350-101 Implementing and Operating Cisco Wireless Core Technologies Questions and Answers

To enforce endpoint compliance using Cisco ISE, the WLC must allow AAA policies configured on the ISE tooverride the WLAN default access policies. Enablingaaa-overrideon the WLAN allows the WLC to apply RADIUS-supplied attributes from Cisco ISE, including user roles, VLAN assignment, and posture evaluation outcomes, to connected clients. This is essential for enterprise environments where a posture policy (e.g., checking device security posture, anti-virus status, OS updates) must be applied prior to granting full network access.

Without enablingaaa-override, the WLC would ignore the RADIUS-supplied attributes and enforce only the WLAN-level defaults, preventing compliance-based enforcement. Option B (wireless profile policy WLAN-Staffnac) is invalid syntax; the WLAN profile must be configured via AAA overrides rather than a standalone NAC profile. Options C and D incorrectly attempt to manipulate radius enable commands at the WLAN or profile level but do not facilitate endpoint posture assessment enforcement.

Cisco’s official wireless deployment guides recommendaaa-overridewhenever integration with Cisco ISE or other RADIUS servers is used for role assignment, VLAN mapping, or posture policy enforcement. Reference topic:Client Connectivity Configuration — WLAN AAA override, Cisco ISE integration, posture policy enforcement, and compliance-based access.

To implement a guest Wi-Fi network on a Cisco 9800 WLC with the requirements mentioned, the solution must ensure that guests are isolated from the corporate LAN and are redirected to a login page before being able to access the internet. Additionally, access needs to be restricted to web browsing only, with no need for preshared keys or certificates.

Option A: "Create a WLAN that uses a web policy and points to a consent parameter map."This is necessary to enforce the login page and redirect users to a webauth page. By creating a WLAN with web policy, you ensure that users are redirected to a captive portal where they can accept the terms and conditions or login to the network. This solution also helps in segregating the guest network from the corporate network, as users are contained within their VLAN.

Option E: "Deploy a WLAN policy that points wireless users to a webauth parameter map."Web authentication (webauth) is an essential part of guest access. Deploying a WLAN policy with webauth ensures that users are directed to the login page (a webauth parameter map), allowing them to authenticate before browsing the internet.

Other options:

Option Bwould block mDNS, but it does not directly address the need for a login page or VLAN segregation.

Option Cis important for enforcing access control policies, but it doesn't fulfill all the requirements of the login page and limited access (web browsing only).

Option Dis unrelated to the requirement of providing access only to web browsing, as it primarily addresses peer-to-peer traffic blocking, which is not directly tied to web access control.

Therefore, the correct solution involves combining a web policy with a webauth parameter map for login page redirection (A and E).

The failure is occurring during WPA/WPA2 key management, not during mobility anchoring. The radioactive trace showsFailed to validate eapol mic. MIC mismatchfollowed byFailed to validate eapol key m2, which means the authenticator and supplicant derived different key material during the PSK handshake. Cisco’s Catalyst 9800 client-connectivity troubleshooting maps this log pattern directly to a wrong password condition and lists the corrective actions as fixing the password on the endpoint or on the SSID/WLAN. The11r MIC validation failedphrase does not automatically make 802.11r the root cause; it only shows that the failed MIC validation occurred while Fast Transition key logic was in use. Disabling 802.11r would be a workaround only for client capability or FT interoperability issues, but the trace points to PSK mismatch. Removing the anchor WLC would break the intended DMZ anchoring design, and matching WLANs on foreign and anchor is required for anchor deployments, but it would not produce this EAPOL M2 MIC failure. The correct remediation is to ensure the client-entered PSK matches the WLAN PSK. Reference topics: WPA/WPA2-PSK authentication, EAPOL 4-way handshake, Catalyst 9800 radioactive trace analysis, and client connectivity troubleshooting.

