A Meraki AP automatically registers to the dashboard when it: 1) receives a DHCP-assigned IP address and 2) can initiate outbound TCP connections to the Meraki cloud (ports 80, 443, 7734, 7752). No manual serial-number entry, VPN, or static addressing is required. Therefore, simply connecting the APs to a network that provides Internet access and permits outbound traffic to the Meraki cloud allows the devices to self-discover and register, minimizing per-device configuration.

A. Cloud registration works over standard Internet; site-to-site VPN is unnecessary and unsupported for discovery.

B. Static IP can be used but still requires Internet reachability; it does not automate cloud discovery.

C. DHCP lease-table entries do not influence Meraki cloud discovery; APs register by contacting cloud servers.

1. Cisco Meraki MR Installation Guide (QS07-MR-Rev L, July 2023), p. 2 “First-Time Setup—Cloud Connectivity.”

2. Meraki Documentation “MR Firewall Rules,” §Prerequisites—APs must reach destination m.meraki.com via TCP 80/443/7734/7752.

3. Cisco Meraki Technical White Paper “Zero-Touch Provisioning,” p. 3.

DNA Center provides intent-based policy orchestration while Cisco ISE supplies identity and posture enforcement; integrating the two lets policies adapt to user and device context. Mobile-device-management (MDM) connectors in ISE supply detailed posture attributes. Cisco Spaces ingests AP telemetry from Catalyst 9800/9100 to deliver real-time and historical location analytics. Combining these three platforms gives dynamic identity/posture-aware network access plus granular visibility into device activity and location.

B. Lacks ISE and Spaces, so no identity, posture, or location visibility.

C. Static VLAN assignments ignore identity‐based policy and device posture; Spaces is absent.

D. Omits MDM and Spaces, so no posture assessment and no location analytics.

1. Cisco DNA Center 2.x Design Guide, “ISE Integration for Policy,” §5.2.

2. Cisco ISE Administrator Guide 3.x, “MDM API Integration,” ch. 45.

3. Cisco Spaces Deployment Guide, “Catalyst 9100/9800 Streaming Telemetry,” §3.

4. Cisco Validated Design CVD-SD-Access-Campus, 2023, pp. 68-74 (ISE + DNA Center + Spaces use case).

On AireOS WLCs a WPA2-Personal WLAN is enabled by configuring a PSK with the command security wpa akm psk set-key {ascii | hex}. The ascii keyword declares that the forthcoming string is an ASCII passphrase; index 0 specifies an unencrypted key entry. This single command both enables PSK authentication and stores the passphrase, satisfying the company policy that requires an ASCII key. No additional 802.1X or cipher commands are necessary for client authentication.

A. Disables 802.1X but does not define a PSK, so no client authentication key exists.

B. Merely enables DHCP proxy and is unrelated to WLAN security or authentication.

C. Selects AES cipher suites but provides no authentication method or passphrase.

1. Cisco Wireless Controller Command Reference, Release 8.10, “security wpa akm psk set-key” (WLAN Commands), pp. 1154-1155.

2. Cisco Wireless LAN Controller Configuration Guide, Release 8.10, Chap. 7 “Configuring WLAN Security (WPA2 Personal)”.

In Cisco Catalyst Center, client issue notifications are configured through the Assurance workflow. The path "Assurance > Issue Settings" is where administrators configure email destinations for issue notifications. This allows automated alerts to be sent to the NOC when client issues are detected, preventing situations where problems go unnoticed until users report them. The Issue Settings area specifically handles the configuration of notification recipients and thresholds for various types of network issues.

A. "Platforms > Notifications" is not the correct navigation path for configuring issue-based email alerts in Catalyst Center.

B. Developer Toolkit is for API integration and programmability features, not for configuring operational email alerts.

D. This navigation path does not exist in the standard Catalyst Center interface for email notification configuration.

1. Cisco Catalyst Center Assurance User Guide, Release 2.3.5, Chapter: "Managing Issues and Health Scores," Section: "Configuring Issue Notifications"

2. Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Chapter: "Integration with Cisco DNA Center"

3. Cisco Digital Network Architecture Center Platform User Guide, Release 2.3.3, Section: "Assurance Workflows"

On Catalyst 9800 controllers each WLAN is tied to a policy profile, which in turn is bound to a Layer-3 interface (SVI). Creating a dedicated guest SVI with network 10.20.30.0/24 and mapping that interface to the guest policy profile guarantees that DHCP offers originate only from that pool and keeps traffic logically separated from corporate VLANs, allowing the required 200+ clients while maintaining isolation.

A. Shared pool can still hand out corporate subnet addresses; policy tag alone does not create VLAN separation.

C. DHCP option 43 is used for AP discovery, not client address allocation; shared pool again breaks isolation.

D. Static addressing is unmanageable for 200+ guests and does not enforce VLAN separation.

1. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide, 17.3, “Creating a VLAN Interface and Mapping to Policy Profile”, steps 1–5.

