Topic 09 Practice Test 2 covers WLAN GUI Client Connectivity for Cisco Certified Network Associate 200-301 CCNA and maps to objectives 2.9. For broader exam preparation, review the Cisco CCNA 200-301 Exam Dumps. Every option includes focused technical reasoning explaining both the networking concept and its fit to the scenario.
Question 1
Beacon sees the correct client policy but the expected SSID was never defined as a WLAN profile. Which object should be created or corrected first? Choose ONE.
- Site tag
- WLAN profile
- Policy tag
- RF tag
Correct Answer: B
Correct Answer
Answer B is correct because The WLAN profile defines the wireless network identity and WLAN-specific properties, including the SSID presented to clients. At Beacon, WLAN profile troubleshooting uses this evidence. The WLAN profile path at Beacon therefore meets the stated constraint. At Beacon, the WLAN profile state is observable afterward.
Incorrect Answers
Answer C is incorrect because A policy tag maps an existing WLAN profile to a policy profile; it does not replace the WLAN object that defines the SSID itself. At Beacon, WLAN profile troubleshooting uses this evidence. The Policy tag path at Beacon therefore misses the stated constraint. At Beacon, the WLAN profile state is observable afterward.
Answer A is incorrect because A site tag controls site-specific AP behavior and FlexConnect-related policy rather than creating the client WLAN identity. At Beacon, WLAN profile troubleshooting uses this evidence. The Site tag path at Beacon therefore misses the stated constraint. At Beacon, the WLAN profile state is observable afterward.
Answer D is incorrect because An RF tag groups radio-frequency profiles and is not the object used to define an SSID/WLAN for client association. At Beacon, WLAN profile troubleshooting uses this evidence. The RF tag path at Beacon therefore misses the stated constraint. At Beacon, the WLAN profile state is observable afterward.
Question 2
Delta’s configuration appears complete, yet the SSID is not being presented because the WLAN profile itself is administratively disabled. Which setting should be corrected? Choose ONE.
- Enable CDP globally
- Convert the AP to sniffer mode
- Change the native VLAN on the AP switchport
- Enable the WLAN profile
Correct Answer: D
Correct Answer
Answer D is correct because The WLAN profile must be enabled before the controller can deploy and advertise it through an applicable policy-tag mapping. At Delta, WLAN enablement troubleshooting uses this evidence. The Enable the path at Delta therefore meets the stated constraint. At Delta, the WLAN enablement state is observable afterward.
Incorrect Answers
Answer C is incorrect because Changing an AP switchport native VLAN does not administratively enable a WLAN profile that is disabled in controller configuration. At Delta, WLAN enablement troubleshooting uses this evidence. The Change the path at Delta therefore misses the stated constraint. At Delta, the WLAN enablement state is observable afterward.
Answer A is incorrect because CDP affects Cisco neighbor discovery and has no role in enabling or advertising an administratively disabled WLAN. At Delta, WLAN enablement troubleshooting uses this evidence. The Enable CDP path at Delta therefore misses the stated constraint. At Delta, the WLAN enablement state is observable afterward.
Answer B is incorrect because Sniffer mode is for packet capture and would prevent normal client service rather than cause the WLAN to be advertised. At Delta, WLAN enablement troubleshooting uses this evidence. The Convert the path at Delta therefore misses the stated constraint. At Delta, the WLAN enablement state is observable afterward.
Question 3
Falcon clients fail because users are configured for WPA2-PSK while the WLAN expects enterprise 802.1X. If the design truly calls for a shared key, which WLAN security model should be selected? Choose ONE.
- 802.1X with a RADIUS server
- WPA2/WPA3 Personal with a pre-shared key
- Open authentication with no encryption
- TACACS+ command authorization
Correct Answer: B
Correct Answer
Answer B is correct because A personal-mode WLAN uses a shared secret/PSK with the selected WPA generation, matching a design that intentionally does not use per-user 802.1X authentication. At Falcon, personal security troubleshooting uses this evidence. The WPA2/WPA3 Personal path at Falcon therefore meets the stated constraint. At Falcon, the personal security state is observable afterward.
