In a Cisco Wireless LAN Controller (WLC), rogue access points are APs detected in the RF environment that are not part of the managed wireless network. When other legitimate wireless networks exist in close proximity, such as in a multitenant building, their APs will be detected as rogues. The correct procedure is to classify these known, non-threatening APs as "friendly." This classification informs the system that the AP is a known entity and not a security threat, thereby preventing false positives and unnecessary security alerts while still tracking its presence.

A. adhoc: This classification is specifically for wireless devices operating in a peer-to-peer mode, not for infrastructure access points, which are described in the scenario.

C. malicious: This classification is reserved for APs that are identified as a direct security threat, such as an evil twin or an unauthorized AP connected to the corporate network.

D. unclassified: This is the default, initial state for any newly detected rogue AP. The question requires performing a classification, not leaving the AP in its default state.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5

"Configuring Rogue Detection" chapter

"Information About Rogue Detection" section. This guide states

"A rogue AP is classified as one of the following: ... Friendly—The rogue AP is classified as a known AP." This directly supports classifying known

neighboring APs as friendly.

2. Enterprise Mobility 8.5 Design Guide

"Wireless Security" chapter

"Rogue AP Detection and Containment" section. This document clarifies the use case: "Rogues are classified as either friendly or malicious... A friendly rogue might be an AP in a neighboring office." This perfectly describes the multitenant building scenario.

3. Cisco AireOS 8.10 MR5 Configuration Guide

"Rogue Access Points" section. This guide outlines the classification states

confirming that "Friendly" is the appropriate state for a known AP that is not a threat

distinguishing it from "Malicious" and the initial "Unclassified" state. It notes

"When a rogue AP is declared

it is listed as an unclassified rogue. You can change the classification of the rogue AP..."

The Clients and Users → Client Summary report in Cisco Prime Infrastructure presents a graphical, time-bounded overview that counts all associated wireless clients and groups them by WLAN, band, AP, authentication type, device type, and other categories—exactly the “summary grouped data of the total number of wireless clients” requested.

A. Client Traffic Stream Metrics – focuses on packet-level airtime and throughput per client, not total‐client count summaries.

C. Posture Status Count – shows ISE posture-assessment states (compliant, non-compliant) rather than client association totals.

D. Mobility Client Summary – reports mobility (anchor/foreign) client details; limited to roaming/mobility events, not overall client population.

1. Cisco Prime Infrastructure 3.2 User Guide

“Reports > Clients and Users Reports > Client Summary” (OL-32112-01

p. 1364-1365): “Provides a summary of the number of wireless clients associated to the network

grouped by WLAN

AP

radio band… Displayed graphically.”

2. Cisco Prime Infrastructure 3.6 Administration Guide

Ch. 12 “Generating a Client Summary Report

” Table 12-6.

3. Cisco Prime Infrastructure 3.5 Quick Start Guide

“Client Summary report shows total number of clients and grouping options.”

The Cisco DNA Center Assurance interface provides tools to monitor network health, which includes viewing current and historical issues and alarms. When filtering this data, the user interface presents several predefined time ranges. The available options are typically the last 3 hours, the last 24 hours, and the last 7 days. The question asks for the maximum time range that can be viewed, which, according to the standard options provided in the interface, is 7 days. This allows administrators to analyze trends and investigate problems that have occurred over the past week.

A. 3 hours: This is a valid time-range option for viewing recent events, but it is the minimum predefined duration, not the maximum.

B. 24 hours: This is a standard and useful time range for daily analysis, but it is not the maximum available option.

C. 3 days: This is not a standard, predefined time-range option available in the Cisco DNA Center issues and alarms filter dropdown menu.

1. Cisco DNA Center User Guide

Release 2.3.5

"View Issues" Chapter. In the "Filter Issues" section

Step 3 explicitly states the available time range options: "From the Time Range drop-down list

choose the time range for which you want to view issues. You can view issues for the last 3 hours

24 hours

or 7 days." This confirms that 7 days is the maximum predefined selection.

2. Cisco DNA Center Assurance User Guide

Release 2.1.2

"Work with Issues" Chapter. The "Filter the List of Issues" section provides similar guidance: "In the Time Range field

click the down arrow and choose the time range for the issues you want to view (the last 3 hours

24 hours

or 7 days)." This corroborates the 7-day maximum across different versions of the software.

