350-101 Implementing and Operating Cisco Wireless Core Technologies Questions and Answers

Bridge mode in a Cisco wireless mesh deployment allows access points to operate as mesh infrastructure nodes, typically as a Root AP (RAP) or Mesh AP (MAP), so Ethernet segments can be connected across a wireless backhaul. Cisco’s mesh design documentation states that in a point-to-point bridging scenario, a mesh AP can extend a remote network by using the backhaul radio “to bridge two segments of a switched network.” This directly maps to option A: point-to-point communication between network segments.

In Catalyst 9800 mesh deployments, Cisco documents converting an AP to bridge mode withcapwap ap mode bridge, after which the AP rejoins the controller in bridge mode and can be assigned a mesh role. Cisco also defines the RAP as the AP with the wired connection toward the WLC, while the MAP joins through its radio path toward the RAP. Option B is incorrect because bridge mode does not force all traffic to 2.4 GHz; Cisco mesh backhaul can use configured backhaul radios. Option C describes RRM/TPC behavior, not bridge mode. Option D incorrectly associates mesh bridge mode with WAN edge functions. Reference topics:Wireless Network Implementation — mesh AP roles, RAP/MAP operation, wireless backhaul, and Ethernet bridging.

‘

The correct answer isfast BSS transition protocol, which is IEEE 802.11r Fast Transition. Cisco describes 802.11r BSS Fast Transition as the mechanism used to provide seamless roaming for wireless clients by reducing the time required to roam between access points. It achieves this by allowing keying material to be prepared or cached so that the client does not perform a full authentication exchange every time it moves to another AP within the same mobility domain.

This is specifically relevant to Layer 2 roaming because the client remains in the same Layer 2 network while reassociating to a different BSS. Fast Transition reduces roam latency, which is critical for voice, video, collaboration, barcode scanners, and other real-time applications. Cisco also classifies fast secure roaming as the method used to accelerate client roaming when Layer 2 security is configured on the WLAN. Increased beacon intervals do not provide handoff acceleration. Optimized roaming helps with sticky-client behavior but is not the secure handoff protocol. Deferred probe response is an RF/client steering behavior, not an 802.11 Layer 2 roaming key-transition method. Reference topics:802.11r Fast BSS Transition, Layer 2 roaming, fast secure roaming, WLAN mobility, and Catalyst 9800 roaming design.

WPA2 Personal (PSK) authentication relies on a shared secret (preshared key) configured on both the wireless LAN controller (WLC) and the client device. In the exhibit, the WLAN is configured with WPA2 and PSK (set-key ascii MyKey123), which means the network expects clients to use the same preshared key to authenticate. To enable client connectivity, the preshared key must be manually entered on each client device; this aligns the client and WLC authentication parameters. Options B, C, and D are unrelated to WPA2 Personal: MAC filtering is a security policy mechanism, Active Directory integration supports WPA2 Enterprise with 802.1X authentication, and client certificates are used for certificate-based EAP methods, not PSK. Cisco Wireless Core Technologies emphasize that PSK deployments require consistent key configuration across the WLAN and clients, and that the preshared key is the critical element for successful authentication. This ensures secure, encrypted communication while providing simple setup for small or branch deployments without an enterprise RADIUS infrastructure. Reference topics:Client Connectivity Configuration — WPA2 Personal, preshared key authentication, WLAN configuration, branch deployment WLAN security.

The command that enables web-based client authentication on the WLAN issecurity web-auth. Cisco’s Catalyst 9800 Web-Based Authentication guide shows the WLAN configuration workflow: enter WLAN configuration mode, disable WPA security for the open Layer 2 guest WLAN, then “Enable web authentication for WLAN” usingsecurity web-auth. Cisco then applies the authentication list and parameter map withsecurity web-auth authentication-list ...andsecurity web-auth parameter-map ..., which refine the WebAuth method and portal behavior after WebAuth itself is enabled.

