Cisco 350-101 - Implementing and Operating Cisco Wireless Core Technologies (350-101 WLCOR)v1.0

The missing command isradius server external-radius. On a Catalyst 9800 WLC, the external RADIUS server object must be declared first with radius server < server-name > . The following lines, address ipv4 10.10.10.100 auth-port 1812 acct-port 1813 and key radiuskey, are subcommands entered under that RADIUS server configuration mode. Cisco’s Catalyst 9800 802.1X configuration workflow starts by declaring the RADIUS server, then adding it to a RADIUS server group, then creating the authentication method list, and finally mapping that list to the WLAN. Cisco’s configuration guide example uses the same IOS XE structure: radius server < name > , followed by address ipv4 ... auth-port 1812 acct-port 1813 and key ....

The server group later references server name external-radius, so the RADIUS server object must be namedexternal-radiusexactly. Option C would incorrectly create a server named RADIUS-GRP, which is already the AAA server group name, not the RADIUS server object. Options B and D are invalid IOS XE syntax. PEAP-MSCHAPv2 itself is handled through the 802.1X/EAP exchange with the RADIUS server; the WLC acts as the authenticator and forwards authentication requests through the configured AAA method list. Reference topic:Client Connectivity Configuration — WPA2-Enterprise, 802.1X, RADIUS server objects, AAA groups, and WLAN authentication-list binding.

The command that enables 802.1X client authentication for this WLAN issecurity dot1x authentication-list ISE_GROUP. On a Cisco Catalyst 9800 WLC, the WLAN configuration defines Layer 2 security behavior, including whether the SSID uses 802.1X and which AAA method list is used for EAP/RADIUS authentication. Cisco documents the CLI workflow for 802.1X WLAN authentication as entering WLAN configuration mode and applyingsecurity dot1x authentication-list < authenticate-list-name > , explicitly describing this as the step to enable the authentication list for 802.1X security. Cisco’s Catalyst 9800 configuration example also shows the exact formsecurity dot1x authentication-list ISE_GROUPand states that the WLAN is then configured with 802.1X authentication.

no ip mac-bindingdisables IP-to-MAC binding checks and does not select a RADIUS method list.aaa override enableallows authorization attributes from AAA/ISE to be applied after authentication, but it does not initiate 802.1X authentication.wlan branch1 policy branch1_policymaps the WLAN to a policy profile through a policy tag, but it is not the authentication command. Reference topics:802.1X WLAN security, RADIUS AAA method lists, Catalyst 9800 WLAN configuration, and secure client onboarding.

For in-depth wireless troubleshooting using a Cisco 9176 AP, the correct operational mode is thesniffer mode. This mode allows the AP to capture all RF frames, including management, control, and data frames, across all configured channels, and forward these to a remote protocol analyzer such as Wireshark. Sniffer mode is distinct from other AP modes because the AP does not serve clients in this state; its sole function is passive packet capture for analysis of interference, RF performance, and client behavior. The commandap name < ap_name > mode snifferexecuted on the WLC explicitly sets this mode.

Monitor mode (option A) is used to observe client behavior and RF environment, but it does not provide complete over-the-air packet capture. Local mode (option C) is the standard AP mode for client connectivity and normal CAPWAP operation. Rogue-detector mode (option D) is used to identify unauthorized APs and clients but does not capture traffic for external analysis.

Cisco documentation and technical guides for Catalyst APs clearly differentiate these modes, noting thatsniffer mode provides full frame capture without client services, making it ideal for troubleshooting complex wireless performance issues in high-density deployments. Reference topic:Wireless Network Operation — AP modes, sniffer mode configuration, RF troubleshooting, and protocol analyzer integration.