The correct method issoftware image management workflows, specifically Cisco Catalyst Center Software Image Management, commonly referenced as SWIM. Cisco documents SWIM as the mechanism used to manage software upgrades and maintain consistency of image versions across the network. It provides an image repository, golden-image assignment, image distribution, activation, readiness checks, and scheduled execution. Cisco’s wireless automation guidance specifically states that SWIM is used to update Catalyst 9800 Series Wireless Controller software by distributing the image from the Catalyst Center repository to wireless controllers and upgrading the images running on those controllers; both stages can run immediately or be scheduled for a defined maintenance window.

Option C is also validated by Catalyst Center’s update-status and workflow views. Cisco documentsImage Update Statusas the view that shows all update tasks, filters by in-progress, success, or failure, and displays a progress bar for active updates. The workflow view then exposes distribution and activation task status, timing, prechecks, postchecks, checksum verification, and AP pre-image download details. Inventory snapshots and templates do not execute controller firmware upgrades, and “lifecycle workflow” is too generic. Reference topics:Wireless Monitoring and Management — Catalyst Center SWIM, image compliance, golden images, controller upgrade automation, and update progress reporting.

The correct method issoftware image management workflows, specifically Cisco Catalyst Center Software Image Management, commonly referenced as SWIM. Cisco documents SWIM as the mechanism used to manage software upgrades and maintain consistency of image versions across the network. It provides an image repository, golden-image assignment, image distribution, activation, readiness checks, and scheduled execution. Cisco’s wireless automation guidance specifically states that SWIM is used to update Catalyst 9800 Series Wireless Controller software by distributing the image from the Catalyst Center repository to wireless controllers and upgrading the images running on those controllers; both stages can run immediately or be scheduled for a defined maintenance window.

Option C is also validated by Catalyst Center’s update-status and workflow views. Cisco documentsImage Update Statusas the view that shows all update tasks, filters by in-progress, success, or failure, and displays a progress bar for active updates. The workflow view then exposes distribution and activation task status, timing, prechecks, postchecks, checksum verification, and AP pre-image download details. Inventory snapshots and templates do not execute controller firmware upgrades, and “lifecycle workflow” is too generic. Reference topics:Wireless Monitoring and Management — Catalyst Center SWIM, image compliance, golden images, controller upgrade automation, and update progress reporting.

The failure is occurring during WPA/WPA2 key management, not during mobility anchoring. The radioactive trace showsFailed to validate eapol mic. MIC mismatchfollowed byFailed to validate eapol key m2, which means the authenticator and supplicant derived different key material during the PSK handshake. Cisco’s Catalyst 9800 client-connectivity troubleshooting maps this log pattern directly to a wrong password condition and lists the corrective actions as fixing the password on the endpoint or on the SSID/WLAN. The11r MIC validation failedphrase does not automatically make 802.11r the root cause; it only shows that the failed MIC validation occurred while Fast Transition key logic was in use. Disabling 802.11r would be a workaround only for client capability or FT interoperability issues, but the trace points to PSK mismatch. Removing the anchor WLC would break the intended DMZ anchoring design, and matching WLANs on foreign and anchor is required for anchor deployments, but it would not produce this EAPOL M2 MIC failure. The correct remediation is to ensure the client-entered PSK matches the WLAN PSK. Reference topics: WPA/WPA2-PSK authentication, EAPOL 4-way handshake, Catalyst 9800 radioactive trace analysis, and client connectivity troubleshooting.

A high-gain patch antenna is a directional antenna that concentrates RF energy into a defined coverage area rather than radiating equally in all directions. Cisco’s Wireless RF Reference Guide explains that antenna gain determines how RF power is radiated and that higher-gain antennas do not create additional transmit power; they focus existing power in a given direction. Cisco also distinguishes omnidirectional high-gain patterns, which flatten coverage, from directional antennas, which focus energy toward a target area.

