Topic 09 Practice Test 1 covers WLAN GUI Client Connectivity for Cisco Certified Network Associate 200-301 CCNA and maps to objectives 2.9. For broader exam preparation, review the Cisco CCNA 200-301 Exam Dumps. Every option includes focused technical reasoning explaining both the networking concept and its fit to the scenario.
Question 1
Aster is creating a new employee WLAN on a Catalyst 9800. Which configuration object defines the WLAN identity, including its profile and SSID characteristics? Choose ONE.
- Policy tag
- WLAN profile
- Site tag
- RF tag
Correct Answer: B
Correct Answer
Answer B is correct because The WLAN profile defines the wireless network identity and WLAN-specific properties, including the SSID presented to clients. At Aster, WLAN profile evidence is checked directly. The WLAN profile choice at Aster therefore meets the required outcome. At Aster, the WLAN profile state is observable afterward.
Incorrect Answers
Answer A is incorrect because A policy tag maps an existing WLAN profile to a policy profile; it does not replace the WLAN object that defines the SSID itself. At Aster, WLAN profile evidence is checked directly. The Policy tag choice at Aster therefore misses the required outcome. At Aster, the WLAN profile state is observable afterward.
Answer C is incorrect because A site tag controls site-specific AP behavior and FlexConnect-related policy rather than creating the client WLAN identity. At Aster, WLAN profile evidence is checked directly. The Site tag choice at Aster therefore misses the required outcome. At Aster, the WLAN profile state is observable afterward.
Answer D is incorrect because An RF tag groups radio-frequency profiles and is not the object used to define an SSID/WLAN for client association. At Aster, WLAN profile evidence is checked directly. The RF tag choice at Aster therefore misses the required outcome. At Aster, the WLAN profile state is observable afterward.
Question 2
Cobalt created a WLAN and policy mapping but intentionally left the WLAN disabled. What must happen before APs can advertise that WLAN through an enabled mapping? Choose ONE.
- Enable CDP globally
- Change the native VLAN on the AP switchport
- Enable the WLAN profile
- Convert the AP to sniffer mode
Correct Answer: C
Correct Answer
Answer C is correct because The WLAN profile must be enabled before the controller can deploy and advertise it through an applicable policy-tag mapping. At Cobalt, WLAN enablement evidence is checked directly. The Enable the choice at Cobalt therefore meets the required outcome. At Cobalt, the WLAN enablement state is observable afterward.
Incorrect Answers
Answer B is incorrect because Changing an AP switchport native VLAN does not administratively enable a WLAN profile that is disabled in controller configuration. At Cobalt, WLAN enablement evidence is checked directly. The Change the choice at Cobalt therefore misses the required outcome. At Cobalt, the WLAN enablement state is observable afterward.
Answer A is incorrect because CDP affects Cisco neighbor discovery and has no role in enabling or advertising an administratively disabled WLAN. At Cobalt, WLAN enablement evidence is checked directly. The Enable CDP choice at Cobalt therefore misses the required outcome. At Cobalt, the WLAN enablement state is observable afterward.
Answer D is incorrect because Sniffer mode is for packet capture and would prevent normal client service rather than cause the WLAN to be advertised. At Cobalt, WLAN enablement evidence is checked directly. The Convert the choice at Cobalt therefore misses the required outcome. At Cobalt, the WLAN enablement state is observable afterward.
Question 3
Ember requires a personal-mode WLAN protected with a shared secret rather than an enterprise RADIUS exchange. Which security approach best fits? Choose ONE.
- Open authentication with no encryption
- TACACS+ command authorization
- 802.1X with a RADIUS server
- WPA2/WPA3 Personal with a pre-shared key
Correct Answer: D
Correct Answer
Answer D is correct because A personal-mode WLAN uses a shared secret/PSK with the selected WPA generation, matching a design that intentionally does not use per-user 802.1X authentication. At Ember, personal security evidence is checked directly. The WPA2/WPA3 Personal choice at Ember therefore meets the required outcome. At Ember, the personal security state is observable afterward.
