400-351 CCIE Wireless Written Exam

CCIEFARM.
COM 400-351 05-FEB-2017
400-351,
CCIEFARM
CCIE WIRELESS
WRITTEN EXAM (400-351)
400-351 CCIE® WIRELESS WRITTEN EXAM
Exam Number: 400-351
Associated Certifications: CCIE® Wireless Written Exam
Duration: 120 minutes (90-110 questions)
Available Languages: English
We provide CCIE Workbooks to CCIE candidates and CCIE FARM were established in May 2007. We have
offered Real Workbook to CCIE candidates from countries such as USA, UK, AUS, INDIA, CANADA, JAPAN
UAE, Saudi Arabia, Egypt and so on. All of our members succeeded in CCIE examination through our
Workbooks. We was already verified , known as famous site that supply CCIE Workbooks from great many
CCIE’s and candidates.
Disclaimer: This material is not sponsored by Cisco Systems Inc. Cisco certified Internetworking Engineer,
the Cisco systems logo and the CCIE* logo are trademarks or registered trademarks of Cisco Systems Inc. in
the United States and certain other countries. All other trademarks are trademarks of their respective
owners.
Copyright@www.cciefarm.com All Rights Reserved.
0
CCIEFARM.COM 400-351 05-FEB-2017
The Cisco CCIE Wireless certification assesses and validates wireless

expertise. Candidates who pass the CCIE Wireless certification exams must
demonstrate broad theoretical knowledge of wireless networking and a
solid understanding of wireless LAN technologies from Cisco, the market
leader in WLAN technology.
You must pass the two-hour, written qualification exam, which covers
networking concepts and some equipment commands before you are
eligible to schedule the lab exam.
The CCIE written exam is a two-hour qualification exam. The exam uses a
combination of 90-110 multiple choice questions and simulations to assess
skills.
The following topics are guidelines for the content likely to be included on the
exam. However, other related topics may also appear on any specific delivery
of the exam. In order to better reflect the contents of the exam and for clarity
purposes, the guidelines below may change at any time without notice.
1
DISCLAIMER: CCCIE Wireless Written Exam Workbook is designed to provide

extensive practical information to help candidates in the preparation for CISCO
Systems CCIE Wireless Written Exam. We do not take liability or responsibility to any
person or entity with respect to loss or damage caused by the information presented
in the workbook
Cisco, Cisco Systems, and CCIE (Cisco Certified Internetwork Expert) are registered
trademarks of Cisco Systems, Inc. and of its affiliates in the USA and other countries.
The information presented in the workbook is not necessarily related to Cisco

Systems, Inc. This workbook is not affiliated, endorsed or sponsored by Cisco Systems,
Inc. This workbook provides detailed and comprehensive practical examples for the
preparation of CCIE Wireless Written but cannot be used as a replacement of other
supplementary books or prescribed materials. Purpose of the workbook is to provide
more practical information about the CCIE Wireless Written Exam.
This workbook is prepared for the individual candidates who have purchased it with
non-disclosure agreement. Imitation, copying, editing or posting contents of the
workbook over the internet is part of copyright and non-disclosure agreement
violation.
2
1. You are in process of installing Cisco prime high availability servers and you have a firewall
between the primary and secondary server. Which two incoming and outgoing TCPIUDP ports
must be enabled on the firewall for Cisco prime servers to exchange health monitoring
heartbeat massage and to allow Oracle to synchronize data? (Choose Two)
A. 1521
B. 8080
C. 8082
D. 1522
2. Which two statements about 80211r are true? (Choose Two)
A. A PTK is generated before the client roams to the target AR

B. Non-80211r clients cannot associate to WLANs that have 802 llr enabled on WLC AireOS
code 8.0.
C. 80211r IS supported only on OPEN and WPA2 WLANs
D. This protocol uses the four-way handshake for the key management upon roaming.
3. Refer to the exhibit.

What is the best way to resolve this issue?
A. Install a publicity signed wildcard certificate by a well-known CA on the RADIUS server

B. Disable certificate checks on the client
C. Use the certificate authority on the Cisco identity services Engine
D. Install a publicly signed server certificate by a well-known CA on the RADIUS server
3
4. You need to open the appropriate firewall port for RLDR. Which port must you open?
A. UDP 6352
B. UDP 5246
C. TCP 37540
D. TCP 8443
E. TCP 16113
F. UDP 16666
5. You want to set up Prime infrastructure to be notified when a device configuration has
changed. Which option is available in prime infrastructure 2.2?
A. Set up prime infrastructure to send an email containing the device configuration

change(s} on regularly scheduled
B. Set up prime Infrastructure to send an email containing the change audit report
immediately after the configuration change is detected
C. Set up prime infrastructure to send an email containing the change audit report on a
regular scheduled basis
D. Set up prime infrastructure to send an email containing the configuration change(s)
immediately after the configuration change is detected.
6. Which two statement are true about adding identity services engines 1.3 to prime
infrastructure 2.2? (Choose Two)
A. You need to use super user credential on ISE for Pl integration to work.
B. A maximum of three ISEs can be added to Pi
C. If you add two SEs one should be primary and the other should be standby.
D. Configuration templates within Plcan be used to set up ISE
7. Which two statement about local profiling on a Cisco WLC running AireOS are true? (Choose
Two)
A. Profiling is performed on IPV4 and IPV6 client.

