350-101 Questions and Answers

The correct method issoftware image management workflows, specifically Cisco Catalyst Center Software Image Management, commonly referenced as SWIM. Cisco documents SWIM as the mechanism used to manage software upgrades and maintain consistency of image versions across the network. It provides an image repository, golden-image assignment, image distribution, activation, readiness checks, and scheduled execution. Cisco’s wireless automation guidance specifically states that SWIM is used to update Catalyst 9800 Series Wireless Controller software by distributing the image from the Catalyst Center repository to wireless controllers and upgrading the images running on those controllers; both stages can run immediately or be scheduled for a defined maintenance window.

Option C is also validated by Catalyst Center’s update-status and workflow views. Cisco documentsImage Update Statusas the view that shows all update tasks, filters by in-progress, success, or failure, and displays a progress bar for active updates. The workflow view then exposes distribution and activation task status, timing, prechecks, postchecks, checksum verification, and AP pre-image download details. Inventory snapshots and templates do not execute controller firmware upgrades, and “lifecycle workflow” is too generic. Reference topics:Wireless Monitoring and Management — Catalyst Center SWIM, image compliance, golden images, controller upgrade automation, and update progress reporting.

The missing command must create the RADIUS server group context before the existingserver name external-radiuscommand can bind the defined RADIUS server into that group. Cisco’s Catalyst 9800 802.1X configuration workflow shows the exact CLI sequence: define the RADIUS server, then enteraaa group server radius < radius-grp-name > , then addserver name < radius-server-name > . The Catalyst 9800 configuration guide likewise states that the RADIUS server-group identification is created withaaa group server radius server-group, followed by the server name assignment.

In this exhibit,external-radiusis already declared underradius server, andaaa authentication dot1x CLIENT_GROUP group RADIUS-GRPalready points the 802.1X method list to the server group namedRADIUS-GRP. Therefore, the box must containaaa group server radius RADIUS-GRPso thatserver name external-radiusis syntactically valid and functionally associates the external server with the group. Cisco also identifies dot1x authentication lists as the AAA method type used for 802.1X SSIDs, with “group” directing authentication to an external RADIUS server. Reference topics:Client Connectivity Configuration — WPA2-Enterprise, 802.1X/EAP, AAA method lists, RADIUS server groups, and Catalyst 9800 WLAN security

IEEE 802.11ax, also known as Wi-Fi 6, introduces several advancements to improve network performance, particularly in dense environments. Among these,OFDMA (Orthogonal Frequency Division Multiple Access)is a key feature introduced by 802.11ax. OFDMA allows more efficient use of the available spectrum by enabling multiple users to share the same channel simultaneously. This is done by subdividing the channel into smaller sub-channels, allowing data to be transmitted to multiple devices at the same time, improving overall throughput and reducing latency.

Option A: 60 GHz utilizationrefers to Wi-Fi standards like 802.11ad and 802.11ay, which use the 60 GHz band, but 802.11ax focuses on improving efficiency in the 2.4 GHz and 5 GHz bands, not the 60 GHz band.

Option B: Wi-Fi multimediais related to Wi-Fi features that prioritize multimedia traffic, but it is not a new attribute specifically introduced by 802.11ax.

Option D: MIMO (Multiple Input, Multiple Output)is a technology that allows multiple antennas to be used at both the transmitter and receiver, and while MIMO is supported in 802.11ac, it was enhanced in 802.11ax withMU-MIMO (Multi-User MIMO)for uplink, not a new technology introduced by 802.11ax.

Therefore,OFDMA(Option C) is the correct answer, as it is a key feature that 802.11ax introduces to improve network efficiency and capacity.

The correct element is theget() method. In the script, each device object is treated as a Python dictionary created from parsed JSON API output. The lines device.get("macAddress", "N/A") and device.get("ipAddress", "N/A") perform direct key-based lookup against the dictionary and return the associated value when the key exists. Python documentation defines dictionaries as key-value mappings and states that get() is used to avoid a KeyError by returning None or a specified default value when the key is absent.