Cisco’s LDAP authentication example mirrors the exhibit exactly:wlan webauth 2 webauth, removal of WPA/802.1X Layer 2 security,security web-auth,security web-auth authentication-list ldapauth, andsecurity web-auth parameter-map global. Option B only creates or enters the WLAN profile with WLAN ID 2 and SSID name. Options C and D disable WPA2 and 802.1X AKM; they do not authenticate clients. Reference topics:Client Connectivity Configuration — guest WLAN authentication, WebAuth, Layer 3 security, authentication lists, parameter maps, and Catalyst 9800 WLAN security configuration.

The exhibit creates WLAN profileguest-networkwith WLAN ID20and enables web authentication, but it does not yet define the client VLAN or bind the WLAN to a deployable policy. On Catalyst 9800 controllers, the WLAN profile defines SSID and wireless/security characteristics, while thepolicy profiledefines client-facing network policy, including VLAN assignment, AAA, ACLs, and switching behavior. Cisco’s web authentication configuration guide states that the policy profile specifies client VLAN, AAA, ACLs, timeout settings, and related policy, and the VLAN is assigned under the policy profile.

The second required object is thepolicy tag, because a policy tag maps the WLAN profile to the policy profile. Cisco also notes that the default policy tag automatically maps only WLAN IDs1 through 16; WLAN ID17 or highercannot use that default mapping. Since this WLAN is ID 20, a custom policy tag mapping is required. Mesh bridging, STP, AP group naming, or physical-interface isolation do not complete the Catalyst 9800 WLAN-to-VLAN policy model. Reference topics:Wireless Network Implementation — Catalyst 9800 configuration model, WLAN profiles, policy profiles, policy tags, guest VLAN assignment, and web authentication.

The correct Cisco technology isAI Network Analytics. Cisco describes Cisco AI Network Analytics as a Catalyst Center capability that uses machine learning and machine reasoning to generate deployment-specific insights, identify operational issues, and accelerate troubleshooting. Cisco’s official Catalyst Center Assurance documentation states that Cisco AI Network Analytics uses advanced machine learning techniques and an advanced cloud learning platform with deidentified network event data to identify critical issues in the network.

This makes option D the only precise match. Catalyst Center Assurance is the broader assurance and monitoring framework where AI Network Analytics is surfaced, but it is not the specific technology named in the question. Network Services is a generic platform function area, not the AI/ML analytics feature. Catalyst Center LLM Insights is not the established Cisco wireless assurance feature associated with cloud-based machine learning for issue detection. AI Network Analytics provides AI-driven baselining, anomaly detection, root-cause assistance, trends, insights, and comparative benchmarking. Cisco also documents that the AI Network Analytics cloud runs machine learning models using deidentified network event data and returns issues and insights back into Catalyst Center. Reference topics:Automation and AI — Cisco Catalyst Center, AI Network Analytics, AI-driven baselining, anomaly detection, and wireless assurance intelligence.

For campus wireless monitoring deployments involving Cisco Spaces, ISE, and Catalyst Center appliances, strict separation of management traffic from user data is required to maintain security and service continuity. The correct approach is to configure the switch interfaces connecting these appliances as access ports assigned to the dedicated management VLAN. This ensures that management and telemetry traffic is isolated from production WLAN traffic, preventing any disruption to end users if configuration changes are made. Assigning the management VLAN as the native VLAN on trunk ports (Option B) is inappropriate because the native VLAN still transmits untagged traffic and could allow accidental bridging with user traffic, violating security policies. PortFast (Option A) is used for rapid STP convergence on end-user ports but does not enforce VLAN separation or management isolation. Port Aggregation Protocol (Option C) is intended for link bundling and redundancy, not VLAN segmentation. Cisco Wireless best practices emphasize access port configuration for management appliances in a dedicated VLAN to guarantee security, telemetry reliability, and non-disruptive network operations. Proper implementation involves assigning a unique VLAN ID for all monitoring and management devices and configuring the switch port as an access port, ensuring consistent isolation and predictable behavior in a high-density campus environment. Reference topics:Wireless Monitoring and Management — Cisco Spaces deployment, ISE integration, management VLAN isolation, switch access port configuration.