When integrating a Cisco Wireless LAN Controller (WLC) with a TACACS+ server for administrative access, specific attribute-value pairs must be configured in the user's shell profile on the server. The WLC maps these attributes to its internal management user roles. For a user requiring read-only permissions, the role attribute must be set to the value MONITOR. This value grants the user the ability to view all configurations, monitor status, and see logs on the WLC, but prohibits them from making any configuration changes, which directly corresponds to read-only access.

A. ADMIN: This value grants full read-write administrative privileges, which is more than the required read-only access.

B. MANAGEMENT: This is not a standard, predefined role value used by the WLC for TACACS+ integration.

D. READ: While descriptive, "READ" is not the specific keyword the WLC expects. The correct value for this access level is MONITOR.

1. Cisco Wireless Controller Configuration Guide

Release 8.5

"Configuring Security Solutions" Chapter

"Information About TACACS+" section: This guide explicitly lists the TACACS+ custom attributes for management user roles. It states

"For Read-Only role

the attribute is role=MONITOR."

Source: Cisco. (2017). Cisco Wireless Controller Configuration Guide

Release 8.5. Retrieved from Cisco.com. Specifically

the table detailing TACACS+ custom attributes for management user roles.

2. Security Configuration Guide

Cisco Wireless Controller

Release 8.10

"Configuring TACACS+" section: This document confirms the required attribute-value pairs for different access levels. It specifies that for a user to have Read-Only access

the TACACS+ server must return the cisco-av-pair shell:role=MONITOR.

Source: Cisco. (2021). Security Configuration Guide

Cisco Wireless Controller

Release 8.10. Retrieved from Cisco.com. The section on "Configuring TACACS+ (GUI)" details the required attributes.

In a Cisco Connected Mobile Experiences (CMX) high-availability (HA) deployment, a "split-brain" condition occurs when both servers assume the primary role, typically due to a network partition. To recover from this state, the administrator must manually intervene on the server that is intended to be the backup. The correct command to run on this server is cmxha backup convert. This command reverts the node's status from an erroneous primary state back to its designated backup role, allowing it to re-establish communication and synchronization with the legitimate primary server.

A. cmxha convert backup: This is incorrect syntax. The command structure requires the object (backup) to precede the action (convert).

C. cmxha secondary convert: This is incorrect syntax. The command uses the keyword backup, not secondary, and the word order is reversed.

D. cmxha convert secondary: This is incorrect syntax. The command uses the keyword backup, not secondary, for specifying the role conversion.

1. Cisco CMX Configuration Guide

Release 10.6

"Configuring High Availability" chapter

"Recovering from a Split Brain Scenario" section. The guide explicitly states: "To convert the secondary CMX server back to its original state

run the cmxha backup convert command on the secondary CMX server." This confirms the exact command and its purpose in resolving a split-brain issue.

When a public-facing NAT IP address is configured on the Wireless LAN Controller's (WLC) management interface, the WLC's default behavior is to respond only to AP discovery and join requests destined for that NAT IP address. This configuration prevents APs on the internal network, which use the WLC's private management IP, from joining. The command config network ap-discovery nat-ip-only disable modifies this behavior, allowing the WLC to respond to join requests sent to both its internal management IP and its external NAT IP. This ensures that both internal APs and external OfficeExtend APs (OEAPs) can successfully associate with the same controller.

A. config flexconnect office-extend nat-ip-only disable: This command does not exist in the documented CLI. The nat-ip-only setting is a global network discovery parameter, not a FlexConnect-specific one.

B. config network ap-discovery nap-ip-only enable: This command contains a typo (nap-ip-only). If corrected to nat-ip-only enable, it would enforce the problematic behavior, forcing the WLC to respond only to the NAT IP.

C. config flexconnect office-extend nat-ip-only enable: This command does not exist. Even if it did, enabling a nat-ip-only feature would restrict, not expand, the WLC's responsiveness, failing to solve the issue for internal APs.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5

"Configuring the Controller for Network Address Translation" section: "If you have both internal and external access points

and you want them to be able to join the controller

you must disable the NAT-only setting by entering this command: config network ap-discovery nat-ip-only disable."

2. Cisco OfficeExtend Access Point Deployment Guide

"WLC Behind a NAT Device" section: "When the WLC is configured with a NAT IP address

the WLC sends its NAT IP address in the discovery response to the OEAP. ... If you have APs on the LAN side of the WLC

you must disable the 'AP discovery on NAT IP only' feature using the config network ap-discovery nat-ip-only disable CLI command."