Incorrect Answers
Answer C is incorrect because 802.1X with RADIUS provides enterprise identity-based authentication and does not match a requirement for one shared WLAN secret. At Ember, personal security evidence is checked directly. The 802.1X with choice at Ember therefore misses the required outcome. At Ember, the personal security state is observable afterward.
Answer A is incorrect because An open WLAN does not provide the requested protected shared-key access and exposes traffic to risks the design is intended to avoid. At Ember, personal security evidence is checked directly. The Open authentication choice at Ember therefore misses the required outcome. At Ember, the personal security state is observable afterward.
Answer B is incorrect because TACACS+ is typically used for network-device administration and command authorization, not as the client-side personal WLAN security mechanism. At Ember, personal security evidence is checked directly. The TACACS+ command choice at Ember therefore misses the required outcome. At Ember, the personal security state is observable afterward.
Question 4
Granite is deploying an enterprise WLAN where users authenticate individually against a central identity service. Which security model should be selected? Choose ONE.
- A single WPA2 pre-shared key for all users
- Open authentication
- CDP authentication
- 802.1X/enterprise authentication backed by RADIUS
Correct Answer: D
Correct Answer
Answer D is correct because Enterprise WLAN authentication uses 802.1X/EAP with a RADIUS-backed identity service so each user or device can be authenticated centrally. At Granite, enterprise security evidence is checked directly. The 802.1X/enterprise authentication choice at Granite therefore meets the required outcome. At Granite, the enterprise security state is observable afterward.
Incorrect Answers
Answer A is incorrect because A single pre-shared key provides shared-secret personal authentication and does not give the unique centrally managed identities required here. At Granite, enterprise security evidence is checked directly. The A single choice at Granite therefore misses the required outcome. At Granite, the enterprise security state is observable afterward.
Answer B is incorrect because Open authentication does not provide the requested identity verification through the enterprise AAA service. At Granite, enterprise security evidence is checked directly. The Open authentication choice at Granite therefore misses the required outcome. At Granite, the enterprise security state is observable afterward.
Answer C is incorrect because CDP is a neighbor-discovery protocol and cannot authenticate wireless clients. At Granite, enterprise security evidence is checked directly. The CDP authentication choice at Granite therefore misses the required outcome. At Granite, the enterprise security state is observable afterward.
Question 5
Ion’s enterprise WLAN already uses the correct 802.1X security method, but no authentication server is associated with the policy. What controller-side dependency should be checked? Choose ONE.
- CDP hold timer
- RADIUS/AAA server association for the WLAN policy
- RF tag channel width
- AP LED state
Correct Answer: B
Correct Answer
Answer B is correct because Enterprise authentication requires the controller to know which RADIUS server/group or AAA method to use for client authentication, so that association is fundamental to the login exchange. At Ion, RADIUS association evidence is checked directly. The RADIUS/AAA server choice at Ion therefore meets the required outcome. At Ion, the RADIUS association state is observable afterward.
Incorrect Answers
Answer C is incorrect because RF tag settings control radio behavior and do not tell the controller where to send user authentication requests. At Ion, RADIUS association evidence is checked directly. The RF tag choice at Ion therefore misses the required outcome. At Ion, the RADIUS association state is observable afterward.
Answer D is incorrect because AP LED state is operational/visual behavior and cannot provide AAA server reachability or selection. At Ion, RADIUS association evidence is checked directly. The AP LED choice at Ion therefore misses the required outcome. At Ion, the RADIUS association state is observable afterward.
Answer A is incorrect because CDP hold timers affect neighbor information lifetime and are unrelated to the wireless client authentication backend. At Ion, RADIUS association evidence is checked directly. The CDP hold choice at Ion therefore misses the required outcome. At Ion, the RADIUS association state is observable afterward.