Incorrect Answers
Answer A is incorrect because 802.1X with RADIUS provides enterprise identity-based authentication and does not match a requirement for one shared WLAN secret. At Falcon, personal security troubleshooting uses this evidence. The 802.1X with path at Falcon therefore misses the stated constraint. At Falcon, the personal security state is observable afterward.
Answer C is incorrect because An open WLAN does not provide the requested protected shared-key access and exposes traffic to risks the design is intended to avoid. At Falcon, personal security troubleshooting uses this evidence. The Open authentication path at Falcon therefore misses the stated constraint. At Falcon, the personal security state is observable afterward.
Answer D is incorrect because TACACS+ is typically used for network-device administration and command authorization, not as the client-side personal WLAN security mechanism. At Falcon, personal security troubleshooting uses this evidence. The TACACS+ command path at Falcon therefore misses the stated constraint. At Falcon, the personal security state is observable afterward.
Question 4
Harbor wants to eliminate a shared wireless password and instead authenticate employees with unique credentials through the AAA infrastructure. Which approach fits? Choose ONE.
- CDP authentication
- A single WPA2 pre-shared key for all users
- Open authentication
- 802.1X/enterprise authentication backed by RADIUS
Correct Answer: D
Correct Answer
Answer D is correct because Enterprise WLAN authentication uses 802.1X/EAP with a RADIUS-backed identity service so each user or device can be authenticated centrally. At Harbor, enterprise security troubleshooting uses this evidence. The 802.1X/enterprise authentication path at Harbor therefore meets the stated constraint. At Harbor, the enterprise security state is observable afterward.
Incorrect Answers
Answer B is incorrect because A single pre-shared key provides shared-secret personal authentication and does not give the unique centrally managed identities required here. At Harbor, enterprise security troubleshooting uses this evidence. The A single path at Harbor therefore misses the stated constraint. At Harbor, the enterprise security state is observable afterward.
Answer C is incorrect because Open authentication does not provide the requested identity verification through the enterprise AAA service. At Harbor, enterprise security troubleshooting uses this evidence. The Open authentication path at Harbor therefore misses the stated constraint. At Harbor, the enterprise security state is observable afterward.
Answer A is incorrect because CDP is a neighbor-discovery protocol and cannot authenticate wireless clients. At Harbor, enterprise security troubleshooting uses this evidence. The CDP authentication path at Harbor therefore misses the stated constraint. At Harbor, the enterprise security state is observable afterward.
Question 5
Juniper clients reach the enterprise SSID but every login times out; packet traces show the controller never sends authentication requests to the identity service. Which configuration area is most relevant? Choose ONE.
- CDP hold timer
- AP LED state
- RF tag channel width
- RADIUS/AAA server association for the WLAN policy
Correct Answer: D
Correct Answer
Answer D is correct because Enterprise authentication requires the controller to know which RADIUS server/group or AAA method to use for client authentication, so that association is fundamental to the login exchange. At Juniper, RADIUS association troubleshooting uses this evidence. The RADIUS/AAA server path at Juniper therefore meets the stated constraint. At Juniper, the RADIUS association state is observable afterward.
Incorrect Answers
Answer C is incorrect because RF tag settings control radio behavior and do not tell the controller where to send user authentication requests. At Juniper, RADIUS association troubleshooting uses this evidence. The RF tag path at Juniper therefore misses the stated constraint. At Juniper, the RADIUS association state is observable afterward.
Answer B is incorrect because AP LED state is operational/visual behavior and cannot provide AAA server reachability or selection. At Juniper, RADIUS association troubleshooting uses this evidence. The AP LED path at Juniper therefore misses the stated constraint. At Juniper, the RADIUS association state is observable afterward.
Answer A is incorrect because CDP hold timers affect neighbor information lifetime and are unrelated to the wireless client authentication backend. At Juniper, RADIUS association troubleshooting uses this evidence. The CDP hold path at Juniper therefore misses the stated constraint. At Juniper, the RADIUS association state is observable afterward.
