Free 300-425 Practice Test Questions 2026

Explanation:

Why Option B is Correct?

Mobility Tunnels Use UDP 16666

Primary Data Path: Cisco WLCs use UDP port 16666 for inter-controller mobility tunneling (client roaming data).

Firewall Requirement: Must allow UDP 16666 bidirectionally between WLCs.

Protocol 97 for Control Path (Management Ports)

Secondary Control Path: Some WLCs (especially in split-MAC architectures) use Protocol 97 (EtherIP) for management communication.

Firewall Requirement: Must allow IP Protocol 97 between WLC management interfaces.

Testing with mapping Command

Use mapping to verify UDP 16666 connectivity.

Ensure Protocol 97 is open for management sync (if applicable).

Why Other Options Are Incorrect?

Option A: Protocol 96

Protocol 96 is invalid—Cisco mobility uses Protocol 97 (EtherIP) for management.

Option C/D: UDP 16667

UDP 16667 is incorrect—Cisco’s official docs specify UDP 16666 for mobility tunnels.

Reference:

Cisco Wireless LAN Controller Configuration Guide

Mobility tunnels require UDP 16666 for data and Protocol 97 (EtherIP) for management.

Cisco TAC Bulletin on Firewall Rules for Mobility

Confirms UDP 16666 and Protocol 97 must be open.

Explanation:

Why Option A is Correct?

Impact of Full Reauthentication on Voice Calls

When a VoWiFi client roams and performs full 802.1X reauthentication, it introduces latency (100–300 ms).

This causes gaps or drops in voice conversations, degrading call quality.

Solution: Use fast roaming methods (e.g., 802.11r, CCKM, OKC) to skip full reauth.

Why Option E is Correct?

802.1X Alone Forces Full Reauthentication

By default, 802.1X without fast roaming requires:

A new 4-way handshake (WPA2/WPA3).

Full EAP reauthentication (e.g., PEAP, EAP-TLS).

This slows roaming and disrupts real-time traffic like voice.

Solution: Enable 802.11r (Fast Transition) or CCKM for seamless roaming.

Why Other Options Are Incorrect?

Option B: Roaming time increases with 802.1X + CCKM

False. CCKM (Cisco Centralized Key Management) reduces roaming time by caching keys and skipping full EAP.

Option C: Roaming requires seeing four APs

False. Roaming decisions are based on RSSI, SNR, and band steering, not a fixed AP count.

Option D: Roaming at -80 dBm

Misleading. While clients may roam at -80 dBm, this is not a strict rule.

Voice networks often enforce -67 dBm RSSI thresholds for proactive roaming.

Reference:

Cisco VoWLAN Design Guide

Recommends 802.11r/CCKM to avoid full reauthentication gaps.

CWNP Voice over Wi-Fi Best Practices

Confirms 802.1X alone is unsuitable for voice roaming.

Key Takeaways for Voice Roaming:

Avoid full 802.1X reauthentication (use 802.11r/CCKM).

Set RSSI thresholds (e.g., -67 dBm) to force timely roaming.

Enable 802.11k/v for assisted roaming.

Explanation:

Why Option A (Interface Group) is Correct?

Interface Groups allow multiple dynamic interfaces (VLANs) to be mapped to a single WLAN.

This is useful when different sites/facilities need unique VLAN assignments for the same SSID.

Example:

Site A uses VLAN 10 for the "Employee" WLAN.

Site B uses VLAN 20 for the same "Employee" WLAN.

Flexibility:

Simplifies WLAN-to-VLAN mappings without creating separate WLANs for each location.

Why Option C (AP Group) is Correct?

AP Groups enable per-AP or per-site VLAN assignments.

APs in different facilities can be grouped and assigned unique VLANs for the same WLAN.

Example:

AP Group "HQ" maps "Employee" WLAN to VLAN 10.

AP Group "Branch" maps "Employee" WLAN to VLAN 20.

Granular Control:

Allows site-specific policies (VLANs, QoS, RF settings) without extra WLAN configurations.

Why Other Options Are Incorrect?

