Cisco Certified Network Associate (CCNA) 200-301 Practice Test 25
Question 240
A switching team must implement a change. An office deploys cloud-managed Wi-Fi where cloud services administer configuration while working APs can locally forward traffic where supported. Which technical decision most directly meets these requirements?
- Assume every associated client packet must traverse the cloud portal and that Wi-Fi always stops when Internet access fails.
- Use only local autonomous console settings while claiming all WLAN policy and telemetry are centrally cloud managed.
- Use a cloud-managed WLAN platform for configuration/telemetry while confirming that the selected AP supports local client-data forwarding during cloud disconnects.
- Disable the branch Ethernet VLANs because cloud management carries all local client frames by definition.
Explanation
Correct Answer
C:The management control plane can be cloud-hosted while some AP deployments bridge or route user packets locally. Survivability differs by platform, so verify the actual service behavior under a simulated cloud outage.
Incorrect Answers
A:Cloud-managed control does not universally imply cloud-tunneled user data; forwarding design is platform-specific.
B:Standalone local provisioning alone does not implement the requested cloud policy control plane.
D:Local bridging still requires valid LAN uplink/VLAN connectivity where that model is selected.
Question 241
Troubleshooting report: A site expects controller-wide WLAN changes to reach a standalone autonomous AP, but it has no controller join process. Which finding best accounts for the behavior?
- The AP is fully joined to the WLC, so the problem must be an LACP hash imbalance.
- The AP is autonomous and does not participate in the controller join/policy mechanism; controller-side changes will not automatically configure it.
- Every autonomous AP automatically subscribes to WLC WLAN policy on the same Ethernet VLAN.
- The switch trunk native VLAN forces the AP to import all WLC radio settings without any control session.
Explanation
Correct Answer
B:Controller-based WLAN policies target joined lightweight APs. A standalone autonomous AP retains locally managed settings unless separately reconfigured or replaced with a supported controller-based unit.
Incorrect Answers
A:The premise says there is no controller join process, unlike a joined lightweight AP.
C:L2 VLAN proximity is not equivalent to a CAPWAP-managed AP joining a controller.
D:Trunk tagging and central WLAN policy distribution are separate mechanisms.
Question 242
An AP receives a DHCP lease yet never joins its WLC because controller discovery or secure join traffic is unsuccessful. The team should investigate which specific technical cause?
- The AP has IP connectivity but CAPWAP WLC discovery, control connectivity, certificates or join authorization is failing; inspect AP and controller join logs.
- The AP must be joined because DHCP successfully supplied a lease.
- The AP requires a separate wired 802.1Q trunk for every SSID before any CAPWAP control traffic can form.
- The issue is necessarily a client PSK mismatch even though no AP join has completed.
Explanation
Correct Answer
A:An AP can obtain DHCP without locating a controller or completing CAPWAP control establishment. Check configured controller discovery, reachability and join diagnostics rather than assuming the AP is adopted.
Incorrect Answers
B:A lease proves IP bootstrap, not CAPWAP discovery or secure controller join.
C:SSID data VLAN design is not the exclusive prerequisite for controller discovery/join.
D:Client WPA security is a later service stage; the observed failure is AP-to-controller management.
Question 243
A switching team must explain an outage. Under centrally tunneled forwarding, branch users lose data connectivity whenever the WAN path to headquarters fails. Which diagnosis follows from these observations?
- The AP is already locally switching all client data to a branch VLAN, so HQ WAN loss necessarily blocks local DHCP packets.
- The branch WLAN uses centrally tunneled client data, making HQ/WLC WAN reachability a data-path dependency; local switching could eliminate that dependence if supported.
- A valid local Ethernet access port guarantees centralized CAPWAP data tunneling will work with the WAN down.
- The symptom proves the RF channel is jammed whenever the WAN link fails.
Explanation
Correct Answer
B:With central switching, client payloads are encapsulated toward the controller over CAPWAP. Losing that path can interrupt traffic even when a branch AP remains powered and broadcasting.
Incorrect Answers
A:Local switching is designed to avoid routing every data packet through the remote central controller path.
C:Physical branch connectivity cannot carry a required remote central tunnel across a failed WAN.
D:A repeated WAN-dependent outage under central tunneling points to forwarding path, not necessarily interference.
Question 244
A switching team collects this evidence: A nearby user sees no client association from an AP configured exclusively as a monitor sensor, although the radio is powered. Which root-cause interpretation best fits the observations?
- The radio is operating as a monitor sensor rather than a serving AP, so it is not advertising/accepting normal client associations.
- A monitor-only radio always serves ordinary clients simultaneously because its power LED is on.
- The only cause is a wrong PC IPv4 default route, even though the client cannot associate over 802.11.
- The AP must lack PoE power because it is running an active RF monitor.
Explanation
Correct Answer
A:Power and RF receive capability do not imply a client-service SSID. A monitor radio scans channels for security/RRM observations and may be deliberately unavailable for normal stations.
Incorrect Answers
B:Monitor mode can be exclusively scan-oriented without client association service.
C:Association is link-layer radio behavior; an IPv4 gateway is irrelevant until after association.
D:The premise states the radio is powered and operational as a sensor.
Question 245
Troubleshooting report: Cloud telemetry and configuration access stop during an Internet outage, but the AP's local client forwarding may continue. Which finding best accounts for the behavior?
- All locally bridged AP traffic must stop immediately whenever the cloud management dashboard is unreachable.
- The AP becomes a central CAPWAP WLC automatically when Internet fails.
- The loss of cloud telemetry proves the Ethernet port has no physical link.
- Cloud management and telemetry depend on Internet/cloud reachability, whereas locally switched client forwarding may remain available if the AP supports offline operation.