The correct action is to create a dedicated guest interface/VLAN and bind it to the guest WLAN through the Catalyst 9800 policy profile. In Catalyst 9800 architecture, the WLAN defines the SSID and wireless security parameters, while the policy profile defines client forwarding policy, VLAN mapping, DHCP-related behavior, and access policy. Cisco’s Catalyst 9800 VLAN configuration procedure places the VLAN selection under thePolicy Profile > Access Policiessection, where a VLAN or VLAN group is mapped to the WLAN policy profile. Cisco also documents that DHCP can be configured per interface or per WLAN and recommends using the DHCP server address assigned to the relevant interface for WLAN client addressing.

A dedicated guest VLAN backed by the 10.20.30.0/24 DHCP scope provides up to 254 usable addresses, satisfying the 200-client requirement while keeping guest users separated from corporate users at Layer 3/VLAN boundaries. Option A and C are wrong because a shared DHCP pool violates the requirement for a guest-only subnet; DHCP option 43 is for AP/controller discovery, not client addressing. Option D is not scalable and does not define DHCP allocation. Reference topics:Catalyst 9800 policy profiles, WLAN-to-policy mapping, guest VLAN segmentation, DHCP scopes, and guest network isolation.

The correct expression isaccessPoints[0].interfaces[1] .macAddress. The JSON object contains a top-level key namedaccessPoints, whose value is an array. Array indexing begins at zero, soaccessPoints[0]selects the first access point object,ap-west-1. Inside that object, theinterfaceskey also contains an array. Therefore,interfaces[1] selects the second interface object, which hasslot: 1,status: "down", andmacAddress: "CC:FA:00:11:22:34". The final selector,.macAddress, returns that MAC address value.

This structure is directly aligned with Cisco automation workflows, where RESTCONF and Catalyst Center APIs exchange structured data in JSON. Cisco documents that Catalyst Center REST API payloads are JSON-formatted, and its example describes JSON as key-value data separated by colons. Cisco also states that Catalyst 9800 RESTCONF uses structured XML or JSON with YANG models for programmatic device access. Option B selectsap-east-2. Option C selects the first interface onap-west-1. Option D references a non-existent second interface onap-east-2. Reference topics:Automation and AI — JSON parsing, REST APIs, Catalyst Center programmability, RESTCONF, and wireless telemetry data structures.

When a radio wavebends around an obstaclein its path, this phenomenon is calleddiffraction. Diffraction allows the RF signal to reach areas that are not in the direct line of sight of the transmitter, such as behind walls, corners, or other obstructions. The amount of bending depends on the wavelength of the signal relative to the size of the obstacle—longer wavelengths (lower frequencies) diffract more effectively than shorter wavelengths.

This property is crucial in wireless network design, especially in enterprise or mesh deployments, because it enables coverage in complex indoor environments and around obstructions where direct line-of-sight communication is impossible. Diffraction differs from other RF phenomena:absorption(option A) occurs when RF energy is partially absorbed by materials, reducing signal strength;diffusion(option B) refers to scattering of the signal in multiple directions; andreflection(option C) occurs when RF waves bounce off surfaces like walls or ceilings, which can lead to multipath interference.

Cisco wireless design guides emphasize understanding diffraction forcoverage planning, AP placement, and optimizing signal propagationin indoor and campus deployments, ensuring that signals can adequately reach shadowed or obstructed areas without excessive loss or dead spots. Reference topic:RF Fundamentals — diffraction, reflection, absorption, and indoor wireless propagation.

AI Enhanced RRM is not a static-threshold tuning feature and it is not designed to simply raise AP transmit power. Cisco defines AI Enhanced RRM as a radio resource management technology that applies artificial intelligence and machine learning to optimize RF environments, uses distributed data collection from Cisco wireless controllers with cloud-based analytics, and automates adaptive RF parameter tuning for Cisco wireless networks.

The operational model is telemetry-driven. RF telemetry is collected from APs by the Catalyst 9800 WLC, sent through Cisco Catalyst Center to the Cisco AI Analytics Cloud, analyzed by RRM algorithms, and then configuration-change information is returned through Catalyst Center toward the managed wireless infrastructure. Cisco’s AI-Enhanced RRM deployment guide further identifies DCA, TPC, FRA, and DBS as examples of optimizations performed, meaning the feature enhances dynamic RF control rather than disabling it.