B. When local profiling is enabled. RADIUS profiling is allowed.
C. Wired clients behind the Workgroup Bridge are profiled and a policy action is taken.
D. Profiling is performed only on IPV4 clients.
E. Wired clients behind the Workgroup Bridge are not profiled and no policy action is taken.
4
8. Which key is derived on the client supplicant and the authentication server as a result of the
8O2ixIEAP authentication phase?
A. Group Temporal Key

B. Pairwise Transient Key
C. Master Session Key
D. Pairwise Master Key
9. You are a network administrator at ACME Corporation where you have a pair of Cisco 5760
Wireless LAN Controllers deployed for HA AP SSO mode a failover event occurs and the
secondary Cisco 5760 controller moves into the active role. Which three statements about the
failover event are true? (Choose Three)
A. Rogue APs and clients are not synced to the standby and are releamed upon switchover.
B. With SSO, wIPS information is already synced with the standby unit and this information
need not be releamed upon switchover.
C. Upon guest anchor controller switchover, mobility tunnels stay active, APs remain
connected, clients re-join at MA or MC, and clients are anchored on the new active
controller.
D. Switchover during AP preimage download causes the APs to start image download all over
again from the new active controller.
E. The new active controller does not need to releam the shun list from IPS and other MCs,
which eliminates the need to redistribute it to the Mas.
F. Netflow records are already exported upon switchover and collection starts resuming in
the new active controller.
10. In Cisco Wireless LAN Controller the transmit power level of an AP radio is assigned an integer
value inserted of a value in mW or dBm. Which two statements about the power level are
true? (Choose Two)
A. The integer corresponds to a power level that vanes depending on the regulatory domain
in which the access points are deployed
B. Each successive lower power level always represents 50% of the previous power level
C. Power Level 1 is always the minimum power level allowed per country code setting
D. There are always eight power levels for configuration
5
11. Refer the exhibit.

Wireless voice users on VLAN 2150 report poor voice quality during heavy network usage The
WLC is configured correctly given the configuration in the exhibit, which possible cause of the
problem is true?
A. MLSQoS is not enabled on the switch

B. VLAN 2150 is not allowed on the trunkport of the switch
C. The WLC switch port dose not trust CoS values for Voice traffic that traverses the WLC.
D. The wireless voice VLAN does not have the proper QoS settings
12. Which statement about Wired Guest Access is true?
A. The wired guest traffic terminates only on the anchor Cisco WLC
B. Wired Guest Access is not supported in the Cisco 5760 WLC.
C. The Cisco 5760 WLC supports Wired Guest Access only in conjunction with the converged
access switches.
D. The guest traffic can terminate on the foreigh WLC, but egress interface must be defined
on the guest SSID
6
13. Which two statement describe characteristics of high availability cisco 576Owireless LAN
controller that uses the stackwise-480 technology? (Choose Two)
A. A switch stack has only three WLCs one active WLC and two standby WLCs
B. If the WLC become unavailable the standby assumes the role of the active and continue to
the keep the stack operational
C. A switch stack has only Two WICs both WLCs are in active/active mode
D. A switch stack has only two WLCs one active and one standby WLC
14. Your customer has a Cisco unified Wireless Network running AireOS 8.0 and wants to learn
about the Flex Connect mode that is available on his APs which two statements are true?
(Choose Two)
A. When an AP is changed from local mode to Flex Connect mode a reboot is required.
B. A newly connected AP can be booted in Flex Connect mode
C. When an AP IS changed from local mode to Flex Connect mode a reboot IS not required
D. Cisco Centralized Key Management require the use of Flex Connect group

Based upon the given configuration which two statement are true? (Choose Two)
A. Local RADIUS server is used

B. No password is required everyone can join wireless network
C. Users will be required to provide a username and password for authentication
D. User will be required to provide a password only order to get access
E. Remote RADIUS servers is used
7
16. Given the IPV6 address and subnet 2001:adcb:3257:9048::/64. which option list the start and
ending IP address of this subnet?
A. 2001:adcb:3257:9048:, 2001:adcb:3257:9048:0000:0000:0000:ffff
B. 2001:adcb:3257:9048:0:0:0:0. 2001:adcb:3257:9048:0000:ffff:ffff:ffff
C. 2001:adcb:3257:9048:0:0:0:0, 2001:adcb:3257:9048:ffff:ffff:ffff
D. 2001:adcb:3257:9048 0 0 0 0. 2001adbc: 3257 9048 0000:0000:0000:ffff
E. 2001:adcb:3257:9048 :0:0:0:0, 2001:adcb:3257: 9048: 0000:0000:ffff: ffff
F. 2001:adcb:3257:9048:0::, 2001:adcb:3257:9048:0000:0000:0000:ffff
17. Which two features require Network Time Protocol synchronization on the Cisco 5760 WLC?
(Choose Two)
A. AP CAPWAP multicast
B. SNMPv3
C. AP authentication
D. Band Select
8

Your customer is testing native supplicant provisioning using the ISE (at 192.168.t2) and a
Cisco WLC. The Cisco WLC has an ACC Configured on it called on boarding during the testing of
many different client devices (android apple windows) it appears that these devices are never
redirected to the on boarding portal through they a access the internet which statement
explain this behaviour
A. The ACL has a permit any at the end of the list redirection does not take place unless the
client hits a website that gets denied
B. The source and destination port in the ACL are not set up correctly
C. The ACL has a permit any at the end of the list redirection does not take place unless the
client hits a websites that guest permitted
D. There is nothing wrong the ad the problem must exist either on the client side or on the
configured ISE authorization profile
9

