clients experience more retries, lower modulation rates, reduced throughput, and possible disconnects. Cisco’s high-density wireless guidance states that raised noise floor lowers SNR, translating to lower speeds and higher airtime utilization. Options B, C, and D describe unrelated timing, spectrum-planning, or bandwidth-demand concepts. Reference topics:RF Fundamentals — noise floor, SNR, RSSI, RF interference, retries, and wireless link quality.

The switch interfaces connected to the APs must be configured as 802.1Q trunk ports. The requirement states that AP management and guest Wi-Fi traffic must remain separate, and additional VLANs for IoT and voice are expected. An access port supports only one VLAN, so it cannot scale for multiple locally tagged client VLANs. Cisco’s Catalyst AP guidance states that when multiple VLANs are used for client traffic, the AP switch port should trunk the VLANs, and management traffic is untagged; when a management VLAN is used, it should be configured as the native VLAN on the switch port. Cisco’s Catalyst 9800 FlexConnect documentation also shows the AP connected to a trunk port with a native VLAN for AP IP connectivity and a separate VLAN for locally switched client traffic.

Option C is therefore correct: configure a trunk, set the AP management VLAN as native, and restrict the allowed VLAN list to only required management and client VLANs such as guest, IoT, and voice. This supports segmentation and prevents unnecessary internal VLAN exposure. Reference topics:AP switch-port design, 802.1Q trunks, native VLANs, client VLAN tagging, FlexConnect/local switching, and guest traffic segmentation.

In a Cisco wireless fabric architecture, fabric edge nodes are responsible for terminating user data traffic at the network edge. These nodes act as the first point of contact for client devices, handling tasks such as encryption/decryption, VLAN tagging, Quality of Service (QoS) enforcement, and traffic forwarding to the appropriate destination within the fabric. The design centralizes control-plane functions in fabric control nodes, while edge nodes focus on data-plane operations to reduce latency and optimize network performance. Option A, authenticating TLS connections for management, is handled by management or control-plane components rather than edge nodes. Option B, enabling multicast snooping, is a network switch function but not a core responsibility of fabric edge nodes. Option D, converting Layer 2 to Layer 3 addresses, is part of routing functions and not a dedicated role of the wireless fabric edge node in client data processing. Cisco Wireless Core Technologies emphasize that by terminating user data at the edge, fabric edge nodes enable efficient traffic handling, secure processing, and scalable wireless deployment, which is critical in high-density enterprise environments. Reference topics:Wireless Network Operation — Cisco wireless fabric architecture, fabric edge node role, user data termination, data-plane operations.

TACACS+ is used for device administration, especially for GUI and CLI access to infrastructure platforms such as Cisco Catalyst 9800 WLCs, switches, and routers. Cisco defines TACACS+ as a security application that provides centralized validation for users attempting to access a device or network access server, and it separates authentication, authorization, and accounting functions for administrative control. Cisco ISE device administration documentation further states that TACACS+ is used to control and audit network device configuration, allowing devices to query ISE for administrator authentication and authorization while sending accounting records for logging administrator actions.

Therefore, the primary benefit is streamlined administrator access across platforms. Instead of maintaining local administrator accounts independently on every WLC or network device, TACACS+ enables centralized identity validation, role-based authorization, and consistent audit trails. Option A is incorrect because TACACS+ supports differentiated authorization rather than static grouping. Option B is the opposite of centralized accounting. Option D is inaccurate because TACACS+ is mainly for device administration, whereas client or endpoint network access is typically handled with RADIUS. Reference topics:Wireless Monitoring and Management — AAA for WLC administration, TACACS+ device administration, role-based access, and centralized audit control.

The failure is caused by the redirect ACL not being available where enforcement occurs. In FlexConnect local switching, client data-plane handling occurs on the AP, so the CWA redirect ACL cannot exist only as a controller ACL or only as a policy-profile reference. Cisco states that the redirect ACL is a punt ACL and that, for FlexConnect local switching, the ACL must be predefined on the AP because the AAA server returns only the ACL name, not the ACL definition.

