Free Cisco 350-101 Practice Exam with Questions & Answers

The correct answer isMake-before-break handover logic. This is a key feature in Cisco's Ultra-Reliable Wireless Backhaul (URWB) process that allows devices to establish a connection to the next AP (Access Point) before disconnecting from the current AP. This seamless transition ensures that there is no disruption in the wireless connection as the client roams between APs, which is especially important in environments where consistent, low-latency connectivity is essential, such as in real-time applications (e.g., voice or video).

Option A (Open roaming)refers to a method of allowing devices to roam freely across networks, but it doesn't address the specific need for a seamless handover process.

Option B (Fast client handoff)refers to methods used to speed up the roaming process, but it doesn’t specifically ensure that the next AP is connected before disconnecting from the current one.

Option C (802.11v high speed roaming)is an IEEE standard feature that helps optimize roaming behavior for fast-moving devices, butmake-before-break handover logicis the specific mechanism that allows for a seamless roaming experience.

Therefore,Make-before-break handover logic(Option D) is the correct answer as it directly addresses the need for devices to establish a reliable connection to the next AP during roaming before losing connectivity with the current one.

Cisco Catalyst Center Assurance is the correct solution because the requirement is centralized, scalable, multi-site client monitoring with aggregated health and troubleshooting data. Cisco states that Catalyst Center Assurance provides aClient health dashboardand supports both wired and wireless clients. It is specifically used to obtain a global view of all client device health and determine whether issues require action.

This directly matches the need for monitoring clients across branch locations and responding faster during performance degradation. Catalyst Center Assurance also provides location-based visibility, health scoring, client trend analysis, onboarding failure reasons such as AAA or DHCP, and Client 360 views for detailed troubleshooting. Cisco documents that Client 360 provides detailed client connectivity troubleshooting, including what problem occurred, when it occurred, why it occurred, and whether the impact is isolated or widespread. Cisco’s Catalyst Center data sheet further describes Network and Client Health dashboards as giving administrators a high-level overview of every network device and client, with expansion by geographical site, device list, client list, or topology. Syslog, WLC CLI logging, and a local WLC dashboard are useful operational tools, but they do not provide enterprise-scale assurance analytics. Reference topics:Wireless Monitoring and Management — Catalyst Center Assurance, Client Health, Client 360, centralized wireless monitoring, and operational analytics.

For Cisco Catalyst 9176 APs deployed at remote sites without DHCP option 43, automatic WLC discovery can be accomplished using DNS-based CAPWAP controller discovery. By creating a DNS A record namedcisco-capwap-controller. < domain > that resolves to the WLC management IP address, APs can query DNS and locate their centralized controller automatically, eliminating the need for site visits or manual configuration. This method is preferred for large-scale or satellite deployments where APs may exist on different subnets and traditional DHCP-based discovery is unavailable. Option A is impractical because manually assigning static IPs to hundreds of APs is operationally complex and error-prone. Option B, using a multicast group, is not supported for cross-subnet controller discovery in CAPWAP; multicast is limited to local subnets. Option D (ap-discovery) is not a recognized standard for WLC discovery; Cisco specifically documentscisco-capwap-controlleras the required DNS entry for CAPWAP-based automatic discovery. This approach ensures zero-touch provisioning, simplifies network operations, and guarantees that APs join the correct controller, supporting centralized management and consistent configuration across multiple campuses. Reference topics:Wireless Network Implementation — CAPWAP discovery, DNS-based controller discovery, Catalyst 9800 WLC onboarding, zero-touch provisioning.

For configuring guest access on a Cisco Catalyst 9800 WLC using an external WebAuth server, the WLAN must be explicitly associated with the external server through a parameter map. The correct command syntax in Cisco IOS XE iswireless wlan < wlan-name > followed bysecurity web-auth external < parameter-map > . This configuration links the WLAN to the external WebAuth server defined in the parameter map, allowing guests to be redirected to the portal for authentication. The parameter map (webauth-ext) contains details such as server IP, port, and other authentication parameters required for the external WebAuth interaction. Option B is incorrect because it improperly uses multiple WLAN names in one command, which is not valid syntax. Option C usesparameter external security-map, which is invalid and does not associate the WLAN correctly with the WebAuth server. Option D incorrectly combines the security and parameter-map syntax and is not supported in IOS XE for external WebAuth. Cisco Wireless Core Technologies recommends this approach for centralized guest management, allowing consistent enforcement of guest policies, seamless authentication, and integration with external WebAuth servers across multiple WLANs and APs. Reference topics:Client Connectivity Configuration — WebAuth, external guest portal, WLAN parameter map configuration, Cisco IOS XE 17.x.

WPA2-Personal authenticates clients with a preshared key, not with 802.1X. Cisco documents WPA/WPA2 as supporting multiple authentication methods, including 802.1X and PSK, and specifically states that when PSK is selected, a preshared key or passphrase must be configured. The configuration element that enables client authentication in this scenario is the PSK ASCII key function represented by option D. On Catalyst 9800 IOS XE, the PSK method is enabled with PSK authentication key management, and the passphrase is defined withsecurity wpa psk set-key {ascii | hex} {0 | 8} password; Cisco’s example issecurity wpa psk set-key ascii 0 test.

Option A disables 802.1X AKM, which is appropriate for Personal mode, but it does not by itself authenticate clients. Option B controls DHCP proxy behavior and has no role in WPA authentication. Option C enables AES for WPA2 encryption, which protects traffic confidentiality but does not supply the authentication secret. Reference topics:Client Connectivity Configuration — WPA2-Personal, PSK authentication, AKM selection, AES encryption, and Catalyst 9800 WLAN security configuration.

