350-101 Exam Dumps - Cisco CCIE Wireless Questions and Answers

The correct element is theget() method. In the script, each device object is treated as a Python dictionary created from parsed JSON API output. The lines device.get("macAddress", "N/A") and device.get("ipAddress", "N/A") perform direct key-based lookup against the dictionary and return the associated value when the key exists. Python documentation defines dictionaries as key-value mappings and states that get() is used to avoid a KeyError by returning None or a specified default value when the key is absent.

This behavior is exactly what automation scripts need when consuming controller or wireless inventory APIs, because returned device records may not always contain every field. Cisco API inventory models commonly return structured device objects containing properties such as MAC address, model, network ID, product type, and wireless-related inventory attributes, which are then parsed by automation code. The pop operation would remove a dictionary key, not safely read it. The import function only loads modules such as requests and json. The format expression only builds the printed output string. Reference topics:Automation and AI — Python scripting, REST API consumption, JSON parsing, and wireless inventory automation.

The correct configuration is option C because Cisco IOS XE restricts inbound protocols on VTY lines with thetransport inputcommand. Cisco’s Catalyst 9800 best-practice guidance states that administrators should confirm SSH is enabled and Telnet is disabled for better controller security, and that the Catalyst 9800 follows standard Cisco IOS XE behavior for enabling or disabling Telnet and SSH. Cisco IOS XE SSH documentation explicitly showsline vty line_number [ending_line_number]followed bytransport input ssh, and explains that this prevents non-SSH Telnet connections, limiting access to SSH only.

The existing exhibit already includes the SSH prerequisites: hostname, domain name, RSA key generation, AAA new-model, a default login method using local credentials, and a local privileged user. The missing VTY configuration must therefore apply that default AAA login list to the VTY lines withlogin authentication defaultand restrict inbound transport to SSH. Cisco AAA documentation confirms thatlogin authentication defaultapplies the configured default authentication list to the line or set of lines. Option A is incomplete and does not explicitly permit SSH. Option B uses invalid syntax. Option D omits the requiredinputkeyword. Reference topics:Catalyst 9800 secure management, VTY access control, SSH, Telnet hardening, AAA login authentication, and IOS XE device administration.

The correct configuration approach is to enableApplication Visibility and Controlon thepolicy profile. On the Catalyst 9800, WLANs are not configured as isolated monolithic objects; the WLAN profile is mapped to a policy profile through a policy tag, and many client traffic services are applied from that policy profile. Cisco defines AVC as the wireless feature set that identifies and monitors applications using DPI, creates rules to manage application bandwidth and usage, and integrates with Flexible NetFlow for per-application or per-protocol statistics. Cisco further states that AVC benefits from NBAR running on the AP or controller, and that the NBAR2 engine analyzes and recognizes traffic flows.

Operationally, Cisco’s 9800 AVC guide shows that AVC is enabled by navigating toConfiguration > Services > Application Visibilityand selecting the relevantPolicy Profile. It also shows the CLI form under the policy profile:wireless profile policy AVC_testingfollowed byip nbar protocol-discovery, with verification showingNBAR Protocol Discovery : Enabled. Options A and B are incorrect because the feature is not enabled directly on the WLAN. Option C is generic and incomplete; the Cisco feature construct is AVC. Reference topics:AVC, NBAR2, Flexible NetFlow, Catalyst 9800 policy profiles, and wireless application visibility.

The correct authentication method isEAP-TLS. WPA2-Enterprise uses 802.1X/EAP authentication rather than a pre-shared key, and the supplicant, authenticator, and RADIUS authentication server participate in the enterprise authentication exchange. Cisco documentation states that in enterprise WPA/WPA2 operation, 802.1X/EAP is used for authentication and provides strong authentication between the client and authentication server.

