Cisco 350-101 Online Practice Questions and Exam Preparation

Cisco 350-101 Online Questions & Answers

• Question 11:

  Refer to the exhibit.

  

  An onsite engineer is working to connect devices to the wireless network in a corporate environment. The network requirements dictate that WPA2-Enterprise security must be used with certificate-based mutual authentication to align with enterprise policy, which requires client and server certificates for secure access. After the initial wireless settings are applied on a Windows-based workstation, the engineer must select the appropriate authentication method in the client network properties to complete a successful enterprise Wi-Fi connection.

  Which option in the "Choose a network authentication method" dropdown meets this requirement?

  A. MSCHAPv2
  B. TEAP
  C. EAP-TLS
  D. PEAP
  C. EAP-TLS

  ---

  Explanation

  The controlling requirement is An onsite engineer is working to connect devices to the wireless network in a corporate environment. The network requirements dictate that WPA2-Enterprise security must be used with certificate-based mutual authentication to align with enterprise policy. The choice EAP-TLS maps to that requirement directly.

  Security questions should separate authentication, authorization, and policy enforcement. The WLAN security method gets the client on the network, while RADIUS and policy attributes decide what access the client receives. This choice is the piece that enables or applies that security behavior; the other choices either skip the external method, use the wrong authentication model, or affect a separate policy area.

  MSCHAPv2 does not provide the specific RF, security, forwarding, management, or automation behavior that is required. TEAP would be considered only for a different symptom or design goal. PEAP can sound related, but it does not own the behavior being tested.

  A good review method is to ask whether the choice would still solve the issue if every unrelated setting remained unchanged.

• Question 12:

  What is a benefit of network adaptability in terms of improved operational outcomes when using AI-RRM in Cisco Catalyst Center?

  A. provisioning of static device addresses
  B. reduction of co-channel interference
  C. transmission of regular software update schedules
  D. categorization of users by authentication type
  B. reduction of co-channel interference

  ---

  Explanation

  The question is not asking for a generally related feature; it is asking about.

  What is a benefit of network adaptability in terms of improved operational outcomes when using AI-RRM in Cisco Catalyst Center? That makes reduction of co-channel interference the relevant choice.

  RF questions should be solved from measurable behavior. Signal level, noise, channel restrictions, interference classification, and propagation effects determine whether a link is stable and compliant. The selected mechanism is tied to that RF behavior, so it explains the observed result without changing unrelated WLAN security or management settings.

  provisioning of static device addresses omits the part of the configuration that actually enforces the requested outcome. transmission of regular software update schedules shifts attention away from the condition that the client, AP, or controller must satisfy. categorization of users by authentication type belongs to a different workflow and would leave the stated condition unresolved.

  The key lesson is that Cisco wireless features are usually scoped tightly, and the scope determines whether a choice is usable.

• Question 13:

  Which feature does a high-gain patch antenna impart to a wireless signal?

  A. single narrow frequency use
  B. partial overlap of frequency bands
  C. focused beam in a flat area
  D. alternating direction with elevation
  C. focused beam in a flat area

  ---

  Explanation

  The question is not asking for a generally related feature; it is asking about Which feature does a high-gain patch antenna impart to a wireless signal? That makes focused beam in a flat area the relevant choice.

  Antenna questions are about pattern and energy concentration. Gain changes how energy is focused, not the authentication method, VLAN assignment, or controller policy. The chosen setting matches the coverage shape or gain behavior described in the stem, which is why it is preferred over unrelated wireless features.

  single narrow frequency use does not provide the specific RF, security, forwarding, management, or automation behavior that is required. partial overlap of frequency bands would be considered only for a different symptom or design goal. alternating direction with elevation can sound related, but it does not own the behavior being tested.

  A good review method is to ask whether the choice would still solve the issue if every unrelated setting remained unchanged.

  A complete review also checks whether the choice would still solve the problem if all other settings stayed the same. That test favors the correct choice because it changes the feature, protocol, or policy named by the question. The distractors may be legitimate Cisco wireless concepts, but they would send the engineer toward a different task and leave the stated requirement unresolved.

• Question 14:

  A network administrator at a marketing company manages a Cisco Catalyst 9800 Series Wireless Controller running Cisco IOS XE 17.x. The WLAN named XYZ-Guest is set up for visitors, and the administrator wants to implement a web authentication (WebAuth) portal using an external server to manage guest access. To ensure seamless and secure guest authentication, the controller must be configured to use an external WebAuth server for the WLAN.

  The administrator must configure the XYZ-Guest WLAN to use an external WebAuth server with a parameter map named webauth-ext.

  Which set of Cisco IOS XE commands must be used?

  A. wireless wlan XYZ-Guestsecurity web-auth external webauth-ext
  B. wireless wlan XYZ-Guest 2 XYZ-Guestparameter-map webauth-ext
  C. wlan XYZ-Guest 2parameter external security-map webauth-ext
  D. wlan XYZ-Guest 2 XYZ-Guestsecurity web-auth parameter-map webauth-ext
  A. wireless wlan XYZ-Guestsecurity web-auth external webauth-ext

  ---

  Explanation

  wireless wlan XYZ-Guestsecurity web-auth external webauth-ext fits because the item is asking about this condition: A network administrator at a marketing company manages a Cisco Catalyst 9800 Series Wireless Controller running Cisco IOS XE 17.x. The WLAN named XYZ-Guest is set up for visitors.