Question 6
Keystone maps an employee WLAN to a policy profile that should place centrally switched clients into VLAN 30. Where should the intended client network/VLAN policy be checked? Choose ONE.
- The controller NTP configuration
- The AP’s CDP neighbor table
- The policy profile mapped to the WLAN
- The RF tag only
Correct Answer: C
Correct Answer
Answer C is correct because The policy profile carries network and switching policy for the WLAN/client session, including the client network/VLAN association in a centrally switched design. At Keystone, client VLAN policy evidence is checked directly. The The policy choice at Keystone therefore meets the required outcome. At Keystone, the client VLAN policy state is observable afterward.
Incorrect Answers
Answer D is incorrect because An RF tag manages radio/RF profiles and is not the primary object that assigns the client VLAN for the WLAN. At Keystone, client VLAN policy evidence is checked directly. The The RF choice at Keystone therefore misses the required outcome. At Keystone, the client VLAN policy state is observable afterward.
Answer B is incorrect because CDP neighbor information helps verify physical neighbors but does not determine which client VLAN the WLAN uses. At Keystone, client VLAN policy evidence is checked directly. The The AP’s choice at Keystone therefore misses the required outcome. At Keystone, the client VLAN policy state is observable afterward.
Answer A is incorrect because NTP synchronizes time and does not control the client network/VLAN selected after wireless association. At Keystone, client VLAN policy evidence is checked directly. The The controller choice at Keystone therefore misses the required outcome. At Keystone, the client VLAN policy state is observable afterward.
Question 7
Mesa has created WLAN `Corp` and policy profile `Corp-Policy`. Which object maps those two profiles so APs assigned the object can receive the WLAN-policy pairing? Choose ONE.
- Policy tag
- Interface range
- RF tag
- Site tag
Correct Answer: A
Correct Answer
Answer A is correct because A policy tag explicitly maps each WLAN profile to a policy profile, and that mapping is distributed to APs assigned the tag when the relevant profiles are enabled. At Mesa, policy mapping evidence is checked directly. The Policy tag choice at Mesa therefore meets the required outcome. At Mesa, the policy mapping state is observable afterward.
Incorrect Answers
Answer D is incorrect because A site tag controls site/AP operational characteristics and FlexConnect-related configuration rather than mapping a WLAN profile to a policy profile. At Mesa, policy mapping evidence is checked directly. The Site tag choice at Mesa therefore misses the required outcome. At Mesa, the policy mapping state is observable afterward.
Answer C is incorrect because An RF tag assigns radio-frequency profiles and is separate from the WLAN-to-policy mapping. At Mesa, policy mapping evidence is checked directly. The RF tag choice at Mesa therefore misses the required outcome. At Mesa, the policy mapping state is observable afterward.
Answer B is incorrect because An interface range is a switch configuration construct and does not define Catalyst 9800 WLAN/policy relationships. At Mesa, policy mapping evidence is checked directly. The Interface range choice at Mesa therefore misses the required outcome. At Mesa, the policy mapping state is observable afterward.
Question 8
Orchid creates the correct policy tag but assigns a different tag to the target AP. What is the likely client-facing result? Choose ONE.
- Assign the required policy tag to the target AP
- Enable LACP on the AP radio
- Change the switch root bridge
- Configure a static route on every client
Correct Answer: A
Correct Answer
Answer A is correct because An AP receives the WLAN/policy mappings defined by its assigned policy tag; assigning the correct tag is therefore required for that WLAN to be available on the AP. At Orchid, AP policy tag evidence is checked directly. The Assign the choice at Orchid therefore meets the required outcome. At Orchid, the AP policy tag state is observable afterward.
Incorrect Answers
Answer C is incorrect because Spanning-tree root placement may affect wired topology but does not create a missing WLAN mapping inside the AP’s policy tag. At Orchid, AP policy tag evidence is checked directly. The Change the choice at Orchid therefore misses the required outcome. At Orchid, the AP policy tag state is observable afterward.
