100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 280
A FlexConnect branch AP is locally switching a WLAN but uses a centralized RADIUS service via its controller for new 802.1X client authentication. The controller WAN connection fails and no local/backup authentication is configured. Which result is most accurate?
- New 802.1X clients always authenticate locally because local switching automatically includes a RADIUS server
- Existing authenticated clients may keep using local switching, but new 802.1X associations fail without reachable authentication
- The AP immediately tunnels all locally switched traffic to the failed controller to preserve policy
- All local VLANs are disabled on the branch switch regardless of their other non-wireless use
Explanation
Correct Answer
B:A FlexConnect locally switched WLAN can continue existing client forwarding while a controller outage prevents newly centrally authenticated clients from joining without an available local authentication method.
Incorrect Answers
A:Local switching controls the client data path, not necessarily authentication. A separate, supported local authentication service is required to accept new centrally authenticated clients without the controller.
C:During a controller failure an AP cannot create a functioning data tunnel to that unreachable controller. Local switching means the data path stays at the branch rather than being backhauled.
D:A controller outage can affect WLAN client state but does not administratively disable unrelated VLANs on the branch switch.
Question 281
A lightweight AP with a supported 802.3 PoE class connects to one access-switch port and must get both Ethernet data and its full rated power without an external injector. Which physical access port capability is required?
- Use an ordinary non-PoE Ethernet switchport and rely on switch data signaling
- Enable a voice VLAN on a port that lacks sufficient power budget
- Use an appropriately budgeted PoE access switchport
- Configure the controller management VLAN on the upstream router only
Explanation
Correct Answer
C:A suitable PoE switch port supplies both the wired Ethernet link and negotiated electrical power to an AP. Port capability and power budget must meet the AP model’s requirements or it may not fully operate.
Incorrect Answers
A:A data-capable port without negotiated power sourcing cannot run the AP without an external supported power supply.
B:A VLAN choice cannot supply the required electrical wattage or PoE power class.
D:IP management connectivity is separate from delivering electrical power on the AP Ethernet pair.
Question 282
A FlexConnect AP locally switches traffic for WLANs mapped to VLANs 20 and 30, so its switch uplink needs to carry both with 802.1Q tags. Which switchport link type is appropriate when the AP supports that trunk design?
- Configure the AP uplink as a single untagged access VLAN 20
- Configure a trunk that permits only VLAN 20
- Carry both WLANs as an untagged native VLAN
- Use a supported 802.1Q trunk uplink for the AP
Explanation
Correct Answer
D:A supported locally switching AP can use an 802.1Q trunk to carry multiple WLAN VLANs with their tags on one Ethernet uplink. A single access VLAN cannot transport several distinct tagged client networks.
Incorrect Answers
A:One untagged access VLAN cannot transport both separately mapped VLANs 20 and 30 for the specified locally switched WLANs.
B:A permitted list omitting VLAN 30 still drops VLAN 30 client frames at the switch uplink.
C:A single native VLAN cannot preserve two distinct client VLAN identities on the same link.
Question 283
A controller supports an LAG across multiple physical Ethernet ports to increase uplink resilience and throughput; all members are on compatible equipment. Which physical/logical aggregation choice is needed?
- Use a supported link aggregation group
- Bring up two independent switch ports with no coordinated aggregation
- Enable STP PortFast on each controller uplink instead of aggregating
- Configure a static IP default route across all member Ethernet ports
Explanation
Correct Answer
A:Link aggregation combines supported parallel controller uplinks into a logical bundle, with member compatibility and platform limits respected. It provides redundancy and aggregate traffic capacity without treating every link as an independent management interface.
Incorrect Answers
B:Uncoordinated active uplinks are not a single logical Link Aggregation Group and can create incompatible forwarding behavior.
C:PortFast addresses edge STP transitions, not the supported controller/switch bundling mechanism.
D:A router default route does not combine Ethernet ports into the controller LAG described.
Question 284
An AP boots and has power but cannot register with its controller because the management VLAN/DHCP/default gateway path is wrong. What addressing and VLAN reachability should be corrected?
- Provide correct AP management VLAN and IP reachability
- Increase AP transmit power before checking IP configuration
- Add more SSIDs to the controller WLAN list
- Increase switch QoS priority for already-established WLAN traffic
Explanation
Correct Answer
A:An AP requires L3 reachability to discover and join its controller where applicable.
Incorrect Answers
B:RF transmit power cannot fix an AP unable to reach its controller at the IP management layer.
C:More WLAN profiles do not correct the AP management VLAN, address, default gateway or controller reachability.
D:Client traffic QoS cannot repair an AP that has not joined its controller because of addressing failure.
