Free Practice Questions for the Cisco CCNP Wireless 300-120 Exam (2026 Updated)

When multicast mode is used, the controller selects a multicast group address, and the APs that join it receive the CAPWAP-encapsulated multicast stream. Each controller must use its own group address. If two controllers shared the same group, an AP of one controller could receive the traffic that the other controller sends to its APs, which causes duplicated or misdirected traffic and complicates troubleshooting, especially when both controllers manage APs in the same multicast domain. Using a separate group per controller isolates the traffic of each controller, and it keeps the replication tree of the network clean. The management addresses of the controllers are unicast addresses that have no relation to the multicast group, so assigning their management addresses to a multicast group is not a valid configuration. Cisco recommends a unique CAPWAP multicast group address for each controller. A good design check is that each controller has a different group address in the administratively scoped range, and that the network can route the multicast group between the controller and the APs.

Local profiling means that the Catalyst 9800 identifies the clients itself, without sending the data to a server. The controller uses the information that it sees as clients join the network. The DHCP exchange gives the host name, the vendor class and the option 55 parameter request list, and the OUI of the MAC address identifies the manufacturer of the device. From these the controller derives the device type and class, and it can show them to the administrator in the client view. When HTTP profiling is also used, the user agent adds further information. Of the options offered, DHCP and MAC address OUI are the two local methods. The IP address of a client says nothing about the device type, a wireless supplicant is not an item that the controller can inspect, and RADIUS profiling is not local, because it sends the attributes to an external server such as ISE.

Options D and E are the intended answers, because the design requires centralized configuration management, branch-specific policies, and continued wireless operation during WAN failures.

Option D: Grouping access points by branch enables site-specific FlexConnect configuration, including VLAN mappings, authentication parameters, and roaming-related settings. However, Cisco Catalyst 9800 controllers use Site Tags associated with Flex Profiles, rather than the legacy AireOS FlexConnect Group configuration object. Each branch can receive a dedicated Site Tag and Flex Profile to implement its local requirements.

Option E: Local switching allows wireless client traffic to be bridged directly onto the branch LAN instead of traversing a CAPWAP data tunnel to the central controller. When WAN connectivity fails, FlexConnect APs transition to standalone mode. WPA2-PSK WLANs can continue authenticating new clients locally and forwarding traffic through the branch network.

Incorrect options: A introduces unnecessary controller authentication dependency; B makes client connectivity dependent on central switching; and C is unnecessary because WPA2-PSK authentication does not require a RADIUS server.

Cisco Study Guide References: WLSI v1.2, Section 1.1 — FlexConnect Switching and Operating Modes; Section 1.2.a — FlexConnect Groups and Roaming; Section 1.2.b — Split Tunneling and Fault Tolerance.

Cisco Learning Content

Technical accuracy note: Option D should ideally say assign branch APs to dedicated Site Tags with appropriate Flex Profiles to match Catalyst 9800 terminology.

A FlexConnect AP can keep serving clients when its link to the controller is down, but if its own Ethernet uplink fails, clients that associate would have no path to any network. The Flex profile provides a safeguard for this situation: the fallback-radio-shut command shuts the radios when the Ethernet connection is not operational, so the AP stops accepting clients and they can move to a neighbouring AP that is still connected. On a Catalyst 9800 the command is entered under the Flex profile context, which is created with wireless profile flex followed by the profile name. The keyword sequence wireless flexconnect profile is not a valid context on this platform, and ethernet-fallback-enable is not a command in the Flex profile, so those variants cannot meet the requirement. The correct command set is therefore wireless profile flex [profile name] followed by fallback-radio-shut, and then end to leave configuration mode. After applying the profile, the show wireless profile flex detailed command confirms that the radios will be shut down whenever the wired uplink of the AP stops working.

A Platinum QoS profile on the AireOS controller is designed for voice. It lets the traffic of the WLAN use the voice priority, and the DSCP value 46 (EF) used by voice must be preserved end to end. When the configuration is migrated to the Catalyst 9800, the equivalent behaviour is built with a policy map, and the policy map must not downgrade the voice markings. The correct policy map therefore keeps EF for DSCP 46 and does not remap the voice class to a lower class. The alternatives fail this test: one policy remarks all voice classes to AF41, which is the video class, another sets everything to default (best effort), and another sets everything to CS1, the scavenger class that is deliberately below best effort. Any of these would remove the priority that CP-840 wireless phones need. The first option keeps ef for the voice class, so it mirrors Platinum correctly.

