Cisco 400-351 Online Practice Questions and Exam Preparation

Cisco 400-351 Online Questions & Answers

• Question 41:

  DRAG DROP

  Drag and drop the configuration steps for access point groups on the wireless LAN controller from the left into the correct order on the right.

  Select and Place:

  

  

• Question 42:

  Which two statements about accessing the GUI and CLI of Cisco WLC are true? (Choose two.)

  A. The feature "Management using Dynamic Interfaces" can be applied to one of the Dynamic Interfaces only.
  B. Wireless management access is only possible through the default management WLAN "thazz"
  C. The wireless clients can access the Cisco WLC only when the option " Enable Controller Management to be accessible from Wireless Clients" is checked.
  D. The feature "Management using Dynamic Interfaces" can be configured in CLI onlyWireless management access is only possible through the default management WLAN -WLAN ID
  E. Wired clients |can have only CLI access with the dynamic interface of the Cisco WLC, while wireless clients have both CLI and GUI access with the dynamic interface when the feature "Management using Dynamic Interfaces" is enabled.
  A. The feature "Management using Dynamic Interfaces" can be applied to one of the Dynamic Interfaces only.
  C. The wireless clients can access the Cisco WLC only when the option " Enable Controller Management to be accessible from Wireless Clients" is checked.

• Question 43:

  Which two statements about 802.11are true? (Choose two}

  A. MIC is appended for robust management frame.
  B. IGTK is used to protect robust broadcast and multicast management frames
  C. Association and disassociation frames are protected.
  D. PKC is used to protect robust unicast management frames .
  E. Association responses are not protected
  B. IGTK is used to protect robust broadcast and multicast management frames
  E. Association responses are not protected

• Question 44:

  

  Refer to the exhibit. Which three statements about this extract of the configuration of an autonomous AP are true? (Choose three.)

  A. This configuration is of a non-root bridge access point.
  B. The RADIUS server IP address I misconfigured. It points to the AP itself. Which creates a loop for the RADIUS packets.
  C. This configuration allows bridging of VLANs 3 and 4.
  D. The SSID is not visible for clients proting the wireless medium.
  E. The administrator cannot access the AP via the web GUI using a secure connection.
  F. The native VLAN must be VLAN 1 to match the native VLAN configured on the switch to which the AP is connecting.
  C. This configuration allows bridging of VLANs 3 and 4.
  D. The SSID is not visible for clients proting the wireless medium.
  E. The administrator cannot access the AP via the web GUI using a secure connection.

• Question 45:

  Which three options are valid AP modes for lightweight APS in the WLC 7.0.116 release? (Choose three.)

  A. SE-Connect
  B. WPS
  C. RAM
  D. OEAP
  E. Rogue Detector
  F. Sniffer
  A. SE-Connect
  E. Rogue Detector
  F. Sniffer

• Question 46:

  Which two statements about AP Local Authentication by FlexConnect AP in standalone mode are true? (Choose two.)

  A. A FlexConnect AP in standalone mode cannot be configured to perform full 802.1X authentication to a backup RADIUS server.
  B. Should a WAN outage occur, having the RADIUS server located inside the branch will not represent any advantages for the clients with regards of the wireless services that they will be able to access
  C. When using EAP-TLS, a FlexConnect group must be created so that the Cisco Wireless LAN Controller can push the certificates to the FlexConnect AP in the FlexConnect Group.
  D. From AireOS release 8.0, Cisco Extended Keying Groups (CEKG) is a supported Local Authentication Protocol when deploying FlexConnect.
  E. Only LEAP, EAP-FAST, PEAP, and EAP-TLS authentications are supported.
  C. When using EAP-TLS, a FlexConnect group must be created so that the Cisco Wireless LAN Controller can push the certificates to the FlexConnect AP in the FlexConnect Group.
  E. Only LEAP, EAP-FAST, PEAP, and EAP-TLS authentications are supported.

• Question 47:

  When configuring Application Visibility and Control on the wireless controller, which two restrictions must be considered prior to AVC configuration and implementation? (Choose two.)

  A. IPv6 packet classification is not supported.
  B. The number of applications that you can apply rate limit is 9.
  C. Controller CLI support is not present for the AVC Protocol Pack feature.
  D. AVC rate limiting is not supported on the Cisco 5520 WLCs.
  E. Multicast traffic is not supported.
  A. IPv6 packet classification is not supported.
  C. Controller CLI support is not present for the AVC Protocol Pack feature.

• Question 48:

  You have a Cisco Prime Infrastructure instance that has multiple MSEs and Cisco WLCs. You plan to use Prime Infrastructure to identify the most critical security issues on each managed device. Which option must you use to calculate the thermometer score for Cisco WLCs and MSEs?

  A. highest scoring Cisco WLC plus the lowest scoring MSE
  B. highest scoring Cisco WLC plus the highest scoring MSE
  C. lowest scoring Cisco WLC plus the lowest scoring MSE
  D. lowest scoring Cisco WLC plus the highest scoring MSE
  C. lowest scoring Cisco WLC plus the lowest scoring MSE

• Question 49:

  

  Refer to the exhibit. This portion of configuration refers to a multiple SSID/VLAN configuration of a Cisco IOS AP with just one radio. Which statement is correct?

  A. The configuration does not allow for non-corporate clients to connect to any SSID. Guest traffic, therefore, will not be allowed.
  B. The SSID "EAP" will allow client to connect to it using EAP-TLS as the authentication method. However, in this scenario, ISE is the only supported external RADIUS server.
  C. You can use dot11 mbssid globally to allow broadcast of multiple SSIDs, or you can do it on individual radios with the command mbssid guest-mode.
  D. The AP must have subinterfaces 80, 81, and 82 configured, on the Radio1 and Ethernet interfaces.
  C. You can use dot11 mbssid globally to allow broadcast of multiple SSIDs, or you can do it on individual radios with the command mbssid guest-mode.

• Question 50:

  Which two statements about header attacks are true? (Choose two.)

  A. An attacker can use IPv6 Next header attacks to steal user data and launch phishing attacks.
  B. An attacker can leverage an HTTP response header to write malicious cookies.
  C. An attacker can use vulnerabilities in the IPv6 routing header to launch attacks at the application layer.
  D. An attacker can execute a spoofing attack by populating the RH0 routing header subtype with multiple destination addresses.
  E. An Attacker can use HTTP Header attacks to launch a DoS attack.
  F. An attacker can leverage an HTTP response header to inject malicious code into an application.
  A. An attacker can use IPv6 Next header attacks to steal user data and launch phishing attacks.
  B. An attacker can leverage an HTTP response header to write malicious cookies.