Cisco Implementing and Operating Cisco Wireless Core Technologies 350-101 WLCOR Exam Questions

Answer : D

The correct command is security dot1x authentication-list RADIUS_AUTH_LIST. On a Catalyst 9800 WLC, the WLAN configuration must bind the WLAN's 802.1X authentication process to an AAA authentication method list. Cisco's Catalyst 9800 802.1X configuration workflow shows the WLAN entered with wlan <wlan-id> <ssid-name>, followed by the command security dot1x authentication-list <dot1x-list-name>. Cisco configuration guide examples also show the same syntax under WLAN configuration mode as Device(config-wlan)# security dot1x authentication-list auth-list-name.

In the exhibit, security wpa akm dot1x enables 802.1X as the key-management method, while security wpa wpa2 and security wpa wpa2 ciphers aes establish WPA2/AES security. These statements define the WLAN security framework, but they do not identify which AAA method list will be used to reach the RADIUS backend. The missing command must therefore attach the named authentication list RADIUS_AUTH_LIST to dot1x authentication. Options A, B, and C are parser-invalid or incorrectly ordered IOS XE syntax. Reference topic: Client Connectivity Configuration --- WPA2-Enterprise WLAN configuration, 802.1X authentication, AAA method lists, RADIUS-backed client access, and Catalyst 9800 WLAN security commands.

Answer : A

To enforce adaptive policies based on user identity, device posture, and provide comprehensive visibility into device activity and location, Cisco recommends integrating Cisco Catalyst Center, Cisco ISE, and Cisco Spaces. Cisco ISE provides identity-based access control and posture assessment, allowing dynamic policy enforcement for users and devices. Mobile device management integration further extends posture checks for endpoint compliance. Cisco Catalyst Center enables real-time assurance and monitoring of network performance, device activity, and service health, while Cisco Spaces provides location analytics and visibility of client devices across the wireless environment. Option B relies solely on ACLs and MDM, which cannot provide full network-wide visibility or context-aware policy enforcement. Option C enables visibility via Catalyst Center but lacks dynamic identity and posture-based policies because it omits ISE integration. Option D integrates ISE but neglects device posture and location visibility, failing to meet all requirements. The combination in Option A ensures that adaptive policies can respond to real-time user and device conditions, enforce compliance, and provide actionable insights for network operations. Reference topics: Wireless Monitoring and Management --- Catalyst Center assurance, Cisco ISE integration, mobile device posture, Cisco Spaces location analytics.

Answer : C

In decibel calculations, the formula used to convert a power ratio to decibels (dB) is:

Thus, the power ratio of 10:1 corresponds to a 10 dB change in power.

Option A: -20 dB would correspond to a ratio of 0.01:1, not 10:1.

Option B: 5 dB would correspond to a power ratio of approximately 3.16:1, not 10:1.

Option D: 15 dB would correspond to a ratio of 31.62:1, not 10:1.

Therefore, Option C: 10 dB is the correct answer, as it is the result of a power ratio of 10:1.

Thus, the power ratio of 10:1 corresponds to a 10 dB change in power.

Option A: -20 dB would correspond to a ratio of 0.01:1, not 10:1.

Option B: 5 dB would correspond to a power ratio of approximately 3.16:1, not 10:1.

Option D: 15 dB would correspond to a ratio of 31.62:1, not 10:1.

Therefore, Option C: 10 dB is the correct answer, as it is the result of a power ratio of 10:1.

Answer : A

In Cisco Catalyst 9800 WLAN configurations, assigning a VLAN to a WLAN is done using the access vlan <vlan-id> command under the WLAN context. This ensures that clients associating with the guest SSID are placed in the correct Layer 2 VLAN for proper segmentation and network access. The exhibit shows that security features are removed and the WLAN is operational, but no VLAN is yet assigned. Option A correctly uses access vlan 10 under the WLAN configuration, enabling client traffic to be tagged or untagged into VLAN 10 for site A deployment. Option B is invalid syntax; simply using vlan 10 is insufficient and not recognized in IOS XE WLAN configuration. Options C and D involve policy profile commands, which define WLAN policies but do not directly assign the VLAN to the guest WLAN itself. Cisco Wireless Core Technologies emphasize that proper VLAN assignment ensures guest isolation, correct DHCP assignment, and traffic segregation, which is critical for security and compliance in enterprise deployments. Assigning the VLAN in this manner also allows downstream switches to correctly forward traffic to the intended network segment. Reference topics: Client Connectivity Configuration --- WLAN VLAN assignment, guest SSID, access vlan, Cisco Catalyst 9800.