For Cisco Catalyst 9176 APs deployed at remote sites without DHCP option 43, automatic WLC discovery can be accomplished using DNS-based CAPWAP controller discovery. By creating a DNS A record namedcisco-capwap-controller. < domain > that resolves to the WLC management IP address, APs can query DNS and locate their centralized controller automatically, eliminating the need for site visits or manual configuration. This method is preferred for large-scale or satellite deployments where APs may exist on different subnets and traditional DHCP-based discovery is unavailable. Option A is impractical because manually assigning static IPs to hundreds of APs is operationally complex and error-prone. Option B, using a multicast group, is not supported for cross-subnet controller discovery in CAPWAP; multicast is limited to local subnets. Option D (ap-discovery) is not a recognized standard for WLC discovery; Cisco specifically documentscisco-capwap-controlleras the required DNS entry for CAPWAP-based automatic discovery. This approach ensures zero-touch provisioning, simplifies network operations, and guarantees that APs join the correct controller, supporting centralized management and consistent configuration across multiple campuses. Reference topics:Wireless Network Implementation — CAPWAP discovery, DNS-based controller discovery, Catalyst 9800 WLC onboarding, zero-touch provisioning.

The correct configuration isaaa-overridefollowed bynacunder the existing Catalyst 9800 wireless policy profile. The exhibit already places the administrator in policy-profile configuration mode with wireless profile policy my-policy, so the missing commands must be policy-profile subcommands, not another profile declaration. Cisco’s Catalyst 9800 configuration examples show the exact sequence: enter wireless profile policy < policy-profile-name > , enable aaa-override, enable nac, then configure VLAN and no shutdown.

aaa-override permits authorization attributes returned by AAA or Cisco ISE, such as VLAN, ACL, QoS, redirect ACL, or posture-related access controls, to override the locally defined policy. Cisco’s documentation explicitly states that AAA override applies policies coming from AAA or ISE servers, while nac enables Network Access Control in the policy profile. This is the required behavior when endpoints must be posture-validated before normal network access is granted. Cisco also notes that NAC State is enabled in the policy profile and can only be enabled when AAA override is enabled.

Option A is invalid because nac-policy is not the correct CLI keyword. Options B and D omit NAC. Reference topic:Client Connectivity Configuration — Catalyst 9800 policy profiles, AAA override, NAC State, posture enforcement, and ISE-based access control.

The correct answer is D. Cisco Spaces connector deployments often require a VLAN on which the connector is reachable for management or data, and Cisco Spaces wired gateway guidance identifies the connector VLAN as the VLAN used for communication to the connector. The same guidance also supports multiple source VLANs for monitored wired devices, which aligns with the requirement for future analytics-service scalability.

A trunk port is the proper design choice because it can carry multiple VLANs over the same physical interface. Cisco Catalyst switch documentation states that an access port carries traffic for only one VLAN, while an IEEE 802.1Q trunk carries multiple VLANs and supports tagged traffic. The command switchport trunk allowed vlan 30 limits the trunk initially to VLAN 30, satisfying the current management VLAN requirement without changing the native VLAN or other default VLAN settings. Cisco also documents that an allowed VLAN list limits VLAN membership only on the associated trunk port, so it does not affect other switch ports.

Option A works only for a single untagged VLAN and is less scalable. Options B and C mix access mode with trunk-only commands and are syntactically or operationally invalid. Reference topic: Wireless Monitoring and Management — Cisco Spaces connector deployment, VLAN reachability, trunking, and analytics service scalability.

