Cisco 200-355 Online Practice Questions and Exam Preparation

Cisco 200-355 Online Questions & Answers

• Question 421:

  Which action secures the SNMPv2C protocol in a Cisco WLC?

  A. configure new communities and disable default communities
  B. use digital certificates to authenticate and encrypt transmissions
  C. enable password or transfer encryption
  D. set a username and difficult-to-guess password
  A. configure new communities and disable default communities

  ---

  See the SNMP configuration for Cisco WLC page shown in reference link below: http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_0111.html

• Question 422:

  Which three Cisco Unified Wireless Network capabilities use information that is provided by Radio Resource Management neighbor messages? (Choose three.)

  A. aggressive load balancing
  B. dynamic channel assignment
  C. hybrid remote edge access point
  D. intercontroller mobility (that is, mobility groups)
  E. over-the-air provisioning
  F. rogue AP classification
  B. dynamic channel assignment
  E. over-the-air provisioning
  F. rogue AP classification

  ---

  First we should learn how the RRM works:

  1.

  Controllers (whose APs need to have RF configuration computed as a single group) are provisioned with the same RF Group Name. An RF Group Name is an ASCII string each AP will use to determine if the other APs they hear are a part of the same system. (RF groups are groups of controllers that share the same RF group name and whose APs can hear the neighbor messages of each other)

  2.

  APs periodically send out Neighbor Messages, sharing information about themselves, their controllers, and their RF Group Name. These neighbor messages can then be authenticated by other APs sharing the same RF Group Name.

  3.

  APs that can hear these Neighbor Messages and authenticate them based on the shared RF Group Name, pass this information (consisting primarily of controller IP address and information on the AP transmitting the neighbor message) up to the controllers to which they are connected.

  4.

  The controllers, now understanding which other controllers are to be a part of the RF Group, then form a logical group to share this RF information and subsequently elect a group leader.

  5.

  Equipped with information detailing the RF environment for every AP in the RF Group, a series of RRM algorithms are used to optimize AP configurations. Information from Radio Resource Management (RRM) monitors the radio resources, performs dynamic channel assignments, provides detection and avoidance of interference, and provides the dynamic transmit power control (TPC).

  The RRM neighbor message contains the following information:

  *

  Radio Identifier: If the AP had multiple radios, this field identifies the radio used to transmit the message.

  *

  Group ID: The 16-bit value and controller MAC address. This information is used to detect rogue access points. The access points will then check the beacon/probe-response frames in neighboring access point messages to see if they

  contain an authentication information element (IE) that matches that of the RF group. If the check is successful, the frames are authenticated. Otherwise, the authorized access point reports the neighboring access point as a rogue, records its

  BSSID in a rogue table, and sends the table to the controller.

  *

  WLC IP Address: RF group leader's management IP address. This address is discovered through Over-the-Air Provisioning (OTAP)

  *

  AP Channel: The native channel that the AP uses to service clients.

  *

  Neighbor Message Channel: The channel the message is sent on.

  *

  Power: The power level at which the message is transmitted.

  *

  Antenna Pattern: The antenna pattern currently in use Note:

  Dynamic channel assignment is used to dynamically allocate access point channel assignments to avoid conflict and to increase capacity and performance. For example, two overlapping channels in the 802.11g band, such as 1 and 2, cannot

  both simultaneously use 54 Mbps. By effectively reassigning channels, the controller keeps adjacent channels separated, thereby avoiding this problem.

  Over-the-Air Provisioning (OTAP) is a method for APs to discover the management IP of a controller over the air.

  A rogue AP is an AP that is unknown to the controller. http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a008072c759.shtml http://www.cisco.com/en/US/docs/wireless/controller/5.2/configuration/guide/c52rrm.html

• Question 423:

  Which two algorithms are available in RRM? (Choose two.)

  A. coverage-hole detection
  B. dynamic channel assignment
  C. RSSI normalizer
  D. transmitting channel expander
  E. rogue detection
  A. coverage-hole detection
  B. dynamic channel assignment

  ---

  Most clients enable you to associate to a detected network (broadcasted SSID) or configure a specific profile. In all cases, you must configure the network name (SSID), the operating mode (ad-hoc or infrastructure), and some security settings (that will be different depending on whether the SSID uses Pre-Shared Key Security or Enterprise [EAP/802.1x] security).

• Question 424:

  You need to set up an ad hoc connection to another client in a conference room to exchange files using Windows 7. Which two items do you need to create this connection? (Choose two.)