Answer : D

To enable WPA2-Enterprise with RADIUS authentication on a Cisco Catalyst 9800 WLC, the WLAN configuration must specify the use of 802.1X as the authentication mechanism. The command security wpa wpa2 akm dot1x explicitly instructs the WLAN to use WPA2 encryption with the 802.1X authentication key management (AKM), which leverages the configured RADIUS server group for client authentication. Option B (security dot1x authentication-list) and Option C (security dot1x method-list) are legacy or IOS-style commands that define AAA method lists but do not directly bind the WLAN to WPA2-Enterprise security. Option A (security wpa enable) only enables WPA but does not define the authentication mode or RADIUS integration, which is insufficient for WPA2-Enterprise deployments. Cisco Wireless design guides emphasize that for staff or enterprise-class WLANs using external RADIUS servers, the WLAN's security profile must use WPA2 with AKM set to 802.1X. This ensures clients perform EAP authentication with the external server, supporting secure credential exchange and proper authorization. Correctly applying security wpa wpa2 akm dot1x in the WLAN configuration guarantees the WLC enforces encryption and authentication policies in line with enterprise security requirements. Reference topics: Client Connectivity Configuration --- WPA2-Enterprise, 802.1X, AKM, RADIUS integration on Cisco WLCs.

Answer : A

The requirement is guest client isolation, not merely guest authentication or internet breakout. On a Catalyst 9800 WLC, peer-to-peer blocking is the correct control because it prevents wireless clients associated to the same WLAN from communicating directly with one another. Cisco defines peer-to-peer blocking as a WLAN security feature applied to individual WLANs, where each client inherits the WLAN's P2P blocking behavior, and traffic can be bridged locally, dropped, or forwarded upstream. For this scenario, the appropriate action is the drop behavior, because guest-to-guest file sharing must be prohibited while upstream internet access remains available.

The dedicated guest VLAN, VLAN 30, provides traffic segmentation from production networks and creates a clean policy boundary for VisitorAccess. Cisco's Catalyst 9800 configuration model maps WLANs to policy profiles, and the policy profile defines client network and switching policy, including VLAN association. Options B, C, and D do not solve client isolation: local authentication validates users, FlexConnect/local switching changes traffic forwarding behavior, and multicast/RADIUS does not block unicast guest-to-guest traffic. Reference topics: Client Connectivity Configuration --- guest WLAN design, P2P blocking, VLAN segmentation, and Catalyst 9800 WLAN-to-policy mapping.

Answer : C

For a retail guest WLAN deployment, Cisco best practices dictate using central web authentication (web-auth) combined with access control lists (ACLs) to enforce network segmentation and restrict guest traffic to internet-only access. Central web authentication allows all guest devices to be redirected to a captive portal for login without requiring a pre-shared key or WPA2-Enterprise credentials, satisfying the ''no password'' requirement. Applying an ACL that blocks access to internal subnets ensures that guest traffic cannot interfere with corporate networks while still permitting internet connectivity. Option A is unsuitable because WPA2-Enterprise and dynamic VLAN assignment are designed for employee or secure networks, not open guest access. Option B provides local web-auth, which is limited to a single WLC and does not scale across multiple floors effectively. Option D (MAC filtering) only enforces device-level access but does not provide web-based login or segmentation, failing the requirement for captive portal and internet-only access. Cisco Wireless Core Technologies recommend central web authentication with ACL enforcement for guest networks to provide consistent coverage, network isolation, and compliance with security policies across multiple APs and WLCs. Reference topics: Client Connectivity Configuration --- Guest WLAN deployment, central web-auth, ACL enforcement, segmentation from corporate WLAN.