This behavior is exactly what automation scripts need when consuming controller or wireless inventory APIs, because returned device records may not always contain every field. Cisco API inventory models commonly return structured device objects containing properties such as MAC address, model, network ID, product type, and wireless-related inventory attributes, which are then parsed by automation code. The pop operation would remove a dictionary key, not safely read it. The import function only loads modules such as requests and json. The format expression only builds the printed output string. Reference topics:Automation and AI — Python scripting, REST API consumption, JSON parsing, and wireless inventory automation.

When deploying Meraki APs, it is essential to claim each AP in the Meraki dashboard to ensure that they are automatically assigned to the correct network and can be managed remotely. This process involves registering the APs with the Meraki cloud, which is done by adding the AP serial numbers to the network within the Meraki dashboard before physically installing them at the branch.

Option B: "Add the AP serial numbers to the required network within the Meraki dashboard."This is the correct answer. Before the APs are physically connected, the administrator needs to log into the Meraki dashboard and add the serial numbers of the new APs to the intended network. This ensures that once the APs are powered on and connected, they automatically join the correct network and are ready for monitoring and management without requiring further configuration.

Option A: "Activate mesh networking mode for all the new APs before installation."Mesh networking mode is used when APs need to communicate wirelessly to extend coverage, but it is not a requirement for the deployment and registration process. The APs should be connected normally for initial setup, and mesh mode can be enabled later if needed.

Option C: "Preconfigure SSID names and VLAN tags on the local page of each AP in the Meraki dashboard."While configuring SSID and VLAN settings is essential, this is not the first action required for ensuring the APs are claimed by the correct network. The priority is to add the AP serial numbers to the Meraki dashboard for proper network assignment.

Option D: "Create a separate DHCP scope for all the new APs on the local server."DHCP scope configuration is important for assigning IP addresses, but this is not the primary step for ensuring the APs are correctly registered in the Meraki dashboard. The APs can obtain IP addresses from an existing DHCP scope once they are connected and claimed in the dashboard.

Therefore, the best approach isOption B, as it ensures that the APs are correctly assigned to the intended network in the Meraki cloud, ready for management and monitoring once connected.

The correct configuration issecurity wpa wpa2 ciphers gcmp256. The WLAN already contains WPA3, SAE, FT-SAE, SAE-EXT-KEY, and FT-SAE-EXT-KEY AKMs, so adding another SAE-EXT-KEY command is not the missing element. For Wi-Fi 7 operation, Cisco states that WPA3-Personal requiresGCMP256 with SAE-EXT-KEY and/or FT + SAE-EXT-KEY, and that AES/CCMP128 clients do not operate as Wi-Fi 7 clients when the required stronger cipher combination is absent. Cisco’s Catalyst 9800 WPA3 security enhancement guide gives the CLI syntax directly:security wpa wpa2 ciphers gcmp256, which configures GCMP-256 cipher support.

Option D is therefore the only valid WLC command that enables the required cipher for Wi-Fi 7-capable client operation and higher throughput behavior. Option A uses incorrect syntax and is already functionally represented in the exhibit assecurity wpa akm sae ext-key. Options B and C use invalid cipher constructs; TKIP is legacy and incompatible with modern high-throughput WLAN operation. Reference topics:802.11be/Wi-Fi 7 security requirements, WPA3-Personal, SAE-EXT-KEY, GCMP-256 cipher support, and Catalyst 9800 WLAN security configuration.

The exhibit creates WLAN profileguest-networkwith WLAN ID20and enables web authentication, but it does not yet define the client VLAN or bind the WLAN to a deployable policy. On Catalyst 9800 controllers, the WLAN profile defines SSID and wireless/security characteristics, while thepolicy profiledefines client-facing network policy, including VLAN assignment, AAA, ACLs, and switching behavior. Cisco’s web authentication configuration guide states that the policy profile specifies client VLAN, AAA, ACLs, timeout settings, and related policy, and the VLAN is assigned under the policy profile.