Question 6
Lumen clients authenticate successfully but receive addresses from VLAN 40 instead of the designed VLAN 30. Which wireless configuration object is the most relevant place to inspect the client network policy? Choose ONE.
- The controller NTP configuration
- The AP’s CDP neighbor table
- The policy profile mapped to the WLAN
- The RF tag only
Correct Answer: C
Correct Answer
Answer C is correct because The policy profile carries network and switching policy for the WLAN/client session, including the client network/VLAN association in a centrally switched design. At Lumen, client VLAN policy troubleshooting uses this evidence. The The policy path at Lumen therefore meets the stated constraint. At Lumen, the client VLAN policy state is observable afterward.
Incorrect Answers
Answer D is incorrect because An RF tag manages radio/RF profiles and is not the primary object that assigns the client VLAN for the WLAN. At Lumen, client VLAN policy troubleshooting uses this evidence. The The RF path at Lumen therefore misses the stated constraint. At Lumen, the client VLAN policy state is observable afterward.
Answer B is incorrect because CDP neighbor information helps verify physical neighbors but does not determine which client VLAN the WLAN uses. At Lumen, client VLAN policy troubleshooting uses this evidence. The The AP’s path at Lumen therefore misses the stated constraint. At Lumen, the client VLAN policy state is observable afterward.
Answer A is incorrect because NTP synchronizes time and does not control the client network/VLAN selected after wireless association. At Lumen, client VLAN policy troubleshooting uses this evidence. The The controller path at Lumen therefore misses the stated constraint. At Lumen, the client VLAN policy state is observable afterward.
Question 7
Northstar’s WLAN and policy profile are both enabled, but the AP’s assigned configuration lacks the WLAN-to-policy association. Which tag should be inspected? Choose ONE.
- RF tag
- Site tag
- Policy tag
- Interface range
Correct Answer: C
Correct Answer
Answer C is correct because A policy tag explicitly maps each WLAN profile to a policy profile, and that mapping is distributed to APs assigned the tag when the relevant profiles are enabled. At Northstar, policy mapping troubleshooting uses this evidence. The Policy tag path at Northstar therefore meets the stated constraint. At Northstar, the policy mapping state is observable afterward.
Incorrect Answers
Answer B is incorrect because A site tag controls site/AP operational characteristics and FlexConnect-related configuration rather than mapping a WLAN profile to a policy profile. At Northstar, policy mapping troubleshooting uses this evidence. The Site tag path at Northstar therefore misses the stated constraint. At Northstar, the policy mapping state is observable afterward.
Answer A is incorrect because An RF tag assigns radio-frequency profiles and is separate from the WLAN-to-policy mapping. At Northstar, policy mapping troubleshooting uses this evidence. The RF tag path at Northstar therefore misses the stated constraint. At Northstar, the policy mapping state is observable afterward.
Answer D is incorrect because An interface range is a switch configuration construct and does not define Catalyst 9800 WLAN/policy relationships. At Northstar, policy mapping troubleshooting uses this evidence. The Interface range path at Northstar therefore misses the stated constraint. At Northstar, the policy mapping state is observable afterward.
Question 8
Pioneer’s WLAN works on AP-A but not AP-B. Both APs are healthy, yet AP-B has a policy tag that does not include the WLAN mapping. What should be corrected? Choose ONE.
- Assign the required policy tag to the target AP
- Configure a static route on every client
- Enable LACP on the AP radio
- Change the switch root bridge
Correct Answer: A
Correct Answer
Answer A is correct because An AP receives the WLAN/policy mappings defined by its assigned policy tag; assigning the correct tag is therefore required for that WLAN to be available on the AP. At Pioneer, AP policy tag troubleshooting uses this evidence. The Assign the path at Pioneer therefore meets the stated constraint. At Pioneer, the AP policy tag state is observable afterward.
Incorrect Answers
Answer D is incorrect because Spanning-tree root placement may affect wired topology but does not create a missing WLAN mapping inside the AP’s policy tag. At Pioneer, AP policy tag troubleshooting uses this evidence. The Change the path at Pioneer therefore misses the stated constraint. At Pioneer, the AP policy tag state is observable afterward.
