Cisco 350-101 Online Practice Questions and Exam Preparation

Cisco 350-101 Online Questions & Answers

• Question 1:

  Which result is produced using a power ratio of 10:1 in standard decibel calculations?

  A. -20 dB
  B. 5 dB
  C. 10 dB
  D. 15 dB
  C. 10 dB

  ---

  Explanation

  Here, 10 dB is tied to the actual requirement in the stem: Which result is produced using a power ratio of 10:1 in standard decibel calculations?

  Here, the requirement is summarized by this condition: Which result is produced using a power ratio of 10:1 in standard decibel calculations? The selection 10 dB fits because it changes that condition directly.

  This question is testing whether the requirement is matched to the feature that actually owns it. Many Cisco wireless terms are related, but only one usually changes the described behavior. That selection is preferred because it applies to the exact condition in the stem, while the remaining choices solve different operational or configuration problems. -20 dB belongs to a different workflow and would leave the stated condition unresolved. 5 dB may be useful elsewhere, but it does not apply the control that the stem is asking for. 15 dB changes an adjacent setting instead of the mechanism that produces the required result.

  The tested habit is to avoid picking a familiar wireless term unless it changes the exact condition in the question.

• Question 2:

  Clients on a centrally switched WLAN authenticate successfully, but none of them receive an IP address.

  The DHCP server is on a different subnet, and the client VLAN gateway has no helper address.

  What should be configured?

  A. A higher AP transmit power level
  B. A different RADIUS shared secret
  C. DHCP relay for the client VLAN
  D. A DFS channel exclusion list
  C. DHCP relay for the client VLAN

  ---

  Explanation

  The answer follows from the requirement itself: Clients on a centrally switched WLAN authenticate successfully, but none of them receive an IP address. The DHCP server is on a different subnet, and the client VLAN gateway has no helper address. What should be configured? DHCP relay for the client VLAN is the response that matches that requirement.

  RF questions should be solved from measurable behavior. Signal level, noise, channel restrictions, interference classification, and propagation effects determine whether a link is stable and compliant. The selected mechanism is tied to that RF behavior, so it explains the observed result without changing unrelated WLAN security or management settings.

  A higher AP transmit power level may be useful elsewhere, but it does not apply the control that the stem is asking for. A different RADIUS shared secret changes an adjacent setting instead of the mechanism that produces the required result. A DFS channel exclusion list addresses a different failure domain, so it would not close the gap described here.

  That is why the correct selection follows the requirement directly instead of merely belonging to the same Cisco wireless product family.

• Question 3:

  An audit requires encrypted remote management for a Catalyst 9800 WLC. Administrators must use secure web access and secure CLI access only.

  Which management posture meets the requirement?

  A. Enable HTTP and Telnet, and disable HTTPS.
  B. Allow Telnet only from the wireless management VLAN.
  C. Use SNMP read-only as the only management method.
  D. Enable HTTPS and SSH, and disable HTTP and Telnet.
  D. Enable HTTPS and SSH, and disable HTTP and Telnet.

  ---

  Explanation

  Here, Enable HTTPS and SSH, and disable HTTP and Telnet. is tied to the actual requirement in the stem: An audit requires encrypted remote management for a Catalyst 9800 WLC. Administrators must use secure web access and secure CLI access only. Which management posture meets the requirement?

  Security questions should separate authentication, authorization, and policy enforcement. The WLAN security method gets the client on the network, while RADIUS and policy attributes decide what access the client receives. This feature is the piece that enables or applies that security behavior; the other choices either skip the external method, use the wrong authentication model, or affect a separate policy area.

  Enable HTTP and Telnet, and disable HTTPS. shifts attention away from the condition that the client, AP, or controller must satisfy. Allow Telnet only from the wireless management VLAN. belongs to a different workflow and would leave the stated condition unresolved. Use SNMP read-only as the only management method. may be useful elsewhere, but it does not apply the control that the stem is asking for.

  The same logic applies on real deployments: fix the component that owns the failure domain first, then validate adjacent services.

• Question 4:

  Refer to the exhibit.

  

  A network engineer must create a PSK WLAN that will be anchored to the DMZ. After this WLAN is created, users cannot connect to it.

  Based on the output from the RA trace, which action must the engineer take to resolve the issue?

  A. Disable fast transition 802.11r on the WLAN.
  B. Configure matching passwords on the client and the WLAN.
  C. Remove the anchor WLC from the mobility group.
  D. Configure matching WLANs on the foreign and the anchor.
  B. Configure matching passwords on the client and the WLAN.