Answer B is incorrect because LACP is a wired link-aggregation protocol and is not enabled on an AP radio to deploy WLAN configuration. At Orchid, AP policy tag evidence is checked directly. The Enable LACP choice at Orchid therefore misses the required outcome. At Orchid, the AP policy tag state is observable afterward.
Answer D is incorrect because Clients do not fix controller-to-AP policy deployment by adding static routes; the missing WLAN is a controller tagging/configuration issue. At Orchid, AP policy tag evidence is checked directly. The Configure a choice at Orchid therefore misses the required outcome. At Orchid, the AP policy tag state is observable afterward.
Question 9
Quartz is deploying a branch where APs use FlexConnect behavior. Which tag is most closely associated with site-specific AP mode and Flex profile settings? Choose ONE.
- VLAN tag
- RF tag
- Site tag
- Policy tag
Correct Answer: C
Correct Answer
Answer C is correct because The site tag groups site-specific AP settings and determines local-mode versus FlexConnect-related behavior and profiles for the AP. At Quartz, site tag evidence is checked directly. The Site tag choice at Quartz therefore meets the required outcome. At Quartz, the site tag state is observable afterward.
Incorrect Answers
Answer D is incorrect because A policy tag maps WLAN profiles to policy profiles; it does not by itself define the AP’s site/FlexConnect operating characteristics. At Quartz, site tag evidence is checked directly. The Policy tag choice at Quartz therefore misses the required outcome. At Quartz, the site tag state is observable afterward.
Answer B is incorrect because An RF tag selects radio-frequency profiles and is separate from site-specific FlexConnect behavior. At Quartz, site tag evidence is checked directly. The RF tag choice at Quartz therefore misses the required outcome. At Quartz, the site tag state is observable afterward.
Answer A is incorrect because `VLAN tag` is not the Catalyst 9800 configuration object used to group AP site and FlexConnect settings. At Quartz, site tag evidence is checked directly. The VLAN tag choice at Quartz therefore misses the required outcome. At Quartz, the site tag state is observable afterward.
Question 10
Summit’s voice WLAN requires differentiated treatment from a best-effort guest WLAN. In the Catalyst 9800 GUI, where should the engineer review the WLAN/client QoS policies? Choose ONE.
- The QoS and AVC settings in the mapped policy profile
- The CDP device ID
- The native VLAN on every client device
- The root bridge priority only
Correct Answer: A
Correct Answer
Answer A is correct because Catalyst 9800 policy profiles expose QoS and AVC settings for WLAN and client traffic, including ingress and egress service-policy selection. At Summit, wireless QoS evidence is checked directly. The The QoS choice at Summit therefore meets the required outcome. At Summit, the wireless QoS state is observable afterward.
Incorrect Answers
Answer B is incorrect because CDP device identity has no mechanism for applying wireless traffic classification or QoS policy. At Summit, wireless QoS evidence is checked directly. The The CDP choice at Summit therefore misses the required outcome. At Summit, the wireless QoS state is observable afterward.
Answer C is incorrect because Client devices do not set the infrastructure’s native VLAN as a means of obtaining the controller’s WLAN QoS treatment. At Summit, wireless QoS evidence is checked directly. The The native choice at Summit therefore misses the required outcome. At Summit, the wireless QoS state is observable afterward.
Answer D is incorrect because Spanning-tree root priority influences Layer 2 topology and does not select per-WLAN or per-client QoS policy. At Summit, wireless QoS evidence is checked directly. The The root choice at Summit therefore misses the required outcome. At Summit, the wireless QoS state is observable afterward.
Question 11
Aster wants centrally switched wireless clients so data traverses the controller path rather than being switched locally at the branch AP. Which policy choice aligns with that goal? Choose ONE.