The second required object is thepolicy tag, because a policy tag maps the WLAN profile to the policy profile. Cisco also notes that the default policy tag automatically maps only WLAN IDs1 through 16; WLAN ID17 or highercannot use that default mapping. Since this WLAN is ID 20, a custom policy tag mapping is required. Mesh bridging, STP, AP group naming, or physical-interface isolation do not complete the Catalyst 9800 WLAN-to-VLAN policy model. Reference topics:Wireless Network Implementation — Catalyst 9800 configuration model, WLAN profiles, policy profiles, policy tags, guest VLAN assignment, and web authentication.

The correct Cisco technology isAI Network Analytics. Cisco describes Cisco AI Network Analytics as a Catalyst Center capability that uses machine learning and machine reasoning to generate deployment-specific insights, identify operational issues, and accelerate troubleshooting. Cisco’s official Catalyst Center Assurance documentation states that Cisco AI Network Analytics uses advanced machine learning techniques and an advanced cloud learning platform with deidentified network event data to identify critical issues in the network.

This makes option D the only precise match. Catalyst Center Assurance is the broader assurance and monitoring framework where AI Network Analytics is surfaced, but it is not the specific technology named in the question. Network Services is a generic platform function area, not the AI/ML analytics feature. Catalyst Center LLM Insights is not the established Cisco wireless assurance feature associated with cloud-based machine learning for issue detection. AI Network Analytics provides AI-driven baselining, anomaly detection, root-cause assistance, trends, insights, and comparative benchmarking. Cisco also documents that the AI Network Analytics cloud runs machine learning models using deidentified network event data and returns issues and insights back into Catalyst Center. Reference topics:Automation and AI — Cisco Catalyst Center, AI Network Analytics, AI-driven baselining, anomaly detection, and wireless assurance intelligence.

Migrating a Cisco Catalyst AP to Meraki cloud management requires issuing a specific CLI command on the WLC to switch the AP's management mode. The correct syntax isap management mode meraki force noprompt, which instructs the controller to transition the AP to Meraki mode, bypassing validation prompts that normally require manual confirmation. Theforcekeyword ensures the command is executed even if the AP is actively associated or configured, andnopromptsuppresses confirmation dialogues for unattended migration. Options A, C, and D are invalid syntax or improperly order the parameters, which would result in a CLI error. Cisco Wireless Core Technologies recommend this approach during enterprise migration scenarios where multiple APs are moved from Catalyst WLC management to cloud-based Meraki management, enabling centralized configuration and monitoring in a large-scale deployment. Using this command ensures a seamless transition without service disruption, while maintaining inventory consistency and supporting automation for mass AP migrations. Reference topics:Wireless Network Implementation — AP management mode migration, Meraki cloud integration, CLI AP management, Catalyst 9176 WLC migration.

YANG represents network configuration and operational state as a hierarchical data model. In Cisco model-driven programmability, YANG is used with NETCONF to model configuration and state data so that client applications can programmatically retrieve, edit, and manage device configuration. Cisco states that YANG is used with NETCONF for automated and programmable network operations, and that YANG primarily models the configuration and state data used by NETCONF operations.

The correct hierarchy is thetree and leaf-based structure. Cisco’s YANG model structure description defines it as a hierarchical framework that organizes data into a tree with top-level nodes and nested child nodes, and groups related data through containers, lists, and leaves. In this model, containers and lists create structure, while leaf nodes hold actual values such as interface names, VLAN IDs, descriptions, IP addresses, or policy parameters. Option B describes a relationship inside the hierarchy, but it is not the full YANG modeling hierarchy. Options A and C are not valid YANG/NETCONF structural models. Reference topics:Automation and AI — model-driven programmability, NETCONF, YANG data models, configuration/state data, and Cisco IOS XE programmability.

Bridge mode in a Cisco wireless mesh deployment allows access points to operate as mesh infrastructure nodes, typically as a Root AP (RAP) or Mesh AP (MAP), so Ethernet segments can be connected across a wireless backhaul. Cisco’s mesh design documentation states that in a point-to-point bridging scenario, a mesh AP can extend a remote network by using the backhaul radio “to bridge two segments of a switched network.” This directly maps to option A: point-to-point communication between network segments.

