Refer to the exhibit. The image shows a packet capture that was taken at the CLI of the Cisco CMX server. It shows UDP traffic from the WLC coming into the server. What does the capture prove?

A. The Cisco CMX server receives NetFlow data from the WLC.

B. The Cisco CMX server receives NMSP traffic from the WLC.

C. The Cisco CMX server receives SNMP traffic from the WLC.

D. The Cisco CMX server receives Angle-of-Arrival data from the WLC.

An engineer is implementing RADIUS to restrict administrative control to the network with the WLC management IP address of 192.168.1.10 and an AP subnet of
192.168.2.0/24. Which entry does the engineer define in the RADIUS server?

A. administrative access defined on the WLC and the network range 192.168.2.0/255.255.254.0

B. NAS entry of the virtual interface and the network range 192.168.2.0/255.255.255.0

C. shared secret defined on the WLC and the network range 192.168.1.0/255.255.254.0

D. WLC roles for commands and the network range 192.168.1.0/255.255.255.0

A Cisco WLC has been added to the network and Cisco ISE as a network device, but authentication is failing. Which configuration within the network device configuration should be verified?

A. SNMP RO community

B. device interface credentials

C. device ID

D. shared secret

What is configured to use more than one port on the OEAP to extend the wired network?

A. remote LAN ACL

B. AAA override

C. client load balancing

D. remote LAN

An engineer configures an AireOS WLC v8.2 that has Cisco Aironet 3700 Series APs and Cisco Hyperlocation modules. The engineer deploys and enables a WLAN that has Hyperlocation. During testing, the engineer notices poor location accuracy when the packets arrive. Which action resolves the issue?

A. Open SNMP port 161 and NMSP port 16113 on the WLC.

B. Enable Hyperlocation in the Global Configuration settings of the WLC.

C. Wait 60 to 90 minutes for RRM to settle before recording location measurements.

D. Install the software code for the WLC that supports the Hyperlocation module.

An engineer must create an account to log in to the CLI of an access point for troubleshooting. Which configuration on the WLC will accomplish this?

A. Allow New Telnet Sessions

B. ReadWrite User Access Mode

C. SNMP V3 User

D. Global Configuration Enable Password

An engineer must implement a BYOD policy with these requirements:
✑ Onboarding unknown machines
✑ Easily scalable
✑ Low overhead on the wireless network
Which method satisfies these requirements?

A. triple SSID

B. single SSID

C. open SSID

D. dual SSID

An engineer is setting up web authentication for the public Wi-Fi. The installation will take place in a retail store. The existing Facebook page to log in to the captive portal must be used. The engineer already paired the Cisco MSE to the Facebook page. Which two actions complete the configuration? (Choose two.)

A. Configure access control lists.

B. Pair Cisco MSE to Cisco Prime Infrastructure.

C. Configure the client for authentication.

D. Configure Cisco MSE to allow mobile authentication.

E. Configure WLAN for authentication.

A new MSE with wIPS service has been installed and no alarm information appears to be reaching the MSE from controllers. Which protocol must be allowed to reach the MSE from the controllers?

A. SOAP/XML

B. NMSP

C. CAPWAP

D. SNMP

An engineer must run a Client Traffic Stream Metrics report in Cisco Prime Infrastructure. Which task must be run before the report?

A. scheduled report

B. radio performance

C. client status

D. software

A wireless network engineer must present a list of all rogue APs with a high severity score to senior management. Which report must be created in Cisco Prime
Infrastructure to provide this information?

A. Rogue AP Count Summary

B. New Rogue APs

C. Rogue AP Events

D. Rogue APs

Refer to the exhibit. An engineer needs to configure location services in an office. The requirement is to use FastLocate and achieve higher locations refresh rates. Which location-based technique should be implemented?

A. probe-based

B. location patterning

C. data packet-based

D. angulation

An engineer must track guest traffic flow using the WLAN infrastructure. Which Cisco CMX feature must be configured and used to accomplish this tracking?

A. analytics

B. connect and engage

C. presence

D. detect and locate

Refer to the exhibit.
 
Which area indicates the greatest impact on the wireless network when viewing the Cisco CleanAir Zone of Impact map of interferers?

A. A

B. B

C. C

D. D

A user is trying to connect to a wireless network that is configured for WPA2-Enterprise security using a corporate laptop. The CA certificate for the authentication server has been installed on the Trusted Root Certification Authorities store on the laptop. The user has been prompted to enter the credentials multiple times, but the authentication has not succeeded. What is causing the issue?