Option B (Mobility Group)

Mobility groups facilitate inter-controller roaming but do not control VLAN mappings.

Option D (Controller Group)

Controller groups (not a standard Cisco term) are irrelevant to WLAN-to-VLAN flexibility.

Option E (RF Group)

RF groups optimize channel and power management across controllers but do not affect VLAN assignments.

Reference:

Cisco Wireless LAN Controller Configuration Guide

Interface Groups: Allow WLANs to map to multiple VLANs dynamically.

AP Groups: Assign VLANs based on AP location/role.

Enterprise Mobility 4.1 Design Guide

Recommends AP Groups + Interface Groups for multi-site VLAN flexibility.

Explanation:

Why Option D is Correct?

Mismatch in Encryption Settings Between AireOS and Catalyst 9800-CL:

AireOS 5520 (v8.8.120.0) supports encrypted mobility tunnels by default (if configured).

Catalyst 9800-CL (v16.10.1e) requires explicit data-link-encryption configuration to match the AireOS encryption setting.

If 9800-CL lacks this config, the data path fails (control path may still work).

Symptom:

Control path up (mobility peer shows as "UP" in show mobility summary).

Data path down (no client traffic passes between controllers).

Why Other Options Are Incorrect?

Option A: Incorrect Certificate Hash Key

Certificate issues would break both control and data paths (not just data).

Option B: Encrypted Mobility on AireOS 5520

Encrypted mobility is supported between AireOS and Catalyst 9800-CL.

The issue is missing config on 9800-CL, not incompatibility.

Option C: Disabled Data-DTLs on AireOS 5520

data-dtl s is not a valid AireOS command (misleading option).

Reference:

Cisco Catalyst 9800-CL Configuration Guide (v16.10)

Requires data-link-encryption enable for encrypted mobility with AireOS.

Cisco TAC Case Study #WLC-MOBILITY-ENC

Confirms control path up + data path down is typical of encryption mismatches.

Explanation:

Why Option C (Monitor) is Correct?

Monitor Mode on Cisco APs

When an AP is set to Monitor mode, it scans all channels (both Wi-Fi and non-Wi-Fi) to detect interference.

This mode does not transmit—it only listens, making it ideal for spectrum analysis with tools like MetaGeek Chanalyzer. Non-Wi-Fi Interference Detection

Monitor mode allows the AP to:

Detect microwaves, Bluetooth, Zigbee, cordless phones, etc.

Capture RF noise floor, channel utilization, and interference patterns.

MetaGeek Chanalyzer Integration

Chanalyzer relies on passive scanning (no AP transmissions), which aligns with Monitor mode.

Why Other Options Are Incorrect?

Option A: FlexConnect

FlexConnect is for branch office deployments (local switching), not spectrum analysis.

Option B: Sniffer

Sniffer mode captures Wi-Fi packets (802.11 frames) for protocol analysis (e.g., Wireshark), not non-Wi-Fi interference.

Option D: SE-Connect

SE-Connect (Spectrum Expert Connect) is deprecated and replaced by Monitor mode for interference detection.

Reference:

Cisco AP2700 Series Deployment Guide

Recommends Monitor mode for spectrum analysis and interference detection.

MetaGeek Chanalyzer Documentation

Requires APs in non-transmitting mode (Monitor) for accurate RF scans.

Explanation:

Why Option B is Correct?

Seamless Roaming Requires Consistent WLAN Names

For clients to roam smoothly between APs on different controllers, the WLAN name (SSID) must be identical on both WLCs. If Copr-NET390595865 (WLC-1) and Copr-NET6837l638 (WLC-2) are different, clients treat them as separate networks, causing reauthentication delays during roaming.

Mobility Group Tunneling Depends on WLAN Alignment

Controllers in the same mobility group share client session data, but only if the WLAN profiles match (same SSID, security, VLAN, etc.).

Impact of Mismatched WLAN Names

Clients drop connections when moving between APs on different controllers.

Voice/video calls experience gaps or drops.

Why Other Options Are Incorrect?

Option A: Move All APs to One Controller

N+1 HA (High Availability) is for redundancy, not roaming optimization.