The exhibit showsRedirect ACL failureandEXCLUDE_PUNT_ACL_FAIL, which aligns with an AP-side punt/redirect ACL application failure. Cisco’s Catalyst 9800 CWA configuration specifically requires the redirect ACL definition to be sent through the FlexConnect profile; in the GUI this is done under the Flex ProfilePolicy ACLtab by adding the ACL, enabling central web authentication, and applying the change. The equivalent CLI iswireless profile flex < profile > followed byacl-policy < acl-name > andcentral-webauth, after which the AP uses the ACL for client redirection. AP-Join profiles do not carry client redirect ACL policy, and adding the ACL only to the policy profile does not push it to FlexConnect APs for local switching. Reference topics:FlexConnect local switching, CWA redirect ACLs, Catalyst 9800 policy ACLs, and ISE URL-redirect authorization.

The correct answer is D. Cisco Spaces connector deployments often require a VLAN on which the connector is reachable for management or data, and Cisco Spaces wired gateway guidance identifies the connector VLAN as the VLAN used for communication to the connector. The same guidance also supports multiple source VLANs for monitored wired devices, which aligns with the requirement for future analytics-service scalability.

A trunk port is the proper design choice because it can carry multiple VLANs over the same physical interface. Cisco Catalyst switch documentation states that an access port carries traffic for only one VLAN, while an IEEE 802.1Q trunk carries multiple VLANs and supports tagged traffic. The command switchport trunk allowed vlan 30 limits the trunk initially to VLAN 30, satisfying the current management VLAN requirement without changing the native VLAN or other default VLAN settings. Cisco also documents that an allowed VLAN list limits VLAN membership only on the associated trunk port, so it does not affect other switch ports.

Option A works only for a single untagged VLAN and is less scalable. Options B and C mix access mode with trunk-only commands and are syntactically or operationally invalid. Reference topic: Wireless Monitoring and Management — Cisco Spaces connector deployment, VLAN reachability, trunking, and analytics service scalability.

The correct command isreceiver ip address 198.51.100.10 57555 protocol tls-native profile spaces-profilebecause it matches the Cisco IOS XE model-driven telemetry subscription syntax used on Catalyst 9800 controllers. Cisco documents the receiver statement under telemetry ietf subscription as receiver ip address ip-address receiver-port protocol protocol profile name, and describes it as the command that configures the receiver IP address, port, protocol, and profile for telemetry notifications.

In the exhibit, the subscription already defines the telemetry feed: encode-tdl encoding, a native stream, the TDL URI for ewlc/wlan_config, the WLC source address, and an on-change update policy. What is missing is the collector destination. For Cisco Spaces or Catalyst Center-style integrations, the WLC must know where to export telemetry and which secure transport profile to use. Cisco troubleshooting examples for Catalyst 9800 telemetry use the same command structure: receiver ip address X.X.X.X 25103 protocol tls-native profile ... under the telemetry subscription.

Options A, B, and D are invalid because they reorder the CLI keywords. IOS XE telemetry configuration is parser-order sensitive: the command begins with receiver ip address, followed by the receiver port, then protocol, then profile. Reference topic:Wireless Monitoring and Management — Catalyst 9800 streaming telemetry, Cisco Spaces integration, TLS transport, and telemetry receiver configuration.

The correct configuration isaaa-overridefollowed bynacunder the existing Catalyst 9800 wireless policy profile. The exhibit already places the administrator in policy-profile configuration mode with wireless profile policy my-policy, so the missing commands must be policy-profile subcommands, not another profile declaration. Cisco’s Catalyst 9800 configuration examples show the exact sequence: enter wireless profile policy < policy-profile-name > , enable aaa-override, enable nac, then configure VLAN and no shutdown.

aaa-override permits authorization attributes returned by AAA or Cisco ISE, such as VLAN, ACL, QoS, redirect ACL, or posture-related access controls, to override the locally defined policy. Cisco’s documentation explicitly states that AAA override applies policies coming from AAA or ISE servers, while nac enables Network Access Control in the policy profile. This is the required behavior when endpoints must be posture-validated before normal network access is granted. Cisco also notes that NAC State is enabled in the policy profile and can only be enabled when AAA override is enabled.

Option A is invalid because nac-policy is not the correct CLI keyword. Options B and D omit NAC. Reference topic:Client Connectivity Configuration — Catalyst 9800 policy profiles, AAA override, NAC State, posture enforcement, and ISE-based access control.

A high-gain patch antenna is a directional antenna that concentrates RF energy into a defined coverage area rather than radiating equally in all directions. Cisco’s Wireless RF Reference Guide explains that antenna gain determines how RF power is radiated and that higher-gain antennas do not create additional transmit power; they focus existing power in a given direction. Cisco also distinguishes omnidirectional high-gain patterns, which flatten coverage, from directional antennas, which focus energy toward a target area.

