Free 350-401 Practice Test Questions 2026

✅Explanation:

This command enables Fast Transition (FT, also known as 802.11r) on a WLAN configured with a Pre-Shared Key (PSK). Fast Transition is a feature that reduces roaming latency for clients moving between access points, creating a seamless experience for voice and video applications.

The command format is specific: the ft element must be inserted directly into the security wpa akm command to enable FT for PSK-based authentication. The full configuration on a Cisco Catalyst 9800 would also include the security ft command and setting the PSK key, but the command that specifically enables AKM for FT with PSK is security wpa akm ft psk.

Why other options are incorrect:

A. security ft adaptive:
This command enables Adaptive 802.11r, a mode for mixed environments, but does not by itself configure the necessary authentication key management (AKM) for Fast Transition. The question asks for the command to enable FT on a corporate WLAN, implying a full configuration including AKM.

B. security wpa akm dot1x:
This configures the WLAN to use 802.1X authentication (Enterprise), not Pre-Shared Key (PSK). It does not enable Fast Transition.

C. security wpa akm psk:
This enables PSK authentication for the WLAN, but it does not enable Fast Transition. Without the ft keyword, Fast Transition is not active.

🔗 References:

Cisco Vulnerability Advisory: Provides configuration examples for PSK with Adaptive 11r (security ft adaptive & security wpa akm psk) and 11r-PSK (security ft & security wpa akm ft psk).

Cisco Catalyst 9800 Configuration Guide:Details the CLI steps for setting up 802.11r Fast Transition on a PSK WLAN, including the command security wpa akm ft psk.

Explanation:

The standard that provides the capability to permit or deny network connectivity based on the user or device identity is IEEE 802.1X. This standard defines port-based network access control (PNAC), which restricts access to the network until a client device or user successfully authenticates.

How 802.1X Works
When a device connects to a port that is secured with 802.1X, the port is in an unauthorized state. This allows only Extensible Authentication Protocol over LAN (EAPOL) traffic to pass through while blocking all other data, effectively denying network connectivity. The switch (acting as the authenticator) then requests the client's identity and relays this information to a central authentication server, typically a RADIUS server. If the server verifies the client's credentials (such as a username/password, a certificate, or a device MAC address), it sends an "accept" message, and the switch transitions the port to an authorized state, granting the device full network access.

Why Other Options Are Incorrect:

A. 802.1d
– This is the standard for the original Spanning Tree Protocol (STP), which prevents loops in a network by creating a loop-free logical topology. It does not involve authentication or access control.

C. 802.1q
– This is the standard for VLAN tagging and defines how VLAN membership information is inserted into Ethernet frames. It segments network traffic but does not authenticate users or devices.

D. 802.1w
– This is the standard for Rapid Spanning Tree Protocol (RSTP), which provides faster convergence than the original STP in case of network topology changes. It does not provide access control or authentication functions.

References
IEEE 802.1X-2020 standard abstract
Cisco configuration guides on 802.1X port-based authentication
Glossary definitions of IEEE 802.1 standards

✅ Explanation:

The correct answer is B. WPA3 Enterprise. This is the only wireless Layer 2 security method that meets both requirements for the new SSID: broadcasting on 6 GHz radios and authenticating users with EAP-TLS.

Why other options are incorrect:

A. WPA2 Enterprise:
This is incorrect because WPA2 is not permitted on the 6 GHz band. The 6 GHz band requires WPA3 security to be operational.

C. WPA3 Personal:
While this provides the required WPA3 security for 6 GHz, it uses Simultaneous Authentication of Equals (SAE) with a pre-shared key. This does not support the certificate-based authentication required by EAP-TLS.

D. WPA2 Personal:
This is incorrect for the same reasons as option A. WPA2 is not supported on the 6 GHz band, and a PSK would not support EAP-TLS authentication.

🔗 References
Cisco Official Documentation: Confirms that WPA2 is not supported on the 6 GHz band and WPA3 must be enabled.

Wi-Fi 6E Glossary Definitions: States that the Wi-Fi Alliance mandates WPA3-only security for certified Wi-Fi 6E networks and devices.

✅ Explanation:

In a high-density wireless environment, the primary goal is to increase capacity by creating smaller, more numerous coverage cells. The most direct action to control the maximum cell size is to decrease the transmit (TX) power on the access points. By lowering the TX power, the RF signal does not travel as far, reducing the physical coverage area of the cell. This allows more access points to be deployed in a given physical space, increasing the overall capacity of the network to handle more concurrent users. This approach is the most direct and effective method for controlling cell size.

