Free Cisco 350-101 Practice Exam with Questions & Answers | Set: 2

Dynamic endpoint profiling in Cisco wireless networks is used to classify devices based on type, behavior, and attributes, enabling policy enforcement that adapts to device posture. In a deployment integrated with Cisco ISE, profiling groups are created to define rules and categories for device types such as smartphones, laptops, printers, and IoT devices. These profiling groups allow the wireless controller to map devices to the correct ISE policy sets dynamically, ensuring that security policies, VLAN assignments, and access controls are applied according to the device profile. Option A (device-type groups) is a generic categorization that does not fully leverage ISE dynamic profiling capabilities. Option C (user ID groups) focuses on user identity rather than device characteristics. Option D (endpoint group mapping) is typically applied after device profiling and classification, but initial enforcement requires creating profiling groups. By configuring profiling groups, the IT team ensures that the network can classify endpoints automatically, enforce access policies consistently, and integrate with ISE for context-aware security and compliance monitoring. Reference topics:Wireless Monitoring and Management — Dynamic endpoint profiling, Cisco ISE policy integration, profiling groups, device classification for secure access.

MIMO, or Multiple-Input Multiple-Output, is a core 802.11n and later wireless technology that uses multiple transmit and receive radio chains and antennas to improve wireless performance. Cisco’s Wireless RF Reference Guide explains that IEEE 802.11n introduced MIMO, replacing the older single-radio SISO model with multiple radios, each using its own antenna, to increase data rates and improve reception in multipath environments. Cisco also notes that weak or distorted multipath signals can be received by more than one radio and reconstructed, improving decode quality and reliability.

This directly supports option A: MIMO exploits multiple RF paths rather than treating multipath as purely destructive. Depending on implementation, MIMO can use spatial diversity, maximal ratio combining, and spatial streams to increase throughput, improve signal-to-noise ratio, reduce retries, and make more efficient use of airtime. Cisco describes spatial stream notation such as 4x4:4 as four transmitters, four receivers, and four spatial streams. Option B describes frequency hopping, not MIMO. Option C is not a MIMO function. Option D is the opposite of MIMO because MIMO deliberately uses multiple antennas and radio paths. Reference topics:802.11 Technology Fundamentals — MIMO, spatial streams, multipath, SISO versus MIMO, and 802.11n/ac/ax PHY enhancements.

When deploying Meraki APs, it is essential to claim each AP in the Meraki dashboard to ensure that they are automatically assigned to the correct network and can be managed remotely. This process involves registering the APs with the Meraki cloud, which is done by adding the AP serial numbers to the network within the Meraki dashboard before physically installing them at the branch.

Option B: "Add the AP serial numbers to the required network within the Meraki dashboard."This is the correct answer. Before the APs are physically connected, the administrator needs to log into the Meraki dashboard and add the serial numbers of the new APs to the intended network. This ensures that once the APs are powered on and connected, they automatically join the correct network and are ready for monitoring and management without requiring further configuration.

Option A: "Activate mesh networking mode for all the new APs before installation."Mesh networking mode is used when APs need to communicate wirelessly to extend coverage, but it is not a requirement for the deployment and registration process. The APs should be connected normally for initial setup, and mesh mode can be enabled later if needed.

Option C: "Preconfigure SSID names and VLAN tags on the local page of each AP in the Meraki dashboard."While configuring SSID and VLAN settings is essential, this is not the first action required for ensuring the APs are claimed by the correct network. The priority is to add the AP serial numbers to the Meraki dashboard for proper network assignment.

Option D: "Create a separate DHCP scope for all the new APs on the local server."DHCP scope configuration is important for assigning IP addresses, but this is not the primary step for ensuring the APs are correctly registered in the Meraki dashboard. The APs can obtain IP addresses from an existing DHCP scope once they are connected and claimed in the dashboard.

Therefore, the best approach isOption B, as it ensures that the APs are correctly assigned to the intended network in the Meraki cloud, ready for management and monitoring once connected.