  A. SSID name
  B. RF channel
  C. 802.1X/EAP credentials
  D. pre-shared key
  E. Telnet
  F. IBSS name
  G. SSH
  D. pre-shared key
  F. IBSS name

  ---

  wireless ad-hoc network is when two or more wireless nodes communicate directly on a peer-to-peer basis with no wireless network infrastructure. This is also referred to as an independent basic service set (IBSS). Wireless ad-hoc networks are typically formed on a temporary basis to rapidly enable communication between hosts, such as to exchange files during a spontaneous meeting or between hosts at home. The pre-shared key and the IBSS name need to be configured to allow for this. http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/secwlandg20/sw2dg/ch7_2_SPMb.html

• Question 425:

  A help desk ticket states that a wireless access point has not joined its controller and is flashing rapidly. How can the help desk administer the access point with the default settings?

  A. console
  B. SSH
  C. Telnet
  D. HTTP
  E. HTTPS
  A. console

• Question 426:

  Which open standard defines the combination of Extensible Authentication Protocol with Advanced Encryption Standard for providing strong wireless LAN client security?

  A. IEEE 802.1X
  B. IEEE 802.11i
  C. WEP
  D. WPA
  E. WPA2
  B. IEEE 802.11i

  ---

  802.11i supersedes the previous security specification, Wired Equivalent Privacy (WEP), which was shown to have security vulnerabilities. Wi-Fi Protected Access (WPA) had previously been introduced by the Wi-Fi Alliance as an

  intermediate solution to WEP insecurities. WPA implemented a subset of a draft of 802.11i. The Wi-Fi Alliance refers to their approved, interoperable implementation of the full 802.11i as WPA2, also called RSN (Robust Security Network) .

  802.11i makes use of the Advanced Encryption Standard (AES) block cipher, whereas WEP and WPA use the RC4 stream cipher.

  http://en.wikipedia.org/wiki/IEEE_802.11i-2004

• Question 427:

  Which protocol helps the administrator to determine whether a detected rogue AP is in the network of the organization?

  A. RLDP
  B. RCP
  C. RDP
  D. RAPP
  A. RLDP

  ---

  RLDP is an active approach, which is used when rogue AP has no authentication (Open Authentication) configured. This mode, which is disabled by default, instructs an active AP to move to the rogue channel and connect to the rogue as a client. During this time, the active AP sends deauthentication messages to all connected clients and then shuts down the radio interface. Then, it will associate to the rogue AP as a client.

  The AP then tries to obtain an IP address from the rogue AP and forwards a User Datagram Protocol (UDP) packet (port 6352) that contains the local AP and rogue connection information to the controller through the rogue AP. If the controller receives this packet, the alarm is set to notify the network administrator that a rogue AP was discovered on the wired network with the RLDP feature. https://supportforums.cisco.com/discussion/10941011/rd-rogue-detector-or-rldp-rogue-location-discovery-protocol

• Question 428:

  Which software application tool can be used for verification of signal strength?

  A. inSSIDer
  B. LANDnav
  C. WLC-EAP
  D. ICMP
  A. inSSIDer

  ---

  Reference: https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/116057-site-survey-guidelines-wlan-00.html#anc35

• Question 429:

  When a wireless client is authenticated in a controller-based wireless network, which two pieces of source identification information can be used by the controller for an Access-Request message that is sent to an external RADIUS server? (Choose two.)

  A. AP IP address
  B. controller MAC address
  C. wireless client MAC address
  D. wireless client IP address
  E. controller IP address
  B. controller MAC address
  E. controller IP address

• Question 430:

  Which key is established using the four-way handshake during the WPA authentication process?

  A. Pairwise Master Key
  B. Pairwise Multiple Key
  C. Pairwise Session Key
  D. Pairwise Transient Key
  E. Pairwise Transverse Key
  D. Pairwise Transient Key

  ---

  The authentication process leaves two considerations: the access point (AP) still needs to authenticate itself to the client station (STA), and keys to encrypt the traffic need to be derived. The earlier EAP exchange or WPA2-PSK configuration has provided the shared secret key PMK (Pairwise Master Key). To derive the PMK from the WPA-PSK, the PSK is put through PBKDF2-SHA1 as the cryptographic hash function. This key is, however, designed to last the entire session and should be exposed as little as possible. Therefore the four-way handshake is used to establish another key called the PTK (Pairwise Transient Key). The PTK is generated by concatenating the following attributes: PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address. The product is then put through a pseudo random function. http://en.wikipedia.org/wiki/IEEE_802.11i-2004