Free 350-101 Practice Test Questions and Answers (2026)

YANG is a vendor-neutral, human-readable data modeling language that defines the structure of configuration and operational data manipulated by NETCONF on Cisco wireless controllers and other devices.

B. NETCONF uses SSH for security; YANG is not a security protocol.

C. NETCONF always operates on data models such as YANG; it does not transport raw, model-less data.

D. YANG is an IETF standard (RFC 6020/7950), not a Cisco-proprietary scripting language.

1. RFC 6020: YANG—A Data Modeling Language for the NETCONF Protocol, sec. 1.

2. Cisco IOS XE Programmability Configuration Guide, Rel 17.3, “NETCONF/RESTCONF and YANG,” pp. 1-3.

3. MIT 6.829 Computer Networks lecture notes, Spring 2022, “NETCONF and Model-Driven Telemetry,” slide 7 (defines YANG).

In Cisco wireless mesh, Bridge mode turns a Mesh Access Point into a layer-2 bridge, extending an Ethernet segment over the wireless backhaul. This provides transparent point-to-point or point-to-multipoint connectivity between network segments that are separated physically.

B. Radio band selection is unrelated; bridge mode does not default traffic to 2.4 GHz.

C. RF transmit-power control (TPC) is part of RRM, not a bridge-mode function.

D. Communicating with the WAN edge is routing, whereas bridge mode operates purely at Layer 2.

1. Cisco “Indoor and Outdoor Mesh Access Point Deployment Guide,” Rev 3, p.12-13, section “Bridge Mode.”

2. Cisco Aironet APs Command Reference, IOS 15.3(3)JA, “bridge-group” description.

Peer-to-Peer (P2P) blocking in the policy profile prevents frames from one wireless client being forwarded to another on the same SSID, achieving guest isolation. Mapping VisitorAccess to VLAN 30 meets the dedicated-guest-VLAN requirement and scales automatically across all APs controlled by the 9800.

B – Local authentication does not isolate guests from each other.

C – FlexConnect/local switching not necessary; central switching already scales and isolation still required.

D – Multicast/RADIUS settings do not stop client-to-client traffic.

1. Cisco Catalyst 9800 Series Configuration Guide, “Configure Peer-to-Peer Blocking,” p. 75 (IOS XE 17.9).

2. Cisco Guest Access Design Guide, 2022, Sec. “Guest User Isolation with P2P Blocking,” para. 2.

In Catalyst 9800 telemetry configuration, the receiver statement is entered inside the Spaces profile with the syntax “receiver ip address protocol tls-native profile ”. This line specifies the destination IP, port 57555, use of the native TLS transport, and binds it to the previously created Spaces profile, thereby enabling encrypted export of location telemetry.

A. Puts keywords in the wrong order and omits the port number.

B. Places “protocol” before the IP/port, which is syntactically invalid.

D. Attempts to start with ‘profile … receiver’, an unsupported command structure.

1. Cisco Catalyst 9800 Series Config Guide, 17.9, “Cisco Spaces Connector”, Example 5 – receiver ip address 198.51.100.10 57555 protocol tls-native profile spaces-profile.

2. Cisco IOS XE “telemetry ietf” Command Reference, rev 2023-07, receiver syntax definition, p. 14.

Cisco Catalyst Center’s Software Image Management (SWIM) workflow lets administrators define golden images, stage and schedule controller upgrades across redundant pairs, and provides real-time compliance and progress reporting—automating the entire structured firmware update cycle while minimizing operational effort.

A. Inventory snapshots only report current hardware; they neither stage nor orchestrate image updates.

B. Software templates configure device settings, not firmware images or upgrade sequencing.

D. “Lifecycle workflow” is a Prime Infrastructure term; Catalyst Center uses SWIM for image life-cycle tasks.

1. Cisco Catalyst Center 2.3.5 User Guide, Chapter “Manage Software Images (SWIM),” Sections “Create Upgrade Workflow” & “Monitor Image Deployment.”

2. Cisco, “Automating Software Image Management with Cisco DNA Center,” White Paper C11-744143-02, pp. 2-4.

3. Cisco Live Session BRKNET-3011, “Operationalizing Controller Upgrades with DNA Center,” slides 18-23, 2022.

Mobility anchoring requires that the same WLAN (SSID, WLAN-ID, security type, PSK, and policy) exist on both the foreign and the anchor WLC. If the anchor lacks a matching WLAN, the mobility tunnel creation fails and the client association is rejected, which is what the Radioactive Trace is reporting. Creating the identical WLAN on the anchor resolves the issue.