The failure is occurring during WPA/WPA2 key management, not during mobility anchoring. The radioactive trace showsFailed to validate eapol mic. MIC mismatchfollowed byFailed to validate eapol key m2, which means the authenticator and supplicant derived different key material during the PSK handshake. Cisco’s Catalyst 9800 client-connectivity troubleshooting maps this log pattern directly to a wrong password condition and lists the corrective actions as fixing the password on the endpoint or on the SSID/WLAN. The11r MIC validation failedphrase does not automatically make 802.11r the root cause; it only shows that the failed MIC validation occurred while Fast Transition key logic was in use. Disabling 802.11r would be a workaround only for client capability or FT interoperability issues, but the trace points to PSK mismatch. Removing the anchor WLC would break the intended DMZ anchoring design, and matching WLANs on foreign and anchor is required for anchor deployments, but it would not produce this EAPOL M2 MIC failure. The correct remediation is to ensure the client-entered PSK matches the WLAN PSK. Reference topics: WPA/WPA2-PSK authentication, EAPOL 4-way handshake, Catalyst 9800 radioactive trace analysis, and client connectivity troubleshooting.

The switch interfaces connected to the APs must be configured as 802.1Q trunk ports. The requirement states that AP management and guest Wi-Fi traffic must remain separate, and additional VLANs for IoT and voice are expected. An access port supports only one VLAN, so it cannot scale for multiple locally tagged client VLANs. Cisco’s Catalyst AP guidance states that when multiple VLANs are used for client traffic, the AP switch port should trunk the VLANs, and management traffic is untagged; when a management VLAN is used, it should be configured as the native VLAN on the switch port. Cisco’s Catalyst 9800 FlexConnect documentation also shows the AP connected to a trunk port with a native VLAN for AP IP connectivity and a separate VLAN for locally switched client traffic.

Option C is therefore correct: configure a trunk, set the AP management VLAN as native, and restrict the allowed VLAN list to only required management and client VLANs such as guest, IoT, and voice. This supports segmentation and prevents unnecessary internal VLAN exposure. Reference topics:AP switch-port design, 802.1Q trunks, native VLANs, client VLAN tagging, FlexConnect/local switching, and guest traffic segmentation.

The correct answer isBbecause Wi-Fi antenna gain is expressed usingdBi, which means decibels relative to an isotropic radiator. Cisco’s Wireless RF Reference Guide states that antenna gain is measured in decibels relative to isotropic gain, ordBi. Cisco RF design documentation also explains that dBi is used to describe the power gain rating of antennas by comparing real antennas against an ideal isotropic antenna that radiates equally in all directions.

Antenna gain is not a measurement of physical antenna length. Length may influence antenna design and resonance, but it is not the operational unit used to express gain. It is also not measured as voltage against dBm.dBmis an absolute power reference relative to one milliwatt, commonly used for transmit power or received signal strength, whiledBidescribes antenna gain. Cisco’s EIRP calculation reinforces this separation: transmitter power is in dBm, antenna gain is in dBi, and cable loss is in dB. A “blend of analog and digital signals” has no RF measurement relevance. Reference topic:RF Fundamentals — antenna gain, dB/dBi/dBm, isotropic radiator reference, EIRP, and RF propagation behavior.

Central Web Authentication is the correct design for an open guest SSID that redirects users to a captive portal before allowing network access. Cisco describes CWA as a guest-redirection method where the redirect URL and redirect ACL are centrally controlled and communicated to the WLC through RADIUS, with the external authentication system handling the login workflow. On a Catalyst 9800 WLAN, Cisco’s configuration flow for Central Web Authentication requires AAA/ACL configuration, including the AAA server list and an ACL tied to the WLAN so client access can be controlled before and after authentication.