  Guest wireless designs must combine onboarding with isolation. The portal, redirect ACL, policy profile, VLAN mapping, and peer blocking controls serve different parts of that design. This choice satisfies the guest access requirement because it supports the requested user flow or segmentation instead of merely changing a generic WLAN parameter.

  wireless wlan XYZ-Guest 2 XYZ-Guestparameter-map webauth-ext belongs to a different workflow and would leave the stated condition unresolved. wlan XYZ-Guest 2parameter external security-map webauth-ext may be useful elsewhere, but it does not apply the control that the stem is asking for. wlan XYZ-Guest 2 XYZ-Guestsecurity web-auth parameter-map webauth-ext changes an adjacent setting instead of the mechanism that produces the required result.

  The tested habit is to avoid picking a familiar wireless term unless it changes the exact condition in the question.

• Question 15:

  A network engineer is integrating Cisco ISE with a wireless controller for 802.1X authentication. The controller is registered with Cisco ISE as a network device. To secure communication, the engineer must configure a shared secret for RADIUS authentication.

  Which CLI command on the WLC accomplishes this task?

  A. 9800(config-radius-server)# radius enable authentication MySecretKey123
  B. 9800(config-radius-server)# radius-server shared-secret MySecretKey123
  C. 9800(config-radius-server)# ISE MySecretKey123
  D. 9800(config-radius-server)# key 0 MySecretKey123
  D. 9800(config-radius-server)# key 0 MySecretKey123

  ---

  Explanation

  The useful clue is this requirement: A network engineer is integrating Cisco ISE with a wireless controller for 802.1X authentication. The controller is registered with Cisco ISE as a network device. To secure communication, the engineer must configure a shared secret for RADIUS authentication. That clue points to 9800(config-radius-server)# key 0 MySecretKey123.

  Security questions should separate authentication, authorization, and policy enforcement. The WLAN security method gets the client on the network, while RADIUS and policy attributes decide what access the client receives. The chosen behavior is the piece that enables or applies that security behavior; the other choices either skip the external method, use the wrong authentication model, or affect a separate policy area.

  9800(config-radius-server)# radius enable authentication MySecretKey123 can sound related, but it does not own the behavior being tested. 9800(config-radius-server)# radius-server shared-secret

  MySecretKey123 omits the part of the configuration that actually enforces the requested outcome. 9800 (config-radius-server)# ISE MySecretKey123 shifts attention away from the condition that the client, AP, or controller must satisfy.

  In production troubleshooting, that distinction matters because changing the wrong layer can leave the original failure untouched.

• Question 16:

  Refer to the exhibit.

  

  An engineer is configuring a switch port for a Cisco Spaces deployment at a new branch site. The Spaces connector requires access to the management VLAN 30. The network team plans to add more analytics services in the future, so the configuration must also allow for easy scalability and avoid service interruption for currently connected devices and default switch VLAN settings.

  Which set of commands must be added to the box in the CLI to complete the configuration?

  A. switchport mode accessswitchport access vlan 30
  B. switchport mode accessswitchport trunk allowed vlan 30switchport access native vlan
  C. switchport mode accessswitchport trunk allowed vlan 30switchport trunk native vlan none
  D. switchport mode trunkswitchport trunk allowed vlan 30
  D. switchport mode trunkswitchport trunk allowed vlan 30

  ---

  Explanation

  The answer follows from the requirement itself: An engineer is configuring a switch port for a Cisco Spaces deployment at a new branch site. The Spaces connector requires access to the management VLAN 30.

  The network team plans to add more analytics services in the future. switchport mode trunkswitchport trunk allowed vlan 30 is the response that matches that requirement.

  The Spaces connector requires access to the management VLAN 30. That points to switchport mode trunkswitchport trunk allowed vlan 30. Branch designs usually test the difference between central management and local data handling. FlexConnect behavior is chosen when the AP must keep useful service at the site while still being managed by the controller. That selection fits that branch requirement because it changes forwarding or authentication behavior at the AP site rather than relying on an always-

  available central path. switchport mode accessswitchport access vlan 30 addresses a different failure domain, so it would not close the gap described here. switchport mode accessswitchport trunk allowed

  vlan 30switchport access native vlan is too broad or aimed at the wrong layer for this scenario. switchport mode accessswitchport trunk allowed vlan 30switchport trunk native vlan none does not provide the specific RF, security, forwarding, management, or automation behavior that is required. The answer should therefore be evaluated by effect, not by how recognizable the command or platform name appears.

• Question 17:

  During initial Catalyst 9800 WLC setup, the management interface has an IP address and mask, but the controller cannot reach devices outside the local subnet.

  Which configuration is required?

  A. Enable optimized roaming on the WLAN.
  B. Create a guest anchor mobility tunnel.
  C. Configure a default route toward the management gateway.
  D. Configure a channel utilization threshold.
  C. Configure a default route toward the management gateway.

