Covers FlexConnect deployment, wireless QoS and AVC, multicast on WLANs, CMX location services, client profiling with ISE, BYOD and guest access, Catalyst Center monitoring, and hardening.
12 free sample questions150 in the full practice test
FlexConnect · VLAN-based central switching and Flex ACL
A network architect is designing a FlexConnect deployment for 50 remote retail branches using Catalyst 9800 controllers. The security policy requires that specific traffic from wireless clients be dropped before traversing the WAN link to the data center, while still allowing local branch printing. Which configuration approach optimally achieves this requirement?
flowchart TD
Client([Wireless Client]) --> AP[FlexConnect AP]
AP -->|Local Switching| Switch[Branch Switch]
Switch -->|WAN Link| Core[Data Center Core]
Core --> WLC[Catalyst 9800 WLC]
AP -.->|Flex ACL Applied| Drop[Drop Traffic]
Answer and explanation
Correct answer: B
In a FlexConnect deployment with local switching, traffic is placed directly onto the local branch network and does not traverse the CAPWAP data tunnel. To filter this traffic locally before it hits the WAN, a FlexConnect ACL (Flex ACL) must be configured on the WLC and pushed to the AP, where it is mapped to the locally switched VLAN or the client.
Question 2
AdvancedMultiple answers
FlexConnect · Smart AP image upgrade
When implementing the Smart AP Image Upgrade feature for a large FlexConnect deployment across multiple branch offices, which TWO operational phases drastically reduce the WAN bandwidth consumption during a Catalyst 9800 controller upgrade? (Select TWO)
Answer and explanation
Correct answers: A, C
The Smart AP Image Upgrade (also known as AP Image Predownload for FlexConnect) optimizes WAN bandwidth. Instead of every AP downloading the image over the WAN, a single Master AP per model in the FlexConnect group downloads the image from the WLC. Then, the Master AP distributes the image to the Subordinate APs locally over the LAN.
Question 3
Intermediate
FlexConnect · Split tunneling and fault tolerance
A multinational retail organization is deploying wireless networks across 500 branch locations. Each branch has 3 to 5 APs and relies on a central Catalyst 9800 WLC located in the primary data center.
The organization requires that branch employees can continue to scan inventory and process local point-of-sale (POS) transactions even if the WAN link to the data center completely fails. The local POS servers are hosted on a server at each branch.
However, guest traffic must be funneled directly back to the data center for deep packet inspection and centralized logging, regardless of WAN state. If the WAN fails, guest access should immediately cease to prevent uninspected traffic from accessing the internet locally.
Which combination of FlexConnect configurations will satisfy these business requirements?
Answer and explanation
Correct answer: B
For the Employee WLAN to survive a WAN outage and access local resources, it must be configured for Local Switching (to drop traffic on the local LAN) and Local Authentication (to authenticate clients without reaching the WLC). For the Guest WLAN to be forced to the data center and fail closed during a WAN outage, it must be configured for Central Switching. Central Switching tunnels traffic to the WLC; if the WLC is unreachable, the SSID stops broadcasting or clients lose connectivity, fulfilling the security requirement.
Question 4
Beginner
FlexConnect · Implement Office Extend
When deploying Cisco OfficeExtend Access Points (OEAP) for remote teleworkers, which protocol is utilized to securely encrypt both the control and data planes between the remote AP and the corporate Catalyst 9800 WLC over the public internet?
Answer and explanation
Correct answer: B
Cisco OfficeExtend Access Points (OEAPs) use Datagram Transport Layer Security (DTLS) to encrypt both the CAPWAP control and data tunnels over the public internet. This ensures that corporate data remains secure without requiring the end user to initiate a separate software VPN connection.
Question 5
Beginner
FlexConnect · FlexConnect groups and roaming
True or False: To successfully achieve 802.11r Fast Transition (FT) roaming between two FlexConnect APs that are utilizing local switching and local authentication, both APs must be assigned to the exact same FlexConnect group.
Answer and explanation
Correct answer: A
True. For fast roaming protocols (such as 802.11r, CCKM, or OKC) to work properly in a FlexConnect deployment with local switching, the APs must be part of the same FlexConnect group. This allows the APs to share client PMK (Pairwise Master Key) cache information with each other.
Question 6
Intermediate
FlexConnect · Split tunneling and fault tolerance
During a WAN failure, a FlexConnect AP loses its CAPWAP tunnel to the Catalyst 9800 WLC and transitions into Standalone mode. What happens to existing wireless clients that are connected to a locally switched, WPA2-PSK WLAN on this AP?
Answer and explanation
Correct answer: B
When a FlexConnect AP enters Standalone mode due to a WLC reachability failure, existing clients on locally switched WLANs remain connected and can continue passing local traffic. New clients can also authenticate and associate if the WLAN is configured for local authentication (which WPA2-PSK natively supports locally).
Register free for 6 more questions
Or unlock all 150 300-120 questions with explanations, timed mode and flashcards.