When a FlexConnect AP switches client traffic locally, the traffic is not tunnelled in CAPWAP. The AP forwards the client frames directly to the access switch, as 802.1Q tagged frames on a trunk port, and the user priority of the frame is translated into the CoS bits of the tag. If the voice QoS of the branch is to be based on layer 2 markings, the switch port to which the AP is connected must trust the CoS received from the AP. That is configured with the trust cos option of mls qos on the port. Trusting DSCP would use the layer 3 marking, which the requirement does not ask for. The AWID priority mapping options listed in the choices are not switch trust settings and are specific to autonomous AP configurations. Trusting CoS therefore preserves the layer 2 markings of the locally switched voice traffic across the branch network.

In a WPA2-Enterprise network, three parties are involved: the client, which acts as the supplicant, the controller or AP, which acts as the authenticator, and the authentication server. The client and the authenticator exchange EAP over the wireless link, using EAPOL frames, and PEAP builds a TLS tunnel between the client and the authentication server inside which the credentials are validated. The controller does not interpret the PEAP exchange. It relays the EAP messages to the authentication server, encapsulated in RADIUS. The protocol that the controller uses to communicate with the server, which in turn checks the credentials against Active Directory, is therefore RADIUS. EAP is the authentication framework carried inside the exchange, 802.1X is the port-based access control standard that defines how EAP is transported between supplicant and authenticator, and WPA2 is the security certification for the wireless link. This distinction between EAP, 802.1X and RADIUS is a common exam item, because the three terms describe different layers of the same authentication flow.

When profiling is moved to ISE, the endpoint is initially authorised with a limited policy, because ISE has not yet classified the device. After the controller sends the DHCP and HTTP attributes in RADIUS accounting, ISE classifies the client, for example as a Windows device, and the new profile must be enforced without waiting for a new connection. ISE does this with a Change of Authorization. The configuration of the profiling policy offers three behaviours: no CoA, port bounce and reauth. A port bounce toggles a switch port and cannot be used for a wireless client, which has no switch port. The reauthentication CoA triggers the controller to reauthenticate the session, and ISE then applies the authorisation policy that corresponds to the new profile. For immediate update of the access policy for a wireless client, the CoA type to apply is reauth. Remember that the reauthentication is sent to the controller using the RADIUS CoA on the port where the controller listens, which is the reason why the CoA port must match.

The security policy allows only web management traffic from the IT subnet to reach the controller. A CPU ACL that implements this blocks HTTP and HTTPS from other sources. Web authentication, however, depends on HTTP and HTTPS reaching the controller. The Cisco troubleshooting document explains that if the CPU ACLs are configured to block HTTP or HTTPS traffic, the web authentication process can fail, because the guest client must open a connection to the virtual interface to reach the login page. If the CPU ACL has no rule that allows that traffic for the virtual IP address, or an earlier deny rule matches ports 80 and 443, the browser keeps waiting and finally times out. The statements that web authentication is not supported with CPU ACLs and that it works only with Internet Explorer are untrue. An incorrect DNS server would give a name resolution error, not a timeout at the redirect. The CPU ACL is blocking the guest traffic.

The requirement is to minimise WAN utilisation while upgrading hundreds of APs at remote sites with limited bandwidth. Pre-download shortens the outage by transferring the image before the reload, but each AP still downloads its own copy across the WAN, so total WAN traffic is not reduced. Cisco's guidance for branch APs with constrained bandwidth is the efficient, or smart, AP image upgrade. With that feature only one AP of each model per site, the primary, downloads the image from the controller. The remaining APs obtain it from the primary over the local network using TFTP. WAN transfers are reduced from one per AP to one per model per site, and the upgrade also completes faster. Downloading after the controller reboot would produce the worst case, with all APs pulling the image at once and an extended outage. A parallel manual TFTP upgrade over SSH does not reduce WAN consumption either. The smart AP image upgrade is the approach that meets the goal.

The goal is to segregate every iPad that connects to the guest WLAN into a separate VLAN without Cisco ISE. This is an application of local profiling and a local policy on the controller. With device classification enabled, the controller identifies the type of client from its DHCP and HTTP data. A local policy then matches the device type, in this case Apple iPad, and applies an action, for example assigning a different VLAN through a service template. The policy is attached to the WLAN, or to the policy profile, and works independently of RADIUS. Using 802.1X to profile devices requires an AAA server, and a guest WLAN generally does not use it. An mDNS profile controls the service discovery of devices such as printers and Apple TVs and has nothing to do with VLAN assignment. RADIUS DHCP profiling only collects the information and sends it to a server. Creating a local policy on the WLC is the correct method.

Options C and D are correct because Cisco OfficeExtend access points provide a local web-based management interface that authorized users can access to configure personal wireless networks.