A. 802.11r only affects fast-roam hand-shakes; it does not stop the initial association of all clients.

B. PSK mismatch is checked at the foreign WLC/AP, independent of anchoring; the trace points to mobility failure, not bad keys.

C. Removing the anchor breaks the required DMZ design goal rather than fixing the authentication failure.

1. Cisco Wireless LAN Controller Config Guide, Rel 8.10, “Configuring Mobility Anchors”, section “WLAN Requirements” – “The same WLAN ID, SSID and security parameters must be configured on both foreign and anchor, or clients cannot associate.”

2. Cisco Live BRKEWN-2033, 2022, slide 36 “Client fails when anchor WLAN absent/mismatched – seen in RA trace as WLAN-ID mismatch.”

3. Cisco TAC Case Collection, Doc ID 116419, “Association denied when anchor lacks matching WLAN”, para 3.

Wi-Fi antenna gain is expressed in dBi—decibels referenced to an ideal isotropic radiator. The dB measurement quantifies how much stronger the antenna’s peak radiation is compared with this isotropic reference, providing a standardized way to compare antenna performance.

A. Physical length alone does not measure gain; only correlates for certain designs.

C. dBm measures power, not antenna gain; voltage comparison is irrelevant.

D. “Blend of analog and digital signals” is unrelated to gain measurement.

1. Cisco White Paper “Antenna Basics and Radio Fundamentals”, 2014, p.4-5: definition of dBi for antenna gain – cisco.com

2. Cisco CCNA Wireless (WIFUND) Official Cert Guide, ISBN 978-1-58714-467-7, Ch. 9 “Antenna Concepts”, pp. 236-237: dBi as standard gain metric.

TACACS+ centralizes administrator authentication and authorization so the same credentials and role definitions apply consistently across routers, switches, firewalls, and other Cisco platforms, greatly simplifying and unifying device access management.

A. TACACS+ supports granular role-based authorization, not static undifferentiated groups.

B. TACACS+ consolidates—rather than fragments—access statistics and logs.

D. TACACS+ separates network-user (AAA services) from device-admin authentication, not merges them into one user.

1. Cisco IOS Security Configuration Guide, “Configuring TACACS+ for Device Administration”, section “Benefits”, bullet 1 “Provides centralized, consistent administrator access across multiple devices.”

2. RFC 8907 – TACACS+ Protocol, §1.3, “centralized AAA for network devices allows uniform admin experience”.

AI Enhanced RRM extends classic Radio Resource Management by exporting telemetry from Catalyst 9800 controllers to Cisco AI Cloud Analytics. Machine-learning models analyze historical and real-time RF data, predict environmental changes, and push optimized channel, power, and threshold settings back to the controller. This closed-loop, cloud-driven approach proactively maximizes performance and mitigates interference—capabilities unavailable with static thresholds or on-box algorithms alone.

A. Classic RRM uses reactive thresholds; AI-Enhanced adds cloud ML and is not static.

B. Optimization balances coverage and interference; it does not simply raise transmit power.

C. Feature retains dynamic channel/power control; it is not disabled for fixed settings.

1. Cisco Technical Brief “AI Enhanced RRM on Catalyst 9800,” v1.2, Dec 2022, p. 3 “Machine Learning & Cloud Analytics Workflow.”

2. Cisco Live Session BRKEWN-2011, 2023, slide 18 “AI-Enhanced RRM Architecture—Predictive Optimization.”

3. Cisco Catalyst 9800 Configuration Guide, 17.10, “Enabling AI-Enhanced RRM,” overview section.

Optimized Roaming forces clients to roam sooner by monitoring their RSSI. When a client’s RSSI drops below the configured threshold (or packet loss exceeds a set value), the AP immediately sends a disassociation frame, compelling the client to search for a stronger AP and improving overall WLAN performance.

B – Feature is local to WLC/AP, no external integration required.

C – Uses RSSI/packet loss, not peer-to-peer beacons, for location.

D – No static load balancing; clients make dynamic roam decisions.

1. Cisco Optimized Roaming Deployment Guide, v1.2, p. 3 “AP disassociates clients below RSSI threshold.”

2. Cisco Catalyst 9800 Series Configuration Guide, “Configure Optimized Roaming,” Sec. “client-disconnect-threshold,” IOS XE 17.9.

A Meraki AP automatically registers to the dashboard when it: 1) receives a DHCP-assigned IP address and 2) can initiate outbound TCP connections to the Meraki cloud (ports 80, 443, 7734, 7752). No manual serial-number entry, VPN, or static addressing is required. Therefore, simply connecting the APs to a network that provides Internet access and permits outbound traffic to the Meraki cloud allows the devices to self-discover and register, minimizing per-device configuration.