Answer C is incorrect because LACP is a wired link-aggregation protocol and is not enabled on an AP radio to deploy WLAN configuration. At Pioneer, AP policy tag troubleshooting uses this evidence. The Enable LACP path at Pioneer therefore misses the stated constraint. At Pioneer, the AP policy tag state is observable afterward.
Answer B is incorrect because Clients do not fix controller-to-AP policy deployment by adding static routes; the missing WLAN is a controller tagging/configuration issue. At Pioneer, AP policy tag troubleshooting uses this evidence. The Configure a path at Pioneer therefore misses the stated constraint. At Pioneer, the AP policy tag state is observable afterward.
Question 9
Redwood moves an AP into a remote-site design and needs the controller to apply the site’s FlexConnect characteristics. Which tag should be reviewed? Choose ONE.
- Policy tag
- Site tag
- RF tag
- VLAN tag
Correct Answer: B
Correct Answer
Answer B is correct because The site tag groups site-specific AP settings and determines local-mode versus FlexConnect-related behavior and profiles for the AP. At Redwood, site tag troubleshooting uses this evidence. The Site tag path at Redwood therefore meets the stated constraint. At Redwood, the site tag state is observable afterward.
Incorrect Answers
Answer A is incorrect because A policy tag maps WLAN profiles to policy profiles; it does not by itself define the AP’s site/FlexConnect operating characteristics. At Redwood, site tag troubleshooting uses this evidence. The Policy tag path at Redwood therefore misses the stated constraint. At Redwood, the site tag state is observable afterward.
Answer C is incorrect because An RF tag selects radio-frequency profiles and is separate from site-specific FlexConnect behavior. At Redwood, site tag troubleshooting uses this evidence. The RF tag path at Redwood therefore misses the stated constraint. At Redwood, the site tag state is observable afterward.
Answer D is incorrect because `VLAN tag` is not the Catalyst 9800 configuration object used to group AP site and FlexConnect settings. At Redwood, site tag troubleshooting uses this evidence. The VLAN tag path at Redwood therefore misses the stated constraint. At Redwood, the site tag state is observable afterward.
Question 10
Tundra sees correct SSID, security, and client VLAN settings but voice traffic is not receiving the intended QoS policy. Which policy-profile area should be inspected? Choose ONE.
- The QoS and AVC settings in the mapped policy profile
- The native VLAN on every client device
- The CDP device ID
- The root bridge priority only
Correct Answer: A
Correct Answer
Answer A is correct because Catalyst 9800 policy profiles expose QoS and AVC settings for WLAN and client traffic, including ingress and egress service-policy selection. At Tundra, wireless QoS troubleshooting uses this evidence. The The QoS path at Tundra therefore meets the stated constraint. At Tundra, the wireless QoS state is observable afterward.
Incorrect Answers
Answer C is incorrect because CDP device identity has no mechanism for applying wireless traffic classification or QoS policy. At Tundra, wireless QoS troubleshooting uses this evidence. The The CDP path at Tundra therefore misses the stated constraint. At Tundra, the wireless QoS state is observable afterward.
Answer B is incorrect because Client devices do not set the infrastructure’s native VLAN as a means of obtaining the controller’s WLAN QoS treatment. At Tundra, wireless QoS troubleshooting uses this evidence. The The native path at Tundra therefore misses the stated constraint. At Tundra, the wireless QoS state is observable afterward.
Answer D is incorrect because Spanning-tree root priority influences Layer 2 topology and does not select per-WLAN or per-client QoS policy. At Tundra, wireless QoS troubleshooting uses this evidence. The The root path at Tundra therefore misses the stated constraint. At Tundra, the wireless QoS state is observable afterward.
Question 11
Beacon clients unexpectedly exit locally at a FlexConnect branch instead of using the central data path. Which switching policy should be examined? Choose ONE.