Option D: The employee can determine the OEAP's assigned IP address by accessing the home router's management interface and examining its DHCP client table or connected-device list. When the OEAP obtains its management IP address dynamically, the home router typically maintains a corresponding DHCP lease record. The employee can identify the access point through its hostname or MAC address.

Option C: After determining the OEAP IP address, the employee enters that address into a supported web browser to access the local management interface. Following successful authentication, the employee navigates to the configuration section and defines a personal SSID, including its security settings and passphrase. Personal SSID traffic is locally switched onto the home network rather than tunneled to the corporate controller.

Incorrect options: A is not the documented procedure for personal SSID configuration. B is incorrect because a device sticker normally provides hardware identification rather than its dynamically assigned IP address. E reverses the access procedure: the employee must first access the AP management interface before reaching its welcome and configuration pages.

Cisco documentation also requires local management access to be permitted through the relevant OfficeExtend configuration.

Cisco Study Guide References: WLSI v1.2 — Section 1.3, Implement Office Extend; Cisco Wireless Controller Configuration Guide, OfficeExtend Access Points, Configuring a Personal SSID

Cisco's recommendation for an AP that is in local mode is an access port that trusts DSCP. The AP's local mode traffic travels in a CAPWAP tunnel, and the AP sets the DSCP of the outer header according to the marking and QoS profile of the WLAN. That value must be preserved by the switch so the voice packets from the 8821 phone receive priority throughout the wired network. A trunk is not required for a local mode AP, because the client VLANs are terminated on the controller and not at the access switch. The command trust device cisco-phone applies only when a Cisco IP phone is detected through CDP on the port, and an AP is not a phone. Trusting CoS would depend on an 802.1Q tag that is not present on an access port. The configuration with switchport mode access and mls qos trust dscp meets the recommendation.

For APs in local mode, client traffic is encapsulated in CAPWAP and sent to the controller. The QoS marking that the network can actually see is the DSCP value in the outer IP header of the CAPWAP packet, which the AP derives from the 802.11 user priority of the original frame or from the inner DSCP. Layer 2 CoS values are not suitable as a trust basis in this design. The APs sit on access ports in a single management VLAN, so there may be no 802.1Q tag and therefore no CoS, and the question also stresses a network with multiple VLANs, where DSCP is the only marking that survives routing between them. The switch ports that connect the APs must consequently trust DSCP, so that the marking set by the AP is honoured and passed on towards the controller. WMM UP is an over-the-air value that is not present in wired frames, and IP precedence offers only eight classes and is outdated. DSCP is the correct trust model.

For RADIUS profiling on the Catalyst 9800, the controller must send the profiling data, DHCP and HTTP attributes, to ISE in RADIUS accounting messages. The Cisco profiling document lists the steps: device classification must be enabled globally, an AAA accounting method list of the type identity must be created that points to the RADIUS server group, that list must be added to the policy profile as its accounting list, and RADIUS profiling must be enabled in the policy profile. In the exhibit the policy profile already refers to accounting-list acct method and has radius-profiling enabled, and the blank belongs to the global command that defines that list. The command is aaa accounting identity acct_method start-stop group rad-group. The command variants with network, exec or commands define other accounting types, for network services, administrative sessions or command authorisation, and these do not carry the client session attributes that ISE needs for profiling.

FlexConnect lets the switching mode be chosen per WLAN, so the two SSIDs of a branch can behave differently. The corporate WLAN must reach file servers that sit in the data centre behind the controller, so its traffic has to be tunnelled to the WLC. That means local switching must be disabled for this WLAN, which is the central switching mode. The guest WLAN has the opposite requirement, because its traffic should leave through the Internet connection installed in each office instead of crossing the WAN to the data centre and back. Enabling local switching for the guest WLAN achieves that and also saves WAN bandwidth. The guest VLAN must then exist on the branch trunk and be mapped to the WLAN in the FlexConnect configuration. Any answer that applies the same setting to both WLANs, or that reverses the settings, would either hairpin the guest traffic through the data centre or cut corporate users off from the central servers.

VideoStream converts the IP multicast stream into a unicast stream over the air for each client that has joined the group. Because the frames are sent as unicast, the 802.11 acknowledgement mechanism applies, and every VideoStream client acknowledges the video frames that it receives. Frames that are lost are retransmitted, which makes the delivery reliable. Plain 802.11 multicast offers no such mechanism, because multicast frames are not acknowledged, so the statement that multicast is reliable by default is false. The feature also does not convert unicast frames into multicast frames. It works in the opposite direction, from multicast to unicast. Finally, the delivery over the air becomes more reliable, not less, and the wired Ethernet side is not changed by the feature. The correct statement is that each VideoStream client acknowledges receipt of the stream. This acknowledgement mechanism is the main reason why VideoStream is recommended for video distribution, where lost frames are noticeable to viewers.

