Cisco Certified Network Professional (CCNP) Wireless — Practice Set 1

Question 1

A campus network engineer is designing a wireless deployment for a large enterprise. In which Cisco Catalyst 9800 WLC deployment mode do access points switch client data traffic locally at the AP without forwarding it to the WLC, while still receiving management and control traffic from the WLC?

Accepted Answer

In FlexConnect (formerly Hybrid-WLAN or H-REAP) mode, the AP switches locally authenticated client data traffic at the AP site without tunnelling it back to the WLC, reducing WAN bandwidth consumption for branch deployments. Management, control, and CAPWAP signaling still traverse the WAN to the WLC. In Local mode, all client data is tunnelled to the WLC for central switching. Monitor mode dedicates the AP to passive wireless scanning. Sniffer mode captures 802.11 frames and forwards them to a protocol analyser.

Question 2

A network architect evaluates campus wireless deployment options for Cisco SD-Access. Which embedded wireless controller option integrates wireless LAN controller functionality directly into a Catalyst 9000 series switch, eliminating the need for a separate WLC appliance?

Accepted Answer

The Cisco Embedded Wireless Controller (EWC) runs directly on Catalyst 9000 series switches (such as the 9300 and 9400) as an IOS-XE software component, providing centralized wireless control for up to a limited number of APs without requiring a dedicated WLC appliance. Cisco Catalyst Center is the management and assurance platform, not the wireless controller itself. Cisco Mobility Express was an older embedded WLC that ran on certain AP models and has been largely superseded by EWC. vWLC is a virtualized controller running as a VM.

Question 3

A wireless engineer designs a campus network. In Cisco SD-Access architecture, which Catalyst Center role is responsible for translating host policies into network configurations and programming the underlay fabric?

Accepted Answer

In Cisco SD-Access, Catalyst Center (formerly DNA Center) acts as the controller and orchestration plane. It translates intent-based policies (segmentation, QoS, wireless policies) into device configurations and programs the fabric underlay and overlay. The LISP Map Server/Resolver handles the LISP control plane mapping (EID-to-RLOC). The border node connects the SD-Access fabric to external networks. The edge node is where hosts and wireless APs connect to the fabric.

Question 4

A network engineer deploys a virtual Cisco Catalyst 9800 WLC (C9800-CL) in a data centre. Which hypervisor platforms are officially supported for running the Cisco C9800-CL cloud-based wireless LAN controller?

Accepted Answer

The Cisco Catalyst 9800-CL cloud wireless LAN controller supports deployment on VMware ESXi, KVM, and Microsoft Hyper-V hypervisors, as well as on AWS and Azure public cloud platforms. It runs IOS XE and provides the same feature set as the hardware C9800 appliances. It is not limited to Cisco UCS hardware, nor is it VMware-only. Support for multiple hypervisors allows flexible private cloud deployments.

Question 5

A network engineer implements network function virtualization in a campus environment. Which term describes the management and orchestration layer that automates the lifecycle of virtualized network functions (VNFs) in an NFV architecture?

Accepted Answer

In the ETSI NFV reference architecture, the NFV Orchestrator (NFVO) manages the lifecycle and orchestration of network services composed of VNFs, while the VNF Manager (VNFM) handles instantiation, scaling, and termination of individual VNFs. Together they form the NFV Management and Orchestration (MANO) layer. An SDN controller manages network topology and forwarding plane but is distinct from NFV orchestration. The hypervisor (VMM) provides the compute virtualization layer. The vSwitch provides virtual networking between VMs but does not orchestrate VNF lifecycles.

Question 6

An engineer troubleshoots wireless client connectivity in an 802.11 network. Which medium access method does 802.11 use to control access to the shared wireless medium and avoid collisions?

Accepted Answer

IEEE 802.11 wireless LAN uses CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) because wireless stations cannot transmit and receive simultaneously, making collision detection (used in 802.3 Ethernet) impossible. CSMA/CA uses a Distributed Coordination Function (DCF) where stations sense the medium, wait for a random backoff if busy, and send an RTS/CTS exchange for large frames to reduce the hidden node problem. CSMA/CD is the Ethernet method. Token passing is used in Token Ring networks. TDMA divides time into fixed slots, which is not how 802.11 DCF operates.

Question 7

A wireless engineer compares 802.11ac (Wi-Fi 5) and 802.11ax (Wi-Fi 6) technologies. Which technology introduced in 802.11ax enables multi-user simultaneous uplink AND downlink transmissions using OFDMA sub-channel allocation?

