Cisco 350-101 - Implementing and Operating Cisco Wireless Core Technologies (350-101 WLCOR)v1.0

The correct configuration issecurity wpa wpa2 ciphers gcmp256. The WLAN already contains WPA3, SAE, FT-SAE, SAE-EXT-KEY, and FT-SAE-EXT-KEY AKMs, so adding another SAE-EXT-KEY command is not the missing element. For Wi-Fi 7 operation, Cisco states that WPA3-Personal requiresGCMP256 with SAE-EXT-KEY and/or FT + SAE-EXT-KEY, and that AES/CCMP128 clients do not operate as Wi-Fi 7 clients when the required stronger cipher combination is absent. Cisco’s Catalyst 9800 WPA3 security enhancement guide gives the CLI syntax directly:security wpa wpa2 ciphers gcmp256, which configures GCMP-256 cipher support.

Option D is therefore the only valid WLC command that enables the required cipher for Wi-Fi 7-capable client operation and higher throughput behavior. Option A uses incorrect syntax and is already functionally represented in the exhibit assecurity wpa akm sae ext-key. Options B and C use invalid cipher constructs; TKIP is legacy and incompatible with modern high-throughput WLAN operation. Reference topics:802.11be/Wi-Fi 7 security requirements, WPA3-Personal, SAE-EXT-KEY, GCMP-256 cipher support, and Catalyst 9800 WLAN security configuration.

The correct command isreceiver ip address 198.51.100.10 57555 protocol tls-native profile spaces-profilebecause it matches the Cisco IOS XE model-driven telemetry subscription syntax used on Catalyst 9800 controllers. Cisco documents the receiver statement under telemetry ietf subscription as receiver ip address ip-address receiver-port protocol protocol profile name, and describes it as the command that configures the receiver IP address, port, protocol, and profile for telemetry notifications.

In the exhibit, the subscription already defines the telemetry feed: encode-tdl encoding, a native stream, the TDL URI for ewlc/wlan_config, the WLC source address, and an on-change update policy. What is missing is the collector destination. For Cisco Spaces or Catalyst Center-style integrations, the WLC must know where to export telemetry and which secure transport profile to use. Cisco troubleshooting examples for Catalyst 9800 telemetry use the same command structure: receiver ip address X.X.X.X 25103 protocol tls-native profile ... under the telemetry subscription.

Options A, B, and D are invalid because they reorder the CLI keywords. IOS XE telemetry configuration is parser-order sensitive: the command begins with receiver ip address, followed by the receiver port, then protocol, then profile. Reference topic:Wireless Monitoring and Management — Catalyst 9800 streaming telemetry, Cisco Spaces integration, TLS transport, and telemetry receiver configuration.

A line-of-sight (LOS) RF connection requires a clear, unobstructed path between the transmitter and receiver. This ensures that the transmitted signal reaches the receiving device without attenuation, reflection, or diffraction caused by physical obstacles such as walls, furniture, or other structures. LOS conditions are critical for high-frequency RF links, particularly in the 5 GHz band, where signals cannot easily penetrate objects. While multipath propagation (Option A) and MIMO (Option B) techniques enhance throughput and reliability in non-line-of-sight environments, they do not satisfy the definition of LOS. Reflections (Option C) actually introduce delays, fading, and interference, which can degrade signal quality. In Cisco Wireless Core Technologies, understanding LOS is foundational for designing point-to-point wireless backhaul links, outdoor Wi-Fi deployments, and high-performance campus networks. Ensuring LOS minimizes path loss, maximizes received signal strength, and supports predictable coverage patterns. Proper site surveys, RF planning, and AP placement are used to maintain LOS where required, particularly for directional antennas or high-gain links. Reference topics:RF Fundamentals — Line-of-Sight (LOS), RF propagation, path loss, multipath effects, MIMO considerations.

