100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 270
On a shared Ethernet segment, the switch advertising the best path toward the root supplies the one forwarding port for that segment. Which RSTP port role is elected there?
- An alternate port blocked from forwarding
- The root port on every switch across the segment
- A designated role port
- A backup port on shared media where another same-switch port is designated
Explanation
Correct Answer
C:A root bridge has designated ports on its connected segments in the active topology.
Incorrect Answers
A:The alternate route is a standby route toward the root, not the best-path forwarding port elected for this segment.
B:A root port is each non-root switch’s chosen port toward the root bridge; the best port selected for the shared segment is designated.
D:A backup role is a distinct nonforwarding redundant port scenario; it is not the one designated forwarding segment port.
Question 271
An office AP joins a Catalyst 9800 controller and must serve normal associated WLAN clients with controller-managed profiles on its radios. Which lightweight AP operating mode serves ordinary client traffic?
- Use monitor mode and continue normal client service
- Use sniffer mode and direct all clients into a capture stream
- Use bridge-only backhaul mode without local WLAN service
- Use local mode on a lightweight AP
Explanation
Correct Answer
D:Lightweight AP local mode ordinarily serves associated WLAN clients under the wireless controller’s radio and policy configuration. A dedicated monitor AP is instead used to scan and report the RF environment.
Incorrect Answers
A:A monitor-mode radio primarily scans and observes rather than providing the regular serving WLAN association cell requested.
B:Sniffer mode captures 802.11 frames for analysis instead of acting as a conventional client-serving AP.
C:A bridging/backhaul role does not by itself supply the ordinary controller-managed client association function.
Question 272
A branch office has a FlexConnect AP with local switch uplink and locally mapped client VLANs. WAN controller connectivity is unreliable, but authorized clients should continue local data switching. Which supported AP mode behavior is intended?
- Keep centrally switched local-mode WLAN traffic regardless of WAN failure
- Switch the AP into monitor-only RF survey mode
- Bridge all client traffic to an unrelated remote SSID
- Use FlexConnect local switching where supported
Explanation
Correct Answer
D:In supported FlexConnect modes, client frames may be switched at a branch instead of traversing a controller tunnel. Authentication can still depend on controller or AAA reachability depending on the configured WLAN mode.
Incorrect Answers
A:Central client-data switching depends on reaching the controller and cannot guarantee local bridge traffic during the outage described.
B:Monitoring suppresses ordinary client associations and therefore cannot maintain local user data forwarding.
C:Changing client Wi-Fi identities does not provide the VLAN-local FlexConnect switching behavior required at the branch.
Question 273
A dedicated AP is reserved for scanning nearby channels and reporting RF interference and rogue devices, not serving user associations. Which monitoring-oriented AP mode is appropriate?
- Choose local client-serving mode as the sole monitoring function
- Choose FlexConnect local-switching mode
- Choose packet-sniffer mode forwarding every captured frame to a destination
- Use a monitor-mode AP
Explanation
Correct Answer
D:Monitor mode prioritizes scanning and wireless intrusion/radio measurements rather than routine client associations. An ordinary serving AP in local mode has a different principal operating role.
Incorrect Answers
A:A normal serving AP may collect limited telemetry, but a dedicated scan-focused monitor role is the correct specified monitoring mode.
B:FlexConnect controls where client data is switched and is not the dedicated non-serving RF survey role.
C:Sniffer mode is designed for targeted packet capture; the scenario asks for channel scanning and RF/rogue monitoring, not captures.
Question 274
A Wi-Fi troubleshooting team needs a dedicated AP to capture and encapsulate on-air 802.11 frames for Wireshark on a configured destination host. Which AP role performs packet sniffing?
- Use local mode to serve WLAN client sessions
- Use FlexConnect for local VLAN forwarding
- Use sniffer AP mode
- Use monitor mode solely for periodic rogue classification
Explanation
Correct Answer
C:Sniffer mode collects 802.11 frames for delivery to a packet analyzer.
Incorrect Answers
A:Normal client-serving mode is not the dedicated packet-sniffer role that streams captured 802.11 frames to an analyzer.
B:Local switching determines client traffic path; it does not supply the dedicated monitor-to-analyzer frame capture specified.
D:A monitor can scan RF and report devices, but the request specifically requires sniffer capture encapsulation to a packet-analysis host.
Question 275
Two warehouse buildings require a wireless backhaul between their wired LANs where no fiber or copper path exists, using supported mesh/bridge APs. Which wireless bridge role is appropriate?
- Use a local serving AP at each building with no interbuilding wireless backhaul
- Use an appropriate wireless bridge or mesh AP design
- Use monitor-mode radios at both buildings
- Use a controller CAPWAP control tunnel as the wireless bridge itself
Explanation
Correct Answer
B:Bridge and mesh modes provide wireless backhaul between network segments.
Incorrect Answers
A:Two independent client access radios do not automatically form a dedicated transparent wired-LAN bridge across the gap.