The correct action is to expose only encrypted management services: HTTPS for WebUI administration and SSH for remote CLI administration. The exhibit confirms the WLC wireless management interface is VLAN 10 with IP address 10.10.1.2, but interface placement alone does not enforce secure management protocol policy. Cisco Catalyst 9800 documentation identifies web admin settings as controller management configuration that determines administrator access, protocols, and interfaces for remote management. Cisco further states that administrators can connect securely over HTTPS, while HTTP “is not a secure connection,” and that HTTPS encrypts data to and from the server.

For CLI access, Cisco’s Catalyst 9800 Secure Shell guidance states that SSH enables secure remote access, and usingtransport input sshprevents non-SSH Telnet connections, limiting the device to SSH-only access. Therefore, options A and B violate policy because they permit Telnet and/or HTTP. Option C fails because console access is local, not remote, and disabling only HTTP still leaves Telnet exposure unresolved. Reference topics:Wireless Monitoring and Management — WLC management access, secure administration, HTTPS, SSH, and management-plane hardening.

Client exclusion is a feature in Cisco Catalyst 9800 WLCs that allows the administrator to temporarily block clients exhibiting misbehavior, such as excessive retries, excessive bandwidth usage, or roaming issues. The IOS XE CLI command for enabling client exclusion in a WLAN policy isclient-exclusion < timeout > , where < timeout > defines the duration (in seconds) the client is prevented from associating with the WLAN. Option D correctly usesclient-exclusion 120to block the misbehaving clients for 120 seconds. Option A (exclude 120) is not valid IOS XE syntax. Option B (exclusionlist timeout 120) is also incorrect as it refers to internal exclusion lists, not the WLAN policy applied to live clients. Option C (security exclusion timeout 120) is invalid and does not configure client exclusion at the WLAN policy level. Cisco Wireless Core Technologies emphasize using client exclusion policies during high-density events or temporary network congestion to ensure network fairness, protect overall WLAN performance, and maintain connectivity for well-behaving clients. Reference topics:Client Connectivity Configuration — Client exclusion, WLAN policy, misbehaving client mitigation, Cisco Catalyst 9800 IOS XE.

Bridge mode in a Cisco wireless mesh deployment allows access points to operate as mesh infrastructure nodes, typically as a Root AP (RAP) or Mesh AP (MAP), so Ethernet segments can be connected across a wireless backhaul. Cisco’s mesh design documentation states that in a point-to-point bridging scenario, a mesh AP can extend a remote network by using the backhaul radio “to bridge two segments of a switched network.” This directly maps to option A: point-to-point communication between network segments.

In Catalyst 9800 mesh deployments, Cisco documents converting an AP to bridge mode withcapwap ap mode bridge, after which the AP rejoins the controller in bridge mode and can be assigned a mesh role. Cisco also defines the RAP as the AP with the wired connection toward the WLC, while the MAP joins through its radio path toward the RAP. Option B is incorrect because bridge mode does not force all traffic to 2.4 GHz; Cisco mesh backhaul can use configured backhaul radios. Option C describes RRM/TPC behavior, not bridge mode. Option D incorrectly associates mesh bridge mode with WAN edge functions. Reference topics:Wireless Network Implementation — mesh AP roles, RAP/MAP operation, wireless backhaul, and Ethernet bridging.

‘

The correct answer isRF technical standards. In Japan, wireless LAN and other radio equipment must operate under national RF regulatory requirements controlled by the Ministry of Internal Affairs and Communications, commonly referenced as MIC. TELEC, a registered certification body in Japan, states that specified radio equipment such as wireless LAN equipment used in Japan must conform to technical regulations regulated by MIC, and that radio equipment conformity certification validates conformance to the technical standards under Japan’s Radio Act.