- Central switching for the WLAN/client policy
- Monitor mode
- Sniffer mode
- FlexConnect local switching
Correct Answer: A
Correct Answer
Answer A is correct because Central switching keeps the client data path anchored through the controller-side infrastructure rather than locally bridging client data at the remote AP site. At Beacon, central switching troubleshooting uses this evidence. The Central switching path at Beacon therefore meets the stated constraint. At Beacon, the central switching state is observable afterward.
Incorrect Answers
Answer D is incorrect because FlexConnect local switching intentionally bridges client data into the local branch network and therefore produces the opposite path from the stated requirement. At Beacon, central switching troubleshooting uses this evidence. The FlexConnect local path at Beacon therefore misses the stated constraint. At Beacon, the central switching state is observable afterward.
Answer B is incorrect because Monitor mode dedicates AP resources to RF observation and does not select a client data-switching path for a production WLAN. At Beacon, central switching troubleshooting uses this evidence. The Monitor mode path at Beacon therefore misses the stated constraint. At Beacon, the central switching state is observable afterward.
Answer C is incorrect because Sniffer mode is for packet capture and is not a client-serving switching policy. At Beacon, central switching troubleshooting uses this evidence. The Sniffer mode path at Beacon therefore misses the stated constraint. At Beacon, the central switching state is observable afterward.
Question 12
Delta’s WAN utilization is high because wireless branch clients are centrally switched. The approved design calls for local breakout. Which WLAN/Flex policy should be changed? Choose ONE.
- Force central switching
- Enable the appropriate FlexConnect local-switching behavior
- Put the AP in monitor mode
- Disable the site tag
Correct Answer: B
Correct Answer
Answer B is correct because FlexConnect local switching allows branch client data to be bridged onto the local wired network according to policy, avoiding an unnecessary central data path. At Delta, local switching troubleshooting uses this evidence. The Enable the path at Delta therefore meets the stated constraint. At Delta, the local switching state is observable afterward.
Incorrect Answers
Answer A is incorrect because Central switching sends client traffic through the controller path and therefore does not satisfy the local-breakout requirement. At Delta, local switching troubleshooting uses this evidence. The Force central path at Delta therefore misses the stated constraint. At Delta, the local switching state is observable afterward.
Answer C is incorrect because Monitor mode stops normal client service and is not a method for providing local branch forwarding. At Delta, local switching troubleshooting uses this evidence. The Put the path at Delta therefore misses the stated constraint. At Delta, the local switching state is observable afterward.
Answer D is incorrect because Removing the site tag can disrupt the intended AP/site configuration and does not specifically implement approved local switching. At Delta, local switching troubleshooting uses this evidence. The Disable the path at Delta therefore misses the stated constraint. At Delta, the local switching state is observable afterward.
Question 13
Falcon’s SSID is visible and RF signal is strong, but association/authentication fails because the client and WLAN use different AKM/security methods. What should be corrected? Choose ONE.
- Make the client and WLAN authentication/key-management method match
- Add an EtherChannel member
- Change the AP’s CDP timer
- Increase the switch STP priority
Correct Answer: A
Correct Answer
Answer A is correct because The client and WLAN must agree on compatible authentication and key-management methods; a PSK client/security mismatch with enterprise 802.1X prevents successful authentication. At Falcon, AKM compatibility troubleshooting uses this evidence. The Make the path at Falcon therefore meets the stated constraint. At Falcon, the AKM compatibility state is observable afterward.
Incorrect Answers
Answer C is incorrect because CDP timer values affect neighbor discovery and do not reconcile incompatible wireless authentication methods. At Falcon, AKM compatibility troubleshooting uses this evidence. The Change the path at Falcon therefore misses the stated constraint. At Falcon, the AKM compatibility state is observable afterward.
Answer D is incorrect because Spanning-tree priority influences Layer 2 topology and cannot fix a client/WLAN AKM mismatch when the SSID is already reachable. At Falcon, AKM compatibility troubleshooting uses this evidence. The Increase the path at Falcon therefore misses the stated constraint. At Falcon, the AKM compatibility state is observable afterward.
Answer B is incorrect because EtherChannel capacity on the wired side does not change the authentication protocol the client and WLAN negotiate. At Falcon, AKM compatibility troubleshooting uses this evidence. The Add an path at Falcon therefore misses the stated constraint. At Falcon, the AKM compatibility state is observable afterward.