  ---

  Explanation

  The controlling requirement is A network engineer must create a PSK WLAN that will be anchored to the DMZ. After this WLAN is created, users cannot connect to it. Based on the output from the RA trace, which action must the engineer take to resolve the issue? The choice Configure matching passwords on the client and the WLAN. maps to that requirement directly.

  Protocol questions depend on the exact 802.11 function involved. Airtime scheduling, frame exchange, channel behavior, and secure roaming each solve a different problem. The selected mechanism maps to the protocol mechanism described by the stem rather than to a controller administration task or a general monitoring feature.

  Disable fast transition 802.11r on the WLAN. would be considered only for a different symptom or design goal. Remove the anchor WLC from the mobility group. can sound related, but it does not own the behavior being tested. Configure matching WLANs on the foreign and the anchor. omits the part of the configuration that actually enforces the requested outcome.

  The distractors are plausible only if the problem is misread as a different workflow.

• Question 5:

  Which role does a fabric edge node perform in a Cisco wireless fabric architecture?

  A. Authenticating TLS connections for management
  B. Enabling multicast snooping on edge switches
  C. Terminating user data
  D. Converting Layer 2 to Layer 3 addresses
  C. Terminating user data

  ---

  Explanation

  When the stem is reduced to Which role does a fabric edge node perform in a Cisco wireless fabric architecture?, Terminating user data is the choice that remains technically aligned.

  This question is testing whether the requirement is matched to the feature that actually owns it. Many Cisco wireless terms are related, but only one usually changes the described behavior. The chosen setting is preferred because it applies to the exact condition in the stem, while the remaining choices solve different operational or configuration problems.

  Authenticating TLS connections for management omits the part of the configuration that actually enforces the requested outcome. Enabling multicast snooping on edge switches shifts attention away from the condition that the client, AP, or controller must satisfy. Converting Layer 2 to Layer 3 addresses belongs to a different workflow and would leave the stated condition unresolved.

  The key lesson is that Cisco wireless features are usually scoped tightly, and the scope determines whether a choice is usable.

• Question 6:

  Which process enables seamless Layer 2 handoff in a wireless network during roaming?

  A. increased beacon interval setting
  B. optimized roaming
  C. fast BSS transition protocol
  D. deferred probe response technique
  C. fast BSS transition protocol

  ---

  Explanation

  In this case, the decisive fact is Which process enables seamless Layer 2 handoff in a wireless network during roaming? fast BSS transition protocol addresses that fact directly.

  Protocol questions depend on the exact 802.11 function involved. Airtime scheduling, frame exchange, channel behavior, and secure roaming each solve a different problem. That configuration maps to the protocol mechanism described by the stem rather than to a controller administration task or a general monitoring feature.

  increased beacon interval setting shifts attention away from the condition that the client, AP, or controller must satisfy. optimized roaming belongs to a different workflow and would leave the stated condition unresolved. deferred probe response technique may be useful elsewhere, but it does not apply the control that the stem is asking for.

  The same logic applies on real deployments: fix the component that owns the failure domain first, then validate adjacent services.

  A complete review also checks whether the choice would still solve the problem if all other settings stayed the same. That test favors the correct choice because it changes the feature, protocol, or policy named by the question. The distractors may be legitimate Cisco wireless concepts, but they would send the engineer toward a different task and leave the stated requirement unresolved.

• Question 7:

  Refer to the exhibit.

  

  A wireless controller is deployed at a branch location to facilitate secure client connectivity.

  A network engineer configures a WLAN using 802.1X to align with company security policies.

  Which configuration enables client authentication for this WLAN?

  A. no ip mac-binding
  B. security dot1x authentication-list ISE_GROUP
  C. aaa override enable
  D. wlan branch1 policy branch1_policy
  B. security dot1x authentication-list ISE_GROUP

  ---

  Explanation

  The requirement can be read as follows: A wireless controller is deployed at a branch location to facilitate secure client connectivity. A network engineer configures a WLAN using 802.1X to align with company security policies. Which configuration enables client authentication for this WLAN? The matching behavior is security dot1x authentication-list ISE_GROUP.

  Security questions should separate authentication, authorization, and policy enforcement. The WLAN security method gets the client on the network, while RADIUS and policy attributes decide what access the client receives. This choice is the piece that enables or applies that security behavior; the other choices either skip the external method, use the wrong authentication model, or affect a separate policy area.

  no ip mac-binding can sound related, but it does not own the behavior being tested. aaa override enable omits the part of the configuration that actually enforces the requested outcome. wlan branch1 policy branch1_policy shifts attention away from the condition that the client, AP, or controller must satisfy.