That makes option C correct: a patch antenna imparts a focused beam, typically useful for covering a hallway, warehouse aisle, seating section, point-to-point link, or defined flat service area. Cisco’s antenna documentation also states that higher-gain antennas provide longer coverage distance but with a coverage-area tradeoff, especially in a particular direction. Option A is incorrect because antenna gain does not restrict operation to a single narrow frequency; frequency support is determined by antenna design and radio band. Option B describes channel overlap, not antenna behavior. Option D does not describe a standard patch antenna radiation pattern. Reference topics:RF Fundamentals — antenna gain, directional antennas, patch antenna radiation patterns, beamwidth, and coverage-cell design.

A line-of-sight (LOS) RF connection requires a clear, unobstructed path between the transmitter and receiver. This ensures that the transmitted signal reaches the receiving device without attenuation, reflection, or diffraction caused by physical obstacles such as walls, furniture, or other structures. LOS conditions are critical for high-frequency RF links, particularly in the 5 GHz band, where signals cannot easily penetrate objects. While multipath propagation (Option A) and MIMO (Option B) techniques enhance throughput and reliability in non-line-of-sight environments, they do not satisfy the definition of LOS. Reflections (Option C) actually introduce delays, fading, and interference, which can degrade signal quality. In Cisco Wireless Core Technologies, understanding LOS is foundational for designing point-to-point wireless backhaul links, outdoor Wi-Fi deployments, and high-performance campus networks. Ensuring LOS minimizes path loss, maximizes received signal strength, and supports predictable coverage patterns. Proper site surveys, RF planning, and AP placement are used to maintain LOS where required, particularly for directional antennas or high-gain links. Reference topics:RF Fundamentals — Line-of-Sight (LOS), RF propagation, path loss, multipath effects, MIMO considerations.

The correct action is to create a dedicated guest interface/VLAN and bind it to the guest WLAN through the Catalyst 9800 policy profile. In Catalyst 9800 architecture, the WLAN defines the SSID and wireless security parameters, while the policy profile defines client forwarding policy, VLAN mapping, DHCP-related behavior, and access policy. Cisco’s Catalyst 9800 VLAN configuration procedure places the VLAN selection under thePolicy Profile > Access Policiessection, where a VLAN or VLAN group is mapped to the WLAN policy profile. Cisco also documents that DHCP can be configured per interface or per WLAN and recommends using the DHCP server address assigned to the relevant interface for WLAN client addressing.

A dedicated guest VLAN backed by the 10.20.30.0/24 DHCP scope provides up to 254 usable addresses, satisfying the 200-client requirement while keeping guest users separated from corporate users at Layer 3/VLAN boundaries. Option A and C are wrong because a shared DHCP pool violates the requirement for a guest-only subnet; DHCP option 43 is for AP/controller discovery, not client addressing. Option D is not scalable and does not define DHCP allocation. Reference topics:Catalyst 9800 policy profiles, WLAN-to-policy mapping, guest VLAN segmentation, DHCP scopes, and guest network isolation.

The command that enables web-based client authentication on the WLAN issecurity web-auth. Cisco’s Catalyst 9800 Web-Based Authentication guide shows the WLAN configuration workflow: enter WLAN configuration mode, disable WPA security for the open Layer 2 guest WLAN, then “Enable web authentication for WLAN” usingsecurity web-auth. Cisco then applies the authentication list and parameter map withsecurity web-auth authentication-list ...andsecurity web-auth parameter-map ..., which refine the WebAuth method and portal behavior after WebAuth itself is enabled.

Cisco’s LDAP authentication example mirrors the exhibit exactly:wlan webauth 2 webauth, removal of WPA/802.1X Layer 2 security,security web-auth,security web-auth authentication-list ldapauth, andsecurity web-auth parameter-map global. Option B only creates or enters the WLAN profile with WLAN ID 2 and SSID name. Options C and D disable WPA2 and 802.1X AKM; they do not authenticate clients. Reference topics:Client Connectivity Configuration — guest WLAN authentication, WebAuth, Layer 3 security, authentication lists, parameter maps, and Catalyst 9800 WLAN security configuration.