Question 14
Harbor clients join the correct SSID but land in the wrong subnet. Which controller configuration is the most direct suspect after confirming the WLAN-to-policy mapping? Choose ONE.
- The client VLAN/network setting in the mapped policy profile
- The controller’s CDP platform string
- The WLAN display name only
- The AP radio channel number
Correct Answer: A
Correct Answer
Answer A is correct because The mapped policy profile determines the client network/switching policy, so an incorrect VLAN/network assignment can place successfully authenticated users into the wrong subnet. At Harbor, client VLAN troubleshooting uses this evidence. The The client path at Harbor therefore meets the stated constraint. At Harbor, the client VLAN state is observable afterward.
Incorrect Answers
Answer D is incorrect because Radio channel selection affects RF operation but does not assign a successfully joined client to a different wired VLAN. At Harbor, client VLAN troubleshooting uses this evidence. The The AP path at Harbor therefore misses the stated constraint. At Harbor, the client VLAN state is observable afterward.
Answer C is incorrect because The display/profile name is an identifier and does not by itself change the client data VLAN. At Harbor, client VLAN troubleshooting uses this evidence. The The WLAN path at Harbor therefore misses the stated constraint. At Harbor, the client VLAN state is observable afterward.
Answer B is incorrect because CDP platform strings are neighbor-discovery metadata and have no role in assigning wireless clients to a subnet. At Harbor, client VLAN troubleshooting uses this evidence. The The controller’s path at Harbor therefore misses the stated constraint. At Harbor, the client VLAN state is observable afterward.
Question 15
Juniper created WLAN 20 and Policy20, yet APs assigned Tag-Branch never receive the WLAN because Tag-Branch lacks the pair. Which step is missing? Choose ONE.
- Create a new CDP neighbor
- Enable Root Guard on the AP switchport
- Change the AP management IP to the client subnet
- Add the WLAN-to-policy-profile mapping to the AP’s policy tag
Correct Answer: D
Correct Answer
Answer D is correct because The policy tag must include the WLAN profile mapped to the intended policy profile; otherwise APs assigned that tag do not receive that WLAN/policy pair. At Juniper, missing mapping troubleshooting uses this evidence. The Add the path at Juniper therefore meets the stated constraint. At Juniper, the missing mapping state is observable afterward.
Incorrect Answers
Answer C is incorrect because AP management addressing is separate from client WLAN deployment and should not be moved into the client subnet merely to fix a missing mapping. At Juniper, missing mapping troubleshooting uses this evidence. The Change the path at Juniper therefore misses the stated constraint. At Juniper, the missing mapping state is observable afterward.
Answer B is incorrect because Root Guard protects spanning-tree root placement and cannot create a WLAN-to-policy mapping in the wireless controller. At Juniper, missing mapping troubleshooting uses this evidence. The Enable Root path at Juniper therefore misses the stated constraint. At Juniper, the missing mapping state is observable afterward.
Answer A is incorrect because CDP neighbors are discovered rather than manually created and have no role in deploying the WLAN. At Juniper, missing mapping troubleshooting uses this evidence. The Create a path at Juniper therefore misses the stated constraint. At Juniper, the missing mapping state is observable afterward.
Question 16
Lumen’s AP is healthy, its policy tag includes the mapping, and the policy profile is enabled, but the WLAN profile itself is disabled. What should the engineer expect? Choose ONE.
- The AP automatically enters sniffer mode
- Clients authenticate but receive a different VLAN only
- The WLAN mapping is not actively deployed/advertised for client use
- The switch trunk converts to access mode
Correct Answer: C
Correct Answer
Answer C is correct because An administratively disabled WLAN is not available for normal client service even if its related policy objects exist, so enabling the WLAN is required for deployment/advertisement. At Lumen, disabled WLAN troubleshooting uses this evidence. The The WLAN path at Lumen therefore meets the stated constraint. At Lumen, the disabled WLAN state is observable afterward.