- Monitor mode
- FlexConnect local switching
- Central switching for the WLAN/client policy
- Sniffer mode
Correct Answer: C
Correct Answer
Answer C is correct because Central switching keeps the client data path anchored through the controller-side infrastructure rather than locally bridging client data at the remote AP site. At Aster, central switching evidence is checked directly. The Central switching choice at Aster therefore meets the required outcome. At Aster, the central switching state is observable afterward.
Incorrect Answers
Answer B is incorrect because FlexConnect local switching intentionally bridges client data into the local branch network and therefore produces the opposite path from the stated requirement. At Aster, central switching evidence is checked directly. The FlexConnect local choice at Aster therefore misses the required outcome. At Aster, the central switching state is observable afterward.
Answer A is incorrect because Monitor mode dedicates AP resources to RF observation and does not select a client data-switching path for a production WLAN. At Aster, central switching evidence is checked directly. The Monitor mode choice at Aster therefore misses the required outcome. At Aster, the central switching state is observable afterward.
Answer D is incorrect because Sniffer mode is for packet capture and is not a client-serving switching policy. At Aster, central switching evidence is checked directly. The Sniffer mode choice at Aster therefore misses the required outcome. At Aster, the central switching state is observable afterward.
Question 12
Cobalt’s branch WLAN should remain locally switched to the branch VLAN rather than tunnel data to headquarters. Which setting is most aligned with that requirement? Choose ONE.
- Put the AP in monitor mode
- Disable the site tag
- Force central switching
- Enable the appropriate FlexConnect local-switching behavior
Correct Answer: D
Correct Answer
Answer D is correct because FlexConnect local switching allows branch client data to be bridged onto the local wired network according to policy, avoiding an unnecessary central data path. At Cobalt, local switching evidence is checked directly. The Enable the choice at Cobalt therefore meets the required outcome. At Cobalt, the local switching state is observable afterward.
Incorrect Answers
Answer C is incorrect because Central switching sends client traffic through the controller path and therefore does not satisfy the local-breakout requirement. At Cobalt, local switching evidence is checked directly. The Force central choice at Cobalt therefore misses the required outcome. At Cobalt, the local switching state is observable afterward.
Answer A is incorrect because Monitor mode stops normal client service and is not a method for providing local branch forwarding. At Cobalt, local switching evidence is checked directly. The Put the choice at Cobalt therefore misses the required outcome. At Cobalt, the local switching state is observable afterward.
Answer B is incorrect because Removing the site tag can disrupt the intended AP/site configuration and does not specifically implement approved local switching. At Cobalt, local switching evidence is checked directly. The Disable the choice at Cobalt therefore misses the required outcome. At Cobalt, the local switching state is observable afterward.
Question 13
Ember configures a WLAN for WPA2-PSK, but a test client is set to WPA2-Enterprise/802.1X. What is the most likely result? Choose ONE.
- Change the AP’s CDP timer
- Increase the switch STP priority
- Make the client and WLAN authentication/key-management method match
- Add an EtherChannel member
Correct Answer: C
Correct Answer
Answer C is correct because The client and WLAN must agree on compatible authentication and key-management methods; a PSK client/security mismatch with enterprise 802.1X prevents successful authentication. At Ember, AKM compatibility evidence is checked directly. The Make the choice at Ember therefore meets the required outcome. At Ember, the AKM compatibility state is observable afterward.
Incorrect Answers
Answer A is incorrect because CDP timer values affect neighbor discovery and do not reconcile incompatible wireless authentication methods. At Ember, AKM compatibility evidence is checked directly. The Change the choice at Ember therefore misses the required outcome. At Ember, the AKM compatibility state is observable afterward.
Answer B is incorrect because Spanning-tree priority influences Layer 2 topology and cannot fix a client/WLAN AKM mismatch when the SSID is already reachable. At Ember, AKM compatibility evidence is checked directly. The Increase the choice at Ember therefore misses the required outcome. At Ember, the AKM compatibility state is observable afterward.