Cisco lightweight and Catalyst access points use CAPWAP for AP-to-controller discovery and join operations. For AP-side preconfiguration, Cisco documents the syntax as capwap ap {primary-base | secondary-base | tertiary-base} controller-name controller-ip-address, specifically for configuring primary, secondary, and tertiary controllers on the AP. This matches option B exactly because it includes the CAPWAP AP command, the controller priority keyword, the controller name, and the controller management IP address. (Cisco)

The Catalyst 9800 AP join process also recognizes these configured controller entries in priority order: primary controller using capwap ap primary-base, secondary controller using capwap ap secondary-base, and tertiary controller using capwap ap tertiary-base. (Cisco) This allows the AP to attempt a backup controller when the preferred controller is unavailable, which is appropriate for remote sites with intermittent WAN reachability. Option A uses obsolete or invalid setcontroller syntax. Option C invents an ap join command format. Option D incorrectly inserts wlc into the AP CAPWAP command. Reference topics:Wireless Network Implementation —CAPWAP discovery, AP join process, Catalyst 9800 controller redundancy, and AP CLI provisioning.

The correct answer is30 dBm, which equals1 wattof conducted transmit power. In the United States, the 2.4-GHz ISM band used by 802.11b/g/n/ax Wi-Fi falls under FCC Part 15.247. The FCC rule permits digital modulation systems in the2400–2483.5 MHzband and specifies that the maximum conducted output power is1 Watt. Converting watts to dBm uses the formuladBm = 10 log10(mW): 1 watt equals 1000 mW, and10 log10(1000) = 30 dBm.

This is also consistent with Cisco wireless configuration behavior, where Cisco controller Radio Resource Management transmit-power limits use dBm values and support a configurable transmit-power range up to30 dBm. The key distinction is that30 dBm is conducted transmit power, while36 dBmcommonly represents an EIRP value when antenna gain is included, such as 30 dBm transmitter output plus 6 dBi antenna gain. Cisco RF fundamentals emphasize that antenna gain affects coverage and radiated energy, so transmit power and EIRP must not be confused. Reference topic:RF Fundamentals — dBm, mW conversion, regulatory domains, transmit power, antenna gain, and EIRP.

In wireless networks, the 20 MHz channel width is the standard and narrowest channel allocation in the 2.4 GHz frequency band. Using narrower channels reduces adjacent-channel interference and allows for better coexistence in high-density environments, which is particularly important in the crowded 2.4 GHz spectrum. A 20 MHz channel uses less RF bandwidth than 40 MHz or 80 MHz channels, providing more non-overlapping channels (channels 1, 6, and 11 in 2.4 GHz) to reduce co-channel interference. Option B is incorrect, as channel width does not inherently increase authentication handoff frequency; handoff behavior is determined by RSSI, client roaming thresholds, and 802.11r fast roaming settings. Option C describes client reassociation support, which is handled by the wireless controller and client firmware, not the channel width itself. Option D is incorrect because wider channels (40 MHz, 80 MHz) provide higher throughput than 20 MHz, at the expense of increased interference potential. Cisco Wireless Core Technologies emphasize that 20 MHz channels are preferred for dense deployments in the 2.4 GHz band to maximize non-overlapping channels and reduce interference, ensuring predictable coverage and reliable client connectivity. Reference topics:RF Fundamentals — 20 MHz channels, 2.4 GHz spectrum planning, interference management, channel allocation.

The correct answer isreduction of co-channel interference. AI-RRM in Cisco Catalyst Center is designed for RF optimization, not IP addressing, software scheduling, or user identity classification. Cisco describes AI-enhanced RRM as applying artificial intelligence and machine learning to optimize RF environments and automate/adapt RF parameter tuning for Cisco wireless networks. This is directly tied to operational RF outcomes such as improved channel planning, transmit power behavior, channel width decisions, and better spectrum utilization.