Incorrect Answers
Answer B is incorrect because Wrong-VLAN placement points to network policy after association; a disabled WLAN prevents the client from reaching that stage. At Lumen, disabled WLAN troubleshooting uses this evidence. The Clients authenticate path at Lumen therefore misses the stated constraint. At Lumen, the disabled WLAN state is observable afterward.
Answer A is incorrect because Wireless profile state does not automatically change an AP into sniffer mode. At Lumen, disabled WLAN troubleshooting uses this evidence. The The AP path at Lumen therefore misses the stated constraint. At Lumen, the disabled WLAN state is observable afterward.
Answer D is incorrect because A controller WLAN enable/disable setting cannot change the Layer 2 mode of the AP’s upstream switchport. At Lumen, disabled WLAN troubleshooting uses this evidence. The The switch path at Lumen therefore misses the stated constraint. At Lumen, the disabled WLAN state is observable afterward.
Question 17
Northstar’s security review finds the guest SSID hidden but otherwise open. Why is that insufficient as an authentication control? Choose ONE.
- A hidden SSID makes RADIUS unnecessary for enterprise authentication
- SSID hiding encrypts all 802.11 management and data frames
- A hidden SSID automatically enables WPA3-Enterprise
- SSID hiding is not a substitute for proper authentication and encryption
Correct Answer: D
Correct Answer
Answer D is correct because Suppressing routine SSID advertisement may reduce casual visibility, but it is not a robust authentication or encryption control; proper WLAN security must still be configured. At Northstar, SSID security troubleshooting uses this evidence. The SSID hiding path at Northstar therefore meets the stated constraint. At Northstar, the SSID security state is observable afterward.
Incorrect Answers
Answer C is incorrect because Hiding an SSID does not automatically configure WPA3-Enterprise or an identity service. At Northstar, SSID security troubleshooting uses this evidence. The A hidden path at Northstar therefore misses the stated constraint. At Northstar, the SSID security state is observable afterward.
Answer B is incorrect because SSID visibility settings do not themselves encrypt wireless data or all management traffic. At Northstar, SSID security troubleshooting uses this evidence. The SSID hiding path at Northstar therefore misses the stated constraint. At Northstar, the SSID security state is observable afterward.
Answer A is incorrect because Enterprise authentication still depends on the configured AAA/security architecture; hidden SSID behavior does not eliminate that requirement. At Northstar, SSID security troubleshooting uses this evidence. The A hidden path at Northstar therefore misses the stated constraint. At Northstar, the SSID security state is observable afterward.
Question 18
Pioneer’s WLAN configuration and client certificates are unchanged, but the controller can no longer reach the RADIUS server. What is the expected impact? Choose ONE.
- RADIUS reachability/AAA exchange must be restored for enterprise logins
- Change the SSID name to force reauthentication
- Enable PortFast on the client laptop
- Replace the policy tag with an RF tag
Correct Answer: A
Correct Answer
Answer A is correct because Enterprise 802.1X authentication depends on successful AAA exchanges with the configured RADIUS service, so loss of controller-to-RADIUS reachability prevents users from completing authentication. At Pioneer, RADIUS reachability troubleshooting uses this evidence. The RADIUS reachability/AAA path at Pioneer therefore meets the stated constraint. At Pioneer, the RADIUS reachability state is observable afterward.
Incorrect Answers
Answer B is incorrect because Renaming the SSID does not restore the controller’s network path to the identity server and would create unnecessary client reconfiguration. At Pioneer, RADIUS reachability troubleshooting uses this evidence. The Change the path at Pioneer therefore misses the stated constraint. At Pioneer, the RADIUS reachability state is observable afterward.
Answer C is incorrect because PortFast is a switchport spanning-tree feature and is not configured on a wireless client to repair RADIUS reachability. At Pioneer, RADIUS reachability troubleshooting uses this evidence. The Enable PortFast path at Pioneer therefore misses the stated constraint. At Pioneer, the RADIUS reachability state is observable afterward.