In Catalyst 9800 mesh deployments, Cisco documents converting an AP to bridge mode withcapwap ap mode bridge, after which the AP rejoins the controller in bridge mode and can be assigned a mesh role. Cisco also defines the RAP as the AP with the wired connection toward the WLC, while the MAP joins through its radio path toward the RAP. Option B is incorrect because bridge mode does not force all traffic to 2.4 GHz; Cisco mesh backhaul can use configured backhaul radios. Option C describes RRM/TPC behavior, not bridge mode. Option D incorrectly associates mesh bridge mode with WAN edge functions. Reference topics:Wireless Network Implementation — mesh AP roles, RAP/MAP operation, wireless backhaul, and Ethernet bridging.

‘

The correct method issoftware image management workflows, specifically Cisco Catalyst Center Software Image Management, commonly referenced as SWIM. Cisco documents SWIM as the mechanism used to manage software upgrades and maintain consistency of image versions across the network. It provides an image repository, golden-image assignment, image distribution, activation, readiness checks, and scheduled execution. Cisco’s wireless automation guidance specifically states that SWIM is used to update Catalyst 9800 Series Wireless Controller software by distributing the image from the Catalyst Center repository to wireless controllers and upgrading the images running on those controllers; both stages can run immediately or be scheduled for a defined maintenance window.

Option C is also validated by Catalyst Center’s update-status and workflow views. Cisco documentsImage Update Statusas the view that shows all update tasks, filters by in-progress, success, or failure, and displays a progress bar for active updates. The workflow view then exposes distribution and activation task status, timing, prechecks, postchecks, checksum verification, and AP pre-image download details. Inventory snapshots and templates do not execute controller firmware upgrades, and “lifecycle workflow” is too generic. Reference topics:Wireless Monitoring and Management — Catalyst Center SWIM, image compliance, golden images, controller upgrade automation, and update progress reporting.

Fast transition is the correct solution because it refers to IEEE 802.11r Fast BSS Transition, which reduces the authentication delay when a wireless client roams from one AP to another. Cisco describes 802.11r Fast Transition as a feature for seamless wireless roaming and states that, after configuration, the WLAN supports faster client roaming between access points. Cisco’s Catalyst 9800 roaming documentation also identifies 802.11r as the mechanism focused on seamless transition between APs, while 802.11k and 802.11v assist with neighbor reporting and network-assisted roaming decisions.

The core advantage is that key negotiation and authentication preparation occur before or during the roam, reducing the interruption experienced by latency-sensitive applications such as voice, video, collaboration tools, and real-time enterprise applications. Static VLAN policy only controls segmentation and does not accelerate roaming. Optimized roaming can help discourage sticky clients from remaining associated to poor-quality APs, but it is not the primary fast-roam authentication mechanism. A redundant RF profile is not an 802.11 roaming solution. Reference topics:802.11r Fast BSS Transition, client roaming, WLAN mobility behavior, Catalyst 9800 WLAN security, and seamless roaming design.

AI Enhanced RRM is not a static-threshold tuning feature and it is not designed to simply raise AP transmit power. Cisco defines AI Enhanced RRM as a radio resource management technology that applies artificial intelligence and machine learning to optimize RF environments, uses distributed data collection from Cisco wireless controllers with cloud-based analytics, and automates adaptive RF parameter tuning for Cisco wireless networks.

The operational model is telemetry-driven. RF telemetry is collected from APs by the Catalyst 9800 WLC, sent through Cisco Catalyst Center to the Cisco AI Analytics Cloud, analyzed by RRM algorithms, and then configuration-change information is returned through Catalyst Center toward the managed wireless infrastructure. Cisco’s AI-Enhanced RRM deployment guide further identifies DCA, TPC, FRA, and DBS as examples of optimizations performed, meaning the feature enhances dynamic RF control rather than disabling it.

Therefore, option D is the only correct answer. Options A, B, and C describe either legacy/static behavior, harmful power-only logic, or a fixed RF design model that contradicts Cisco AI Enhanced RRM. Reference topics:Automation and AI — AI/ML-driven RF optimization, Catalyst Center assurance, RRM telemetry, DCA, TPC, FRA, and DBS.