This aligns directly with Cisco wireless regulatory-domain behavior. Cisco’s Catalyst 9800 country-code documentation explains that APs use legal frequencies approved for their regulatory domain, and for Japan regulatory-domain devices, Japan country codes must be configured so the controller and APs operate within permitted channel and power constraints. Cisco also states that country codes are assigned and verified on APs or wireless controllers to ensure regulatory compliance for wireless operation. Manufacturing batch inspection, customer onboarding, and supplier-chain evaluation are not RF spectrum regulatory functions. Reference topics:RF Fundamentals — regulatory domains, country codes, channel legality, transmit-power limits, and wireless compliance.

The correct answer isCbecause trend deviation in Cisco Catalyst Center AI Analytics is designed to identify behavior that differs from expected network baselines. Cisco AI Network Analytics uses machine learning to establish baselines that are specific to the network and site, then compares live operational telemetry against those learned expectations. Cisco states that AI-driven issues are triggered based on deviations from the predicted baseline for the specific network environment.

For wireless operations, this is valuable because deviations in onboarding, association, DHCP, AAA, radio throughput, AP performance, client experience, retries, SNR, or similar KPIs can surface before they become broad user-impacting incidents. Cisco also describes Trend Deviations as a Trends and Insights function that determines global patterns and deviations to provide system-generated insights. This gives operations teams earlier awareness of abnormal wireless behavior and allows proactive investigation rather than waiting for help-desk tickets or hard threshold alarms.

The other options are unrelated. Time synchronization is handled by NTP, threshold export is not the core function of trend deviation, and log backup is a separate operational process. Reference topic:Wireless Monitoring and Management — Catalyst Center Assurance, AI Network Analytics, trend deviation, anomaly detection, wireless baselining, and proactive operations.

Optimized roaming is a Cisco WLC feature designed to reduce sticky-client behavior. A sticky client remains associated to an AP even after moving far enough away that another AP would provide better RF service. Cisco describes optimized roaming as actively monitoring client data RSSI and disconnecting clients when received signal strength falls below the configured threshold. The official Catalyst 9800 documentation states that optimized roaming “disassociates client when the RSSI is lower than the set threshold,” which directly matches option A.

This function does not calculate device location through peer-to-peer beaconing, does not depend on external experience services, and is not static load balancing. It is an RF/client-roaming enforcement mechanism controlled by the wireless infrastructure. In practical operation, the AP/WLC evaluates client signal quality and, when the configured optimized roaming criteria are met, forces the client to disconnect so it can reassess the RF environment and roam to a better AP. Cisco also notes that optimized roaming helps maintain client connectivity by managing disassociationn based on RSSI and data-rate thresholds. Reference topics:Client Connectivity Configuration — client roaming behavior, sticky-client mitigation, RSSI thresholds, and WLC roaming optimization

Device sensitivity in a wireless environment refers to receiver sensitivity: the minimum RF signal level a client or AP radio must receive to successfully detect, demodulate, and decode a transmission. Cisco defines receiver sensitivity as the minimum signal power level, expressed in dBm or mW, required for a receiver to accurately decode a given signal. Cisco RF design guidance further states that sensitivity indicates the lowest received power before the receiver considers the signal unintelligible.

Therefore, option A is correct because sensitivity is fundamentally about the radio’s capability to process a received signal at low power levels. A more sensitive receiver can decode weaker frames, improving effective coverage and receive performance, provided the signal-to-noise ratio and interference conditions remain acceptable. Cisco also notes that individual device sensitivity determines how well a device can hear and demodulate RF energy, which directly affects contention behavior and WLAN performance in dense environments. Redundant gateways, beacon interval synchronization, and key refresh schedules are Layer 3 availability, 802.11 timing, and security-key management topics; they do not define RF receiver sensitivity. Reference topics:RF Fundamentals — receiver sensitivity, RSSI, dBm, SNR, demodulation, and WLAN coverage behavior.