Answer D is incorrect because RF tags control radio policy and cannot substitute for the policy/WLAN and AAA configuration required for enterprise authentication. At Pioneer, RADIUS reachability troubleshooting uses this evidence. The Replace the path at Pioneer therefore misses the stated constraint. At Pioneer, the RADIUS reachability state is observable afterward.
Question 19
Redwood’s controller objects are individually valid, but an AP still does not provide the new WLAN. Which TWO tagging relationships should be verified together? Choose TWO.
- The target AP is assigned the policy tag containing that mapping
- The policy tag maps the WLAN profile to the policy profile
- The RF tag contains the client VLAN
- The client configures the controller’s management IP as its gateway
- The switch elects the AP as STP root
Correct Answers: A, B
Correct Answers
Answer B is correct because The policy tag must contain the WLAN-to-policy-profile pair so the controller knows which client policy belongs to that WLAN. At Redwood, tag relationships troubleshooting uses this evidence. The The policy path at Redwood therefore meets the stated constraint. At Redwood, the tag relationships state is observable afterward.
Answer A is correct because The AP must be assigned the policy tag that contains the required mapping; otherwise the correct mapping exists but is not applied to that AP. At Redwood, tag relationships troubleshooting uses this evidence. The The target path at Redwood therefore meets the stated constraint. At Redwood, the tag relationships state is observable afterward.
Incorrect Answers
Answer C is incorrect because An RF tag selects radio profiles and does not contain the client WLAN-to-VLAN policy mapping described. At Redwood, tag relationships troubleshooting uses this evidence. The The RF path at Redwood therefore misses the stated constraint. At Redwood, the tag relationships state is observable afterward.
Answer D is incorrect because Wireless clients use the gateway for their client subnet, not the controller management address simply to make the WLAN appear. At Redwood, tag relationships troubleshooting uses this evidence. The The client path at Redwood therefore misses the stated constraint. At Redwood, the tag relationships state is observable afterward.
Answer E is incorrect because An AP is not elected as a spanning-tree root to receive WLAN configuration; STP root selection is unrelated to Catalyst 9800 policy-tag assignment. At Redwood, tag relationships troubleshooting uses this evidence. The The switch path at Redwood therefore misses the stated constraint. At Redwood, the tag relationships state is observable afterward.
Question 20
Tundra has been troubleshooting isolated settings one at a time. Which high-level workflow is most useful for confirming that an SSID, security, client network policy, and AP deployment all line up? Choose ONE.
- Complete WLAN/security, policy profile, policy-tag mapping, and AP tag assignment
- Configure the client VLAN only on endpoint network adapters
- Enable CDP and let neighbor discovery build the WLAN policy
- Configure only an RF tag; all WLAN and client policy settings are inherited automatically
Correct Answer: A
Correct Answer
Answer A is correct because A usable deployment requires the WLAN/security definition, the client network policy, the WLAN-to-policy mapping, and application of that mapping to the intended APs; validating this chain isolates where client connectivity can fail. At Tundra, end-to-end WLAN troubleshooting uses this evidence. The Complete WLAN/security, path at Tundra therefore meets the stated constraint. At Tundra, the end-to-end WLAN state is observable afterward.
Incorrect Answers
Answer D is incorrect because RF tags govern radio profiles and cannot automatically create WLAN security, client-network policy, and policy-tag mapping. At Tundra, end-to-end WLAN troubleshooting uses this evidence. The Configure only path at Tundra therefore misses the stated constraint. At Tundra, the end-to-end WLAN state is observable afterward.
Answer B is incorrect because Client-side VLAN creation is not a substitute for controller WLAN and policy configuration in an enterprise wireless deployment. At Tundra, end-to-end WLAN troubleshooting uses this evidence. The Configure the path at Tundra therefore misses the stated constraint. At Tundra, the end-to-end WLAN state is observable afterward.
Answer C is incorrect because CDP can help discover adjacent Cisco devices but does not synthesize WLANs or wireless policy objects. At Tundra, end-to-end WLAN troubleshooting uses this evidence. The Enable CDP path at Tundra therefore misses the stated constraint. At Tundra, the end-to-end WLAN state is observable afterward.