Why other options are incorrect:

A. Statically set TX power on access points to max.
This would create very large cells, increasing overlap and co-channel interference, which degrades performance in high-density environments. This is the opposite of what should be done.

B. Disable low data rates.
Disabling low data rates prevents clients from operating at the edge of the cell, effectively shrinking the usable area of each AP's coverage. While this does help reduce cell size, it is a secondary strategy. Adjusting TX power is the primary and most direct physical method to control the actual RF cell boundary.

C. Set mandatory data rates.
Setting mandatory data rates is a configuration that controls which data rates clients must support to associate. Similar to disabling low rates, this helps manage client behavior and can shrink the usable cell edge, but it does not directly change the physical RF signal strength. The cell boundaries are still determined by TX power and the physical environment.

🔗 References

Cisco Wireless Design Best Practices:In high-density environments, reducing the power level of the APs is the primary method to decrease cell size and increase network capacity.

CWNA Official Study Guide: Defines cell size and explains how TX power directly controls the radius of a basic service set (BSS) coverage area.

✅ Explanation:

In wireless networking, SNR is the measurement that directly compares the received signal strength to the background noise level. It is a fundamental metric for assessing the quality of a wireless link. SNR is calculated by dividing the received signal power by the noise power (typically expressed in decibels, dB). A higher SNR indicates that the signal is much stronger than the noise, leading to better performance, higher data throughput, and more stable connections. Conversely, a low SNR means the signal is weak relative to the noise, which can cause packet loss, retransmissions, and degraded performance.

Why other options are incorrect:

A. free space path loss:
This is a measure of the theoretical loss in signal strength that occurs as an electromagnetic wave travels through free space (a vacuum) over a given distance. It does not compare the received signal to background noise.

B. link power budget:
This is a total, planned calculation that accounts for all gains and losses in a link to ensure the receiver gets a strong enough signal. It typically includes factors like transmitter power, cable losses, antenna gains, and path loss, but it is not a measurement that compares the received signal to background noise. It is a planning tool, not a post-deployment measurement.

C. fading:
Fading is a variation in signal strength caused by changes in the propagation path, such as multipath interference or shadowing. It is a phenomenon that affects the signal, but it is not the measurement that compares the signal to noise.

🔗 References:

Cisco TAC Technical Documents: SNR defined as "the difference between the received signal and the noise floor."

CWNP (Certified Wireless Network Professional) Glossary: SNR is the direct ratio of the received signal power to the noise power, used to measure link quality.

✅ Explanation:

The Primary/Secondary/Tertiary controllers are configured and saved directly at the AP level in its nonvolatile memory (NVRAM). This method is known as priming the access point. When an AP is primed, the IP addresses of up to three controllers are stored in its NVRAM so it can remember them after a reboot or power failure. If the AP's current primary controller fails, it will attempt to join controllers from its list in this order: primary, secondary, then tertiary. This primed list is distinct from backup controllers configured at the WLC level.

Why other options are incorrect:

B. stored WLC information:
This describes the AP's cached list of up to 8 WLC addresses from its previous controller's mobility group. It is stored in NVRAM but is not manually configured like the Primary/Secondary/Tertiary list. This is a different, automatically populated memory.

C. DNS:
DNS is used to resolve CISCO-CAPWAP-CONTROLLER.localdomain for controller discovery, but this method is not configured in and stored by NVRAM; it relies on DNS server configuration.

D. IP Helper Addresses:
This is a router configuration used to forward broadcast traffic (like DHCP requests), not a method stored on the AP itself. It helps APs find DHCP servers, not directly join HA controllers.

🔗 References

Cisco Catalyst AP Installation Guide: "If the access point was previously joined to a controller, the IP addresses of the primary, secondary, and tertiary controllers are stored in the access point's nonvolatile memory"

Cisco Learning Network Discussion: Details how Primary/Secondary/Tertiary controllers are manually configured and saved at the AP level in NVRAM

✅ Explanation:

AP mode that allows an engineer to scan configured channels for rogue access points is monitor mode.

In this mode, the access point's radios are dedicated to monitoring the Wi-Fi channel for activities like rogue detection and Intrusion Detection Systems (IDS), and it does not serve client traffic.