  In production troubleshooting, that distinction matters because changing the wrong layer can leave the original failure untouched.

• Question 8:

  An administrator wants Cisco ISE to assign different VLANs to contractors and employees on the same SSID. The WLC policy profile currently assigns a single VLAN to all clients.

  Which configuration allows ISE to dynamically assign the VLAN?

  A. Disable RADIUS accounting.
  B. Configure the AP uplink as an access port only.
  C. Enable AAA override for the WLAN policy.
  D. Enable open authentication on the SSID.
  C. Enable AAA override for the WLAN policy.

  ---

  Explanation

  The stem narrows the problem to An administrator wants Cisco ISE to assign different VLANs to contractors and employees on the same SSID. The WLC policy profile currently assigns a single VLAN to all clients. Which configuration allows ISE to dynamically assign the VLAN? In that context, Enable AAA override for the WLAN policy. is the setting or feature that applies.

  Security questions should separate authentication, authorization, and policy enforcement. The WLAN security method gets the client on the network, while RADIUS and policy attributes decide what access the client receives. The chosen setting is the piece that enables or applies that security behavior; the other choices either skip the external method, use the wrong authentication model, or affect a separate policy area.

  Disable RADIUS accounting. can sound related, but it does not own the behavior being tested. Configure the AP uplink as an access port only. omits the part of the configuration that actually enforces the requested outcome. Enable open authentication on the SSID. shifts attention away from the condition that the client, AP, or controller must satisfy.

  In production troubleshooting, that distinction matters because changing the wrong layer can leave the original failure untouched.

• Question 9:

  A campus uses Catalyst 9800 controllers and APs in centralized forwarding. Client traffic from the APs must be tunneled to the controller, and the controller applies the data policy.

  Which Cisco wireless architecture does this describe?

  A. Autonomous bridge mode
  B. Local mode
  C. Cloud-only management
  D. Standalone workgroup bridge
  B. Local mode

  ---

  Explanation

  The stem narrows the problem to A campus uses Catalyst 9800 controllers and APs in centralized forwarding. Client traffic from the APs must be tunneled to the controller, and the controller applies the data policy. Which Cisco wireless architecture does this describe? In that context, Local mode is the setting or feature that applies.

  Catalyst 9800 questions often test object ownership. The WLAN profile identifies the SSID, the policy profile carries client policy, and tags bind those objects to APs. The selected mechanism belongs to the object that owns the requested behavior, so it is more precise than a command that changes RF settings, AP join behavior, or an unrelated profile.

  Autonomous bridge mode belongs to a different workflow and would leave the stated condition unresolved.

  Cloud-only management may be useful elsewhere, but it does not apply the control that the stem is asking for. Standalone workgroup bridge changes an adjacent setting instead of the mechanism that produces the required result.

  The tested habit is to avoid picking a familiar wireless term unless it changes the exact condition in the question.

• Question 10:

  Refer to the exhibit.

  

  A startup company has recently moved to new offices and performed a full network refresh. The application development team requested a high-speed reliable wireless network to use for testing real-time applications. Although, the wireless network is Wi-Fi 7 enabled, the wireless clients are connecting using lower speeds.

  Which configuration must be applied on the WLC to increase throughput?

  A. security wpa3 akm sae ext-key
  B. security wpa wpa2 wpa3 aes512
  C. security wpa wpa2 wpa3 tkip512
  D. security wpa wpa2 ciphers gcmp256
  D. security wpa wpa2 ciphers gcmp256

  ---

  Explanation

  The key is to match the requested effect, A startup company has recently moved to new offices and performed a full network refresh. The application development team requested a high-speed reliable wireless network to use for testing real-time applications. Although, the wireless network is Wi-Fi 7 enabled., with the feature or command that actually produces it; that points to security wpa wpa2 ciphers gcmp 256.

  Security questions should separate authentication, authorization, and policy enforcement. The WLAN security method gets the client on the network, while RADIUS and policy attributes decide what access the client receives. The chosen setting is the piece that enables or applies that security behavior; the other choices either skip the external method, use the wrong authentication model, or affect a separate policy area.

  security wpa3 akm sae ext-key addresses a different failure domain, so it would not close the gap described here. security wpa wpa2 wpa3 aes512 is too broad or aimed at the wrong layer for this scenario. security wpa wpa2 wpa3 tkip512 does not provide the specific RF, security, forwarding, management, or automation behavior that is required.

  The answer should therefore be evaluated by effect, not by how recognizable the command or platform name appears.