Co-channel interference occurs when multiple AP radios operate on the same channel within hearing range, forcing devices to share airtime and increasing contention. AI-RRM uses telemetry, analytics, and learned RF behavior to recommend or apply more optimal RF configurations. Cisco specifically states that AI-enhanced RRM optimization can produce improvements such as up to a40 percent reduction in co-channel interferenceand SNR gains for wireless clients. Cisco’s AI-RRM deployment guidance also identifies AP radio distribution and utilization analysis as critical for minimizing co-channel interference and optimizing wireless performance.

Therefore, option B is the only operational outcome aligned with AI-RRM’s purpose. Reference topic:Automation and AI — Cisco Catalyst Center AI-RRM, RF analytics, RRM automation, channel optimization, and wireless AIOps.

An RTS frame is an 802.11control frameused in the Request to Send/Clear to Send exchange. Cisco identifies RTS as a Request to Send frame and explains that 802.11 control frames assist in delivering data frames between stations. Cisco further states that the RTS/CTS function is optional, helps reduce collisions when hidden stations are associated to the same access point, and that a station sends an RTS frame as the first phase before transmitting a data frame.

Therefore, option B is correct because the RTS frame requests access to the wireless medium before data transmission. If the receiving station or AP replies with CTS, nearby stations defer transmission based on the duration information, reducing collision probability. This is especially relevant in hidden-node environments where two clients can hear the AP but cannot hear each other. Option A refers to RF spectral-mask compliance, which is a physical-layer regulatory concept. Option C confuses NAV behavior with roaming; RTS/CTS may influence virtual carrier sensing, not client roaming updates. Option D is unrelated because frame compression is not an RTS function. Reference topics:802.11 frame types, control frames, RTS/CTS, CSMA/CA, hidden-node mitigation, and medium reservation.

Central Web Authentication is the correct design for an open guest SSID that redirects users to a captive portal before allowing network access. Cisco describes CWA as a guest-redirection method where the redirect URL and redirect ACL are centrally controlled and communicated to the WLC through RADIUS, with the external authentication system handling the login workflow. On a Catalyst 9800 WLAN, Cisco’s configuration flow for Central Web Authentication requires AAA/ACL configuration, including the AAA server list and an ACL tied to the WLAN so client access can be controlled before and after authentication.

Option D is the only answer that satisfies all requirements: captive portal redirection, post-authentication restriction to Internet-only access, and policy enforcement through ACLs. VLAN-level segmentation is implemented through the WLAN policy profile, which maps guest clients to the guest VLAN rather than the staff VLAN. WPA2-PSK is invalid because the guest SSID must not require a password. A local web server alone does not enforce Internet-only authorization or staff-network isolation. mDNS is unrelated to captive portal authentication or guest segmentation. Reference topics:Guest WLAN design, Central Web Authentication, Catalyst 9800 policy profiles, ACL enforcement, VLAN segmentation, and captive portal client onboarding.

The correct answer isfast BSS transition protocol, which is IEEE 802.11r Fast Transition. Cisco describes 802.11r BSS Fast Transition as the mechanism used to provide seamless roaming for wireless clients by reducing the time required to roam between access points. It achieves this by allowing keying material to be prepared or cached so that the client does not perform a full authentication exchange every time it moves to another AP within the same mobility domain.

This is specifically relevant to Layer 2 roaming because the client remains in the same Layer 2 network while reassociating to a different BSS. Fast Transition reduces roam latency, which is critical for voice, video, collaboration, barcode scanners, and other real-time applications. Cisco also classifies fast secure roaming as the method used to accelerate client roaming when Layer 2 security is configured on the WLAN. Increased beacon intervals do not provide handoff acceleration. Optimized roaming helps with sticky-client behavior but is not the secure handoff protocol. Deferred probe response is an RF/client steering behavior, not an 802.11 Layer 2 roaming key-transition method. Reference topics:802.11r Fast BSS Transition, Layer 2 roaming, fast secure roaming, WLAN mobility, and Catalyst 9800 roaming design.