Accepted Answer

OFDMA (Orthogonal Frequency Division Multiple Access) is a key new feature in 802.11ax (Wi-Fi 6) that divides the channel into smaller sub-channels called Resource Units (RUs), allowing the AP to schedule multiple stations simultaneously on different RUs for both downlink and uplink transmissions. This improves efficiency in dense environments with many small-packet clients. MU-MIMO was introduced in 802.11ac for downlink only (and extended to uplink in 802.11ax) and uses multiple spatial streams rather than frequency sub-channels. Beamforming directs RF energy toward specific clients. STBC is a transmit diversity technique for reliability.

Question 8

An RF engineer troubleshoots co-channel interference in a dense Wi-Fi 6 deployment. Which 802.11ax feature reduces co-channel interference between overlapping BSSs by allowing a station to identify transmissions from a different BSS and defer only when necessary?

Accepted Answer

BSS Coloring in 802.11ax assigns a color value (1–63) to each BSS. When a station detects a transmission, it checks the BSS color in the 802.11ax signal extension field of the PHY header. If the color matches its own BSS, it defers. If the color is different (an OBSS — Overlapping BSS), the station can apply Spatial Reuse and potentially transmit simultaneously if the received signal strength is below a threshold, reducing unnecessary deferrals. Target Wake Time (TWT) schedules when devices wake to communicate. UL-OFDMA trigger-based random access manages uplink channel access. 1024-QAM improves throughput via higher modulation.

Question 9

A wireless network engineer configures RTS/CTS in an 802.11 network to address the hidden node problem. Which statement correctly describes how RTS/CTS mitigates the hidden node problem?

Accepted Answer

The hidden node problem occurs when two stations can both hear the AP but cannot hear each other, leading to simultaneous transmissions that collide at the AP. With RTS/CTS, the transmitting station sends an RTS (Request To Send) to the AP, which responds with a CTS (Clear To Send). All stations that hear the CTS set their NAV (Network Allocation Vector) timer, effectively reserving the medium for the duration of the upcoming data exchange. This prevents the hidden node from transmitting during that window. RTS/CTS does not modify transmit power or channel assignments and has been in 802.11 since the original standard.

Question 10

An engineer configures OSPF on a Cisco router. Which OSPF LSA type is generated by an ABR (Area Border Router) to describe networks in other areas and is flooded only within a single area?

Accepted Answer

OSPF Type 3 Summary LSAs are generated by Area Border Routers (ABRs) to advertise networks from one area into another. They are flooded within the area they are injected into but do not cross area boundaries again, keeping inter-area routing summarized. Type 1 Router LSAs describe a router's links and are flooded within a single area. Type 2 Network LSAs are generated by the DR on broadcast networks and are also intra-area. Type 5 AS External LSAs are generated by ASBRs to advertise external routes and are flooded throughout the OSPF domain (except stub areas).

Question 11

A network engineer configures EIGRP on a Cisco router and notices routes are stuck in ACTIVE state. What does the ACTIVE state indicate in EIGRP, and what condition causes a route to remain stuck in ACTIVE?

Accepted Answer

In EIGRP, a route enters the ACTIVE state when the local router loses its successor and sends Query messages to all neighbours seeking an alternative path. The route remains ACTIVE until all Query replies are received. If a neighbour does not reply within the active timer (default 3 minutes), the neighbour is declared stuck-in-active (SIA) and the adjacency is reset. This is commonly caused by slow WAN links, query propagation to distant routers, or memory/CPU issues. The other options describe unrelated EIGRP conditions.

Question 12

A wireless RF engineer performs a site survey for a new Wi-Fi 6 deployment. Which metric directly measures the RF signal quality and accounts for both signal strength and noise floor, helping predict wireless performance?

Accepted Answer

SNR (Signal-to-Noise Ratio) measures the difference in dB between the received signal strength and the noise floor at the receiver. A higher SNR indicates better signal quality and enables higher modulation rates (e.g., 1024-QAM in 802.11ax). RSSI measures absolute signal strength but does not account for noise; a strong signal in a noisy environment may still provide poor throughput. Channel utilization measures how busy the medium is but not signal quality. Transmit power is a configuration parameter, not a measurement of received quality.

Question 13

A wireless engineer uses Cisco DNA Center to monitor RF health. Which Cisco CleanAir feature detects and classifies non-802.11 RF interference sources such as microwave ovens, Bluetooth devices, and video cameras?

Accepted Answer

Cisco CleanAir is a spectrum intelligence technology built into Cisco APs that uses a dedicated spectrum analysis chip to detect, classify, and locate non-802.11 interference sources (such as microwave ovens, Bluetooth, DECT phones, video cameras) by their RF signature. CleanAir data feeds into Cisco DNA Center's wireless health dashboard and RRMS to allow the controller to automatically move channels away from persistent interferers. RRMS/DCA is the channel assignment algorithm that uses CleanAir data as input. The RF health score is a DNA Center metric. 802.11k is a client-to-AP signaling protocol for neighbour discovery.