The exhibit shows the CoS-to-DSCP map of a switch. Reading the output, CoS 1 maps to DSCP 8, CoS 2 to 16, CoS 3 to 24, CoS 4 to 32, CoS 5 to 45, CoS 6 to 48 and CoS 7 to 56. Voice traffic is carried with CoS 5 on Layer 2, and the standard Layer 3 equivalent is DSCP 46, Expedited Forwarding. The entry shown for CoS 5 is 45, not 46. Queueing and priority treatment in the network is defined for DSCP 46 (EF), so voice frames that cross this switch are remarked to a value that no voice class matches and lose priority. The map entry that must be corrected is therefore CoS 5 to DSCP 46. The values for CoS 3 (24), CoS 6 (48) and CoS 7 (56) are the defaults and are not wrong, and the option that proposes CoS 6 to 46 or CoS 7 to 48 would distort control-plane markings instead of fixing voice.

RADIUS servers on a wireless controller can be defined globally and also selected for individual WLANs. When a WLAN has its own authentication server list, that list takes precedence for the clients of this WLAN, and the global server is not consulted. The global list is used only when the WLAN does not specify servers of its own. The controller does not combine the two lists, and it does not try one after the other. If the mapped server rejects the authentication, the controller does not fall back to the globally configured server, because the Access-Reject is a valid answer from the authentication server. This behaviour allows different WLANs, for example corporate and guest, to authenticate against different servers. For clients of WLAN A, the controller therefore uses the RADIUS server that is mapped to WLAN A. This makes it important to review the per-WLAN server list whenever authentication fails for only one SSID while others work normally.

VLAN-based central switching is the FlexConnect capability that combines AAA-driven VLAN assignment with a per-client decision on where traffic is switched. When ISE returns a VLAN or interface for the user and that VLAN exists on the AP, through the WLAN-to-VLAN mapping of the FlexConnect group, the client's traffic is switched locally at the branch. If the returned VLAN is not present at the AP, the traffic is tunnelled to the controller and switched centrally instead. This is exactly the behaviour described: subnets available at the remote site are offloaded locally, and other subnets are carried back to the WLC. FlexConnect local authentication only moves the authentication function to the branch. Central DHCP processing influences where DHCP is handled, and learning the client IP address is a client-tracking setting. Neither of them selects the data path on a per-VLAN basis. Therefore VLAN-based central switching meets the requirement. On the exam, remember that this behaviour is controlled by the FlexConnect group's WLAN-to-VLAN mapping, so the VLAN returned by ISE must be present there for local switching to occur.

In a distributed Cisco ISE deployment the work is divided among personas. The Policy Administration Node holds the configuration and policy, the Monitoring Node handles logging and reporting, and the Policy Service Node processes network access requests from the network devices. Profiling is a function of the policy service, because the PSN is the node that receives the profiling data, for example the RADIUS accounting, DHCP and HTTP information from the controller or from probes, and classifies the endpoint against the profiling policies. The service must therefore be enabled on each Policy Service Node that collects data. The primary admin node distributes the profiling policies but does not collect endpoint data, the monitoring node only stores and reports on session data, and the term Device Admin Node refers to the device administration function that provides TACACS+. The Policy Services Node is the persona that runs the profiling service. Profiling policies are configured on the primary admin node, but only the nodes with the profiling service enabled collect and classify the endpoint data.

A CPU ACL controls traffic that is destined for the controller itself, for example SSH, HTTPS management, SNMP and web authentication. The Cisco configuration guide explains that it is enabled on the CPU Access Control Lists page, and it states that once the CPU ACL is enabled it applies to both wireless and wired traffic. The CLI has the same option, with the config acl cpu command taking the keywords wired, wireless or both. By default the GUI makes the change apply to both. As soon as the change is made, any management access to the controller from the wired network is therefore filtered by the ACL as well, and an engineer who forgets to permit the management subnet can lock themselves out. The ACL does not filter traffic that merely passes through the controller. It does not apply only to wireless or only to wired traffic. The answer is wireless and wired traffic.