A. Cloud registration works over standard Internet; site-to-site VPN is unnecessary and unsupported for discovery.

B. Static IP can be used but still requires Internet reachability; it does not automate cloud discovery.

C. DHCP lease-table entries do not influence Meraki cloud discovery; APs register by contacting cloud servers.

1. Cisco Meraki MR Installation Guide (QS07-MR-Rev L, July 2023), p. 2 “First-Time Setup—Cloud Connectivity.”

2. Meraki Documentation “MR Firewall Rules,” §Prerequisites—APs must reach destination m.meraki.com via TCP 80/443/7734/7752.

3. Cisco Meraki Technical White Paper “Zero-Touch Provisioning,” p. 3.

DNA Center provides intent-based policy orchestration while Cisco ISE supplies identity and posture enforcement; integrating the two lets policies adapt to user and device context. Mobile-device-management (MDM) connectors in ISE supply detailed posture attributes. Cisco Spaces ingests AP telemetry from Catalyst 9800/9100 to deliver real-time and historical location analytics. Combining these three platforms gives dynamic identity/posture-aware network access plus granular visibility into device activity and location.

B. Lacks ISE and Spaces, so no identity, posture, or location visibility.

C. Static VLAN assignments ignore identity‐based policy and device posture; Spaces is absent.

D. Omits MDM and Spaces, so no posture assessment and no location analytics.

1. Cisco DNA Center 2.x Design Guide, “ISE Integration for Policy,” §5.2.

2. Cisco ISE Administrator Guide 3.x, “MDM API Integration,” ch. 45.

3. Cisco Spaces Deployment Guide, “Catalyst 9100/9800 Streaming Telemetry,” §3.

4. Cisco Validated Design CVD-SD-Access-Campus, 2023, pp. 68-74 (ISE + DNA Center + Spaces use case).

On AireOS WLCs a WPA2-Personal WLAN is enabled by configuring a PSK with the command security wpa akm psk set-key {ascii | hex}. The ascii keyword declares that the forthcoming string is an ASCII passphrase; index 0 specifies an unencrypted key entry. This single command both enables PSK authentication and stores the passphrase, satisfying the company policy that requires an ASCII key. No additional 802.1X or cipher commands are necessary for client authentication.

A. Disables 802.1X but does not define a PSK, so no client authentication key exists.

B. Merely enables DHCP proxy and is unrelated to WLAN security or authentication.

C. Selects AES cipher suites but provides no authentication method or passphrase.

1. Cisco Wireless Controller Command Reference, Release 8.10, “security wpa akm psk set-key” (WLAN Commands), pp. 1154-1155.

2. Cisco Wireless LAN Controller Configuration Guide, Release 8.10, Chap. 7 “Configuring WLAN Security (WPA2 Personal)”.

In Cisco Catalyst Center, client issue notifications are configured through the Assurance workflow. The path "Assurance > Issue Settings" is where administrators configure email destinations for issue notifications. This allows automated alerts to be sent to the NOC when client issues are detected, preventing situations where problems go unnoticed until users report them. The Issue Settings area specifically handles the configuration of notification recipients and thresholds for various types of network issues.

A. "Platforms > Notifications" is not the correct navigation path for configuring issue-based email alerts in Catalyst Center.

B. Developer Toolkit is for API integration and programmability features, not for configuring operational email alerts.

D. This navigation path does not exist in the standard Catalyst Center interface for email notification configuration.

1. Cisco Catalyst Center Assurance User Guide, Release 2.3.5, Chapter: "Managing Issues and Health Scores," Section: "Configuring Issue Notifications"

2. Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Chapter: "Integration with Cisco DNA Center"

3. Cisco Digital Network Architecture Center Platform User Guide, Release 2.3.3, Section: "Assurance Workflows"

On Catalyst 9800 controllers each WLAN is tied to a policy profile, which in turn is bound to a Layer-3 interface (SVI). Creating a dedicated guest SVI with network 10.20.30.0/24 and mapping that interface to the guest policy profile guarantees that DHCP offers originate only from that pool and keeps traffic logically separated from corporate VLANs, allowing the required 200+ clients while maintaining isolation.

A. Shared pool can still hand out corporate subnet addresses; policy tag alone does not create VLAN separation.

C. DHCP option 43 is used for AP discovery, not client address allocation; shared pool again breaks isolation.

D. Static addressing is unmanageable for 200+ guests and does not enforce VLAN separation.

1. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide, 17.3, “Creating a VLAN Interface and Mapping to Policy Profile”, steps 1–5.