Concentrating APs on one controller overloads it and defeats load balancing.

Option C: (Duplicate of Option B)

This is the correct answer (same as B).

Option D: Place APs per Floor on the Same Controller

While this reduces inter-controller roaming, it does not solve the core issue of mismatched WLAN names.

Clients moving between floors would still face roaming problems.

Reference:

Cisco Wireless LAN Controller Configuration Guide

States that WLAN names must match across controllers for seamless roaming.

Enterprise Mobility 4.1 Design Guide

Recommends identical WLAN configurations in mobility groups

Explanation:

Why Option B (UDP) is Correct?

SSO (Stateful Switchover) Heartbeats Use UDP

In SSO mode, the primary and secondary WLCs communicate via UDP-based heartbeat packets to monitor each other’s status.

These heartbeats are sent every 100 ms by default.

Key UDP Ports for SSO:

UDP port 1024: Used for redundancy management heartbeat.

If firewalls block UDP 1024, the secondary WLC loses sync and enters maintenance mode..

Why Other Options Are Incorrect?

Option A: RSTP (Rapid Spanning Tree Protocol)

RSTP is a Layer 2 protocol for loop prevention—unrelated to WLC heartbeats.

Option C: TCP

SSO heartbeats do not use TCP—they rely on UDP for low-latency communication.

Option D: ICMP (Ping)

While ICMP can test reachability, SSO heartbeats are UDP-based.

Reference:

Cisco High Availability Configuration Guide (WLC 8.x)

Confirms UDP port 1024 is used for redundancy heartbeats.

Cisco TAC Troubleshooting SSO Failures

Recommends UDP capture filters for heartbeat verification.

Explanation:

Why Option B (Transmit Power Control) is Correct?

Reduces Co-Channel Interference

TPC automatically adjusts AP transmit power to minimize overlap with neighboring APs on the same channel.

Prevents APs from overshooting coverage and causing interference.

Impact on Retransmissions

Lower transmit power reduces collisions and airtime contention, improving retransmission rates.

Why Option E (Dynamic Channel Assignment) is Correct?

Avoids Overlapping Channels

DCA dynamically assigns APs to non-overlapping channels (e.g., 1, 6, 11 in 2.4 GHz).

Ensures APs do not share channels unnecessarily, reducing co-channel interference.

Self-Healing for Interference

If new APs introduce interference, DCA reassigns channels to optimize the RF environment.

Why Other Options Are Incorrect?

Option A: Cisco Compatible Extensions (CCX)

CCX ensures client compatibility but does not mitigate interference.

Option C: Enhanced Distributed Channel Access (EDCA)

EDCA prioritizes voice/video traffic (QoS) but does not address co-channel interference.

Option D: Coverage Hole Detection (CHD)

CHD identifies weak coverage areas but does not reduce interference.

Reference:

Cisco Wireless LAN Controller Configuration Guide

TPC and DCA are part of RRM (Radio Resource Management) for interference mitigation.

Enterprise Mobility 4.1 Design Guide

Recommends DCA + TPC for high-density deployments.

Explanation:

Why Option C is Correct?

Channel Bonding for 802.11a (5 GHz):

The requirement is to bond channels in groups of two, which means using 40 MHz channel width (not 20 MHz).

802.11a (5 GHz) is ideal for high-density environments because it offers:

More non-overlapping channels (e.g., 36, 40, 44, 48, etc.).

Less interference compared to 2.4 GHz (802.11b/g).

Management Frames at 24 Mbps (Mandatory):

Setting 24 Mbps as Mandatory ensures:

All APs must send management frames (beacons, probes, etc.) at 24 Mbps.

Clients must support this rate to connect, preventing slow devices from dragging down performance.

Supported (optional) rates would allow slower transmissions, defeating the goal.

Why Other Options Are Incorrect?

Option A: 802.11b at 40 MHz + 24 Mbps Mandatory

802.11b (2.4 GHz) should never use 40 MHz in high-density deployments because:

Only three non-overlapping channels exist (1, 6, 11).

Bonding them would cause massive co-channel interference.