Doubling the range of a wireless transmitter does not require a linear increase in power due to theinverse-square law of RF propagation. Free-space path loss (FSPL) increases with the square of the distance, meaning to double the distance, the required power must increase by a factor of four in linear terms. In decibel units, power increases are logarithmic:10log⁡10(4)≈610 \log_{10}(4) \approx 610log10​(4)≈6dB.

Given a transmitter at 17 dBm, increasing its output by 6 dB to23 dBmwould theoretically double the coverage in free-space conditions. However, due to environmental factors like multipath, absorption, and antenna efficiency, Cisco RF design guides often round to practical increments, suggesting an increase from 17 dBm to27 dBmto achieve a robust doubling of coverage under real-world conditions.

Options A (20 dBm) and D (17 dBm) are insufficient because they do not provide the necessary power increase to overcome the logarithmic path loss for doubling range. Option C (100 dBm) is unrealistic and exceeds regulatory limits for enterprise wireless deployments. Proper power planning must balance coverage, interference, and regulatory compliance. Reference topic:RF Fundamentals — Free-space path loss, power control, and transmitter range planning in enterprise WLAN design.

An elevated noise floor indicates degraded RF conditions and directly reduces wireless link reliability. Cisco defines the noise floor as the ambient RF noise level, expressed in dBm, below which received signals are unintelligible. Cisco also defines SNR as the ratio of signal strength to the noise floor, meaning that when the noise floor rises, the usable separation between the desired signal and background RF energy decreases.

For a receiver to decode frames reliably, the received signal must remain sufficiently above the noise floor. Cisco site-survey guidance states that RF signals must be higher than the noise floor to be detectable as valid useful signals, and gives the common design example of -67 dBm signal with a -92 dBm noise floor to maintain 25 dB SNR. When the noise floor is elevated, SNR drops, clients experience more retries, lower modulation rates, reduced throughput, and possible disconnects. Cisco’s high-density wireless guidance states that raised noise floor lowers SNR, translating to lower speeds and higher airtime utilization. Options B, C, and D describe unrelated timing, spectrum-planning, or bandwidth-demand concepts. Reference topics:RF Fundamentals — noise floor, SNR, RSSI, RF interference, retries, and wireless link quality.

In Cisco Catalyst 9800 WLAN configurations, assigning a VLAN to a WLAN is done using theaccess vlan < vlan-id > command under the WLAN context. This ensures that clients associating with the guest SSID are placed in the correct Layer 2 VLAN for proper segmentation and network access. The exhibit shows that security features are removed and the WLAN is operational, but no VLAN is yet assigned. Option A correctly usesaccess vlan 10under the WLAN configuration, enabling client traffic to be tagged or untagged into VLAN 10 for site A deployment. Option B is invalid syntax; simply usingvlan 10is insufficient and not recognized in IOS XE WLAN configuration. Options C and D involvepolicy profilecommands, which define WLAN policies but do not directly assign the VLAN to the guest WLAN itself. Cisco Wireless Core Technologies emphasize that proper VLAN assignment ensures guest isolation, correct DHCP assignment, and traffic segregation, which is critical for security and compliance in enterprise deployments. Assigning the VLAN in this manner also allows downstream switches to correctly forward traffic to the intended network segment. Reference topics:Client Connectivity Configuration — WLAN VLAN assignment, guest SSID, access vlan, Cisco Catalyst 9800.

The correct answer isBbecause Wi-Fi antenna gain is expressed usingdBi, which means decibels relative to an isotropic radiator. Cisco’s Wireless RF Reference Guide states that antenna gain is measured in decibels relative to isotropic gain, ordBi. Cisco RF design documentation also explains that dBi is used to describe the power gain rating of antennas by comparing real antennas against an ideal isotropic antenna that radiates equally in all directions.