Therefore, option D is the only correct answer. Options A, B, and C describe either legacy/static behavior, harmful power-only logic, or a fixed RF design model that contradicts Cisco AI Enhanced RRM. Reference topics:Automation and AI — AI/ML-driven RF optimization, Catalyst Center assurance, RRM telemetry, DCA, TPC, FRA, and DBS.

The correct configuration approach is to enableApplication Visibility and Controlon thepolicy profile. On the Catalyst 9800, WLANs are not configured as isolated monolithic objects; the WLAN profile is mapped to a policy profile through a policy tag, and many client traffic services are applied from that policy profile. Cisco defines AVC as the wireless feature set that identifies and monitors applications using DPI, creates rules to manage application bandwidth and usage, and integrates with Flexible NetFlow for per-application or per-protocol statistics. Cisco further states that AVC benefits from NBAR running on the AP or controller, and that the NBAR2 engine analyzes and recognizes traffic flows.

Operationally, Cisco’s 9800 AVC guide shows that AVC is enabled by navigating toConfiguration > Services > Application Visibilityand selecting the relevantPolicy Profile. It also shows the CLI form under the policy profile:wireless profile policy AVC_testingfollowed byip nbar protocol-discovery, with verification showingNBAR Protocol Discovery : Enabled. Options A and B are incorrect because the feature is not enabled directly on the WLAN. Option C is generic and incomplete; the Cisco feature construct is AVC. Reference topics:AVC, NBAR2, Flexible NetFlow, Catalyst 9800 policy profiles, and wireless application visibility.

For configuring guest access on a Cisco Catalyst 9800 WLC using an external WebAuth server, the WLAN must be explicitly associated with the external server through a parameter map. The correct command syntax in Cisco IOS XE iswireless wlan < wlan-name > followed bysecurity web-auth external < parameter-map > . This configuration links the WLAN to the external WebAuth server defined in the parameter map, allowing guests to be redirected to the portal for authentication. The parameter map (webauth-ext) contains details such as server IP, port, and other authentication parameters required for the external WebAuth interaction. Option B is incorrect because it improperly uses multiple WLAN names in one command, which is not valid syntax. Option C usesparameter external security-map, which is invalid and does not associate the WLAN correctly with the WebAuth server. Option D incorrectly combines the security and parameter-map syntax and is not supported in IOS XE for external WebAuth. Cisco Wireless Core Technologies recommends this approach for centralized guest management, allowing consistent enforcement of guest policies, seamless authentication, and integration with external WebAuth servers across multiple WLANs and APs. Reference topics:Client Connectivity Configuration — WebAuth, external guest portal, WLAN parameter map configuration, Cisco IOS XE 17.x.

The correct answer isBbecause Wi-Fi antenna gain is expressed usingdBi, which means decibels relative to an isotropic radiator. Cisco’s Wireless RF Reference Guide states that antenna gain is measured in decibels relative to isotropic gain, ordBi. Cisco RF design documentation also explains that dBi is used to describe the power gain rating of antennas by comparing real antennas against an ideal isotropic antenna that radiates equally in all directions.

Antenna gain is not a measurement of physical antenna length. Length may influence antenna design and resonance, but it is not the operational unit used to express gain. It is also not measured as voltage against dBm.dBmis an absolute power reference relative to one milliwatt, commonly used for transmit power or received signal strength, whiledBidescribes antenna gain. Cisco’s EIRP calculation reinforces this separation: transmitter power is in dBm, antenna gain is in dBi, and cable loss is in dB. A “blend of analog and digital signals” has no RF measurement relevance. Reference topic:RF Fundamentals — antenna gain, dB/dBi/dBm, isotropic radiator reference, EIRP, and RF propagation behavior.