3. Cisco AireOS Command Reference

"config network" commands: This reference documents the config network ap-discovery nat-ip-only {enable | disable} command

explaining its function is to control whether the controller responds to discovery requests on its management interface when a NAT IP is also configured. The disable option is specified for environments with both internal and external APs.

The exhibit from Cisco Prime Infrastructure displays information about non-802.11 interferers. The "Interferer Types" and "Top N Interferers" sections clearly show three distinct devices: a Bluetooth Link, a Bluetooth Discovery device, and a Video Camera. The "Interferer Severity" pie chart shows zero devices in the "Severe," "Significant," or "Moderate" categories. The detailed list confirms this, assigning each interferer a minimal severity of 1 and a low duty cycle of 1%. This evidence directly supports the conclusion that there are "several light interferers." While their impact is likely minimal, they are present and have been detected by CleanAir as potential sources of interference.

A: This is incorrect. The severity chart and the detailed list explicitly show that there are no strong (severe or significant) interferers; all have a minimal severity of 1.

C: This is incorrect. The provided output is a report on interferers and contains no information about AP locations, signal coverage, or physical "clusters," making any conclusion about AP placement impossible.

D: This is incorrect. The presence of only three minor interferers with a 1% duty cycle suggests a relatively clean RF environment, not one that is incapable of providing adequate performance.

1. Cisco

"Cisco CleanAir Technology White Paper": This document explains the core concepts of CleanAir. It defines the Severity Index (SI) as a value from 0 to 100

calculated from duty cycle and RSSI

which represents the potential impact of an interferer. A severity of 1

as shown in the exhibit

is the lowest possible non-zero value

classifying the interferers as minor or light. (See section "Interference Classification and Severity Index").

2. Cisco

"Radio Resource Management under Unified Wireless Networks

Cisco IOS XE Cupertino 17.9": This guide details how CleanAir functions within a Cisco wireless network. It states

"CleanAir is a spectrum analysis tool that can detect

classify

locate

and mitigate interference." The exhibit is a direct output of this detection and classification function

showing several light interferers have been identified. (See "CleanAir" section).

3. Cisco

"Cisco Prime Infrastructure 3.10 User Guide": The user guide for Prime Infrastructure explains how to interpret the dashboards. The "Interferers" dashboard

similar to the one in the exhibit

is used to "view a list of interferers that are active in your network." The data presented (type

severity

duty cycle) is for identifying these sources. The low values indicate the interferers are light. (See Chapter: "Monitoring Wireless Devices

" section "Monitoring Interferers").

The Cisco DNA Center AP health score for interference is calculated based on two key factors. First, the score only considers non-802.11 interference data that is specifically detected and classified by the Cisco CleanAir feature. Interference from other sources, such as co-channel Wi-Fi traffic, does not impact this particular KPI. Second, the health score is only degraded if the detected CleanAir interference exceeds a specific threshold. For the 5 GHz radio band, the health score remains at its maximum (a score of 10) as long as the interference level is 30% or less. Therefore, the score can be unaffected because the interference is not a CleanAir type or because it is below the reporting threshold.

A. The interference is less than or equal to 30% on the 2.4 GHz radio.

This is incorrect. The health score threshold for the 2.4 GHz band is 50%, not 30%.

B. The interference is less than or equal to 50% on the 2.4 GHz radio.

While this is a factually correct threshold, modern enterprise deployments prioritize the 5 GHz band, making its health parameters (Option D) a more likely and relevant answer in an unspecified scenario.

E. Cisco DNA Center does not include interference in the AP health score.

This is incorrect. Interference, as measured by Cisco CleanAir, is a fundamental Key Performance Indicator (KPI) used to calculate the overall AP health score in Cisco DNA Center.

1. Cisco DNA Center User Guide

2.3.5

"Health Dashboards" section.

In the subsection "About the Health Score

" the guide details the KPIs for Access Point health. It explicitly states for the Interference KPI: "Percentage of time the channel is occupied by non-802.11 interference

as detected by Cisco CleanAir. A score of 10 is assigned if interference is less than or equal to 30% on the 5-GHz radio

and less than or equal to 50% on the 2.4-GHz radio." This single statement directly validates that the calculation is exclusive to CleanAir (Option C) and that the 5 GHz threshold is 30% (Option D). It also confirms the thresholds for the other options.

2. Cisco DNA Center Assurance User Guide

"Monitor the Health of Your Network" chapter.

This guide reinforces the concept of health scores being composed of multiple KPIs. The section on AP health details that interference is a critical component

but its measurement is tied to specific technologies (CleanAir) and predefined thresholds

explaining why detected interference might not always impact the score.