Explanation
Correct Answer
D:A cloud outage can make administration and analytics inaccessible without necessarily tearing down every established local data path. Test SSID/authentication and forwarding survivability for the specific platform.
Incorrect Answers
A:Some cloud-managed APs forward locally while cloud configuration and reporting are unavailable.
B:Losing cloud control does not convert AP management roles by itself.
C:Management-plane reachability and physical link status are independent signals.
Question 246
A switching team has repaired a network problem. A site expects controller-wide WLAN changes to reach a standalone autonomous AP, but it has no controller join process. Which device or protocol check is the strongest evidence that this particular failure is gone?
- Check only a central WLC joined-AP list and fail the test if the autonomous AP is not present.
- Confirm an Ethernet cable is plugged in while the radio SSID remains incorrect.
- Run an OSPF neighbor command on an adjacent router as sole proof the autonomous WLAN configuration is correct.
- Locally inspect the autonomous AP SSID, radio/channel, encryption and WLAN settings and confirm a test client associates and passes its intended VLAN traffic.
Explanation
Correct Answer
D:Because the AP is standalone, controller WLAN profiles are not the authoritative source of its settings. Successful local WLAN tests verify the correctly applied policy without requiring a nonexistent WLC join.
Incorrect Answers
A:The site deliberately uses an AP with no WLC join mechanism; a WLC join is not the repair criterion.
B:Carrier does not validate local SSID, security or client association settings.
C:Dynamic routing does not establish the AP radio policy or successful 802.11 client association.
Question 247
A network acceptance test follows this reported failure: An AP receives a DHCP lease yet never joins its WLC because controller discovery or secure join traffic is unsuccessful. Which verification most specifically demonstrates the repaired function rather than checking an unrelated feature?
- The AP still has only an IPv4 lease and cannot be found in WLC joined AP records.
- The WLC joined-AP inventory lists the intended AP in joined/registered state with a stable CAPWAP control session and correct WLAN policy.
- An unrelated AP is registered to the WLC, while the affected AP has no CAPWAP control session.
- The access switch port is up/up but the WLC rejects the AP certificate.
Explanation
Correct Answer
B:The earlier AP had DHCP but not a controller join. Controller registration logs and stable CAPWAP state directly validate discovery and secure join, before testing client WLAN service.
Incorrect Answers
A:A DHCP lease was present even during the original join failure.
C:Another radio’s success cannot prove this AP joins.
D:Physical link alone is not successful controller authorization/join.
Question 248
A switching team is validating a repair. Earlier, under centrally tunneled forwarding, branch users lose data connectivity whenever the WAN path to headquarters fails. Which postchange check most directly establishes the specific problem is resolved?
- The AP still tunnels all user data centrally, and branch traffic stops as soon as the WAN fails.
- The AP advertises the SSID but clients receive no local VLAN access during the WAN test.
- The AP/WLAN reports FlexConnect local switching with correct branch VLAN mapping, and branch clients retain local data connectivity during a controlled controller-WAN outage.
- A separate monitor-only AP scans successfully while branch users continue losing data on the production WLAN.
Explanation
Correct Answer
C:The initial centrally tunneled WLAN lost data when the WAN went down. Actual mode, VLAN configuration and failure simulation test that the repaired design no longer depends on HQ data tunneling.
Incorrect Answers
A:Central tunneling makes client data forwarding dependent on a working WAN path to the controller or central data anchor. A branch WLAN that still loses data when that path is cut has not achieved the required local-switching independence.
B:Radio visibility alone does not prove local user-data continuity.
D:Sensor operation does not validate the production SSID forwarding mode.
Question 249
An AP needs a sufficient negotiated PoE budget, Ethernet data VLAN and a DHCP lease for controller discovery. The team needs a solution consistent with this requirement. Which option is the most appropriate design or configuration decision?
- Rely on a link LED as proof of sufficient power even when the switch reports insufficient PoE allocation.
- Configure only a WLAN SSID on the WLC and leave the AP uplink VLAN unable to obtain an address.
- Enable DTP desirable on the AP port to manufacture additional PoE power from VLAN tags.
- Provide a switchport with the AP’s required PoE power class/budget, an appropriate management/data VLAN and DHCP/controller-reachable IP connectivity.
Explanation
Correct Answer
D:An AP can have Ethernet carrier yet fail boot or radio operation when available PoE power is insufficient. Correct VLAN and IP bootstrapping then allow discovery of the WLC in a controller-based design.
Incorrect Answers
A:Ethernet carrier is not proof that an AP receives the negotiated watts required to initialize its radios.
B:Controller policy cannot reach an AP without appropriate local LAN/IP control reachability.
C:Trunk negotiation does not increase the physical power budget supplied by PoE.
Question 250
A switching team is evaluating a deployment. An AP locally switches two SSIDs into VLAN 10 and VLAN 20 through a tagged switch uplink. What approach correctly addresses the stated requirement?
- Configure the locally switching AP Ethernet uplink as a compatible 802.1Q trunk carrying tagged WLAN client VLANs 10 and 20, with a suitable native/management VLAN.
- Use an ordinary access VLAN 10 port and assume it transports tagged VLAN 20 frames without trunking.
- Allow VLAN 10 only on the operational trunk and expect VLAN 20 SSID clients to obtain their correct gateway.
- Configure the AP in monitor-only mode instead of verifying local WLAN VLAN tags.
Explanation
Correct Answer
A:Locally switched WLAN traffic must preserve client SSID-to-VLAN mappings across the wired AP uplink. A correctly configured trunk carries both VLAN identities rather than collapsing all stations into one access VLAN.
Incorrect Answers
B:A single access VLAN cannot preserve both intended client VLANs from the AP.
C:Pruning VLAN 20 breaks the second locally switched client data path.
D:A monitor radio cannot replace the requested production SSID client forwarding.