The decisive requirement in the question iscertificate-based mutual authentication requiring both client and server certificates. Cisco explicitly describes EAP-TLS as requiring both server-side and client-side certificates, while PEAP requires only a server-side certificate and normally authenticates the client with password-based credentials inside the protected tunnel. Cisco Secure ACS documentation also states that EAP-TLS uses the certificates of the authentication server and the end-user client, enforcing mutual authentication.

MSCHAPv2 is a password-based inner authentication method, not certificate-based mutual authentication. PEAP protects credential exchange with a server certificate but does not inherently require a client certificate. TEAP can support flexible tunneled authentication, but the strict client-and-server certificate requirement maps directly toEAP-TLS. Reference topic:Client Connectivity Configuration — WPA2-Enterprise, 802.1X supplicant configuration, EAP methods, certificates, and RADIUS authentication.

The correct configuration isaaa-overridefollowed bynacunder the existing Catalyst 9800 wireless policy profile. The exhibit already places the administrator in policy-profile configuration mode with wireless profile policy my-policy, so the missing commands must be policy-profile subcommands, not another profile declaration. Cisco’s Catalyst 9800 configuration examples show the exact sequence: enter wireless profile policy < policy-profile-name > , enable aaa-override, enable nac, then configure VLAN and no shutdown.

aaa-override permits authorization attributes returned by AAA or Cisco ISE, such as VLAN, ACL, QoS, redirect ACL, or posture-related access controls, to override the locally defined policy. Cisco’s documentation explicitly states that AAA override applies policies coming from AAA or ISE servers, while nac enables Network Access Control in the policy profile. This is the required behavior when endpoints must be posture-validated before normal network access is granted. Cisco also notes that NAC State is enabled in the policy profile and can only be enabled when AAA override is enabled.

Option A is invalid because nac-policy is not the correct CLI keyword. Options B and D omit NAC. Reference topic:Client Connectivity Configuration — Catalyst 9800 policy profiles, AAA override, NAC State, posture enforcement, and ISE-based access control.

The failure is caused by the redirect ACL not being available where enforcement occurs. In FlexConnect local switching, client data-plane handling occurs on the AP, so the CWA redirect ACL cannot exist only as a controller ACL or only as a policy-profile reference. Cisco states that the redirect ACL is a punt ACL and that, for FlexConnect local switching, the ACL must be predefined on the AP because the AAA server returns only the ACL name, not the ACL definition.

The exhibit showsRedirect ACL failureandEXCLUDE_PUNT_ACL_FAIL, which aligns with an AP-side punt/redirect ACL application failure. Cisco’s Catalyst 9800 CWA configuration specifically requires the redirect ACL definition to be sent through the FlexConnect profile; in the GUI this is done under the Flex ProfilePolicy ACLtab by adding the ACL, enabling central web authentication, and applying the change. The equivalent CLI iswireless profile flex < profile > followed byacl-policy < acl-name > andcentral-webauth, after which the AP uses the ACL for client redirection. AP-Join profiles do not carry client redirect ACL policy, and adding the ACL only to the policy profile does not push it to FlexConnect APs for local switching. Reference topics:FlexConnect local switching, CWA redirect ACLs, Catalyst 9800 policy ACLs, and ISE URL-redirect authorization.

For in-depth wireless troubleshooting using a Cisco 9176 AP, the correct operational mode is thesniffer mode. This mode allows the AP to capture all RF frames, including management, control, and data frames, across all configured channels, and forward these to a remote protocol analyzer such as Wireshark. Sniffer mode is distinct from other AP modes because the AP does not serve clients in this state; its sole function is passive packet capture for analysis of interference, RF performance, and client behavior. The commandap name < ap_name > mode snifferexecuted on the WLC explicitly sets this mode.

Monitor mode (option A) is used to observe client behavior and RF environment, but it does not provide complete over-the-air packet capture. Local mode (option C) is the standard AP mode for client connectivity and normal CAPWAP operation. Rogue-detector mode (option D) is used to identify unauthorized APs and clients but does not capture traffic for external analysis.