The log is a Layer 2 802.1X authentication failure, not an AP join or WLAN encryption mismatch. In WPA3-Enterprise, the client authenticates with 802.1X/EAP through the configured AAA path. Cisco’s Catalyst 9800 WPA3 Enterprise configuration requires the necessary RADIUS or AAA servers and authentication lists before enabling WPA3 Enterprise, and the WLAN must reference the dot1x authentication list. Therefore, aCred Failreason points directly at the user/device credential validation path: the supplicant credentials, Active Directory identity source, RADIUS policy match, or RADIUS reachability.

Cisco’s 9800 802.1X configuration workflow also shows the controller defining a RADIUS server, adding it to a RADIUS group, creating a dot1x AAA authentication method list, and applying that list to the WLAN. It further recommends checking whether the RADIUS server is alive and using ISE RADIUS Live Logs to inspect authentication requests and results. Option A is wrong because the AP is not the supplicant in this WLAN client authentication event. Option B downgrades the security model and avoids 802.1X rather than fixing it. Option D addresses NAC behavior, not a credential authentication failure. Reference topics:Client Connectivity Configuration — WPA3-Enterprise, 802.1X/EAP, RADIUS authentication, and client authentication troubleshooting.

The correct method issoftware image management workflows, specifically Cisco Catalyst Center Software Image Management, commonly referenced as SWIM. Cisco documents SWIM as the mechanism used to manage software upgrades and maintain consistency of image versions across the network. It provides an image repository, golden-image assignment, image distribution, activation, readiness checks, and scheduled execution. Cisco’s wireless automation guidance specifically states that SWIM is used to update Catalyst 9800 Series Wireless Controller software by distributing the image from the Catalyst Center repository to wireless controllers and upgrading the images running on those controllers; both stages can run immediately or be scheduled for a defined maintenance window.

Option C is also validated by Catalyst Center’s update-status and workflow views. Cisco documentsImage Update Statusas the view that shows all update tasks, filters by in-progress, success, or failure, and displays a progress bar for active updates. The workflow view then exposes distribution and activation task status, timing, prechecks, postchecks, checksum verification, and AP pre-image download details. Inventory snapshots and templates do not execute controller firmware upgrades, and “lifecycle workflow” is too generic. Reference topics:Wireless Monitoring and Management — Catalyst Center SWIM, image compliance, golden images, controller upgrade automation, and update progress reporting.

MIMO, or Multiple-Input Multiple-Output, is a core 802.11n and later wireless technology that uses multiple transmit and receive radio chains and antennas to improve wireless performance. Cisco’s Wireless RF Reference Guide explains that IEEE 802.11n introduced MIMO, replacing the older single-radio SISO model with multiple radios, each using its own antenna, to increase data rates and improve reception in multipath environments. Cisco also notes that weak or distorted multipath signals can be received by more than one radio and reconstructed, improving decode quality and reliability.

This directly supports option A: MIMO exploits multiple RF paths rather than treating multipath as purely destructive. Depending on implementation, MIMO can use spatial diversity, maximal ratio combining, and spatial streams to increase throughput, improve signal-to-noise ratio, reduce retries, and make more efficient use of airtime. Cisco describes spatial stream notation such as 4x4:4 as four transmitters, four receivers, and four spatial streams. Option B describes frequency hopping, not MIMO. Option C is not a MIMO function. Option D is the opposite of MIMO because MIMO deliberately uses multiple antennas and radio paths. Reference topics:802.11 Technology Fundamentals — MIMO, spatial streams, multipath, SISO versus MIMO, and 802.11n/ac/ax PHY enhancements.

TACACS+ is used for device administration, especially for GUI and CLI access to infrastructure platforms such as Cisco Catalyst 9800 WLCs, switches, and routers. Cisco defines TACACS+ as a security application that provides centralized validation for users attempting to access a device or network access server, and it separates authentication, authorization, and accounting functions for administrative control. Cisco ISE device administration documentation further states that TACACS+ is used to control and audit network device configuration, allowing devices to query ISE for administrator authentication and authorization while sending accounting records for logging administrator actions.