A. There is an IEEE invalid 802.1X authentication policy on the authentication server.

B. The user Active Directory account is locked out after several failed attempts.

C. There is an invalid 802.1X authentication policy on the authenticator.

D. The laptop has not received a valid IP address from the wireless controller.

What is the maximum time range that can be viewed on the Cisco DNA Center issues and alarms page?

A. 3 hours

B. 24 hours

C. 3 days

D. 7 days

An engineer needs to configure an autonomous AP for 802.1x authentication. To achieve the highest security an authentication server is used for user authentication. During testing, the AP fails to pass the user authentication request to the authentication server. Which two details need to be configured on the AP to allow communication between the server and the AP? (Choose two.)

A. username and password

B. PAC encryption key

C. RADIUS IP address

D. shared secret

E. group name

After receiving an alert about a rogue AP, a network engineer logs into Cisco Prime Infrastructure and looks at the floor map where the AP that detected the rogue is located. The map is synchronized with a mobility services engine that determines that the rogue device is actually inside the campus. The engineer determines that the rogue is a security threat and decides to stop if from broadcasting inside the enterprise wireless network. What is the fastest way to disable the rogue?

A. Go to the location where the rogue device is indicated to be and disable the power.

B. Create an SSID similar to the rogue to disable clients from connecting to it.

C. Update the status of the rogue in Cisco Prime Infrastructure to contained.

D. Classify the rogue as malicious in Cisco Prime Infrastructure.

A network engineer has been hired to perform a new MSE implementation on an existing network. The MSE must be installed in a different network than the Cisco
WLC. Which configuration allows the devices to communicate over NMSP?

A. Allow UDP/16113 port on the central switch.

B. Allow TCP/16113 port on the firewall.

C. Allow UDP/16666 port on the VPN router.

D. Allow TCP/16666 port on the router.

An engineer must implement a wireless network to support location services. The network will include an MSE and Cisco WLC. After the deployment, the IT team must be able to locate and track clients. What is the minimum number of APs that a client must hear to accomplish this configuration so that the engineer can position them accordingly?

A. 1

B. 3

C. 4

D. 6

In a Cisco WLAN deployment, it is required that all Aps from branch1 remain operational even if the control plane CAPWAP tunnel is down because of a WAN failure to headquarters. Which operational mode must be configured on the APs?

A. disconnected

B. standalone

C. lightweight

D. connected

The security policy mandates that only controller web management traffic is allowed from the IT subnet. In testing, an engineer is trying to connect to a WLAN with
Web Authentication for guest users, but the page is timing out on the wireless client browser. What is the cause of the issue?

A. The implemented CPU ACL on the controller is blocking HTTP/HTTPS traffic from the guest clients.

B. Web Authentication Redirect is not supported with CPU ACLs.

C. The DNS server that is configured on the controller is incorrect.

D. Web Authentication Redirect is supported only with Internet Explorer, and the client is using Google Chrome.

Refer to the exhibit. The security team has implemented ISE as an AAA solution for the wireless network. The wireless engineer notices that though clients are able to authenticate successfully, the ISE policies that are designed to place them on different interfaces are not working. Which configuration must be applied in the RADIUS Authentication Settings section from the ISE Network Device page?

A. Disable KeyWrap.

B. Use ASCII for the key input format.

C. Change the CoA Port.

D. Correct the shared secret.

After looking in the logs, an engineer notices that RRM keeps changing the channels for non-IEEE 802.11 interferers. After surveying the area, it has been decided that RRM should not change the channel. Which feature must be enabled to ignore non-802.11 interference?

A. Avoid Cisco AP Load

B. Avoid Non-802.11 Noise

C. Avoid Persistent Non-WiFi Interference

D. Avoid Foreign AP Interference

An engineer needs read/write access to rename access points and add them to the correct AP groups on a wireless controller. Using Cisco ISE TACACS, which custom attributes is the minimum required?

A. role1=WLAN

B. role1=WLAN role2=SECURITY

C. role1=WLANrole2=WIRELESS

D. role1=WIRELESS

What are two considerations when deploying a Cisco Hyperlocation? (Choose two.)

A. NTP configuration is available, but not recommended.

B. The Cisco Hyperlocation feature must be enabled only on the wireless LAN controller.

C. After enabling Cisco Hyperlocation on Cisco CMX, the APs and the wireless LAN controller must be restarted.

D. The Cisco Hyperlocation feature must be enabled on the wireless LAN controller and Cisco CMX.

E. If the Cisco CMX server is a VM, a high-end VM is needed for Cisco Hyperlocation deployments.

An engineer is configuring multicast for two WLCs. The controllers are in different physical locations and each handles around 500 wireless clients. How should the CAPWAP multicast group address be assigned during configuration?