The correct answer isreduction of co-channel interference. AI-RRM in Cisco Catalyst Center is designed for RF optimization, not IP addressing, software scheduling, or user identity classification. Cisco describes AI-enhanced RRM as applying artificial intelligence and machine learning to optimize RF environments and automate/adapt RF parameter tuning for Cisco wireless networks. This is directly tied to operational RF outcomes such as improved channel planning, transmit power behavior, channel width decisions, and better spectrum utilization.

Co-channel interference occurs when multiple AP radios operate on the same channel within hearing range, forcing devices to share airtime and increasing contention. AI-RRM uses telemetry, analytics, and learned RF behavior to recommend or apply more optimal RF configurations. Cisco specifically states that AI-enhanced RRM optimization can produce improvements such as up to a40 percent reduction in co-channel interferenceand SNR gains for wireless clients. Cisco’s AI-RRM deployment guidance also identifies AP radio distribution and utilization analysis as critical for minimizing co-channel interference and optimizing wireless performance.

Therefore, option B is the only operational outcome aligned with AI-RRM’s purpose. Reference topic:Automation and AI — Cisco Catalyst Center AI-RRM, RF analytics, RRM automation, channel optimization, and wireless AIOps.

The correct configuration is option C because Cisco IOS XE restricts inbound protocols on VTY lines with thetransport inputcommand. Cisco’s Catalyst 9800 best-practice guidance states that administrators should confirm SSH is enabled and Telnet is disabled for better controller security, and that the Catalyst 9800 follows standard Cisco IOS XE behavior for enabling or disabling Telnet and SSH. Cisco IOS XE SSH documentation explicitly showsline vty line_number [ending_line_number]followed bytransport input ssh, and explains that this prevents non-SSH Telnet connections, limiting access to SSH only.

The existing exhibit already includes the SSH prerequisites: hostname, domain name, RSA key generation, AAA new-model, a default login method using local credentials, and a local privileged user. The missing VTY configuration must therefore apply that default AAA login list to the VTY lines withlogin authentication defaultand restrict inbound transport to SSH. Cisco AAA documentation confirms thatlogin authentication defaultapplies the configured default authentication list to the line or set of lines. Option A is incomplete and does not explicitly permit SSH. Option B uses invalid syntax. Option D omits the requiredinputkeyword. Reference topics:Catalyst 9800 secure management, VTY access control, SSH, Telnet hardening, AAA login authentication, and IOS XE device administration.

The failure is occurring during WPA/WPA2 key management, not during mobility anchoring. The radioactive trace showsFailed to validate eapol mic. MIC mismatchfollowed byFailed to validate eapol key m2, which means the authenticator and supplicant derived different key material during the PSK handshake. Cisco’s Catalyst 9800 client-connectivity troubleshooting maps this log pattern directly to a wrong password condition and lists the corrective actions as fixing the password on the endpoint or on the SSID/WLAN. The11r MIC validation failedphrase does not automatically make 802.11r the root cause; it only shows that the failed MIC validation occurred while Fast Transition key logic was in use. Disabling 802.11r would be a workaround only for client capability or FT interoperability issues, but the trace points to PSK mismatch. Removing the anchor WLC would break the intended DMZ anchoring design, and matching WLANs on foreign and anchor is required for anchor deployments, but it would not produce this EAPOL M2 MIC failure. The correct remediation is to ensure the client-entered PSK matches the WLAN PSK. Reference topics: WPA/WPA2-PSK authentication, EAPOL 4-way handshake, Catalyst 9800 radioactive trace analysis, and client connectivity troubleshooting.

For a retail guest WLAN deployment, Cisco best practices dictate using central web authentication (web-auth) combined with access control lists (ACLs) to enforce network segmentation and restrict guest traffic to internet-only access. Central web authentication allows all guest devices to be redirected to a captive portal for login without requiring a pre-shared key or WPA2-Enterprise credentials, satisfying the “no password” requirement. Applying an ACL that blocks access to internal subnets ensures that guest traffic cannot interfere with corporate networks while still permitting internet connectivity. Option A is unsuitable because WPA2-Enterprise and dynamic VLAN assignment are designed for employee or secure networks, not open guest access. Option B provides local web-auth, which is limited to a single WLC and does not scale across multiple floors effectively. Option D (MAC filtering) only enforces device-level access but does not provide web-based login or segmentation, failing the requirement for captive portal and internet-only access. Cisco Wireless Core Technologies recommend central web authentication with ACL enforcement for guest networks to provide consistent coverage, network isolation, and compliance with security policies across multiple APs and WLCs. Reference topics:Client Connectivity Configuration — Guest WLAN deployment, central web-auth, ACL enforcement, segmentation from corporate WLAN.