2. Cisco Validated Design – Guest Access on Catalyst 9800 (CVD-9800-GUEST), pp. 14-17.

A high-gain patch antenna is planar and directional; it concentrates RF energy into a narrow, flat horizontal beam, greatly extending range in the chosen direction while reducing vertical and side radiation. It does not change the signal’s operating frequency or alternate its elevation pattern. (Cisco Aironet Antenna Reference Guide, “Directional Patch Antennas”; IEEE 802.11 Antenna Characteristics literature.)

A. High gain does not limit the antenna to a single narrow frequency; frequency range is set by antenna design, not gain.

B. Overlapping frequency bands relate to channel planning, not an antenna’s gain pattern.

D. Patch antennas radiate in one fixed direction; they do not automatically alternate direction with elevation.

1. Cisco Systems, “Aironet Antenna Reference Guide,” OL-2449-10, Section “Patch/Panel Antennas,” pp. 5-4–5-6.

2. IEEE 802.11-2020, Clause 18.3.2.2, discussion of directional antenna patterns.

3. Olexa, “Antenna Fundamentals for Wi-Fi,” IEEE Communications Magazine 54(7): 14-19, 2016, doi:10.1109/MCOM.2016.7509379.

To statically point a Catalyst 9100 AP at a specific controller, use the CAPWAP primary-base command specifying the WLC name followed by its IP address. This populates the AP’s primary controller AP Join Profile and is effective even when DHCP/DNS discovery methods are unavailable.

A. Argument order is invalid; command keyword “primary-base” is missing.

B. Places controller name after keyword but inserts extra keyword “capwap” in wrong position.

C. Omits required controller name parameter, making command incomplete.

1. Cisco Catalyst 9100 Series Access Points Deployment Guide, IOS XE 17, “Specifying a Primary Controller”, Example: capwap ap primary-base WLC1 10.10.10.5.

2. Cisco Aironet & Catalyst AP Command Reference, IOS XE 17, command “capwap ap primary-base ”.

3. Cisco WLC Best Practices White Paper, rev 3.1, p. 9.

Cisco Catalyst 9100/9170 APs use the CAPWAP-AP CLI to pre-provision up to three controllers.

Syntax: capwap ap primary-base , capwap ap secondary-base , capwap ap tertiary-base .

This writes the controller list to NVRAM, so the AP first joins the primary WLC; if that fails, it tries the secondary, then the tertiary—exactly what the WAN-outage scenario requires.

A – “set controller …-base” is not a valid command on Catalyst APs.

C – “ap join …” is a WLC debug command, not persistent CLI on an AP.

D – “capwap ap wlc …” is an invalid keyword sequence; –base is mandatory.

1. Cisco Catalyst 9100 Series Access Points Deployment Guide, “Configuring Primary, Secondary, and Tertiary Controller IP Addresses,” p. 46, Example 3 (IOS XE 17.x).

2. Cisco IOS XE Wireless Controller Discovery Guide, Sec. “Manually Configuring Controller Information on an AP,” para. 2 (17.9.1).

To change only the default gateway on a lightweight AP that already has a static IP, use the dedicated command:

capwap ap ip default-gateway

This updates the gateway without altering the configured IP address or subnet mask.

B. Command sets controller IP, not the gateway.

C. Re-enters IP/mask/gateway; unnecessary and risks typing errors.

D. Same as C and also changes mask to /24, potentially breaking reachability.

1. Cisco Aironet 2800/3800 Series Access Point Deployment Guide, “Manually Assigning a Static IP Address”, Step 5, p. 29 – command capwap ap ip default-gateway x.x.x.x.

2. Cisco Aironet 1700/2700/3700 Series AP Command Reference, “capwap ap ip default-gateway” definition, p. 148.

On Catalyst 9800 controllers, client-limit is set inside the WLAN with “client association limit ”, while client session-timeout is configured in the attached policy profile with “session-timeout ”. Thus commands (E) and (D) fulfill the 50-client cap and 2800-second timeout.

A – “max-association” is not a valid WLAN keyword on 9800; command rejected.

B – Adds redundant “client” token; correct syntax is simply session-timeout.

C – Session-timeout cannot be set in the WLAN context; must be under policy profile.

1. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide, IOS XE 17.3, “Configuring WLANs”, CLI: “client association limit ” (Chapter WLAN-6).

2. Same guide, “Configuring Policy Profile Parameters”, CLI: “session-timeout ” (Chapter Policy-5).

3. Cisco Live BRKEWN-2035 (2021) slide 44, “WLAN vs Policy-profile: where to configure client limits and session timeout”.