Cisco documentation and technical guides for Catalyst APs clearly differentiate these modes, noting thatsniffer mode provides full frame capture without client services, making it ideal for troubleshooting complex wireless performance issues in high-density deployments. Reference topic:Wireless Network Operation — AP modes, sniffer mode configuration, RF troubleshooting, and protocol analyzer integration.

AI Enhanced RRM is not a static-threshold tuning feature and it is not designed to simply raise AP transmit power. Cisco defines AI Enhanced RRM as a radio resource management technology that applies artificial intelligence and machine learning to optimize RF environments, uses distributed data collection from Cisco wireless controllers with cloud-based analytics, and automates adaptive RF parameter tuning for Cisco wireless networks.

The operational model is telemetry-driven. RF telemetry is collected from APs by the Catalyst 9800 WLC, sent through Cisco Catalyst Center to the Cisco AI Analytics Cloud, analyzed by RRM algorithms, and then configuration-change information is returned through Catalyst Center toward the managed wireless infrastructure. Cisco’s AI-Enhanced RRM deployment guide further identifies DCA, TPC, FRA, and DBS as examples of optimizations performed, meaning the feature enhances dynamic RF control rather than disabling it.

Therefore, option D is the only correct answer. Options A, B, and C describe either legacy/static behavior, harmful power-only logic, or a fixed RF design model that contradicts Cisco AI Enhanced RRM. Reference topics:Automation and AI — AI/ML-driven RF optimization, Catalyst Center assurance, RRM telemetry, DCA, TPC, FRA, and DBS.

In a centrally switched deployment, the WLAN traffic is tunneled via CAPWAP from the AP to the WLC, where VLAN assignment occurs. To ensure that client devices are placed into the correct VLAN (in this case, VLAN 10), the WLAN policy profile must define the VLAN mapping. This allows the WLC to tag client traffic appropriately when forwarding to the upstream switch. Option C is correct because it configures the WLAN profile (policy profile) with VLAN 10, ensuring all clients associating with the WLAN are mapped to the proper VLAN automatically. Option A is incorrect because VLAN tagging is managed centrally on the WLC, and access ports at the AP are typically trunked or transparent in central switching mode. Option B is invalid; manually configuring VLAN on client devices is not feasible or scalable in enterprise deployments and does not integrate with CAPWAP central switching. Option D is also incorrect; relying on MAC-based redirection introduces complexity and is not standard practice for VLAN assignment in centrally switched networks. Cisco Wireless Core Technologies recommend using policy profiles to centrally enforce VLANs, simplifying management, ensuring security compliance, and supporting consistent enterprise Wi-Fi connectivity. Reference topics:Client Connectivity Configuration — VLAN assignment, WLAN policy profiles, centrally switched deployments, Cisco Catalyst 9800 WLC.

On Cisco Catalyst 9800 Series WLCs running IOS XE 17.x, WLAN-specific client management parameters are configured under thewlan configuration context. To increase the number of client connections on the XYZ-Guest WLAN, the correct command iswlan XYZ-Guest 1 XYZ-Guest client association limit 50(orclient max-association 50depending on IOS XE version), which explicitly sets the maximum number of clients allowed per AP on this WLAN. To extend session durations and prevent frequent disconnections, theclient session timeoutcommand is applied under the same WLAN context with the desired timeout in seconds, e.g.,wlan XYZ-Guest 1 XYZ-Guest client session timeout 2800.

Profile-based session commands (options B and D) are part of wireless policy profiles, which define broader policy elements like QoS, radio settings, and security, butdo not directly enforce client association limits or session timeouts on the WLAN itself. Configuring these parameters at the WLAN level ensures that all APs associated with this WLAN apply the limits and timeout settings consistently. This approach aligns with Cisco best practices forClient Connectivity Configuration — WLAN client limits, session management, and IOS XE WLC optimization for guest networks.