A. Each WLC must be assigned a unique multicast group address.

B. Each WLC management address must be in the same multicast group.

C. Both WLCs must be assigned the same multicast group address.

D. Each WLC management address must be in a different multicast group.

WPA2 Enterprise with 802.1X is being used for clients to authenticate to a wireless network through a Cisco ISE server. For security reasons, the network engineer wants to ensure that only PEAP authentication is used. The engineer sent instructions to clients on how to configure the supplicants, but the ISE logs still show users authenticating using EAP-FAST. Which action ensures that access to the network is restricted for these users unless the correct authentication mechanism is configured?

A. Enable AAA override on the SSID, gather the usernames of these users, and disable the RADIUS accounts until the devices are correctly configured.

B. Enable AAA override on the SSID and configure an ACL on the WLC that allows access to users with IP addresses from a specific subnet.

C. Enable AAA override on the SSID and configure an access policy in Cisco ISE that denies access to the list of MACs that have used EAP-FAST.

D. Enable AAA override on the SSID and configure an access policy in Cisco ISE that allows access only when the EAP authentication method is PEAP.

More people are working from home, so an engineer must configure OEAPs to support the users. The security team already configured NAT with a public IP address that points to the internal WLC IP address. The APs also have been configured with the public WLC IP address, but APs cannot join the controller yet. Which action resolves this issue?

A. Configure the internal WLC IP address on the OEAPs.

B. Create an ACL in WLC to accept the OEAPs.

C. Enable NAT on the WLC to configure the public IP address.

D. Configure the public WLC IP address on the home router.

Refer to the exhibit. Which two items must be supported on the VoWLAN phones to take full advantage of this WLAN configuration? (Choose two.)

A. TSPEC

B. SIFS

C. 802.11e

D. WMM

E. APSD

An engineer has successfully implemented 10 active RFID tags in an office environment. The tags are not visible when the location accuracy is tested on the
Cisco CMX Detect and Locate window. Which setting on Cisco CMX allows the engineer to view the tags?

A. Enable RFID tags in tracking options.

B. Enable probing clients for active tags.

C. Define an RFID group globally and add the tags.

D. Enable hyperlocation services for RFID.

An engineer is using Cisco Prime Infrastructure reporting to monitor the state of security on the WLAN. Which output is produced when the Adaptive wIPS Top 10
AP report is run?

A. last 10 wIPS events from monitor mode APs

B. last 10 wIPS events from sniffer mode APs

C. last of 10 sniffer mode APs with the most wIPS events

D. last of 10 monitor mode APs with the most wIPS events

A wireless administrator receives this information to complete a CMX deployment in high availability by using version 10.6 to gather analytics.
• IP address of the primary server
• IP address of the secondary server
• failover mode to be configured as automatic
• root password of the secondary server
• email ID for NOC notifications
Enabling high availability fails when these parameters are used. Which action resolves the issue?

A. Insert the cmxadmin password of the secondary server.

B. Use IP protocol 4242 for the controller to reach the CMX server.

C. Place primary and secondary servers in different subnets.

D. Enable the virtual IP address of the primary server.

Refer to the exhibit. An enterprise uses 802.11 b/g APs and must track the RFID tags within the network. How many channels must be used to maximize the optimization of the monitoring and tracking of the tags?

A. 1

B. 3

C. 4

D. 11

Which two statements about the requirements for a Cisco Hyperlocation deployment are true? (Choose two.)

A. After enabling Cisco Hyperlocation on Cisco CMX, the APs and the wireless LAN controller must be restarted.

B. NTP can be configured, but that is not recommended.

C. The Cisco Hyperlocation feature must be enabled on the wireless LAN controller and Cisco CMX.

D. The Cisco Hyperlocation feature must be enabled only on the wireless LAN controller.

E. If the Cisco CMX server is a VM, a high-end VM is needed for Cisco Hyperlocation deployments.

A network engineer performed a new deployment of Cisco DNA Center. The engineer discovered and provisioned all APs and converted them to fabric. The SSIDs were created, and the APs were allocated to the respective floors, but the SSIDs are not being seen on the floors. What must be configured to establish this connectivity?

A. Map the pools to the SSIDs.

B. Configure RADIUS for the SSIDs.

C. Enable all radios on the APs.

D. Add the users in Cisco ISE.

An engineer must implement a CPU ACL that blocks web management traffic to the controller, but they also must allow guests to reach a Web Authentication
Redirect page. To which IP address is guest client HTTPS traffic allowed for this to work?