Antenna gain is not a measurement of physical antenna length. Length may influence antenna design and resonance, but it is not the operational unit used to express gain. It is also not measured as voltage against dBm.dBmis an absolute power reference relative to one milliwatt, commonly used for transmit power or received signal strength, whiledBidescribes antenna gain. Cisco’s EIRP calculation reinforces this separation: transmitter power is in dBm, antenna gain is in dBi, and cable loss is in dB. A “blend of analog and digital signals” has no RF measurement relevance. Reference topic:RF Fundamentals — antenna gain, dB/dBi/dBm, isotropic radiator reference, EIRP, and RF propagation behavior.

Theworkgroup bridge modeon a Cisco access point is designed to integrate awired network segment into an existing wireless infrastructure. In this mode, the AP acts as a client to a root AP or wireless controller-managed network, bridging Ethernet-connected devices on its wired ports to the wireless LAN. This is commonly deployed in environments where wired devices, such as printers, legacy systems, or isolated office equipment, require network connectivity but cannot directly connect to the wired backbone.

Traffic from devices on the wired segment is encapsulated and transmitted over the wireless link to the root AP, effectively extending network access without running physical cabling. Unlike bridging between multiple AP radios (2.4 GHz vs. 5 GHz), or providing inter-Ethernet port forwarding, the primary attribute of a workgroup bridge iswireless-to-wired integration, not radio-to-radio communication or internal LAN segmentation. Broadcast domains are limited to the bridged wired segment and the wireless uplink; they are not automatically extended across all interfaces without VLAN configuration.

Cisco deployment guides emphasize that workgroup bridge mode is ideal forconnecting remote wired clusters to a centralized WLAN, providing seamless connectivity while maintaining security and management under the controller or root AP. Reference topic:Wireless Network Implementation — AP operational modes, workgroup bridge, and wired segment integration.

The correct expression isaccessPoints[0].interfaces[1] .macAddress. The JSON object contains a top-level key namedaccessPoints, whose value is an array. Array indexing begins at zero, soaccessPoints[0]selects the first access point object,ap-west-1. Inside that object, theinterfaceskey also contains an array. Therefore,interfaces[1] selects the second interface object, which hasslot: 1,status: "down", andmacAddress: "CC:FA:00:11:22:34". The final selector,.macAddress, returns that MAC address value.

This structure is directly aligned with Cisco automation workflows, where RESTCONF and Catalyst Center APIs exchange structured data in JSON. Cisco documents that Catalyst Center REST API payloads are JSON-formatted, and its example describes JSON as key-value data separated by colons. Cisco also states that Catalyst 9800 RESTCONF uses structured XML or JSON with YANG models for programmatic device access. Option B selectsap-east-2. Option C selects the first interface onap-west-1. Option D references a non-existent second interface onap-east-2. Reference topics:Automation and AI — JSON parsing, REST APIs, Catalyst Center programmability, RESTCONF, and wireless telemetry data structures.

An RTS frame is an 802.11control frameused in the Request to Send/Clear to Send exchange. Cisco identifies RTS as a Request to Send frame and explains that 802.11 control frames assist in delivering data frames between stations. Cisco further states that the RTS/CTS function is optional, helps reduce collisions when hidden stations are associated to the same access point, and that a station sends an RTS frame as the first phase before transmitting a data frame.

Therefore, option B is correct because the RTS frame requests access to the wireless medium before data transmission. If the receiving station or AP replies with CTS, nearby stations defer transmission based on the duration information, reducing collision probability. This is especially relevant in hidden-node environments where two clients can hear the AP but cannot hear each other. Option A refers to RF spectral-mask compliance, which is a physical-layer regulatory concept. Option C confuses NAV behavior with roaming; RTS/CTS may influence virtual carrier sensing, not client roaming updates. Option D is unrelated because frame compression is not an RTS function. Reference topics:802.11 frame types, control frames, RTS/CTS, CSMA/CA, hidden-node mitigation, and medium reservation.