Question 285
A Catalyst access switch reports denied power on an AP port, while Ethernet cabling is healthy. Which per-port PoE class allocation and global switch power-budget conditions should be reviewed?
- Increase AP radio power settings in the controller
- Assign the AP to a larger management subnet
- Review PoE class and total power budget
- Change the WLAN security mode from WPA2 to WPA3
Explanation
Correct Answer
C:Switch PoE budgets must support all attached powered devices.
Incorrect Answers
A:Radio power configuration cannot resolve the electrical power-budget denial on the physical switchport.
B:An IP subnet does not alter the PoE class or available watts allocated by the PSE.
D:Authentication selection cannot supply power to a radio that the switch is refusing to energize.
Question 286
An AP is designed to receive **untagged** management traffic on VLAN 115 and supports no client VLAN trunking on this port. How should the switchport's access-VLAN membership be assigned?
- Use the correct access VLAN for an AP requiring untagged traffic
- Place the AP on an 802.1Q trunk with VLAN 115 excluded
- Assign the port to untagged VLAN 20 and map AP management to VLAN 115 in the controller
- Enable a voice VLAN on the AP port and leave the access VLAN unchanged
Explanation
Correct Answer
A:An access port carries one normal untagged VLAN to such an AP.
Incorrect Answers
B:An excluded VLAN cannot deliver the untagged management network in the requested simple access-port design.
C:The AP needs Ethernet membership in VLAN 115 on its physical uplink before it can reach its management subnet.
D:A voice-VLAN feature for IP phones does not substitute for the AP management access-VLAN membership.
Question 287
A supported AP locally bridges two WLANs into VLANs 20 and 30. The uplink trunk is currently restricted to VLAN 20 only. Which VLAN transport configuration must change to permit both WLANs?
- Convert the uplink to access mode on VLAN 20
- Allow VLAN 30 only and remove VLAN 20
- Set native VLAN 30 while leaving the permitted list restricted to VLAN 20
- Use a compatible trunk allowing each required WLAN VLAN
Explanation
Correct Answer
D:A locally switching AP needs access to the VLANs it tags into the wired LAN.
Incorrect Answers
A:An access port transports only VLAN 20 as untagged traffic and loses locally switched VLAN 30.
B:That change might restore VLAN 30 but breaks the other required locally switched WLAN in VLAN 20.
C:Changing the native VLAN does not automatically add the missing client VLAN to the permitted 802.1Q set.
Question 288
A controller uplink has several interfaces to a compatible switch and its software supports a consolidated Link Aggregation Group. Which controller/switch aggregation model should be coordinated?
- Treat separate controller uplinks as an unmanaged round-robin bundle
- Configure only routing ECMP paths on the upstream router
- Enable a wireless mesh backhaul instead of coordinating Ethernet members
- Use a supported controller LAG or equivalent architecture
Explanation
Correct Answer
D:Link aggregation may present multiple physical ports as a logical controller uplink.
Incorrect Answers
A:Simply connecting several cables does not establish the matching LAG behavior configured at both ends.
B:IP equal-cost routing is not the supported Ethernet link aggregation required on the controller uplink.
C:Mesh creates wireless bridging and cannot replace the required controller-to-switch Ethernet LAG.
Question 289
An AP resets when its radio load increases because the connected switch port supplies too little negotiated power for the model. Which PoE capability must be corrected before tuning RF?
- Increase switchport negotiated Ethernet line speed while keeping the same PoE limit
- Use compatible PoE at the switch
- Enable an additional WLAN SSID to distribute radio load
- Change the AP management VLAN while leaving the denied power state
Explanation
Correct Answer
B:Power over Ethernet powers an AP through the network cable.
Incorrect Answers
A:A faster PHY rate does not add electrical power allocation to sustain the AP radio load.
C:More SSIDs can increase beacon overhead and do not resolve inadequate switch power supplied to this AP.
D:VLAN membership does not increase PoE class or power budget on the switch port.
Question 290
An AP has adequate PoE and Ethernet link but does not join its controller. Which network prerequisites involving the AP management subnet, IP routing and CAPWAP traffic should be verified?
- Validate management IP and CAPWAP reachability
- Replace WPA2-Enterprise with a PSK before checking AP management IP reachability
- Add all VLANs to the trunk even though the AP has a correct access-VLAN design
- Increase radio transmit power to extend client coverage
Explanation
Correct Answer
A:Client radio coverage does not establish that controller control traffic can reach the AP.
Incorrect Answers
B:WLAN client authentication occurs after AP join and is not the initial CAPWAP management reachability issue.
C:Overbroad trunking does not establish IP reachability to the controller and may violate VLAN policy.
D:RF transmit power cannot repair CAPWAP discovery, DHCP/default-gateway or routed IP path failures.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