The failure is occurring during WPA/WPA2 key management, not during mobility anchoring. The radioactive trace showsFailed to validate eapol mic. MIC mismatchfollowed byFailed to validate eapol key m2, which means the authenticator and supplicant derived different key material during the PSK handshake. Cisco’s Catalyst 9800 client-connectivity troubleshooting maps this log pattern directly to a wrong password condition and lists the corrective actions as fixing the password on the endpoint or on the SSID/WLAN. The11r MIC validation failedphrase does not automatically make 802.11r the root cause; it only shows that the failed MIC validation occurred while Fast Transition key logic was in use. Disabling 802.11r would be a workaround only for client capability or FT interoperability issues, but the trace points to PSK mismatch. Removing the anchor WLC would break the intended DMZ anchoring design, and matching WLANs on foreign and anchor is required for anchor deployments, but it would not produce this EAPOL M2 MIC failure. The correct remediation is to ensure the client-entered PSK matches the WLAN PSK. Reference topics: WPA/WPA2-PSK authentication, EAPOL 4-way handshake, Catalyst 9800 radioactive trace analysis, and client connectivity troubleshooting.

In wireless antenna design, gain refers to the measure of an antenna’s ability to focus energy in a particular direction compared to a reference antenna, usually an isotropic radiator. Gain does not generate additional power; instead, it redistributes radiated energy to increase signal strength in the intended direction, enhancing the effective range and performance of the wireless link. This directional amplification is crucial in both point-to-point and point-to-multipoint deployments, as higher gain antennas can concentrate RF energy to overcome path loss and improve received signal strength at the target. Option A describes system loss calculation, which relates to link budgets, not antenna gain. Option B is unrelated, as checksum figures are part of digital error detection in wireless frames. Option D pertains to environmental tolerance, not RF signal characteristics. In Cisco Wireless Core Technologies, antenna gain is considered during RF planning, coverage modeling, and site surveys to ensure optimal signal distribution, proper overlap, and minimal interference, particularly for high-density deployments. Using high-gain directional antennas in corridors or long hallways, for instance, improves coverage and throughput while minimizing interference outside the target area. Reference topics:RF Fundamentals — Antenna gain, directional radiation patterns, link budget, site survey planning.

Device sensitivity in a wireless environment refers to receiver sensitivity: the minimum RF signal level a client or AP radio must receive to successfully detect, demodulate, and decode a transmission. Cisco defines receiver sensitivity as the minimum signal power level, expressed in dBm or mW, required for a receiver to accurately decode a given signal. Cisco RF design guidance further states that sensitivity indicates the lowest received power before the receiver considers the signal unintelligible.

Therefore, option A is correct because sensitivity is fundamentally about the radio’s capability to process a received signal at low power levels. A more sensitive receiver can decode weaker frames, improving effective coverage and receive performance, provided the signal-to-noise ratio and interference conditions remain acceptable. Cisco also notes that individual device sensitivity determines how well a device can hear and demodulate RF energy, which directly affects contention behavior and WLAN performance in dense environments. Redundant gateways, beacon interval synchronization, and key refresh schedules are Layer 3 availability, 802.11 timing, and security-key management topics; they do not define RF receiver sensitivity. Reference topics:RF Fundamentals — receiver sensitivity, RSSI, dBm, SNR, demodulation, and WLAN coverage behavior.

The correct answer isMake-before-break handover logic. This is a key feature in Cisco's Ultra-Reliable Wireless Backhaul (URWB) process that allows devices to establish a connection to the next AP (Access Point) before disconnecting from the current AP. This seamless transition ensures that there is no disruption in the wireless connection as the client roams between APs, which is especially important in environments where consistent, low-latency connectivity is essential, such as in real-time applications (e.g., voice or video).

Option A (Open roaming)refers to a method of allowing devices to roam freely across networks, but it doesn't address the specific need for a seamless handover process.

Option B (Fast client handoff)refers to methods used to speed up the roaming process, but it doesn’t specifically ensure that the next AP is connected before disconnecting from the current one.