Therefore, the primary benefit is streamlined administrator access across platforms. Instead of maintaining local administrator accounts independently on every WLC or network device, TACACS+ enables centralized identity validation, role-based authorization, and consistent audit trails. Option A is incorrect because TACACS+ supports differentiated authorization rather than static grouping. Option B is the opposite of centralized accounting. Option D is inaccurate because TACACS+ is mainly for device administration, whereas client or endpoint network access is typically handled with RADIUS. Reference topics:Wireless Monitoring and Management — AAA for WLC administration, TACACS+ device administration, role-based access, and centralized audit control.

In RF communications,propagation delayrefers to the finite time required for a signal to travel from the transmitter to the receiver over a given medium. This delay depends on the distance between the endpoints and the speed at which electromagnetic waves propagate through the medium, typically close to the speed of light in air (approximately 3 × 10⁸ m/s). Propagation delay is fundamental in calculating network latency, timing synchronization in protocols, and designing wireless coverage, especially in large-scale enterprise networks.

Reflection (option A) occurs when RF waves encounter surfaces and bounce back, potentially causing multipath interference. Scattering (option C) refers to signal dispersion caused by small objects or irregularities in the medium, which affects signal quality but not the direct travel time. Link speed (option D) represents the maximum data rate supported by a wireless link and is unrelated to the time taken for the signal to propagate.

Cisco wireless design guides emphasize propagation delay considerations when planning high-density deployments, especially in large campuses or long-range point-to-point links, to ensure timing-sensitive applications (e.g., VoIP, video conferencing) maintain acceptable performance. Propagation delay must be factored into QoS and RF design decisions to minimize latency and optimize throughput. Reference topic:RF Fundamentals — signal propagation, latency, multipath effects, and timing in wireless networks.

A high-gain patch antenna is a directional antenna that concentrates RF energy into a defined coverage area rather than radiating equally in all directions. Cisco’s Wireless RF Reference Guide explains that antenna gain determines how RF power is radiated and that higher-gain antennas do not create additional transmit power; they focus existing power in a given direction. Cisco also distinguishes omnidirectional high-gain patterns, which flatten coverage, from directional antennas, which focus energy toward a target area.

That makes option C correct: a patch antenna imparts a focused beam, typically useful for covering a hallway, warehouse aisle, seating section, point-to-point link, or defined flat service area. Cisco’s antenna documentation also states that higher-gain antennas provide longer coverage distance but with a coverage-area tradeoff, especially in a particular direction. Option A is incorrect because antenna gain does not restrict operation to a single narrow frequency; frequency support is determined by antenna design and radio band. Option B describes channel overlap, not antenna behavior. Option D does not describe a standard patch antenna radiation pattern. Reference topics:RF Fundamentals — antenna gain, directional antennas, patch antenna radiation patterns, beamwidth, and coverage-cell design.

The correct configuration approach is to enableApplication Visibility and Controlon thepolicy profile. On the Catalyst 9800, WLANs are not configured as isolated monolithic objects; the WLAN profile is mapped to a policy profile through a policy tag, and many client traffic services are applied from that policy profile. Cisco defines AVC as the wireless feature set that identifies and monitors applications using DPI, creates rules to manage application bandwidth and usage, and integrates with Flexible NetFlow for per-application or per-protocol statistics. Cisco further states that AVC benefits from NBAR running on the AP or controller, and that the NBAR2 engine analyzes and recognizes traffic flows.

Operationally, Cisco’s 9800 AVC guide shows that AVC is enabled by navigating toConfiguration > Services > Application Visibilityand selecting the relevantPolicy Profile. It also shows the CLI form under the policy profile:wireless profile policy AVC_testingfollowed byip nbar protocol-discovery, with verification showingNBAR Protocol Discovery : Enabled. Options A and B are incorrect because the feature is not enabled directly on the WLAN. Option C is generic and incomplete; the Cisco feature construct is AVC. Reference topics:AVC, NBAR2, Flexible NetFlow, Catalyst 9800 policy profiles, and wireless application visibility.