Question 14

A network engineer configures Cisco DNA Center wireless assurance. Which metric does Cisco DNA Center use to represent the overall health of a wireless client's connection, combining onboarding, connectivity, and RF quality into a single score?

Accepted Answer

Cisco DNA Center Assurance computes a client health score on a 0–10 scale that combines multiple dimensions of a wireless client's experience: onboarding events (DHCP, AAA, association), connectivity (link speed, retransmissions), and RF quality (RSSI, SNR). This composite score allows engineers to quickly identify degraded clients without correlating multiple individual metrics. RSSI alone is a single RF metric. AP radio utilization and WLC CPU utilization are infrastructure metrics, not per-client health indicators.

Question 15

A network engineer troubleshoots an intermittent wireless connectivity issue using Cisco DNA Center. Which DNA Center feature captures a detailed timeline of a specific client's onboarding events, association attempts, DHCP transactions, and roaming history?

Accepted Answer

The Client 360 view in Cisco DNA Center provides a comprehensive per-client timeline showing all events related to a specific device: association and authentication events, DHCP lease transactions, roaming events, RF metric history (RSSI, SNR, channel), and application experience data. This allows engineers to pinpoint exactly when a connectivity issue occurred and what event preceded it. Network Time Travel is a Cisco DNA Center feature for querying historical network state. AI Network Analytics uses machine learning to detect anomalies across the network. Intelligent Capture (iCAP) triggers targeted packet captures on APs for a specific client or AP.

Question 16

A wireless security engineer designs authentication for an enterprise WLAN. Which EAP method uses a server-side certificate for mutual authentication and client-side certificates for user/device identity, providing the highest level of 802.1X security?

Accepted Answer

EAP-TLS (Transport Layer Security) provides mutual certificate-based authentication: the RADIUS server presents a server certificate and the client presents a client certificate. Both sides validate the other's certificate against a trusted CA, making it the strongest 802.1X method because it does not rely on passwords that can be brute-forced. PEAP-MSCHAPv2 uses a server certificate but authenticates the client with an MS-CHAPv2 password inside the TLS tunnel. EAP-FAST uses Protected Access Credentials (PACs) and optionally certificates. LEAP is a deprecated Cisco-proprietary method with known cryptographic weaknesses.

Question 17

A wireless security engineer evaluates WPA3-Personal versus WPA2-Personal for a new WLAN. Which security improvement does WPA3-Personal provide that is absent in WPA2-Personal?

Accepted Answer

WPA3-Personal replaces the Pre-Shared Key (PSK) 4-way handshake with SAE (Simultaneous Authentication of Equals), a Dragonfly-based key exchange that provides forward secrecy (each session generates a unique PMK) and is resistant to offline dictionary attacks. Even if an attacker captures the SAE handshake, they cannot perform an offline brute-force attack against the password. AES-CCMP was already mandatory in WPA2 (TKIP was optional for compatibility). WPA3 does not require 802.1X. The key length difference alone does not describe the fundamental security improvement.

Question 18

A wireless security engineer configures a Cisco WLC to detect and contain rogue access points. In Cisco's rogue AP classification model, which rogue classification indicates that the rogue AP is connected to the corporate wired network and poses the greatest security risk?

Accepted Answer

A malicious rogue AP that is detected as being physically connected to the internal corporate wired network (rogue on wire) poses the greatest threat because it provides an unauthorized wireless entry point directly onto the trusted network. The Cisco WLC determines this by checking whether the rogue AP's BSSID is seen in the wired Ethernet infrastructure using techniques such as ARP/IP correlation and detecting the rogue AP's MAC in switch MAC tables via SNMP. A friendly rogue is an AP from a neighbouring organization. An unclassified rogue has not been evaluated. An ad hoc rogue is a direct peer-to-peer wireless connection without infrastructure.

Question 19

A network security engineer configures 802.1X on a Cisco Catalyst switch port. Which RADIUS attribute does the RADIUS server send in the Access-Accept response to assign a VLAN to the authenticated client?

Accepted Answer

IEEE 802.1X dynamic VLAN assignment uses three RADIUS tunnel attributes returned in the Access-Accept message: Attribute 64 (Tunnel-Type) set to VLAN (13), Attribute 65 (Tunnel-Medium-Type) set to 802 (6), and Attribute 81 (Tunnel-Private-Group-ID) containing the VLAN ID or name as a string. The switch reads these attributes and dynamically assigns the authenticated port to the specified VLAN. Attribute 6 (Service-Type) indicates the type of service (framed, login, etc.). Attribute 25 (Class) is an opaque value passed between RADIUS and the NAS. Attribute 8 (Framed-IP-Address) assigns an IP address, applicable to PPP/VPN, not 802.1X wired/wireless VLAN assignment.