Which two statements are true based upon the output in the exhibit? (Choose Two)
A. Operation will be effective only if the video profile on the WLC is mapped to the 8O2ip
protocol with a tagged value of &
B. It is recommended to configure IP multicast on the WLC in multicast-multicast mode
C. CAC must be enabled to avoid channel oversubscription and guarantee the configured
media bandwidth
D. In case of a violation after an RRC re-evaluation, the stream is demoted to the best- effort
class.
20. Which statement about wireless LAN security in a Cisco Unified Wireless Network VoWLAN
deployment is false?
A. EAP-FAST. if available, is the recommended EAP type for use in VoWLAN deployments.
B. Although LEAP is considered secure for VoWLAN handsets when correctly deployed, it is
recommended that a different EAP method (FAST. PEAP. TLS) is used, if available.
C. Dynamic WEP mitigates the security weaknesses in static WEP, making it a viable option
that can be relied upon to secure a VoWLAN deployment
D. When using EAP authentication, the EAP-Request timeout value should be adjusted based
only on the advice of the VoWLAN handset vendor
E. When using WPA Personal, strong keys should be used to avoid a dictionary attack.
10
21. Your customer is thinking of migrating the exiting IEEE 80211b/g network to an IEEE 80211ac
network which two statement are true? (Choose Two)
A. Backward compatibility need to be considered for the existing legacy IEEE 80211b/g
mobile devices
B. Channel option are limited on the radio band UNII 3 due to DFS.
C. Ensure that the WLANs have WMM enabled and support open orWPA2JAES encryption in
order to reach IEEE 80211ac speeds even on IEEE. 802iiac clients
D. Fewer APs have to be proposed because the IEEE 802llac network provides a faster speed
and larger converge area compared with the IEEE 80211b/g network
22. Which three options are valid AP modes for lightweight APS in the WLC 7.0.116 release?
(Choose three)
A. SE-Connect
B. WPS
C. RAM
D. DEAP
E. Rogue Detector
F. Sniffer
23. Which mechanism incorporates the channel capacity into the CAC determination and gives a
much more accurate assessment of the current call-carrying capacity of the AP?
A. reserved roaming bandwidth (%)

B. expedited bandwidth
C. metrics collection
D. admission control
E. load-based AC
F. max RF bandwidth(%)
24. Your customer has high availability Client SSO configure using a pair of Cisco 5508 WICs
running 80 code The primary unit failed over and the secondary unit is now active Which two
statement are true? (Choose Two)
A. Both controller RMlcan be in different subnets.

B. Only the clients that are in the run state are maintained during failover
C. Clients that are in transition such as roaming are dissociated
D. New mobility is supported.
11
25. Your customer wants to configure LSCs and asks for specific information about which number
to configure in the text box right next to the “Number of Attempts”. Which statement is true?
A. The default number of attempts is 100.

B. A value of 2 means that if an AP fails to join the Cisco WLC using an LSC, the AP attempts
to join the Cisco WLC using the default certificate
C. A value of 255 means that if an AP fails to join the Cisco WLC using an LSC, the AP does
not attempt to join the Cisco WLC using the default
D. A value of 3 means that if a user fails to authenticate, the user is disconnected after three
retries

An apple TV is associated to the wireless network wireless attempt to connect to it but they
report that cannot discover the apple TV on their devices what is most likely the root cause?
A. The mDNS origin is not set to wireless

B. The mDNS globalsnooping is disabled
C. The mDNS service provider is not associated to a profile
D. The mDNS profile is not associated to the wlan
12
27. Which feature insersection of a Cisco 5760 Wireless LAN Controller with HA AP SSO is not
true?
A. Upon guest anchor controller switchover, mobility tunnels stay active. APs remain
connected, clients rejoin at MA or MC. and clients are anchored on the new active
controller
B. Roamed clients that have their data path going through the mobility tunnel endpoint
“become Local” in case of Layer 2 with sticky anchoring an Layer3 roam Layer 2 roamed
clients are not affected except when roaming occurs between Cisco Unified Wireless
Network and CA controllers
C. wIPS information is synced to the standby unit. The standby unit does not have to relarn
wIPS information upon switchover
D. Switchover during AP preimage download caused the APs to start image download all
over again from the new active controller
28. Refer the exhibit.

The created dynamic interfaces are bound to an interface group for a specific WLAN profile in
a Cisco Wireless LAN Controller You have noticed duplicated multicast streams on the wireless
medium for the given WLAN profile Which statement is correct?
A. Global multicast mode, global lPv6 config, and multicast listener discovery snooping have
not been enabled. Enable this to avoid duplicate streams
B. Global multicast mode and internet group management protocol snooping have not been
enabled. To avoid stream enable both
C. The controller creates different multicast groups IDs for each multicast address and VLAN
and a result the upstream router sends one copy for each VLAN Enable Multicast VLAN to
avoid duplicate streams.
D. The controller always uses layer 3 multicast group 10 for all layer 3 multicast traffic sent to
the access point internet group management protocol snooping should be disabled to
avoid duplicate streams.
13
29. Which two statement about a Cisco WLC (5500/7500/8500 Series/WiSM-2) High Availability
setup running code 8.0 are true? (Choose Two)
A. Certificates are downloaded only to the primary WLC. Which then pushes them to the
secondary instance
B. You can have one active WLC and multiple standby-hot
C. It is possible to achieve HA between two Cisco Wireless Services Module 2 (WiSM2)
platforms only if the controllers have been deployed on a single chassis
D. Enabling HA requires only a reboot of the primary controller
E. Before you enable HA, ensure that both controllers are physically connected through the
redundant port using an Ethernet cable
F. The IP addresses of the redundancy management interface and the management
interface must be in the same subnet for the primary and secondary Cisco WLCs
30. Which option in the cisco identity service engine allows for authorization based on Active
Directory user and domain computer login?
A. Machine access restriction

B. Active directory group
C. Active directory attributes
D. Identity source sequences
31. You are implementing a WLC at a remote site and want to make sure that you are able to sync
up with the Cisco WCS at the central site. Which two statements about this process are true?
(Choose Two)
A. If the WLC is behind a firewall, you must make sure that UDP ports 161 and 162 are open
B. The Cisco WCS server does not need direct IP connectivity to the WLC
C. Cisco WCS will not be able to communicate with the WLC if the WLC is behind a NAT
device
D. If the WLC is behind a NAT device, the WLCs dynamic AP-manager interface must be
configured with the external NAT IP address.
14

The network operations center is using PI to collect and monitor the AVC data from a cisco
WLC however no AVC information is showing up in cisco Pi based on this information from the
Cisco WLC reason that Cisco Pl is not showing the information is true?
A. Cisco prime does not have the correct licensing installed

B. The monitor Name and exporter-name do note match
C. The Exporter-IP should be the IP address of the cisco WLC
D. The port number should be 9991
33. Which two sets of ports are used to configure high availability database connection between
the primary and secondary Prime infrastructure 2.2? (Choose two)
A. TCP 1522/UDP 1522