Answer D is incorrect because EtherChannel capacity on the wired side does not change the authentication protocol the client and WLAN negotiate. At Ember, AKM compatibility evidence is checked directly. The Add an choice at Ember therefore misses the required outcome. At Ember, the AKM compatibility state is observable afterward.
Question 14
Granite’s employee WLAN authenticates correctly but users receive guest-network DHCP addresses. The policy tag mapping is correct. Which setting should be checked next? Choose ONE.
- The controller’s CDP platform string
- The client VLAN/network setting in the mapped policy profile
- The AP radio channel number
- The WLAN display name only
Correct Answer: B
Correct Answer
Answer B is correct because The mapped policy profile determines the client network/switching policy, so an incorrect VLAN/network assignment can place successfully authenticated users into the wrong subnet. At Granite, client VLAN evidence is checked directly. The The client choice at Granite therefore meets the required outcome. At Granite, the client VLAN state is observable afterward.
Incorrect Answers
Answer C is incorrect because Radio channel selection affects RF operation but does not assign a successfully joined client to a different wired VLAN. At Granite, client VLAN evidence is checked directly. The The AP choice at Granite therefore misses the required outcome. At Granite, the client VLAN state is observable afterward.
Answer D is incorrect because The display/profile name is an identifier and does not by itself change the client data VLAN. At Granite, client VLAN evidence is checked directly. The The WLAN choice at Granite therefore misses the required outcome. At Granite, the client VLAN state is observable afterward.
Answer A is incorrect because CDP platform strings are neighbor-discovery metadata and have no role in assigning wireless clients to a subnet. At Granite, client VLAN evidence is checked directly. The The controller’s choice at Granite therefore misses the required outcome. At Granite, the client VLAN state is observable afterward.
Question 15
Ion’s AP has a valid policy tag, but that tag does not contain a mapping for WLAN 20. What is the most direct correction? Choose ONE.
- Create a new CDP neighbor
- Enable Root Guard on the AP switchport
- Change the AP management IP to the client subnet
- Add the WLAN-to-policy-profile mapping to the AP’s policy tag
Correct Answer: D
Correct Answer
Answer D is correct because The policy tag must include the WLAN profile mapped to the intended policy profile; otherwise APs assigned that tag do not receive that WLAN/policy pair. At Ion, missing mapping evidence is checked directly. The Add the choice at Ion therefore meets the required outcome. At Ion, the missing mapping state is observable afterward.
Incorrect Answers
Answer C is incorrect because AP management addressing is separate from client WLAN deployment and should not be moved into the client subnet merely to fix a missing mapping. At Ion, missing mapping evidence is checked directly. The Change the choice at Ion therefore misses the required outcome. At Ion, the missing mapping state is observable afterward.
Answer B is incorrect because Root Guard protects spanning-tree root placement and cannot create a WLAN-to-policy mapping in the wireless controller. At Ion, missing mapping evidence is checked directly. The Enable Root choice at Ion therefore misses the required outcome. At Ion, the missing mapping state is observable afterward.
Answer A is incorrect because CDP neighbors are discovered rather than manually created and have no role in deploying the WLAN. At Ion, missing mapping evidence is checked directly. The Create a choice at Ion therefore misses the required outcome. At Ion, the missing mapping state is observable afterward.
Question 16
Keystone’s WLAN is configured correctly but remains administratively disabled. Which symptom is most consistent with that state? Choose ONE.
- The switch trunk converts to access mode
- The WLAN mapping is not actively deployed/advertised for client use
- The AP automatically enters sniffer mode
- Clients authenticate but receive a different VLAN only
Correct Answer: B
Correct Answer
Answer B is correct because An administratively disabled WLAN is not available for normal client service even if its related policy objects exist, so enabling the WLAN is required for deployment/advertisement. At Keystone, disabled WLAN evidence is checked directly. The The WLAN choice at Keystone therefore meets the required outcome. At Keystone, the disabled WLAN state is observable afterward.