The correct configuration issecurity wpa wpa2 ciphers gcmp256. The WLAN already contains WPA3, SAE, FT-SAE, SAE-EXT-KEY, and FT-SAE-EXT-KEY AKMs, so adding another SAE-EXT-KEY command is not the missing element. For Wi-Fi 7 operation, Cisco states that WPA3-Personal requiresGCMP256 with SAE-EXT-KEY and/or FT + SAE-EXT-KEY, and that AES/CCMP128 clients do not operate as Wi-Fi 7 clients when the required stronger cipher combination is absent. Cisco’s Catalyst 9800 WPA3 security enhancement guide gives the CLI syntax directly:security wpa wpa2 ciphers gcmp256, which configures GCMP-256 cipher support.

Option D is therefore the only valid WLC command that enables the required cipher for Wi-Fi 7-capable client operation and higher throughput behavior. Option A uses incorrect syntax and is already functionally represented in the exhibit assecurity wpa akm sae ext-key. Options B and C use invalid cipher constructs; TKIP is legacy and incompatible with modern high-throughput WLAN operation. Reference topics:802.11be/Wi-Fi 7 security requirements, WPA3-Personal, SAE-EXT-KEY, GCMP-256 cipher support, and Catalyst 9800 WLAN security configuration.

The missing command isradius server external-radius. On a Catalyst 9800 WLC, the external RADIUS server object must be declared first with radius server < server-name > . The following lines, address ipv4 10.10.10.100 auth-port 1812 acct-port 1813 and key radiuskey, are subcommands entered under that RADIUS server configuration mode. Cisco’s Catalyst 9800 802.1X configuration workflow starts by declaring the RADIUS server, then adding it to a RADIUS server group, then creating the authentication method list, and finally mapping that list to the WLAN. Cisco’s configuration guide example uses the same IOS XE structure: radius server < name > , followed by address ipv4 ... auth-port 1812 acct-port 1813 and key ....

The server group later references server name external-radius, so the RADIUS server object must be namedexternal-radiusexactly. Option C would incorrectly create a server named RADIUS-GRP, which is already the AAA server group name, not the RADIUS server object. Options B and D are invalid IOS XE syntax. PEAP-MSCHAPv2 itself is handled through the 802.1X/EAP exchange with the RADIUS server; the WLC acts as the authenticator and forwards authentication requests through the configured AAA method list. Reference topic:Client Connectivity Configuration — WPA2-Enterprise, 802.1X, RADIUS server objects, AAA groups, and WLAN authentication-list binding.

AI Enhanced RRM is not a static-threshold tuning feature and it is not designed to simply raise AP transmit power. Cisco defines AI Enhanced RRM as a radio resource management technology that applies artificial intelligence and machine learning to optimize RF environments, uses distributed data collection from Cisco wireless controllers with cloud-based analytics, and automates adaptive RF parameter tuning for Cisco wireless networks.

The operational model is telemetry-driven. RF telemetry is collected from APs by the Catalyst 9800 WLC, sent through Cisco Catalyst Center to the Cisco AI Analytics Cloud, analyzed by RRM algorithms, and then configuration-change information is returned through Catalyst Center toward the managed wireless infrastructure. Cisco’s AI-Enhanced RRM deployment guide further identifies DCA, TPC, FRA, and DBS as examples of optimizations performed, meaning the feature enhances dynamic RF control rather than disabling it.

Therefore, option D is the only correct answer. Options A, B, and C describe either legacy/static behavior, harmful power-only logic, or a fixed RF design model that contradicts Cisco AI Enhanced RRM. Reference topics:Automation and AI — AI/ML-driven RF optimization, Catalyst Center assurance, RRM telemetry, DCA, TPC, FRA, and DBS.