2. Cisco Validated Design – Guest Access on Catalyst 9800 (CVD-9800-GUEST), pp. 14-17.

A high-gain patch antenna is planar and directional; it concentrates RF energy into a narrow, flat horizontal beam, greatly extending range in the chosen direction while reducing vertical and side radiation. It does not change the signal’s operating frequency or alternate its elevation pattern. (Cisco Aironet Antenna Reference Guide, “Directional Patch Antennas”; IEEE 802.11 Antenna Characteristics literature.)

A. High gain does not limit the antenna to a single narrow frequency; frequency range is set by antenna design, not gain.

B. Overlapping frequency bands relate to channel planning, not an antenna’s gain pattern.

D. Patch antennas radiate in one fixed direction; they do not automatically alternate direction with elevation.

1. Cisco Systems, “Aironet Antenna Reference Guide,” OL-2449-10, Section “Patch/Panel Antennas,” pp. 5-4–5-6.

2. IEEE 802.11-2020, Clause 18.3.2.2, discussion of directional antenna patterns.

3. Olexa, “Antenna Fundamentals for Wi-Fi,” IEEE Communications Magazine 54(7): 14-19, 2016, doi:10.1109/MCOM.2016.7509379.

To statically point a Catalyst 9100 AP at a specific controller, use the CAPWAP primary-base command specifying the WLC name followed by its IP address. This populates the AP’s primary controller AP Join Profile and is effective even when DHCP/DNS discovery methods are unavailable.

A. Argument order is invalid; command keyword “primary-base” is missing.

B. Places controller name after keyword but inserts extra keyword “capwap” in wrong position.

C. Omits required controller name parameter, making command incomplete.

1. Cisco Catalyst 9100 Series Access Points Deployment Guide, IOS XE 17, “Specifying a Primary Controller”, Example: capwap ap primary-base WLC1 10.10.10.5.

2. Cisco Aironet & Catalyst AP Command Reference, IOS XE 17, command “capwap ap primary-base ”.

3. Cisco WLC Best Practices White Paper, rev 3.1, p. 9.

Cisco Catalyst 9100/9170 APs use the CAPWAP-AP CLI to pre-provision up to three controllers.

Syntax: capwap ap primary-base , capwap ap secondary-base , capwap ap tertiary-base .

This writes the controller list to NVRAM, so the AP first joins the primary WLC; if that fails, it tries the secondary, then the tertiary—exactly what the WAN-outage scenario requires.

A – “set controller …-base” is not a valid command on Catalyst APs.

C – “ap join …” is a WLC debug command, not persistent CLI on an AP.

D – “capwap ap wlc …” is an invalid keyword sequence; –base is mandatory.

1. Cisco Catalyst 9100 Series Access Points Deployment Guide, “Configuring Primary, Secondary, and Tertiary Controller IP Addresses,” p. 46, Example 3 (IOS XE 17.x).

2. Cisco IOS XE Wireless Controller Discovery Guide, Sec. “Manually Configuring Controller Information on an AP,” para. 2 (17.9.1).

To change only the default gateway on a lightweight AP that already has a static IP, use the dedicated command:

capwap ap ip default-gateway

This updates the gateway without altering the configured IP address or subnet mask.

B. Command sets controller IP, not the gateway.

C. Re-enters IP/mask/gateway; unnecessary and risks typing errors.

D. Same as C and also changes mask to /24, potentially breaking reachability.

1. Cisco Aironet 2800/3800 Series Access Point Deployment Guide, “Manually Assigning a Static IP Address”, Step 5, p. 29 – command capwap ap ip default-gateway x.x.x.x.

2. Cisco Aironet 1700/2700/3700 Series AP Command Reference, “capwap ap ip default-gateway” definition, p. 148.

On Catalyst 9800 controllers, client-limit is set inside the WLAN with “client association limit ”, while client session-timeout is configured in the attached policy profile with “session-timeout ”. Thus commands (E) and (D) fulfill the 50-client cap and 2800-second timeout.

A – “max-association” is not a valid WLAN keyword on 9800; command rejected.

B – Adds redundant “client” token; correct syntax is simply session-timeout.

C – Session-timeout cannot be set in the WLAN context; must be under policy profile.

1. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide, IOS XE 17.3, “Configuring WLANs”, CLI: “client association limit ” (Chapter WLAN-6).

2. Same guide, “Configuring Policy Profile Parameters”, CLI: “session-timeout ” (Chapter Policy-5).

3. Cisco Live BRKEWN-2035 (2021) slide 44, “WLAN vs Policy-profile: where to configure client limits and session timeout”.