Incorrect Answers
Answer D is incorrect because Wrong-VLAN placement points to network policy after association; a disabled WLAN prevents the client from reaching that stage. At Keystone, disabled WLAN evidence is checked directly. The Clients authenticate choice at Keystone therefore misses the required outcome. At Keystone, the disabled WLAN state is observable afterward.
Answer C is incorrect because Wireless profile state does not automatically change an AP into sniffer mode. At Keystone, disabled WLAN evidence is checked directly. The The AP choice at Keystone therefore misses the required outcome. At Keystone, the disabled WLAN state is observable afterward.
Answer A is incorrect because A controller WLAN enable/disable setting cannot change the Layer 2 mode of the AP’s upstream switchport. At Keystone, disabled WLAN evidence is checked directly. The The switch choice at Keystone therefore misses the required outcome. At Keystone, the disabled WLAN state is observable afterward.
Question 17
Mesa is considering hiding an SSID and claims that this alone provides strong access security. Which assessment is correct? Choose ONE.
- SSID hiding encrypts all 802.11 management and data frames
- SSID hiding is not a substitute for proper authentication and encryption
- A hidden SSID automatically enables WPA3-Enterprise
- A hidden SSID makes RADIUS unnecessary for enterprise authentication
Correct Answer: B
Correct Answer
Answer B is correct because Suppressing routine SSID advertisement may reduce casual visibility, but it is not a robust authentication or encryption control; proper WLAN security must still be configured. At Mesa, SSID security evidence is checked directly. The SSID hiding choice at Mesa therefore meets the required outcome. At Mesa, the SSID security state is observable afterward.
Incorrect Answers
Answer C is incorrect because Hiding an SSID does not automatically configure WPA3-Enterprise or an identity service. At Mesa, SSID security evidence is checked directly. The A hidden choice at Mesa therefore misses the required outcome. At Mesa, the SSID security state is observable afterward.
Answer A is incorrect because SSID visibility settings do not themselves encrypt wireless data or all management traffic. At Mesa, SSID security evidence is checked directly. The SSID hiding choice at Mesa therefore misses the required outcome. At Mesa, the SSID security state is observable afterward.
Answer D is incorrect because Enterprise authentication still depends on the configured AAA/security architecture; hidden SSID behavior does not eliminate that requirement. At Mesa, SSID security evidence is checked directly. The A hidden choice at Mesa therefore misses the required outcome. At Mesa, the SSID security state is observable afterward.
Question 18
Orchid’s enterprise WLAN is visible but all users time out at authentication after a firewall change. Which dependency should be tested first? Choose ONE.
- Replace the policy tag with an RF tag
- Enable PortFast on the client laptop
- RADIUS reachability/AAA exchange must be restored for enterprise logins
- Change the SSID name to force reauthentication
Correct Answer: C
Correct Answer
Answer C is correct because Enterprise 802.1X authentication depends on successful AAA exchanges with the configured RADIUS service, so loss of controller-to-RADIUS reachability prevents users from completing authentication. At Orchid, RADIUS reachability evidence is checked directly. The RADIUS reachability/AAA choice at Orchid therefore meets the required outcome. At Orchid, the RADIUS reachability state is observable afterward.
Incorrect Answers
Answer D is incorrect because Renaming the SSID does not restore the controller’s network path to the identity server and would create unnecessary client reconfiguration. At Orchid, RADIUS reachability evidence is checked directly. The Change the choice at Orchid therefore misses the required outcome. At Orchid, the RADIUS reachability state is observable afterward.
Answer B is incorrect because PortFast is a switchport spanning-tree feature and is not configured on a wireless client to repair RADIUS reachability. At Orchid, RADIUS reachability evidence is checked directly. The Enable PortFast choice at Orchid therefore misses the required outcome. At Orchid, the RADIUS reachability state is observable afterward.