B. TCP 27051UDP2705
C. TCP 162 I UDP 162
D. TCP 1099/UDP 1099
E. TCP 8082/UDP 8082
34. Which two statements about accessing the GUl and CLI of Cisco WLC are true? (Choose Two)
A. The feature “Management using dynamic interface” can be configures in CLI only.
B. The wireless client can access the Cisco WLC only when the option “Enable controller
wireless Management to be accessible from Wireless clients is checked”.
C. Wired clients can have only eli access with the dynamic interface of the Cisco WLC while
wireless clients have both CLI and GUI access with the dynamic interface when the feature
management using dynamic interface is enabled
D. The feature management using dynamic interface can be applied to one of the dynamic
interface only.
15
35. If a guest anchor controller is used outside the firewall which firewall ports must you open for
guest access including SNMP and mobility features to work in a Cisco unified wireless
network?
A. UDP 16667. IP Protocol 97. UDP 500 501

B. UDP 16666. IP Protocol 97. UDP 162 163
C. UDP 12222. IP Protocol 97. UDP 161 162
D. UDP 16666. IP Protocol 97. UDP 161 162
E. UDP 12223. IP Protocol 97. UDP 161 162
36. During the startup Wizard process on the Cisco 57760 WLC which two configuration are
required within the configuration dialogue to ensure basic network connectivity of the
controller to the management network? (Choose Two)
A. configuration of the controller Hostname

B. configuration of the enable secret password
C. configuration of the network time protocol server
D. configuration of the GigabitEthernet 0/0 interface
E. configuration of the wireless management interface
37. Flexconnect APs have already deployed in a branch office for local switching Currently the
WLAN in the large auditorium is proposed to change to high-density design and thus some
low data rates are proposed to be disabled while keeping the data rates in other areas under
the same Cisco WLC Which configuration settings must be modified in the Cisco WLC to
achieve this configuration? (Choose Two)
A. Flexconnect groups
B. Mobility groups
C. AP Groups
D. RF profiles
38. You are deploying a high-density wireless setup in a conference center using Cisco Aironet
3700i APs as you have no Cisco air not 3700e APs available.
The power levels for all the APs should be set between 4 and 5 which configuration option is
needed to achieve this goal?
A. Select the WC values between 4 dBm and q dBm

B. Manually configure the power levels of the 80211b and 802i1a radios of all APs either 4 or
5
C. Select the tcp values between 4 dBm and dBm
D. Select the TPC values between 11 dNm and 8 dBm
16
39. Which two statement are true about the client report functionality in prime infrastructure 22?
(Choose Two)
A. The “Client Session” report 8O2iland security statics

B. The “Client Count” report display the total number of active clients on the network
C. The “Busiest Clients” report dose include autonomous clients
D. The “Client Count” report include clients to autonomous cisco ISO APs.

The autonomous AP has a corporate and guest SSID configured The security team requested
that you limit guest user traffic to DHCP DNS, and web browsing on the AR Which
configuration best satisfies the request?
A. access-list 101
permit udp any any eq 67
access-list 101 permit udp 10.28.128.0 0.0.0.255 host 10.128.10.15 eq 53
access-list 101 permit tcp 10.28.128.0.0.0.0.255 any eq 80
access-list 101 deny ip any any interface dot11radio 0
ip access-group 101 in
B. access-list 101
access-list 101 permit udp 10.28.128 0.255.255.255 host 10.128.10.15 eq 53
access-list 101 permit tcp 10.28.128 0.255.255.255 any eq 80
access-list 101 deny ip any any interface dot11 radio 0
C. access-list 101
access-list 101 per mit udp 10.28.128.0 0.0.0.255 host 10.128.10.15 eq 53
access-list 101 permit tcp 10.28.128.0 0.0.0.255 any eq 80
access-list 101 deny ip any any interface fast Ethernet 0
17
D. access-list 101
access-list 101 permit udp 10.28.128 0.255.255.255 host 10.128.10.15 eq 53
access-list 101 permit tcp 10.28.128.0 0.255.255.255 any eq 80
access-list 101 deny ip any any interface fast Ethernet 0
41. Which two configuration are required on the Cisco 5760 WLC to ensure that APs will
successfully join the Cisco WLC? (Choose two)
A. Enable IP DHCP SNOOPING TRUST on the wireless controller port-channel interface

B. Activate the apocopate Right-to-use AP license on the wireless LAN controller
C. Ensure that port-fast is enabled on each access point switch port
D. Ensure accurate configuration of the correct time and date on the wireless LAN controller
42. What are the three fundamental properties that are provided by the antenna of an AP?
(Choose three)
A. Frequency
B. Gain
C. dB loss
D. polarization
E. direction
F. modulation
18

Which is a configure snippet of a cisco 5760 controller running code lOS XE 363 which
statement about wlan 11 is true?
19
A. This configuration is for custom WebAuth with an external RADIUS server

B. This configuration is for custom WebAuth with local authentication
C. This configuration is for WebAuth with an external RADIUS server
D. This configuration is for WebAuth with local authentication
E. This configuration is for external WebAuth with an external RADIUS server
44. Your customer needs the list of all the guest client that connected to Wi-Fl successfully but
have not yet authenticated. The customer decides to create an advanced filter in Cisco
Pounder monitor >client and user which two conditions should be included in the filter?
(Choose Two)
A. PEM state =WebauthReqD

B. On Network= Yes
C. Status= Associated
D. Type= Lightweight client
45. What is the minimum VMware ESXi version you need to install Cisco prime infrastructure 21
virtual appliance?
A. ESxi 4.1
B. ESxi 5.0
C. ESxi 4.0
D. ESxi 5.5
E. ESxi 5.1
20