The correct configuration is option C because Cisco IOS XE restricts inbound protocols on VTY lines with thetransport inputcommand. Cisco’s Catalyst 9800 best-practice guidance states that administrators should confirm SSH is enabled and Telnet is disabled for better controller security, and that the Catalyst 9800 follows standard Cisco IOS XE behavior for enabling or disabling Telnet and SSH. Cisco IOS XE SSH documentation explicitly showsline vty line_number [ending_line_number]followed bytransport input ssh, and explains that this prevents non-SSH Telnet connections, limiting access to SSH only.

The existing exhibit already includes the SSH prerequisites: hostname, domain name, RSA key generation, AAA new-model, a default login method using local credentials, and a local privileged user. The missing VTY configuration must therefore apply that default AAA login list to the VTY lines withlogin authentication defaultand restrict inbound transport to SSH. Cisco AAA documentation confirms thatlogin authentication defaultapplies the configured default authentication list to the line or set of lines. Option A is incomplete and does not explicitly permit SSH. Option B uses invalid syntax. Option D omits the requiredinputkeyword. Reference topics:Catalyst 9800 secure management, VTY access control, SSH, Telnet hardening, AAA login authentication, and IOS XE device administration.

The correct answer isorthogonal frequency-division multiple access, orOFDMA. Cisco identifies 802.11ax, also known as Wi-Fi 6, as the generation that introduces OFDMA-based operation to improve efficiency, especially in dense wireless environments. Cisco’s Catalyst 9800 documentation states that OFDMA support for 802.11ax APs improves performance in dense deployments, enables simultaneous data transmissions with OFDMA and MU-MIMO, and supports uplink and downlink multi-user operations across multiple client devices.

Strictly, OFDMA is a multi-user channel-access and subcarrier allocation method rather than a pure constellation modulation scheme. However, within 802.11ax fundamentals and this answer set, OFDMA is the defining PHY/MAC technology. It divides a 20, 40, 80, or 160 MHz channel into smaller resource units so multiple clients can transmit or receive in the same transmission opportunity. Cisco further explains that OFDMA improves wireless performance by using independently modulated subcarriers within frequencies, allowing simultaneous transmissions to and from multiple clients. FHSS and DSSS belong to older 802.11 PHY generations. QAM is used for symbol modulation, but “Quadrature Amplitude Modulation OFDMA” is not the primary 802.11ax technology name. Reference topics:802.11ax/Wi-Fi 6, OFDMA, resource units, uplink/downlink multi-user operation, and high-efficiency WLAN design.

TACACS+ is used for device administration, especially for GUI and CLI access to infrastructure platforms such as Cisco Catalyst 9800 WLCs, switches, and routers. Cisco defines TACACS+ as a security application that provides centralized validation for users attempting to access a device or network access server, and it separates authentication, authorization, and accounting functions for administrative control. Cisco ISE device administration documentation further states that TACACS+ is used to control and audit network device configuration, allowing devices to query ISE for administrator authentication and authorization while sending accounting records for logging administrator actions.

Therefore, the primary benefit is streamlined administrator access across platforms. Instead of maintaining local administrator accounts independently on every WLC or network device, TACACS+ enables centralized identity validation, role-based authorization, and consistent audit trails. Option A is incorrect because TACACS+ supports differentiated authorization rather than static grouping. Option B is the opposite of centralized accounting. Option D is inaccurate because TACACS+ is mainly for device administration, whereas client or endpoint network access is typically handled with RADIUS. Reference topics:Wireless Monitoring and Management — AAA for WLC administration, TACACS+ device administration, role-based access, and centralized audit control.