Answer A is incorrect because RF tags control radio policy and cannot substitute for the policy/WLAN and AAA configuration required for enterprise authentication. At Orchid, RADIUS reachability evidence is checked directly. The Replace the choice at Orchid therefore misses the required outcome. At Orchid, the RADIUS reachability state is observable afterward.
Question 19
Quartz has built a new WLAN and policy profile. Which two relationships must be correct for a target AP to offer that WLAN under the intended policy? Choose TWO.
- The RF tag contains the client VLAN
- The policy tag maps the WLAN profile to the policy profile
- The target AP is assigned the policy tag containing that mapping
- The client configures the controller’s management IP as its gateway
- The switch elects the AP as STP root
Correct Answers: B, C
Correct Answers
Answer B is correct because The policy tag must contain the WLAN-to-policy-profile pair so the controller knows which client policy belongs to that WLAN. At Quartz, tag relationships evidence is checked directly. The The policy choice at Quartz therefore meets the required outcome. At Quartz, the tag relationships state is observable afterward.
Answer C is correct because The AP must be assigned the policy tag that contains the required mapping; otherwise the correct mapping exists but is not applied to that AP. At Quartz, tag relationships evidence is checked directly. The The target choice at Quartz therefore meets the required outcome. At Quartz, the tag relationships state is observable afterward.
Incorrect Answers
Answer A is incorrect because An RF tag selects radio profiles and does not contain the client WLAN-to-VLAN policy mapping described. At Quartz, tag relationships evidence is checked directly. The The RF choice at Quartz therefore misses the required outcome. At Quartz, the tag relationships state is observable afterward.
Answer D is incorrect because Wireless clients use the gateway for their client subnet, not the controller management address simply to make the WLAN appear. At Quartz, tag relationships evidence is checked directly. The The client choice at Quartz therefore misses the required outcome. At Quartz, the tag relationships state is observable afterward.
Answer E is incorrect because An AP is not elected as a spanning-tree root to receive WLAN configuration; STP root selection is unrelated to Catalyst 9800 policy-tag assignment. At Quartz, tag relationships evidence is checked directly. The The switch choice at Quartz therefore misses the required outcome. At Quartz, the tag relationships state is observable afterward.
Question 20
Summit is validating a new WLAN end to end. Which sequence best reflects the controller objects that must align before client testing? Choose ONE.
- Configure the client VLAN only on endpoint network adapters
- Complete WLAN/security, policy profile, policy-tag mapping, and AP tag assignment
- Configure only an RF tag; all WLAN and client policy settings are inherited automatically
- Enable CDP and let neighbor discovery build the WLAN policy
Correct Answer: B
Correct Answer
Answer B is correct because A usable deployment requires the WLAN/security definition, the client network policy, the WLAN-to-policy mapping, and application of that mapping to the intended APs; validating this chain isolates where client connectivity can fail. At Summit, end-to-end WLAN evidence is checked directly. The Complete WLAN/security, choice at Summit therefore meets the required outcome. At Summit, the end-to-end WLAN state is observable afterward.
Incorrect Answers
Answer C is incorrect because RF tags govern radio profiles and cannot automatically create WLAN security, client-network policy, and policy-tag mapping. At Summit, end-to-end WLAN evidence is checked directly. The Configure only choice at Summit therefore misses the required outcome. At Summit, the end-to-end WLAN state is observable afterward.
Answer A is incorrect because Client-side VLAN creation is not a substitute for controller WLAN and policy configuration in an enterprise wireless deployment. At Summit, end-to-end WLAN evidence is checked directly. The Configure the choice at Summit therefore misses the required outcome. At Summit, the end-to-end WLAN state is observable afterward.
Answer D is incorrect because CDP can help discover adjacent Cisco devices but does not synthesize WLANs or wireless policy objects. At Summit, end-to-end WLAN evidence is checked directly. The Enable CDP choice at Summit therefore misses the required outcome. At Summit, the end-to-end WLAN state is observable afterward.