A CPU Access Control List (ACL) on a Cisco Wireless LAN Controller (WLC) filters traffic destined for the controller's own CPU. This includes management traffic (HTTP/S, SSH) and client-related control plane traffic, such as Web Authentication redirects. The stated policy restricts access to the IT subnet only. When a guest client connects, the WLC intercepts its initial web request to redirect it to the authentication portal. This intercepted traffic originates from the guest subnet and is destined for the WLC's CPU. The overly restrictive CPU ACL, which only permits traffic from the IT subnet, will block the guest's request, causing the connection to time out.

B: Web Authentication is fully supported with CPU ACLs; the feature is designed to selectively permit such traffic while blocking other unwanted traffic.

C: An incorrect DNS server on the controller would affect its ability to resolve external hostnames, not the initial IP-based redirection to its internal web portal.

D: Web Authentication uses standard HTTP/HTTPS redirects and is browser-agnostic; it is not limited to a specific browser like Internet Explorer.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5

"Configuring CPU ACLs" section: "The controller has a CPU ACL. This ACL is configurable and is used to protect the controller CPU from DoS attacks and other malicious traffic... When you create a CPU ACL

you must permit the traffic from your wireless clients that require access to the controller CPU. For example

if you are using web authentication

you must permit HTTP and HTTPS." This confirms that a misconfigured ACL will block web authentication.

2. Cisco

"Cisco Wireless LAN Controller (WLC) CPU ACLs" White Paper: "The CPU ACLs are applied to traffic that is destined to the CPU of the WLC. This includes management traffic (Telnet

SSH

HTTP

HTTPS

and SNMP) and traffic from wireless clients that is terminated on the WLC

such as web authentication." This document explicitly states that web authentication traffic is processed by the CPU ACL.

3. Enterprise Mobility 8.5 Design Guide

"WLC Platform Features > CPU ACL" section: "The purpose of the CPU ACL is to protect the WLC CPU from being overloaded by traffic that is not essential to the operation of the WLC... If you configure a CPU ACL

you must be sure to permit all of the traffic that you want the WLC to process. For example

if you are using external web authentication

you must be sure to permit traffic from the web server to the WLC." This highlights the necessity of correctly permitting required traffic.

To prioritize specific application traffic using Cisco Application Visibility and Control (AVC) on a Wireless LAN Controller (WLC), the engineer configures a rule to 'mark' the traffic. This action assigns a Differentiated Services Code Point (DSCP) value, which maps to a pre-defined Quality of Service (QoS) profile (e.g., Platinum, Gold). Network devices use this marking to apply preferential queuing and forwarding, ensuring higher priority for the designated traffic, such as video streams from IP cameras. The other actions available are 'drop' or 'rate-limit', which are used to block or de-prioritize traffic, respectively.

A. permit-ACL: An ACL is a filter to permit or deny traffic based on network addresses and ports, not the primary mechanism for QoS prioritization within an AVC rule.

B. WMM required: Wi-Fi Multimedia (WMM) is a foundational QoS mechanism for the entire WLAN, not a specific action configured within an individual AVC rule to prioritize one application.

D. rate-limit: Rate-limiting restricts the bandwidth for an application. This is an action to de-prioritize or control traffic, which is the opposite of the required prioritization.

1. Cisco Wireless Controller Configuration Guide

Release 8.10: In the chapter "Configuring Quality of Service

" the section "Configuring AVC Profiles (GUI)" outlines the configuration steps. Step 6 explicitly lists the available rule actions: "From the Action drop-down list

choose one of the following actions to be applied to the application traffic: Drop

Mark

Rate-Limit (Ingress)

Rate-Limit (Egress)." The 'Mark' action is used for QoS prioritization.

2. Enterprise Mobility 8.5 Design Guide: In the "Wireless QoS Design" chapter

the "Application Visibility and Control" section states

"The AVC profile contains the different applications and the action to be taken on them. The action can be to drop

mark

or rate-limit the application." It clarifies that marking is the method to assign QoS levels for prioritization. (Cisco Validated Design

Document ID: CVD-1113

Page 138).

3. Application Visibility and Control Deployment Guide: The "Configuring Application Visibility" section details the three possible actions for classified traffic within an AVC profile: drop

mark

and rate-limit. The guide explains that the 'mark' action is used to apply a specific QoS policy to the application's traffic flow. (Document ID: OL-27226-01

"AVC Profile Configuration" section).