C:Monitor mode observes the RF environment but does not carry the wired Ethernet backhaul traffic required.
D:CAPWAP manages/control APs and may carry client data; it is not equivalent to a bridge/mesh backhaul between buildings with no wired path.
Question 276
On Cisco Catalyst 9800, a WLAN profile and client policy profile both exist, but lightweight APs assigned to a new branch do not inherit their intended SSID-to-policy association. Which configuration object maps these two profiles for the assigned APs?
- A site tag only, because it replaces the WLAN-to-policy relationship
- An RF tag, which controls radio profiles rather than client WLAN policy mapping
- The AP join profile, which replaces both the WLAN and policy profiles
- A policy tag mapping the WLAN profile to its policy profile and assigned to the APs
Explanation
Correct Answer
D:The policy tag binds each WLAN profile to a corresponding policy profile; assigning it to the AP ensures the intended WLAN service policy is applied.
Incorrect Answers
A:A site tag controls deployment-site settings and FlexConnect/AP join associations; it does not alone map WLAN definitions to client policy profiles.
B:An RF tag selects radio-frequency configurations and cannot substitute for the mapping between a WLAN profile and a client policy profile.
C:An AP join profile controls AP lifecycle and join-related attributes; it does not replace the controller policy tag’s WLAN-to-policy mapping.
Question 277
A user complains that one SSID has no coverage in a lobby even though the wired LAN is up. Which element actually provides the serving 802.11 radio cell for that WLAN in the area?
- Increase the controller management interface throughput
- Configure a new DHCP scope without a serving radio
- Move the access-switch SVI to the lobby VLAN only
- Use an AP servicing the requested WLAN
Explanation
Correct Answer
D:The AP exchanges 802.11 radio management and data frames with clients.
Incorrect Answers
A:The WLC management port carries management/control responsibilities; it does not radiate 802.11 coverage into the lobby.
B:A valid DHCP lease still requires a radio cell in which wireless clients can associate.
C:An SVI is a routed IP interface, not the radio device that transmits SSID beacons and accepts association frames.
Question 278
A lightweight access point and Catalyst controller exchange control and provisioning information while the AP manages its WLAN radios. Which management/control protocol channel enables that relationship?
- Use LLDP neighbor advertisements as the controller tunnel
- Use the CAPWAP control channel
- Use RADIUS Access-Request packets as the AP control tunnel
- Use ordinary DHCP offers as the persistent wireless control plane
Explanation
Correct Answer
B:CAPWAP carries AP-controller control signaling over the IP network.
Incorrect Answers
A:LLDP discovers link neighbors and is not the AP-to-controller provisioning and control transport.
C:RADIUS can authenticate wireless clients but does not replace the AP CAPWAP management relationship.
D:DHCP can give an AP addressing parameters during onboarding but does not carry ongoing controller/AP control messages.
Question 279
A campus WLAN uses one SSID over several controller-managed access points. A voice handset must roam between APs with less authentication interruption, and the clients and WLAN explicitly support fast transition. Which WLAN enhancement directly targets the reauthentication delay?
- Enable a supported 802.11r Fast Transition mode with the correct security policy
- Disable RF roaming by configuring a unique SSID for every access point
- Replace 802.11 encryption with open authentication to avoid key negotiations
- Enable the controller CAPWAP control channel alone, without any mobility/roaming feature
Explanation
Correct Answer
A:802.11r Fast Transition can speed supported roaming by preparing key transitions between compatible APs without repeating the entire initial authentication path.
Incorrect Answers
B:Per-AP SSIDs would force network-selection changes and disrupt the requested seamless roaming within one logical WLAN.
C:An open WLAN discards the required client security and is not a safe or equivalent way to shorten protected reassociation.
D:CAPWAP supports controller-to-AP operation but does not by itself enable the 802.11r client-side fast-transition authentication behavior.
Question 280
A FlexConnect branch AP is locally switching a WLAN but uses a centralized RADIUS service via its controller for new 802.1X client authentication. The controller WAN connection fails and no local/backup authentication is configured. Which result is most accurate?
- New 802.1X clients always authenticate locally because local switching automatically includes a RADIUS server
- Existing authenticated clients may keep using local switching, but new 802.1X associations fail without reachable authentication
- The AP immediately tunnels all locally switched traffic to the failed controller to preserve policy
- All local VLANs are disabled on the branch switch regardless of their other non-wireless use
Explanation
Correct Answer
B:A FlexConnect locally switched WLAN can continue existing client forwarding while a controller outage prevents newly centrally authenticated clients from joining without an available local authentication method.
Incorrect Answers
A:Local switching controls the client data path, not necessarily authentication. A separate, supported local authentication service is required to accept new centrally authenticated clients without the controller.
C:During a controller failure an AP cannot create a functioning data tunnel to that unreachable controller. Local switching means the data path stays at the branch rather than being backhauled.
D:A controller outage can affect WLAN client state but does not administratively disable unrelated VLANs on the branch switch.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