Option B: 802.11a at 40 MHz + 24 Mbps Supported

"Supported" (optional) data rates allow clients/APs to use slower rates, failing the requirement for management frames at 24 Mbps.

Option D: 802.11b at 40 MHz + 24 Mbps Supported

Double wrong:

40 MHz in 2.4 GHz is disastrous for interference.

"Supported" rates don’t enforce 24 Mbps for management frames.

Reference:

Cisco High-Density Design Guide

Recommends 5 GHz (802.11a/n/ac) with 40 MHz channels for capacity.

Mandatory 24 Mbps data rates prevent airtime waste from slow clients.

CWNP Certified Wireless Design Professional (CWDP)

Channel bonding in 2.4 GHz is prohibited in high-density scenarios.

Explanation:

Why Option A is Correct?

Regulatory Domain Restrictions:

Different countries have different Wi-Fi channel regulations. For example:

Channel 36-48 (5 GHz) is allowed in the EU but restricted in some countries (e.g., Middle East).

DFS channels (52-144) may be unavailable in regions with radar systems.

A centralized controller cluster in Europe might:

Push EU-approved channels to APs in other regions, causing compliance violations.

Disable locally permitted channels, reducing available spectrum.

Impact on Performance:

APs in non-EU offices may lack optimal channels, leading to:

Congestion (fewer channels available).

Interference (overlapping channels).

Why Other Options Are Incorrect?

Option B: Different RF Policies per Office

RF policies can still be customized per site using AP groups or RF profiles, even with centralized controllers.

Option C: Syslog Time-Zone Configuration

While time-zone sync is important, it’s a general logging issue, not a showstopper for global controller clustering.

Option D: Centralized Authentication for Global Users

Centralized controllers can authenticate global users via:

RADIUS servers (e.g., Cisco ISE).

Local authentication fallback (FlexConnect).

Reference:

Cisco Wireless LAN Controller Configuration Guide

Highlights regulatory domain compliance as a critical consideration for global deployments.

IEEE 802.11 Country Code Standards

Lists country-specific channel restrictions.

Explanation:

Why FT (802.11r) is the Right Choice?

Purpose of Fast Transition (802.11r):

Eliminates reauthentication delays by caching security keys during the initial connection.

Clients skip full 802.1X reauthentication when roaming between APs, reducing handoff time from ~300 ms to ~50 ms.

Critical for VoWiFi, real-time apps, and high-density environments.

Key Caching Mechanism:

Uses PMK (Pairwise Master Key) caching to preserve session keys.

Works with WPA2-Enterprise/WPA3-Enterprise (802.1X).

Why Other Options Fail to Address Reauthentication Delays?

A) PEAP: Just an EAP method (authentication protocol), doesn’t optimize roaming.

C) PMF (Protected Management Frames): Security feature for preventing attacks, unrelated to roaming speed.

D) GTK-Randomization: Enhances security by randomizing group keys but doesn’t reduce reauthentication time.

Reference:

Cisco WLC Configuration Guide: Recommends 802.11r for fast roaming in 802.1X networks.

IEEE 802.11r Standard: Defines Fast Transition for seamless BSS-to-BSS handoffs.

Configuration Example:

Explanation:

Why 10 mW is the Best Choice for Predictive Design?

Predictive Design Goals:

Minimize Interference: Lower power reduces cell overlap and co-channel interference.

Optimize AP Density: More APs at lower power improve capacity and roaming.

Location Readiness: Fine-grained RF coverage enhances location accuracy (e.g., Cisco CMX).

Why Not Higher Power?

20/50 mW creates larger cells, increasing interference and reducing capacity.

18 mW is non-standard and rarely used in enterprise designs.

Cisco Best Practices:

Predictive tools (e.g., Ekahau, Cisco DNA Center) default to 10–15 mW for high-density deployments.

10 mW balances coverage and interference mitigation.

Reference:

Cisco Wireless LAN Design Guide: Recommends lower Tx power for high-density/location-aware networks.

Ekahau Pro Design Guidelines: Uses 10 mW as a baseline for predictive surveys.