That makes option C correct: a patch antenna imparts a focused beam, typically useful for covering a hallway, warehouse aisle, seating section, point-to-point link, or defined flat service area. Cisco’s antenna documentation also states that higher-gain antennas provide longer coverage distance but with a coverage-area tradeoff, especially in a particular direction. Option A is incorrect because antenna gain does not restrict operation to a single narrow frequency; frequency support is determined by antenna design and radio band. Option B describes channel overlap, not antenna behavior. Option D does not describe a standard patch antenna radiation pattern. Reference topics:RF Fundamentals — antenna gain, directional antennas, patch antenna radiation patterns, beamwidth, and coverage-cell design.

Client exclusion is a feature in Cisco Catalyst 9800 WLCs that allows the administrator to temporarily block clients exhibiting misbehavior, such as excessive retries, excessive bandwidth usage, or roaming issues. The IOS XE CLI command for enabling client exclusion in a WLAN policy isclient-exclusion < timeout > , where < timeout > defines the duration (in seconds) the client is prevented from associating with the WLAN. Option D correctly usesclient-exclusion 120to block the misbehaving clients for 120 seconds. Option A (exclude 120) is not valid IOS XE syntax. Option B (exclusionlist timeout 120) is also incorrect as it refers to internal exclusion lists, not the WLAN policy applied to live clients. Option C (security exclusion timeout 120) is invalid and does not configure client exclusion at the WLAN policy level. Cisco Wireless Core Technologies emphasize using client exclusion policies during high-density events or temporary network congestion to ensure network fairness, protect overall WLAN performance, and maintain connectivity for well-behaving clients. Reference topics:Client Connectivity Configuration — Client exclusion, WLAN policy, misbehaving client mitigation, Cisco Catalyst 9800 IOS XE.

Bridge mode in a Cisco wireless mesh deployment allows access points to operate as mesh infrastructure nodes, typically as a Root AP (RAP) or Mesh AP (MAP), so Ethernet segments can be connected across a wireless backhaul. Cisco’s mesh design documentation states that in a point-to-point bridging scenario, a mesh AP can extend a remote network by using the backhaul radio “to bridge two segments of a switched network.” This directly maps to option A: point-to-point communication between network segments.

In Catalyst 9800 mesh deployments, Cisco documents converting an AP to bridge mode withcapwap ap mode bridge, after which the AP rejoins the controller in bridge mode and can be assigned a mesh role. Cisco also defines the RAP as the AP with the wired connection toward the WLC, while the MAP joins through its radio path toward the RAP. Option B is incorrect because bridge mode does not force all traffic to 2.4 GHz; Cisco mesh backhaul can use configured backhaul radios. Option C describes RRM/TPC behavior, not bridge mode. Option D incorrectly associates mesh bridge mode with WAN edge functions. Reference topics:Wireless Network Implementation — mesh AP roles, RAP/MAP operation, wireless backhaul, and Ethernet bridging.

‘

The failure is occurring during WPA/WPA2 key management, not during mobility anchoring. The radioactive trace showsFailed to validate eapol mic. MIC mismatchfollowed byFailed to validate eapol key m2, which means the authenticator and supplicant derived different key material during the PSK handshake. Cisco’s Catalyst 9800 client-connectivity troubleshooting maps this log pattern directly to a wrong password condition and lists the corrective actions as fixing the password on the endpoint or on the SSID/WLAN. The11r MIC validation failedphrase does not automatically make 802.11r the root cause; it only shows that the failed MIC validation occurred while Fast Transition key logic was in use. Disabling 802.11r would be a workaround only for client capability or FT interoperability issues, but the trace points to PSK mismatch. Removing the anchor WLC would break the intended DMZ anchoring design, and matching WLANs on foreign and anchor is required for anchor deployments, but it would not produce this EAPOL M2 MIC failure. The correct remediation is to ensure the client-entered PSK matches the WLAN PSK. Reference topics: WPA/WPA2-PSK authentication, EAPOL 4-way handshake, Catalyst 9800 radioactive trace analysis, and client connectivity troubleshooting.