Which WLAN IDs will be advertised by an out-of-the-box AP that joins the WLC for the first
time?
A. 5,8,12.15
B. 5,8,15
C. 8,15
D. 17,512
E. 8,15,17,512
F. 5,8,15,17,512
47. Which three steps are required during the initial configuration of a Cisco Converged Access
controller so that the access points can join? (Choose Three)
A. The Cisco 5760 controller that acts as a mobility controller can support up to 10000Aps
B. Ensure that an active license is enabled with the proper AP count.
C. Ensure that the wireless management interface is correctly configured
D. In a Converged Access deployment, the APs must be on the same VLAN as the wireless
management interface.
E. To enable wireless services, the Cisco 3850 switch must run an ipservices or ipbase license
F. Network connectivity is not necessary because all the APs connect directly to the
Converged Access controller.
48. Which MSS value is appropriate on a Cisco 5508 WLC in an IPV6-only environment?
A. 1236
B. 2131
C. 1285
D. 1331
21
49. Which two impact dose TSPEC admission control have as it relates to 80211e clients? (Choose
Two)
A. Enforce airtime entitlement for wireless voice applications

B. Ensure that call quality dose not degrade for existing VoWLAN calls
C. Deny client access to the WLAN that do not meet the standard
D. Allow access only for VoWLAN traffic when interference is detected
50. Which two statements about accessing the GUI and CLI of Cisco WLC are true?
A. Use the config domain add -N command on the Cisco WLC.

B. The wireless client can access the Cisco WLC only when the option “Enable controller
wireless Management to be accessible from wireless client is checked’.
C. The feature management using dynamic interface can be applied to one of the dynamic
interfaces only
D. Add the country code for Panama (PA) through the Cisco WLC web GUI.
51. Which statement about wireless LAN security in a Cisco Unified Wireless Network VoWLAN
deployment is false?
A. EAP-FAST, if available, is the recommended EAP type for use in VoWLAN deployments
B. Although LEAP is considered secure for VoWLAN handsets when correctly deployed, it is
recommended that a different EAP method (FAST. PEAP. TLS) is used, if available.
C. Dynamic WEP mitigates the security weaknesses in static WEP, making it a viable option
that can be relied upon to secure a VoWLAN deployment.
D. When using EAP authentication, the EAP-Request timeout value should be adjusted based
only on the advice of the VoWLAN handset vendor.
E. When using WPA Personal, strong keys should be used to avoid a dictionary attack
52. You are installing CA controllers that run Cisco ISO-XE and you are ready to implement QoS.
Which QoS target level apply to downstream traffic (toward the client)?
A. Client SSID
B. Client SSID radio
C. Client SSID Radio port
D. Client radio

Your colleague a junior network engineer is struggling to enable DHCP option 82 in the layer 3
switch which is in the DMZ for a mobile client under a guest anchor Cisco wireless LAN
controller deployment. What is your answer?
22
23
A. DHCP proxy must be enabled for DHCP option 82 to operate correctly. All Cisco WLCs that
will be in the setup must have the same DHCP proxy setting
B. DHCP option 82 must be enabled on the dynamic interface with which the WLAN is
associated
C. DHCP option 82 is not supported when it is used with auto anchor mobility
D. The mobility tunnel data path control path or both between the anchor cisco WLC and
foreign WLC are down
54. Which three AP modes are supported by Converged Access WLC (3650/3850/5760) in cisco
ISO-XE software 36E? (Choose Three)
A. Sniffer
B. Local
C. Fiexconnect
D. Monitor
E. office extend
F. Mesh
55. Two autonomous APs are connected to a switch on the same VLAN both APS are configured
with the same SSID and WPA2-PSK. After making configuration changes to one of the APs
spanning tree disabled one of the switch ports into which AP was plugged Which two options
describe possible reasons that spanning tree disabled a port? (Choose Two)
A. One of the APs was configured as a universal workgroup bridge

B. It is not possible for spanning tree to disable a port The bridging loop must have been
coincidental
C. Spanning tree was disabled on both Aps.
D. PortFast was enabled on all ports.
E. One of the APs was configured as a standard workgroup bridge.
56. You have configured video stream on a Cisco WLC and users are now viewing the company
video broadcast over the wireless network how can you verify you have video stream
configures and working in the cisco WLC GUI?
A. The multicast status shows “normalmulticast” in the multicast group detail

B. The multicast status shows “MediaStream allowed” in the multicast group detail
C. The WMM state shows “Enabled” into the client’s detail
D. The multicast status shows “multicast—direct allowed” in the multicast group detail
24

A wireless engineer at ACME Company is troubleshooting a wireless client that is unable to
associate to a WLAN. What is likely the cause of the problem?
A. The AP CAPWAP tunnel is down, and is unable to handle any new connections
B. The client is providing a wrong credential for dot lx authentication
C. The WPA PSKs do not match
D. The client uses WPA, but the AP is advertising only WPA2 support
E. A firewall is blocking the ports that are necessary for the AP to join the WLC.
58. Which option is a feature of a Cisco Autonomous AP that prevents over-the-air direct P2P
communication, which forces all traffic to hit the first-hop router where security policy is
enforced?
A. Public Secure Packet Forwarding

B. Cisco Wireless LAN Controller and Access Point Platforms
C. FlexConnect AP upgrade feature
D. Access Point Radios
25
59. Which two Characteristic of U-APSD are true? (Choose Two)
A. U-APSD is enabled automatically when WMM is enabled

B. In addition to extending battery life. U-APSD increases the latency of the traffic flow
delivered over the wireless media
C. U-APSD is configured on the access point switch port and supports the Power over
Ethernet feature
D. (Unscheduled automatic power save delivery) U-APSD is a QoS facility defined in IEEE
80211e that extends the battery life of mobile clients
60. Prime infrastructure will trigger alarms indicating that the prime infrastructure physicalor
virtual server is low on disk space as the administrator which three actions can you take to
increase disk space immediately upon receiving a major alert (60 percent disk usage)?
(Choose Three)
A. Change the disk controller RAID