Option D is the only answer that satisfies all requirements: captive portal redirection, post-authentication restriction to Internet-only access, and policy enforcement through ACLs. VLAN-level segmentation is implemented through the WLAN policy profile, which maps guest clients to the guest VLAN rather than the staff VLAN. WPA2-PSK is invalid because the guest SSID must not require a password. A local web server alone does not enforce Internet-only authorization or staff-network isolation. mDNS is unrelated to captive portal authentication or guest segmentation. Reference topics:Guest WLAN design, Central Web Authentication, Catalyst 9800 policy profiles, ACL enforcement, VLAN segmentation, and captive portal client onboarding.

In a centrally switched deployment, the WLAN traffic is tunneled via CAPWAP from the AP to the WLC, where VLAN assignment occurs. To ensure that client devices are placed into the correct VLAN (in this case, VLAN 10), the WLAN policy profile must define the VLAN mapping. This allows the WLC to tag client traffic appropriately when forwarding to the upstream switch. Option C is correct because it configures the WLAN profile (policy profile) with VLAN 10, ensuring all clients associating with the WLAN are mapped to the proper VLAN automatically. Option A is incorrect because VLAN tagging is managed centrally on the WLC, and access ports at the AP are typically trunked or transparent in central switching mode. Option B is invalid; manually configuring VLAN on client devices is not feasible or scalable in enterprise deployments and does not integrate with CAPWAP central switching. Option D is also incorrect; relying on MAC-based redirection introduces complexity and is not standard practice for VLAN assignment in centrally switched networks. Cisco Wireless Core Technologies recommend using policy profiles to centrally enforce VLANs, simplifying management, ensuring security compliance, and supporting consistent enterprise Wi-Fi connectivity. Reference topics:Client Connectivity Configuration — VLAN assignment, WLAN policy profiles, centrally switched deployments, Cisco Catalyst 9800 WLC.

AI Enhanced Radio Resource Management (RRM) in Cisco wireless networks improves upon traditional RRM by leveraging historical data in addition to real-time measurements to optimize network performance. Traditional RRM reacts primarily to instantaneous conditions, such as current interference or load, and adjusts parameters like transmit power and channel assignment accordingly. In contrast, AI Enhanced RRM uses historical telemetry to identify patterns, predict congestion, and preemptively adjust network parameters, providing a more stable and high-performing wireless environment. This predictive capability allows the system to make informed adjustments for channel reuse, load balancing, and interference mitigation before network degradation occurs. While real-time adjustments are still made, the inclusion of historical data allows for smarter decisions and more consistent client experience. Options A and B do not describe the core benefits of AI Enhanced RRM, as legacy client support or telemetry encryption are unrelated to predictive or adaptive resource management. Option C only highlights reactive behavior, which is a characteristic of traditional RRM, not AI Enhanced RRM. Cisco documentation and design guides emphasize that AI Enhanced RRM’s key advantage is its predictive approach using historical analytics, enabling proactive network optimization across high-density or dynamic wireless environments. Reference topics:Automation and AI — AI Enhanced RRM, predictive network management, historical telemetry, channel and power optimization.

The correct AP-side command iscapwap ap primary-base WLC-PRIMARY 192.168.100.10. Cisco’s Catalyst AP command reference shows the syntax for configuring the primary controller ascapwap ap primary-base < controller-name > < controller-ip-address > , and provides the same structure in its example:capwap ap primary-base wlc-5520 209.165.200.224. Cisco’s Catalyst 9800 AP join documentation also identifies the primary controller discovery entry ascapwap ap primary-base < wlc-hostname > < wlc-IP-address > .

This command statically primes the lightweight AP with the preferred WLC when DHCP option 43, DNS discovery, broadcast discovery, or prior learned controller information is unavailable. The hostnameAP053540555is only the AP’s local identity and is not part of the WLC discovery command. Option A omits theprimary-basekeyword, so it is not valid syntax. Option B places keywords in the wrong order and does not match Cisco CAPWAP AP CLI. Option C omits the required controller name before the IP address. Reference topics:Wireless Network Implementation — CAPWAP discovery, AP priming, Catalyst 9100 AP onboarding, static WLC discovery, and Catalyst 9800 AP join process.