The client supplicants cannot be controlled from the infrastructure side, because users may still be configured for EAP-FAST in spite of the instructions. The enforcement point is the policy in Cisco ISE. The engineer should define a policy that grants access only when the EAP authentication method is PEAP, for example by checking the network access EAP authentication condition in the authentication or authorization rule, or by allowing only PEAP in the allowed protocols service. Clients that use EAP-FAST then fail the policy and are denied, until they reconfigure their supplicants. Gathering usernames and disabling accounts is manual, penalises the user and does not enforce the method. An ACL on the controller that matches an IP subnet has no relation to the EAP type, and a deny list of MAC addresses reacts after the fact and cannot follow new devices. The ISE access policy that allows PEAP only is the correct solution.

Auto-RP is the Cisco mechanism that distributes group-to-RP mappings automatically, so routers do not need a static RP definition for each group. It uses two reserved multicast addresses. Candidate RPs announce themselves, and the groups that they are willing to serve, to the Cisco-RP-Announce group, 224.0.1.39. A mapping agent listens to those announcements, selects the best RP for each group range and then advertises the resulting group-to-RP mappings to all PIM routers using the Cisco-RP-Discovery group, 224.0.1.40. The address 224.0.0.13 is the all-PIM-routers group used for PIM hello and control messages, and 224.0.0.14 is a reserved link-local address, so neither takes part in Auto-RP. The question asks which address provides the automatic discovery of the best RP for each group, which describes the discovery messages sent by the mapping agent to 224.0.1.40, so that is the correct address. Address 224.0.1.39 carries the candidate-RP announcements. A simple way to remember the pair is that 39 is for announcements from candidate RPs, and 40 is for the discovery messages from the mapping agent.

Thirty-two VLANs for 300 users would be inefficient and costly to implement as separate SSIDs. Every SSID adds management-frame overhead, and a large number of SSIDs reduces the airtime that remains for data, so a design that broadcasts 32 WLANs, or that splits them between bands, is not efficient and also exceeds the WLAN limits of most deployments. The recommended approach is Identity-Based Networking. One SSID with 802.1X is configured, and Cisco ISE authenticates the user and returns the VLAN through RADIUS attributes according to the role or department in the authorization policy, with AAA override enabled on the WLAN or policy profile. The 32 VLANs are then assigned dynamically, and the number of SSIDs stays at one. A second controller adds hardware without solving the SSID problem, and AP groups with different VLANs add complexity and still depend on many WLANs. One SSID with ISE-based VLAN assignment is the efficient solution.

Radio Resource Management responds to non-802.11 interference by changing channels when a channel becomes impaired. If the interferer is persistent, for example a fixed microwave link or a permanent video transmitter, repeated channel changes do not improve the situation, and they disturb clients. CleanAir therefore classifies devices that are always present as persistent devices, and the dynamic channel assignment algorithm has an option, Avoid Persistent Non-WiFi Interference, which lets RRM take the persistent device into account and stop moving the channel because of it. The engineer surveyed the area and decided that RRM should not react, so this is the feature to enable. Avoid Cisco AP Load takes the load of neighbouring Cisco APs into account, Avoid Foreign AP Interference concerns interference from non-Cisco APs, and Avoid Non-802.11 Noise reacts to the general noise level, which would keep the channel changes going. The persistent device option is the correct one.

Wi-Fi Multimedia is part of the 802.11e QoS mechanism, and the 802.11n and later high-throughput rates require WMM to be active. A WLAN on which WMM is disabled therefore does not allow the high-throughput data rates, and clients on it operate with the legacy rates only. The task asks for a guest network that must stay with lower rates while the corporate network uses all rates, which is exactly what is obtained when the WMM policy of the guest WLAN is set to Disabled. The other values keep high-throughput operation possible. Allowed lets WMM-capable clients use WMM and others connect without it, and Required forces clients to support WMM, so both leave the 802.11n rates available. Mandatory is not a WMM policy value on the controller. The trade-off is that guest traffic loses WMM prioritisation, which suits a deliberately low-priority network. Keep in mind that disabling WMM also removes prioritisation for the clients on that WLAN, which is acceptable for guests but not for voice or video networks.

Local profiling on the Catalyst 9800 does not need an external server. The Cisco profiling document explains that device classification is enabled globally on the controller, after which the controller collects information from the clients, DHCP and HTTP data and the OUI of the MAC address, and builds a device profile. The result is visible in the client details, where the device type, name and class can be seen, and it can be used by local policies. The same global setting is also a prerequisite for RADIUS profiling. For a wireless administrator who wants an overview of the client types on the controller, device classification is therefore the configuration that has to be added. The terms native profile, MAC classification and local profile are not the names of the controller configuration items that perform this task, so they cannot be used to obtain the assessment. After the setting is applied, the profiled clients are visible in the monitoring section of the controller, where each client shows its detected device type.