B. Enable corn job on ade for disk clean up using $ du-sh
C. Compacting the Pl database using the NCS CLEANUP command
D. Reduce the storage load on the local disk by setting up and using remote
buckupreposttories
E. Reduce the length of time you store client association data and related events
F. Compacting the Pl database using the NCS DATABASE PURGE command
61. Which of the following organizations certifies WLAN product compatibility and
interoperability between vendors by providing certification testing?
A. CCX
B. ETSI
C. FCC
D. IEEE
E. Wi-Fi Alliance
62. There are 5 switches in the network use VTPv3. SW1 and SW2 configured as Server mode SW1
is the primary server with revision 5OE When add a new SW6 with Revision 200. What will
happen?
A. Switch3 updates its own database with the VLAN information received from SW2
B. VTPv3 configure own database with the VLAN information received from SW1
C. Switch6 updates its own database with the VLAN information received from SW1
D. No switch will work
26
63. An autonomous AP is configured with the infrastructure -client command. What is this
command used for?
A. to allow more than 20 client associations

B. to send reliable multicast traffic
C. to enable multiple VLANs to cross the bridge link
D. to allow only infrastructure device associations

A wireless user has roamed from an AP connected to MA-1 to AP connected to MA-3 the
traffic flow for the user between roam is shown. Which option shows the traffic flow for the
user after roam, considering default sticky anchoring is enabled on the WLAN?
A. MA-3>Distribution switch>core>mc>Distribution switch>MA-1

B. MA-3>Distribution switch>MA-1 >Distribution switch>core
C. MA-3>Distribution switch>MA-2>Distribution switch>core
27
D. MA-3 Distribution switch>MA-2>MA-1 >Distribution switch>core
65. Which two option describe implication of deploying autonomous APs in repeater mode?
(Choose Two)
A. The Ethernet port is disabled in repeater mode

B. You can configure multiple VLANs on repeater access point
C. You should disable Cisco Aironet extensions on the parent(root) AP and on the repeater
Aps
D. The infrastructure SSID should be assigned to the native VLAN
66. Which technology is used by AVC on a Cisco WLC for identification and classification of
applications?
A. modular QoS CLI

B. NBAR
C. ACL
D. IP precedence
67. You are deploying cisco 792x wireless phones on your on your Cisco unified wireless network,
which two configuration setting are recommended?
A. Enable PSPF
B. Enable DTPC
C. Enable WMM
D. Enable PMF
68. Which Cisco WLC configuration option should be used if you do not want to require guest user
to re authenticate via local web authentication when their device has not been associated to
the cisco WLC for a longer period?
A. Condition Web Redirect

B. Client user idle timeout
C. Session Timeout
D. Sleeping Client
28
69. Why would you enable the RFC 3578 option when adding a new RADIUS authentication server
to a WLC?
A. you want to run both RADIUS and TACACS

B. to support Disconnect and Change of Authorization
C. to encrypt communications between the WLC and the RADIUS server
D. to support RADIUS key wrapping
70. Which port does cisco JSE use by default to send RADIUS CoA messages to the Cisco WLC?
A. UDP 3799
B. UDP 1813
C. UDP 1700
D. TCP 1812
71. In which direction does application visibility and controller mark the DSCP value of the original
Packet in the wireless LAN controller?
A. in one direction, either upstream or downstream

B. in one direction, downstream only
C. in both direction upstream and down stream
D. in one direction upstream only
72. Your customer is having wireless VoIP probIems When the Cisco 7925 phones roam from APi
to AP2, the voice drops out and comes back The phones are set up for PEAP/WPA2-AES with
CCKM to an external RADIUS server The APs and WLAN are setup in FlexConnect mode Which
statement explains the issue?
A. PEAP with WPA2-AES is not supported with Cisco Centralized Key Management. use EAP-
FAST.
B. The APs have not been added to the FlexConnectgroup.
C. PEAP with WPA2-AES is not supported with Cisco Centralized Key Management. Use LEAP.
D. The APs have been added to the FlexConnect group.
73. Which two statements are true with regards to RRM? (Choose Two)
A. RRM neighbor messages are sent at the lowest mandatory speed

B. RRM neighbor messages are sent on channel 1
C. RRM neighbor messages are sent at minimum power
D. RRM neighbor messages are sent over the air
E. RRM neighbor messages are sent every 120 sec by default
29
74. AireOS which version support a feature?
A. AireOS 7.0
B. AireOS 7.4
C. AireOS 8.0
D. AireOS 8.1
75. Which two statement about AP local authentication by FlexConnect AP in standalone mode
are true? (Choose Two)
A. Only LEAP, EAP F AST, PEAP and EAP-TLS authentication are supported.
B. Only the vendor certificate authority (CA) certificate has to be downloaded to the Cisco
wireless LAN controller for EAP-TLS authentication
C. Cisco wireless LAN controller must generate a certificate signing request by itself for
submitting to a certificate authority for signing
D. A flexconnect group must be created so that the cisco wireless LAN Controller can push
the certificate to the flexconnect AP in the Flexconnect group.
30

Which statements about this CPU ACL is true?
A. A user on the 10.64.0.0/24 network can use SSH to access the WLC.
B. A User on the 10.64.0.0/24 network cannot use HTTPS to access the WLC GUI
C. A user on the 10.64.0.0/24 network cannot use telnet to access the WLC 172.21.159.37
D. Any user on any other subnet can access the WLC
77. While troubleshooting a failed central web authentication configuration on cisco WLC you
discover that the Cisco WLC policy manager state is showing RUN For new client and not
CENTRAL_WEB_AUTH what is most likely the issue?
A. The WLAN Layer 2 security should be sent to WPA+WPA2

B. The WLAN NAC state should be set to RADIUS NAC
C. The web login page under the cisco WLC security should be set to external (redirect to
external server).
D. The WLAN layer 3 security should be set to web page policy with condition web redirect
31
78. Which three statements about 80211ac are true? (Choose Three)
A. MU-MIMO is supported in wave 1