The requirement is guest client isolation, not merely guest authentication or internet breakout. On a Catalyst 9800 WLC, peer-to-peer blocking is the correct control because it prevents wireless clients associated to the same WLAN from communicating directly with one another. Cisco defines peer-to-peer blocking as a WLAN security feature applied to individual WLANs, where each client inherits the WLAN’s P2P blocking behavior, and traffic can be bridged locally, dropped, or forwarded upstream. For this scenario, the appropriate action is thedropbehavior, because guest-to-guest file sharing must be prohibited while upstream internet access remains available.

The dedicated guest VLAN, VLAN 30, provides traffic segmentation from production networks and creates a clean policy boundary for VisitorAccess. Cisco’s Catalyst 9800 configuration model maps WLANs to policy profiles, and the policy profile defines client network and switching policy, including VLAN association. Options B, C, and D do not solve client isolation: local authentication validates users, FlexConnect/local switching changes traffic forwarding behavior, and multicast/RADIUS does not block unicast guest-to-guest traffic. Reference topics:Client Connectivity Configuration — guest WLAN design, P2P blocking, VLAN segmentation, and Catalyst 9800 WLAN-to-policy mapping.

The correct configuration is option C because Cisco IOS XE restricts inbound protocols on VTY lines with thetransport inputcommand. Cisco’s Catalyst 9800 best-practice guidance states that administrators should confirm SSH is enabled and Telnet is disabled for better controller security, and that the Catalyst 9800 follows standard Cisco IOS XE behavior for enabling or disabling Telnet and SSH. Cisco IOS XE SSH documentation explicitly showsline vty line_number [ending_line_number]followed bytransport input ssh, and explains that this prevents non-SSH Telnet connections, limiting access to SSH only.

The existing exhibit already includes the SSH prerequisites: hostname, domain name, RSA key generation, AAA new-model, a default login method using local credentials, and a local privileged user. The missing VTY configuration must therefore apply that default AAA login list to the VTY lines withlogin authentication defaultand restrict inbound transport to SSH. Cisco AAA documentation confirms thatlogin authentication defaultapplies the configured default authentication list to the line or set of lines. Option A is incomplete and does not explicitly permit SSH. Option B uses invalid syntax. Option D omits the requiredinputkeyword. Reference topics:Catalyst 9800 secure management, VTY access control, SSH, Telnet hardening, AAA login authentication, and IOS XE device administration.

Optimized roaming is a Cisco WLC feature designed to reduce sticky-client behavior. A sticky client remains associated to an AP even after moving far enough away that another AP would provide better RF service. Cisco describes optimized roaming as actively monitoring client data RSSI and disconnecting clients when received signal strength falls below the configured threshold. The official Catalyst 9800 documentation states that optimized roaming “disassociates client when the RSSI is lower than the set threshold,” which directly matches option A.

This function does not calculate device location through peer-to-peer beaconing, does not depend on external experience services, and is not static load balancing. It is an RF/client-roaming enforcement mechanism controlled by the wireless infrastructure. In practical operation, the AP/WLC evaluates client signal quality and, when the configured optimized roaming criteria are met, forces the client to disconnect so it can reassess the RF environment and roam to a better AP. Cisco also notes that optimized roaming helps maintain client connectivity by managing disassociationn based on RSSI and data-rate thresholds. Reference topics:Client Connectivity Configuration — client roaming behavior, sticky-client mitigation, RSSI thresholds, and WLC roaming optimization

Migrating a Cisco Catalyst AP to Meraki cloud management requires issuing a specific CLI command on the WLC to switch the AP's management mode. The correct syntax isap management mode meraki force noprompt, which instructs the controller to transition the AP to Meraki mode, bypassing validation prompts that normally require manual confirmation. Theforcekeyword ensures the command is executed even if the AP is actively associated or configured, andnopromptsuppresses confirmation dialogues for unattended migration. Options A, C, and D are invalid syntax or improperly order the parameters, which would result in a CLI error. Cisco Wireless Core Technologies recommend this approach during enterprise migration scenarios where multiple APs are moved from Catalyst WLC management to cloud-based Meraki management, enabling centralized configuration and monitoring in a large-scale deployment. Using this command ensures a seamless transition without service disruption, while maintaining inventory consistency and supporting automation for mass AP migrations. Reference topics:Wireless Network Implementation — AP management mode migration, Meraki cloud integration, CLI AP management, Catalyst 9176 WLC migration.