Cisco Updated 350-101 Exam Questions and Answers by iman

TACACS+ is used for device administration, especially for GUI and CLI access to infrastructure platforms such as Cisco Catalyst 9800 WLCs, switches, and routers. Cisco defines TACACS+ as a security application that provides centralized validation for users attempting to access a device or network access server, and it separates authentication, authorization, and accounting functions for administrative control. Cisco ISE device administration documentation further states that TACACS+ is used to control and audit network device configuration, allowing devices to query ISE for administrator authentication and authorization while sending accounting records for logging administrator actions.

Therefore, the primary benefit is streamlined administrator access across platforms. Instead of maintaining local administrator accounts independently on every WLC or network device, TACACS+ enables centralized identity validation, role-based authorization, and consistent audit trails. Option A is incorrect because TACACS+ supports differentiated authorization rather than static grouping. Option B is the opposite of centralized accounting. Option D is inaccurate because TACACS+ is mainly for device administration, whereas client or endpoint network access is typically handled with RADIUS. Reference topics:Wireless Monitoring and Management — AAA for WLC administration, TACACS+ device administration, role-based access, and centralized audit control.

In RF communications,propagation delayrefers to the finite time required for a signal to travel from the transmitter to the receiver over a given medium. This delay depends on the distance between the endpoints and the speed at which electromagnetic waves propagate through the medium, typically close to the speed of light in air (approximately 3 × 10⁸ m/s). Propagation delay is fundamental in calculating network latency, timing synchronization in protocols, and designing wireless coverage, especially in large-scale enterprise networks.

Reflection (option A) occurs when RF waves encounter surfaces and bounce back, potentially causing multipath interference. Scattering (option C) refers to signal dispersion caused by small objects or irregularities in the medium, which affects signal quality but not the direct travel time. Link speed (option D) represents the maximum data rate supported by a wireless link and is unrelated to the time taken for the signal to propagate.

Cisco wireless design guides emphasize propagation delay considerations when planning high-density deployments, especially in large campuses or long-range point-to-point links, to ensure timing-sensitive applications (e.g., VoIP, video conferencing) maintain acceptable performance. Propagation delay must be factored into QoS and RF design decisions to minimize latency and optimize throughput. Reference topic:RF Fundamentals — signal propagation, latency, multipath effects, and timing in wireless networks.

The failure is occurring during WPA/WPA2 key management, not during mobility anchoring. The radioactive trace showsFailed to validate eapol mic. MIC mismatchfollowed byFailed to validate eapol key m2, which means the authenticator and supplicant derived different key material during the PSK handshake. Cisco’s Catalyst 9800 client-connectivity troubleshooting maps this log pattern directly to a wrong password condition and lists the corrective actions as fixing the password on the endpoint or on the SSID/WLAN. The11r MIC validation failedphrase does not automatically make 802.11r the root cause; it only shows that the failed MIC validation occurred while Fast Transition key logic was in use. Disabling 802.11r would be a workaround only for client capability or FT interoperability issues, but the trace points to PSK mismatch. Removing the anchor WLC would break the intended DMZ anchoring design, and matching WLANs on foreign and anchor is required for anchor deployments, but it would not produce this EAPOL M2 MIC failure. The correct remediation is to ensure the client-entered PSK matches the WLAN PSK. Reference topics: WPA/WPA2-PSK authentication, EAPOL 4-way handshake, Catalyst 9800 radioactive trace analysis, and client connectivity troubleshooting.

For Cisco Catalyst 9176 APs deployed at remote sites without DHCP option 43, automatic WLC discovery can be accomplished using DNS-based CAPWAP controller discovery. By creating a DNS A record namedcisco-capwap-controller. < domain > that resolves to the WLC management IP address, APs can query DNS and locate their centralized controller automatically, eliminating the need for site visits or manual configuration. This method is preferred for large-scale or satellite deployments where APs may exist on different subnets and traditional DHCP-based discovery is unavailable. Option A is impractical because manually assigning static IPs to hundreds of APs is operationally complex and error-prone. Option B, using a multicast group, is not supported for cross-subnet controller discovery in CAPWAP; multicast is limited to local subnets. Option D (ap-discovery) is not a recognized standard for WLC discovery; Cisco specifically documentscisco-capwap-controlleras the required DNS entry for CAPWAP-based automatic discovery. This approach ensures zero-touch provisioning, simplifies network operations, and guarantees that APs join the correct controller, supporting centralized management and consistent configuration across multiple campuses. Reference topics:Wireless Network Implementation — CAPWAP discovery, DNS-based controller discovery, Catalyst 9800 WLC onboarding, zero-touch provisioning.