B. MU-MIMO allows one AP to transmit unique data to multiple stations simultaneously
C. when using MU-MIMI up to 8 devices can transmit data at the same time
D. 802.11 a/big/n device are able to connect to 802.11ac radios
E. it is possible to reach 160 MHz by combining two discontinuous 80 MHz channel block
F. 802.11 ac is supported in the 14- and 5-Ghz radio band
79. In a VWLAN deployment, what autonomous ISO command should be used to ensure that
VWLAN performance is not adversely impacted by an unexpected channel change resulting
from a DFS event triggered by a nearby airport radar system?
A. ap(contig-if)#DFs band 1 block

B. ap(config-if)#DFs band 23 block
C. ap(config-if)#DFs band 123 block
D. ap(config-if)#DFs band 13 block
E. ap(config-if)#DFs band 2 block
80. Which ArieOS release is the first to support New Mobility on the 2504 WLC ?
A. 7.4.X
B. 7.6.X
C. 8.0.X
D. 8.1.X
81. What two statements are true with regards to the UNII brands? (Choose Two)
A. All channels in the UNII-2 band require DFS and TPC

B. The UN II-3 band provides channel that ate spaced 20 MHz apart
C. The channels in UNII-3 band require DFS and WC
D. The UNII-1 band provides 4 non-overlapping channels
E. Different channels within the UNII-1 band have different restrictions including transmit
power antenna gain antenna style usage
32

The wireless clients use VLAN 2150 The WLC Management is on VLAN 2149 and the lAPs use
VLAN 2100 wireless clients report that they cannot access multicast routing enabled which
two options must be enabled for the clients to receive multicast video? (Choose Two)
A. MSDP
B. ¡p pirn-sparse mode on VLAN 2149
C. ¡p igmp snooping
D. ¡p pim-sparse mode on VLAN 2150
83. You are conducting a site survey for a customer that is about to deploy Cisco wireless phones.
Which three recommendations apply? (Choose Three)
A. Minimum SNR should be 15 Db

B. The minimum recommended wireless signal strength for voice applications is -71 dBm
C. Minimum SNR should be 25 dB.
D. Wireless cell overlap should be 20 percent
E. Minimum SNR should be 35 dB
F. The minimum recommended wireless signal strength for voice applications is -57 dBm
G. Wireless cell overlap should be 10 percent
H. The minimum recommended wireless signal strength for voice applications is -67 dBm
33
84. You have added your active directory server to the cisco ISE and see the status as operational
However when you try to add active directory groups to your authorization policy conditions
in the Cisco ISE, no active Directory groups appear. What is the most likely reason?
A. The credentials used to join the Cisco ISE to active directory do not have succulent
privtleges to query active directory.
B. You did not add any attribute in the Active Directory join point under the External identify
source
C. You did not add any groups in the Active Directory jom potnt under the External identity
source
D. A firewall is blocking tcp port 389 between the cisco ISE and active directory

Which two statements about this output are true? (Choose Two.)
A. Unclassified traffic belongs to the traffic class default, and packets in this class are treated
as FIFO
B. For traffic to match class1, the traffic that is being evaluated must match one of the
specified criteria
C. For traffic to match class 1, the traffic that is being evaluated must match both of the
specified criteria
D. Unclassified traffic will be dropped because no default class is created
34

Which syslog logging facility and severity level is enabled on this AP?
A. logging trap severity 6, logging syslog facility local 7

B. logging trap severity 3, logging syslog facility sys 10
C. logging trap severity 5, logging syslog facility local 14
D. logging trap severity 7, logging syslog facility local 7
E. logging trap severity 9, logging syslog facility kernel
87. RX-SOP is configured for SGHz radio with value set as “High Threshold”. Which two clients will
associate to the AP? (Choose Two)
A. client with RSSI-75 dBm

B. client with RSSI-79d8m
C. client with RSSI-77dBm
D. client with RSSI-73d5m
88. Which multicast mode is recommended when configuring Media Stream on a Cisco WLC?
A. multicast-uncast
B. multicast-routing
C. multicast-multicast
D. multicast-direct
35
89. Which two options are valid mobility roles in which a controller can operate in during a client
mobility session? (Choose Two)
A. Local
B. auto anchor
C. export anchor
D. mobility announcer

What happen if a new MAC address is learned on fast Ethernet 5/1?
A. The port goes into error—disabled state

B. The port switch state to administratively down
C. The port forward traffic from the newly learned MAC
D. The port remain up only traffic from the newly learned MAC is blocked
91. You are working on a deployment that uses two Cisco APs as wireless bridges One of the
bridges is configured as a root bridge and the second bridge is configured as a nonroot bridge
Client A associates to the root bridge and client B associates to the nonroot bridge Which two
statements about this scenario are true? (Choose Two)
A. The default setting of a bridge is nonroot bridge

B. For two bridges to communicate with each other, one of the bridges must be in root
mode and the other bridge must be in nonroot mode
C. Only one device can connect to the Ethernet port of a nonroot bridge
D. Two bridges that are in root mode can talk to each other
E. In point-to-multipoint bridging. WGB is not recommended with the root bridge. WGB
must be associated to the root AP in point-to-multipoint bridging setup.
36
92. During the Cisco 5760 WLC high availability active and standby process (elected or re-elected)
which factor can determine which Cisco 5760 WLC become active?
A. The cisco 5760 WLC the highest stack member priority value
B. the cisco 5760 WLC the highest IP address
C. the cisco 5760 WLC the lowest stack member priority value
D. the cisco 5760 WLC the highest Mac address
93. Which option is a layer 1 client exclusion policy solution?
A. Excessive 802.1x authentication failures

B. VPN passthrough
C. Web policy (web passthrough)
D. Static WEP
E. 802.1X
F. WPA2 (AES-CCMP)
94. 802.11k and 802.11k-enabled client devices send a request for a list of neighbor APs (a
neighbor list) from the APs they are currently associated with. What is this 802.11
management frame also known as?
A. association response
B. association packet
C. beacon frame
D. action packet
95. Which two option are new feature that are supported by IGMPv3 Compared to IGMPv2?
(Choose two)
A. It adds support for IGMP Leave Message