A. DNS server IP

B. controller management IP

C. virtual interface IP

D. client interface IP

An engineer is troubleshooting a Cisco CMX high-availability deployment and notices that the primary and backup Cisco CMX servers are both considered primary. Which command must the engineer run on the backup server?

A. cmxha convert backup

B. cmxha backup convert

C. cmxha secondary convert

D. cmxha convert secondary

An engineer manages the wireless network for a government agency. The wireless network is used for access to the corporate network. The wireless network must include the latest wIPS/wIDS detection definitions. Which action does the engineer take to ensure that this requirement is met?

A. Update the Cisco MSE software.

B. Configure Cisco Prime Infrastructure to push new definitions to the APs.

C. Update the Cisco WLC software.

D. Configure the Cisco WLC to repoll the Cisco MSE for update definitions.

What is the Cisco recommended configuration for a Cisco switch port connected to an AP in local mode for optimal voice over WLAN performance with an 8821 wireless phone?

A. switchport encapsulation dot1q switchport mode trunk mls qos trust device cisco-phone

B. switchport mode access mls qos trust device cisco-phone

C. switchport mode access mls qos trust cos

D. switchport mode access mls qos trust dscp

An IT administrator deployed an OEAP to the home of a remote user, but the OEAP cannot reach the WLC. Which two configuration settings must be completed before an OEAP is deployed successfully? (Choose two.)

A. Configure Secondary Controller Name and Management IP address in the High Availability tab.

B. Configure LSC to authorize the OEAP.

C. Configure the AP mode to FlexConnect and check the box for Office Extend AP.

D. Configure the WLC with an external IP address on the virtual interface.

E. Configure Primary Controller Name and Management IP address in the High Availability tab.

During discovery, one out of five fabric-enabled WLAN controllers is not being properly discovered. The firewall rules are the same for all the controllers. Which element is missing?

A. YANG

B. SNMP management

C. SNMP trap

D. NETCONF

Refer to the exhibit. An engineer implemented the CPU ACL on your Cisco 5520 Series Wireless LAN Controller, and the controller is no longer manageable via the network. What must be changes on this CPU ACL to enable it to manage the controller again?

A. Permit statements must be added to the top of the ACL in both directions, which specify the network to be managed from and the virtual interface of the controller.

B. Line 1 must be set to a destination port of HTTP.

C. Permit statements must be added to the top of the ACL, which specify the network to be managed from.

D. Line 1 must be set to the inbound direction.

An engineer set up a VoWLAN with QoS on the WLC and a class map on the switch, but the markings are not being preserved correctly in the end-to-end traffic flow. Which two configurations on the wired network ensure end-to-end QoS? (Choose two.)

A. trust boundaries

B. access lists

C. policy maps

D. QoS licenses

E. NetFlow

All APs are receiving multicast traffic, instead of only the APs that need it. What is the cause of this problem?

A. The multicast group includes all APs

B. The wrong multicast address was used

C. The multicast group is assigned the wrong VLAN

D. Multicast IGMP snooping is not enabled

A wireless engineer must configure access control on a WLC using a TACACS+ server for a company that is implementing centralized authentication on network devices. Which role value must be configured under the shell profile on the TACACS+ server for a user with read-only permissions?

A. ADMIN

B. MANAGEMENT

C. MONITOR

D. READ

Refer to the exhibit. An engineer deployed a Cisco WLC using local EAP. Users who are configured for EAP-PEAP cannot connect to the network. Based on the local EAP debug on the controller provided, why is the client unable to connect?

A. The client is failing to accept certificate.

B. The Cisco WLC is configured for the incorrect date.

C. The Cisco WLC local EAP profile is misconfigured.

D. The user is using invalid credentials.

Refer to the exhibit. An engineer is creating an ACL to restrict some traffic to the WLC CPU. Which selection must be made from the direction drop-down list?
 

A. It must be Inbound because traffic goes to the WLC.

B. Packet direction has no significance; it is always Any.

C. It must be Outbound because it is traffic that is generated from the WLC.

D. To have the complete list of options, the CPU ACL must be created only by the CLI.

DRAG DROP
-
A network engineer must get an autonomous AP to authenticate to the upstream switch via IEEE 802.1 X. Drag and drop the commands from the left onto the right to complete the configuration.
 

Split Tunneling must be configured for traffic sent by the client to be classified based on packet content, using an ACL. To accomplish this, the packets must be either locally switched from Cisco FlexConnect AP or centrally-switched over CAPWAP. Which type of ACL must be configured to accomplish this switching?

A. Interface

B. CPU

C. FlexConnect

D. WLAN