Question 20

A wireless security team wants to protect a guest WLAN from clients eavesdropping on each other's traffic within the same SSID. Which Cisco WLC feature prevents wireless clients on the same WLAN from directly communicating with each other at Layer 2?

Accepted Answer

Client isolation (Peer-to-Peer blocking) is a WLC WLAN configuration option that prevents wireless clients associated to the same SSID from directly communicating with each other at Layer 2. Traffic from one client must exit through the WLC/gateway, where it can be inspected or dropped. This is commonly used for guest WLANs. WIPS containment sends deauthentication frames to disconnect rogue devices. Layer 3 security with web authentication controls initial access but does not prevent client-to-client traffic after authentication. MFP protects 802.11 management frames from spoofing and replay attacks.

Question 21

A network engineer uses Ansible to automate Cisco Catalyst 9800 WLC configuration. Which Ansible connection plugin is used to connect to IOS-XE devices such as the Catalyst 9800 WLC over SSH?

Accepted Answer

The ansible.netcommon.network_cli connection plugin is used for SSH-based CLI management of network devices running IOS, IOS-XE, IOS-XR, NX-OS, and other platforms. For the Cisco Catalyst 9800 WLC (IOS-XE), network_cli combined with `ansible_network_os: cisco.ios.ios` or `cisco.iosxe` is the standard SSH connection method. ansible.netcommon.httpapi is used for devices that expose REST/RESTCONF APIs (such as the 9800 can also use). ansible.netcommon.netconf is for NETCONF connections. ansible.builtin.ssh is the general-purpose SSH connection for Linux hosts, not network devices.

Question 22

A network engineer writes a Python script to automate wireless network management using the Cisco DNA Center REST API. The script first authenticates and obtains a token. Which HTTP header must all subsequent DNA Center API requests include to pass the authentication token?

Accepted Answer

Cisco DNA Center REST API uses the custom header `X-Auth-Token` to carry the authentication token obtained from the POST /dna/system/api/v1/auth/token endpoint. All subsequent API calls must include this header with the token value. Authorization: Bearer is used by OAuth2-based APIs such as Cisco Intersight. A Cookie header is used by session-cookie-based APIs such as Cisco APIC and UCS Manager. APIC-cookie is the specific ACI APIC authentication cookie header.

Question 23

An engineer uses Python to interact with a Cisco IOS-XE device RESTCONF API. The engineer sends a GET request to retrieve interface statistics. Which Python library and method are commonly used to send HTTP requests in such automation scripts?

Accepted Answer

The Python `requests` library provides a simple and widely-used HTTP client API. requests.get(url, headers=headers, verify=False) sends an HTTP GET request and returns a Response object whose .json() method parses the JSON response body. It supports all HTTP methods (GET, POST, PUT, PATCH, DELETE) needed for RESTCONF. socket.connect() is a raw TCP socket and does not handle HTTP. urllib2 is the Python 2 module; Python 3 uses urllib.request, which is more verbose than requests. netmiko.send_command() is an SSH CLI library, not an HTTP library.

Question 24

A network engineer uses Terraform to manage Cisco DNA Center wireless configurations as infrastructure as code. Which Terraform command applies the planned changes to Cisco DNA Center after reviewing the plan output?

Accepted Answer

terraform apply executes the actions proposed in a Terraform plan and makes the actual API calls to the target system (in this case Cisco DNA Center via its REST API provider) to create, update, or delete resources to match the desired state defined in the HCL configuration files. terraform plan generates and displays the execution plan without making any changes. terraform validate checks HCL syntax and configuration semantics without contacting the provider. terraform push is not a valid Terraform CLI command.

Question 25

A network engineer designs a model-driven telemetry solution for a Cisco Catalyst 9800 WLC to stream wireless client association events to an external collector. Which IOS-XE telemetry subscription type sends data only when the subscribed YANG path value changes?

Accepted Answer

IOS-XE Model-Driven Telemetry (MDT) supports on-change subscriptions, which send an update notification only when the value of the subscribed YANG path changes from its last reported value. This is efficient for event-driven data like wireless client state changes (associated/disassociated). A periodic subscription sends data at fixed intervals regardless of changes, which generates unnecessary traffic for slowly-changing state. A one-time snapshot is a single-shot query. gNMI POLL is a request-response mode, not a push subscription.

350-401 ENCOR — Cisco Certified Network Professional (CCNP) Wireless