Option C (802.11v high speed roaming)is an IEEE standard feature that helps optimize roaming behavior for fast-moving devices, butmake-before-break handover logicis the specific mechanism that allows for a seamless roaming experience.

Therefore,Make-before-break handover logic(Option D) is the correct answer as it directly addresses the need for devices to establish a reliable connection to the next AP during roaming before losing connectivity with the current one.

For configuring guest access on a Cisco Catalyst 9800 WLC using an external WebAuth server, the WLAN must be explicitly associated with the external server through a parameter map. The correct command syntax in Cisco IOS XE iswireless wlan < wlan-name > followed bysecurity web-auth external < parameter-map > . This configuration links the WLAN to the external WebAuth server defined in the parameter map, allowing guests to be redirected to the portal for authentication. The parameter map (webauth-ext) contains details such as server IP, port, and other authentication parameters required for the external WebAuth interaction. Option B is incorrect because it improperly uses multiple WLAN names in one command, which is not valid syntax. Option C usesparameter external security-map, which is invalid and does not associate the WLAN correctly with the WebAuth server. Option D incorrectly combines the security and parameter-map syntax and is not supported in IOS XE for external WebAuth. Cisco Wireless Core Technologies recommends this approach for centralized guest management, allowing consistent enforcement of guest policies, seamless authentication, and integration with external WebAuth servers across multiple WLANs and APs. Reference topics:Client Connectivity Configuration — WebAuth, external guest portal, WLAN parameter map configuration, Cisco IOS XE 17.x.

The correct answer isfast BSS transition protocol, which is IEEE 802.11r Fast Transition. Cisco describes 802.11r BSS Fast Transition as the mechanism used to provide seamless roaming for wireless clients by reducing the time required to roam between access points. It achieves this by allowing keying material to be prepared or cached so that the client does not perform a full authentication exchange every time it moves to another AP within the same mobility domain.

This is specifically relevant to Layer 2 roaming because the client remains in the same Layer 2 network while reassociating to a different BSS. Fast Transition reduces roam latency, which is critical for voice, video, collaboration, barcode scanners, and other real-time applications. Cisco also classifies fast secure roaming as the method used to accelerate client roaming when Layer 2 security is configured on the WLAN. Increased beacon intervals do not provide handoff acceleration. Optimized roaming helps with sticky-client behavior but is not the secure handoff protocol. Deferred probe response is an RF/client steering behavior, not an 802.11 Layer 2 roaming key-transition method. Reference topics:802.11r Fast BSS Transition, Layer 2 roaming, fast secure roaming, WLAN mobility, and Catalyst 9800 roaming design.

When a radio wavebends around an obstaclein its path, this phenomenon is calleddiffraction. Diffraction allows the RF signal to reach areas that are not in the direct line of sight of the transmitter, such as behind walls, corners, or other obstructions. The amount of bending depends on the wavelength of the signal relative to the size of the obstacle—longer wavelengths (lower frequencies) diffract more effectively than shorter wavelengths.

This property is crucial in wireless network design, especially in enterprise or mesh deployments, because it enables coverage in complex indoor environments and around obstructions where direct line-of-sight communication is impossible. Diffraction differs from other RF phenomena:absorption(option A) occurs when RF energy is partially absorbed by materials, reducing signal strength;diffusion(option B) refers to scattering of the signal in multiple directions; andreflection(option C) occurs when RF waves bounce off surfaces like walls or ceilings, which can lead to multipath interference.

Cisco wireless design guides emphasize understanding diffraction forcoverage planning, AP placement, and optimizing signal propagationin indoor and campus deployments, ensuring that signals can adequately reach shadowed or obstructed areas without excessive loss or dead spots. Reference topic:RF Fundamentals — diffraction, reflection, absorption, and indoor wireless propagation.

The correct command isreceiver ip address 198.51.100.10 57555 protocol tls-native profile spaces-profilebecause it matches the Cisco IOS XE model-driven telemetry subscription syntax used on Catalyst 9800 controllers. Cisco documents the receiver statement under telemetry ietf subscription as receiver ip address ip-address receiver-port protocol protocol profile name, and describes it as the command that configures the receiver IP address, port, protocol, and profile for telemetry notifications.