The fault domain is DHCP forwarding, not RF, client-side addressing, or AP discovery. Cisco explains that when a wireless client associates, it sends a DHCP Discover broadcast, and depending on AP mode, that traffic is either forwarded through the WLC or passed to the next hop. Cisco further states that if no DHCP server exists in the client’s local Layer 2 domain, the router or SVI for the client VLAN must forward DHCP discovery traffic using an IP helper address.

Because the APs are inLocal mode, client traffic is centrally switched through CAPWAP to the WLC, where the client VLAN/SVI path must correctly relay DHCP toward the DHCP server. Cisco’s Catalyst 9800 DHCP configuration guide shows DHCP relay configuration under the client VLAN SVI by entering the IPv4 helper address, and the CLI example usesip helper-address < ip-address > to forward UDP broadcasts such as DHCP requests.

Option C resolves the issue because all clients are affected and none receive a DHCP offer, indicating the DHCP Discover is not reaching the DHCP server or the offer is not returning through the relay path. DHCP option 43 is for AP controller discovery, not client DHCP addressing. Reference topics:DHCP relay, Local mode AP forwarding, Catalyst 9800 client VLANs, and wireless client IP assignment.

Signal-to-Noise Ratio (SNR) is a critical metric in wireless networking that quantifies the relationship between the received signal power and the background noise. A higher SNR indicates that the signal strength is significantly stronger than the noise level, which directly impacts the quality and reliability of wireless communication. When SNR is high, the receiver can more accurately decode transmitted frames, leading to fewer errors, reduced retransmissions, and improved data integrity. This results in more consistent throughput and better overall performance of wireless clients, especially in environments with high client density or potential sources of interference. Conversely, a low SNR increases susceptibility to multipath distortion, frame loss, and degraded network performance. Option C correctly identifies the outcome of a high SNR: enhanced data integrity with fewer errors. Option A is incorrect because multipath distortion is primarily influenced by environmental reflections, not directly by SNR. Option B refers to antenna design and MIMO techniques, which affect directional gain and spatial streams but are independent of SNR measurement. Option D is unrelated to SNR, as output frequency ranges are set by regulatory standards and hardware capabilities rather than signal-to-noise conditions. Cisco Wireless Core Technologies emphasizes monitoring SNR to optimize RF planning, AP placement, and client experience in enterprise wireless networks. Reference topics:RF Fundamentals — SNR, signal quality, wireless performance, error rate, enterprise Wi-Fi.

YANG (Yet Another Next Generation) is a data modeling language primarily used in conjunction with the NETCONF (Network Configuration Protocol) to model configuration and operational data for network devices, including Cisco wireless controllers. YANG is a human-readable, hierarchical language designed to define the structure of data, allowing for consistent representation of configuration parameters, operational state, and notifications. It is extensively used in network automation and management systems to ensure standardized configuration management across various devices, making it easier for network administrators to automate and configure network devices using NETCONF.

NETCONF is the protocol that facilitates the transport of these data models (defined in YANG) between network devices and management systems. YANG’s role is to define the structure and constraints of the data that NETCONF will configure or retrieve from devices. This allows administrators to configure network devices programmatically while adhering to a standardized data structure, which is essential for scalability, automation, and integration across various systems.

Options B, C, and D do not describe the actual purpose of YANG in the context of NETCONF and Cisco wireless controllers. Option B describes a security protocol (which could be TLS or SSH), Option C refers to protocols like RESTCONF, and Option D is incorrect because YANG is not a scripting language but a data modeling language.