  ---

  Explanation

  The answer follows from the requirement itself: During initial Catalyst 9800 WLC setup, the management interface has an IP address and mask, but the controller cannot reach devices outside the local subnet.

  Which configuration is required? Configure a default route toward the management gateway. is the response that matches that requirement.

  The scenario narrows the issue to: During initial Catalyst 9800 WLC setup, the management interface has an IP address and mask, but the controller cannot reach devices outside the local subnet. Which configuration is required? That makes Configure a default route toward the management gateway. the best fit, because it changes the same control point named by the stem. Protocol questions depend on the exact 802.11 function involved. Airtime scheduling, frame exchange, channel behavior, and secure roaming each solve a different problem. That selection maps to the protocol mechanism described by the stem rather than to a controller administration task or a general monitoring feature. Enable optimized roaming on the WLAN. is too broad or aimed at the wrong layer for this scenario. Create a guest anchor mobility tunnel. does not provide the specific RF, security, forwarding, management, or automation behavior that is required. Configure a channel utilization threshold. would be considered only for a different symptom or design goal. For exam purposes, separate association, authentication, authorization, forwarding, RF behavior, and management visibility before selecting a command or feature.

• Question 18:

  Which feature enables fast secure roaming in a wireless network?

  A. DCA
  B. 802.11r
  C. 802.11ax
  D. MIMO
  B. 802.11r

  ---

  Explanation

  The condition to solve is Which feature enables fast secure roaming in a wireless network? 802.11r is aligned with that condition rather than with a neighboring workflow.

  Protocol questions depend on the exact 802.11 function involved. Airtime scheduling, frame exchange, channel behavior, and secure roaming each solve a different problem. This feature maps to the protocol mechanism described by the stem rather than to a controller administration task or a general monitoring feature.

  DCA may be useful elsewhere, but it does not apply the control that the stem is asking for. 802.11ax changes an adjacent setting instead of the mechanism that produces the required result. MIMO addresses a different failure domain, so it would not close the gap described here.

  That is why the correct selection follows the requirement directly instead of merely belonging to the same Cisco wireless product family.

  A complete review also checks whether the choice would still solve the problem if all other settings stayed the same. That test favors the correct choice because it changes the feature, protocol, or policy named by the question. The distractors may be legitimate Cisco wireless concepts, but they would send the engineer toward a different task and leave the stated requirement unresolved.

• Question 19:

  Which condition is required for a line-of-sight RF connection?

  A. Wireless multipath signal propagation to the client
  B. MIMO connection support on both wireless radios
  C. Delay on wireless signal delivery introduced by reflection
  D. No physical objects between the transmitter and receiver
  D. No physical objects between the transmitter and receiver

  ---

  Explanation

  When the stem is reduced to Which condition is required for a line-of-sight RF connection?, No physical objects between the transmitter and receiver is the choice that remains technically aligned.

  The scenario narrows the issue to: Which condition is required for a line-of-sight RF connection? That makes No physical objects between the transmitter and receiver the best fit, because it changes the same control point named by the stem. RF questions should be solved from measurable behavior. Signal level, noise, channel restrictions, interference classification, and propagation effects determine whether a link is stable and compliant. That selection is tied to that RF behavior, so it explains the observed result without changing unrelated WLAN security or management settings. Wireless multipath signal propagation to the client is too broad or aimed at the wrong layer for this scenario. MIMO connection support on both wireless radios does not provide the specific RF, security, forwarding, management, or automation behavior that is required. Delay on wireless signal delivery introduced by reflection would be considered only for a different symptom or design goal. For exam purposes, separate association, authentication, authorization, forwarding, RF behavior, and management visibility before selecting a command or feature.

• Question 20:

  A planned WLC maintenance window will intentionally interrupt wireless service for one building. The operations team does not want Cisco Catalyst Center to generate avoidable incident notifications during the work.

  Which action should be taken?

  A. Disable all RADIUS servers globally.
  B. Remove the APs from inventory permanently.
  C. Change every WLAN to open authentication.
  D. Schedule maintenance or suppress notifications for the affected devices.
  D. Schedule maintenance or suppress notifications for the affected devices.

  ---

  Explanation

  The key is to match the requested effect, A planned WLC maintenance window will intentionally interrupt wireless service for one building. The operations team does not want Cisco Catalyst Center to generate avoidable incident notifications during the work. Which action should be taken?, with the feature or command that actually produces it; that points to Schedule maintenance or suppress notifications for the

  affected devices..

  Security questions should separate authentication, authorization, and policy enforcement. The WLAN security method gets the client on the network, while RADIUS and policy attributes decide what access the client receives. That configuration is the piece that enables or applies that security behavior; the other choices either skip the external method, use the wrong authentication model, or affect a separate policy area.

  Disable all RADIUS servers globally. changes an adjacent setting instead of the mechanism that produces the required result. Remove the APs from inventory permanently. addresses a different failure domain, so it would not close the gap described here. Change every WLAN to open authentication. is too broad or aimed at the wrong layer for this scenario.

  This keeps the reasoning tied to the implementation detail rather than to broad wireless terminology.