B. Routers can now send a group-specific query
C. It extends IGMP, which allows for an explicit maximum response time field
D. It supports the link local address 224.0.0.22, which is the destination IP address for
membership reports
E. It adds support for source filtering
37
96. which two types of interface events are common for cleanAir?(choose two)
A. Microwave interference
B. Co-channel interference
C. Spontaneous interference
D. Persistent mterference

APs on VLAN 2100 can get IP address but cannot register to the WLC The IP address of the
WLC management interface is 24244.4.227, which option is the correct DHCP option 43
configuration?
A. f10412f41cd9
B. f10418f404227
C. f10818f41cd0a181cf4a01c
D. f10418f404e3E. f1040a3f0701
98. Which statement about ACLs used on a Cisco WLC is true?
A. A WLAN ACL will override an interface access-list

B. An interface ACL will override a WLAN ACL
C. A WLAN ACL will get applied first followed by an interface ACL
D. An interface ACL will get applied first followed by a WLAN ACL
38

Which AAA attribute is not used by the Cisco WLC running AireOS 8.O?
A. Tunnel-Private-Group-1 0
B. Tunnel-Type
C. Airespace-QOS-Level
D. DACL
39
100. DRAG & DROP
ANSWER
40
101. Prime infrastructure allows you to change an alarm status, drag and drop the status on the left
correct description on the right.
ANSWER
41
102. DRAG & DROP
ANSWER
42
103. When you enable QoS in a Cisco Unified Wireless environment, the AP queues packets based
on the layer 2 CoS value for each packet. The AP processes and applies QoS policies in a specific
order. Drag and drop the QoS statement on the left to the correct order of how the AP
processes and applies QoS policies on the right.
ANSWER
43
104. Drag and drop the route type on the left to their intended usage on the right
ANSWER
44
105. DRAG & DROP
ANSWER
45
106. Drag and drop the 802.11 standards on the left onto the corresponding descriptions on the
right
ANSWER
46
107. Drag and drop the characteristic on the left to the appropriate EAP type on the right
ANSWER
47
108. DRAG & DROP
ANSWER
48
109. Drag and drop the 802.11 technology feature on the left to the related frame type and IE on
the right
ANSWER
49
110. Drag and drop the Cisco AWID IP DSCP values on the left to its matching traffic type on the
right (not all options will be used)
ANSWER
50
111. DRAG & DROP
ANSWER
51
400-351,
CCIEFARM
BEST OF LUCK FOR YOUR EXAM
The Cisco CCIE Wireless certification assesses and validates wireless expertise.
Candidates who pass the CCIE Wireless certification exams must demonstrate
broad theoretical knowledge of wireless networking and a solid understanding
of wireless LAN technologies from Cisco, the market leader in WLAN technology.
52

400-351 CCIE Wireless Written Exam

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

400-351 CCIE Wireless Written Exam

Caricato da

Copyright:

Formati disponibili

CCIEFARM.

COM 400-351 05-FEB-2017

Copyright@www.cciefarm.com All Rights Reserved.

The Cisco CCIE Wireless certification assesses and validates wireless

Copyright@www.cciefarm.com All Rights Reserved.

DISCLAIMER: CCCIE Wireless Written Exam Workbook is designed to provide

The information presented in the workbook is not necessarily related to Cisco

Copyright@www.cciefarm.com All Rights Reserved.

2. Which two statements about 80211r are true? (Choose Two)

A. A PTK is generated before the client roams to the target AR

3. Refer to the exhibit.

A. Install a publicity signed wildcard certificate by a well-known CA on the RADIUS server

Copyright@www.cciefarm.com All Rights Reserved.

A. Set up prime infrastructure to send an email containing the device configuration

A. Profiling is performed on IPV4 and IPV6 client.

Copyright@www.cciefarm.com All Rights Reserved.

A. Group Temporal Key

Copyright@www.cciefarm.com All Rights Reserved.

11. Refer the exhibit.

A. MLSQoS is not enabled on the switch

12. Which statement about Wired Guest Access is true?

Copyright@www.cciefarm.com All Rights Reserved.

15. Refer to the exhibit.

A. Local RADIUS server is used

Copyright@www.cciefarm.com All Rights Reserved.

Copyright@www.cciefarm.com All Rights Reserved.

18. Refer to the exhibit.

Copyright@www.cciefarm.com All Rights Reserved.

19. Refer to the exhibit.

Copyright@www.cciefarm.com All Rights Reserved.

A. reserved roaming bandwidth (%)

A. Both controller RMlcan be in different subnets.

Copyright@www.cciefarm.com All Rights Reserved.

A. The default number of attempts is 100.

26. Refer to the exhibit.

A. The mDNS origin is not set to wireless

Copyright@www.cciefarm.com All Rights Reserved.

28. Refer the exhibit.

Copyright@www.cciefarm.com All Rights Reserved.

A. Machine access restriction

Copyright@www.cciefarm.com All Rights Reserved.

32. Refer to the exhibit.

A. Cisco prime does not have the correct licensing installed

A. TCP 1522/UDP 1522

Copyright@www.cciefarm.com All Rights Reserved.

A. UDP 16667. IP Protocol 97. UDP 500 501

A. configuration of the controller Hostname

A. Select the WC values between 4 dBm and q dBm

Copyright@www.cciefarm.com All Rights Reserved.

A. The “Client Session” report 8O2iland security statics

40. Refer to the exhibit.

Copyright@www.cciefarm.com All Rights Reserved.

A. Enable IP DHCP SNOOPING TRUST on the wireless controller port-channel interface

Copyright@www.cciefarm.com All Rights Reserved.

43. Refer to the exhibit.

Copyright@www.cciefarm.com All Rights Reserved.

A. This configuration is for custom WebAuth with an external RADIUS server

A. PEM state =WebauthReqD

Copyright@www.cciefarm.com All Rights Reserved.

46. Refer to the exhibit.

Copyright@www.cciefarm.com All Rights Reserved.

A. Enforce airtime entitlement for wireless voice applications

A. Use the config domain add -N command on the Cisco WLC.

53. Refer to the exhibit.