In the exhibit, the subscription already defines the telemetry feed: encode-tdl encoding, a native stream, the TDL URI for ewlc/wlan_config, the WLC source address, and an on-change update policy. What is missing is the collector destination. For Cisco Spaces or Catalyst Center-style integrations, the WLC must know where to export telemetry and which secure transport profile to use. Cisco troubleshooting examples for Catalyst 9800 telemetry use the same command structure: receiver ip address X.X.X.X 25103 protocol tls-native profile ... under the telemetry subscription.

Options A, B, and D are invalid because they reorder the CLI keywords. IOS XE telemetry configuration is parser-order sensitive: the command begins with receiver ip address, followed by the receiver port, then protocol, then profile. Reference topic:Wireless Monitoring and Management — Catalyst 9800 streaming telemetry, Cisco Spaces integration, TLS transport, and telemetry receiver configuration.

A high-gain patch antenna is a directional antenna that concentrates RF energy into a defined coverage area rather than radiating equally in all directions. Cisco’s Wireless RF Reference Guide explains that antenna gain determines how RF power is radiated and that higher-gain antennas do not create additional transmit power; they focus existing power in a given direction. Cisco also distinguishes omnidirectional high-gain patterns, which flatten coverage, from directional antennas, which focus energy toward a target area.

That makes option C correct: a patch antenna imparts a focused beam, typically useful for covering a hallway, warehouse aisle, seating section, point-to-point link, or defined flat service area. Cisco’s antenna documentation also states that higher-gain antennas provide longer coverage distance but with a coverage-area tradeoff, especially in a particular direction. Option A is incorrect because antenna gain does not restrict operation to a single narrow frequency; frequency support is determined by antenna design and radio band. Option B describes channel overlap, not antenna behavior. Option D does not describe a standard patch antenna radiation pattern. Reference topics:RF Fundamentals — antenna gain, directional antennas, patch antenna radiation patterns, beamwidth, and coverage-cell design.

The correct action is to expose only encrypted management services: HTTPS for WebUI administration and SSH for remote CLI administration. The exhibit confirms the WLC wireless management interface is VLAN 10 with IP address 10.10.1.2, but interface placement alone does not enforce secure management protocol policy. Cisco Catalyst 9800 documentation identifies web admin settings as controller management configuration that determines administrator access, protocols, and interfaces for remote management. Cisco further states that administrators can connect securely over HTTPS, while HTTP “is not a secure connection,” and that HTTPS encrypts data to and from the server.

For CLI access, Cisco’s Catalyst 9800 Secure Shell guidance states that SSH enables secure remote access, and usingtransport input sshprevents non-SSH Telnet connections, limiting the device to SSH-only access. Therefore, options A and B violate policy because they permit Telnet and/or HTTP. Option C fails because console access is local, not remote, and disabling only HTTP still leaves Telnet exposure unresolved. Reference topics:Wireless Monitoring and Management — WLC management access, secure administration, HTTPS, SSH, and management-plane hardening.

TACACS+ is used for device administration, especially for GUI and CLI access to infrastructure platforms such as Cisco Catalyst 9800 WLCs, switches, and routers. Cisco defines TACACS+ as a security application that provides centralized validation for users attempting to access a device or network access server, and it separates authentication, authorization, and accounting functions for administrative control. Cisco ISE device administration documentation further states that TACACS+ is used to control and audit network device configuration, allowing devices to query ISE for administrator authentication and authorization while sending accounting records for logging administrator actions.

Therefore, the primary benefit is streamlined administrator access across platforms. Instead of maintaining local administrator accounts independently on every WLC or network device, TACACS+ enables centralized identity validation, role-based authorization, and consistent audit trails. Option A is incorrect because TACACS+ supports differentiated authorization rather than static grouping. Option B is the opposite of centralized accounting. Option D is inaccurate because TACACS+ is mainly for device administration, whereas client or endpoint network access is typically handled with RADIUS. Reference topics:Wireless Monitoring and Management — AAA for WLC administration, TACACS+ device administration, role-based access, and centralized audit control.