The command that enables 802.1X client authentication for this WLAN issecurity dot1x authentication-list ISE_GROUP. On a Cisco Catalyst 9800 WLC, the WLAN configuration defines Layer 2 security behavior, including whether the SSID uses 802.1X and which AAA method list is used for EAP/RADIUS authentication. Cisco documents the CLI workflow for 802.1X WLAN authentication as entering WLAN configuration mode and applyingsecurity dot1x authentication-list < authenticate-list-name > , explicitly describing this as the step to enable the authentication list for 802.1X security. Cisco’s Catalyst 9800 configuration example also shows the exact formsecurity dot1x authentication-list ISE_GROUPand states that the WLAN is then configured with 802.1X authentication.

no ip mac-bindingdisables IP-to-MAC binding checks and does not select a RADIUS method list.aaa override enableallows authorization attributes from AAA/ISE to be applied after authentication, but it does not initiate 802.1X authentication.wlan branch1 policy branch1_policymaps the WLAN to a policy profile through a policy tag, but it is not the authentication command. Reference topics:802.1X WLAN security, RADIUS AAA method lists, Catalyst 9800 WLAN configuration, and secure client onboarding.

The correct answer isfast BSS transition protocol, which is IEEE 802.11r Fast Transition. Cisco describes 802.11r BSS Fast Transition as the mechanism used to provide seamless roaming for wireless clients by reducing the time required to roam between access points. It achieves this by allowing keying material to be prepared or cached so that the client does not perform a full authentication exchange every time it moves to another AP within the same mobility domain.

This is specifically relevant to Layer 2 roaming because the client remains in the same Layer 2 network while reassociating to a different BSS. Fast Transition reduces roam latency, which is critical for voice, video, collaboration, barcode scanners, and other real-time applications. Cisco also classifies fast secure roaming as the method used to accelerate client roaming when Layer 2 security is configured on the WLAN. Increased beacon intervals do not provide handoff acceleration. Optimized roaming helps with sticky-client behavior but is not the secure handoff protocol. Deferred probe response is an RF/client steering behavior, not an 802.11 Layer 2 roaming key-transition method. Reference topics:802.11r Fast BSS Transition, Layer 2 roaming, fast secure roaming, WLAN mobility, and Catalyst 9800 roaming design.

To enforce adaptive policies based on user identity, device posture, and provide comprehensive visibility into device activity and location, Cisco recommends integrating Cisco Catalyst Center, Cisco ISE, and Cisco Spaces. Cisco ISE provides identity-based access control and posture assessment, allowing dynamic policy enforcement for users and devices. Mobile device management integration further extends posture checks for endpoint compliance. Cisco Catalyst Center enables real-time assurance and monitoring of network performance, device activity, and service health, while Cisco Spaces provides location analytics and visibility of client devices across the wireless environment. Option B relies solely on ACLs and MDM, which cannot provide full network-wide visibility or context-aware policy enforcement. Option C enables visibility via Catalyst Center but lacks dynamic identity and posture-based policies because it omits ISE integration. Option D integrates ISE but neglects device posture and location visibility, failing to meet all requirements. The combination in Option A ensures that adaptive policies can respond to real-time user and device conditions, enforce compliance, and provide actionable insights for network operations. Reference topics:Wireless Monitoring and Management — Catalyst Center assurance, Cisco ISE integration, mobile device posture, Cisco Spaces location analytics.

Optimized roaming is a Cisco WLC feature designed to reduce sticky-client behavior. A sticky client remains associated to an AP even after moving far enough away that another AP would provide better RF service. Cisco describes optimized roaming as actively monitoring client data RSSI and disconnecting clients when received signal strength falls below the configured threshold. The official Catalyst 9800 documentation states that optimized roaming “disassociates client when the RSSI is lower than the set threshold,” which directly matches option A.

This function does not calculate device location through peer-to-peer beaconing, does not depend on external experience services, and is not static load balancing. It is an RF/client-roaming enforcement mechanism controlled by the wireless infrastructure. In practical operation, the AP/WLC evaluates client signal quality and, when the configured optimized roaming criteria are met, forces the client to disconnect so it can reassess the RF environment and roam to a better AP. Cisco also notes that optimized roaming helps maintain client connectivity by managing disassociationn based on RSSI and data-rate thresholds. Reference topics:Client Connectivity Configuration — client roaming behavior, sticky-client mitigation, RSSI thresholds, and WLC roaming optimization

The log is a Layer 2 802.1X authentication failure, not an AP join or WLAN encryption mismatch. In WPA3-Enterprise, the client authenticates with 802.1X/EAP through the configured AAA path. Cisco’s Catalyst 9800 WPA3 Enterprise configuration requires the necessary RADIUS or AAA servers and authentication lists before enabling WPA3 Enterprise, and the WLAN must reference the dot1x authentication list. Therefore, aCred Failreason points directly at the user/device credential validation path: the supplicant credentials, Active Directory identity source, RADIUS policy match, or RADIUS reachability.

Cisco’s 9800 802.1X configuration workflow also shows the controller defining a RADIUS server, adding it to a RADIUS group, creating a dot1x AAA authentication method list, and applying that list to the WLAN. It further recommends checking whether the RADIUS server is alive and using ISE RADIUS Live Logs to inspect authentication requests and results. Option A is wrong because the AP is not the supplicant in this WLAN client authentication event. Option B downgrades the security model and avoids 802.1X rather than fixing it. Option D addresses NAC behavior, not a credential authentication failure. Reference topics:Client Connectivity Configuration — WPA3-Enterprise, 802.1X/EAP, RADIUS authentication, and client authentication troubleshooting.