Why other options are incorrect:

A. sniffer:
In this mode, the AP captures all Wi-Fi traffic on a channel and forwards it to a packet analyzer for troubleshooting and analysis. It is used for capturing wireless frames, not for scanning configured channels for rogue access points.

C. bridge:
This mode establishes a point-to-point or point-to-multipoint wireless link between network segments, often used for mesh networks. It is not dedicated to scanning for rogue APs.

D. local:
This is the default operating mode where the AP provides wireless client access and tunnels traffic back to the controller. While a local mode AP can be configured to perform rogue detection, it is not a dedicated scanning mode.

🔗 References

Cisco Wireless Controller Configuration Guide, Release 8.8 - Managing APs

✅ Explanation:

Traditional security architecture focuses on a strong perimeter at the Internet edge, protecting against threats entering or leaving the network (north-south traffic). This "castle-and-moat" approach assumes that once inside, traffic is trustworthy.

However, this assumption is no longer valid. Threats that breach the perimeter can now move laterally (east-west) across the internal network for extended periods, searching for valuable data. An NGFW at the data center core is placed in the internal traffic path to inspect and control this communication between trusted systems, preventing the spread of an attack from a compromised server to other critical assets. This is a fundamental security enhancement driven by the modern threat landscape.

Why other options are incorrect:

A. virtual private network for remote access:
This is incorrect. Remote access VPNs are a standard feature of edge firewalls and are not a new security enhancement added solely by deploying an NGFW at the data center.

B. DDoS protection:
While an NGFW can offer some DDoS protection, this is traditionally a primary function of Internet edge devices and is not the new benefit gained from a data center NGFW, which is focused on internal traffic.

D. firewall protection of the south-north traffic at the data center:
This is incorrect. South-north (or north-south) traffic is the traditional edge traffic that the firewall at the Internet edge already protects. The new and crucial enhancement is the protection of east-west internal traffic, which had previously been left unscrutinized.

🔗 References

Fortinet White Paper: Notes that "hackers penetrating the perimeter now roam the network for days or weeks," meaning the threat has expanded to the data center core where data moves between trusted systems.

Expert Insights: Explains that perimeter firewalls alone fall short because east-west traffic gets a free pass, allowing attackers to move laterally.

✅ Explanation:

A Type 1 hypervisor, also known as a bare-metal hypervisor, is installed directly onto a server's physical hardware without requiring an underlying operating system . This architecture is distinct from a Type 2 hypervisor, which runs as a software layer on top of a host OS .

Why other options are incorrect:

A. It runs on top of the host operating system.
This describes a Type 2 hypervisor, not a Type 1. A Type 1 hypervisor bypasses the host OS entirely and runs directly on hardware .

B. It is preferred for supporting nonproduction workloads.
Type 2 hypervisors are generally preferred for nonproduction tasks like development and testing due to their ease of installation on existing systems . Type 1 hypervisors are the standard for enterprise production workloads due to their superior performance and isolation.

C. It has greater latency than a Type 2 hypervisor.
This is incorrect. Because a Type 1 hypervisor runs directly on hardware without the extra OS layer, it experiences lower latency and provides higher performance than Type 2 hypervisors .

🔗 References

PhoenixNAP Bare Metal Hypervisor Explanation: Details that Type 1 hypervisors run directly on physical hardware, offering near-native performance and a smaller attack surface without an intermediary OS .

DigitalOcean Conceptual Article: Defines a bare-metal hypervisor as virtualization software installed directly on a server’s physical hardware, contrasting it with hosted hypervisors that run on top of an existing OS .

✅ Explanation:

SSO (Stateful Switchover) is a high-availability feature that works with HSRP to minimize network disruptions, but the key to this question is understanding what SSO does and how it interacts with HSRP.

SSO provides Route Processor (RP) redundancy by establishing one RP as the active processor and another as the standby processor, synchronizing critical state information between them. When the active RP fails, the standby RP takes over control of the same device.

Why other options are incorrect:

A. It enables HSRP to elect another switch in the group as the active HSRP switch.
This describes what happens without SSO. With SSO, the standby RP takes over on the same device, and the HSRP active router does not change.

B. It ensures fast failover in the case of link failure.
Link failure is not the primary scenario addressed by SSO with HSRP. SSO protects against RP failure on the device itself, not link failures.

C. It enables data forwarding along known routes following a switchover, while the routing protocol reconverges.
This describes Nonstop Forwarding (NSF), which often works alongside SSO but is not the function of SSO with HSRP. NSF ensures data forwarding continues during routing protocol reconvergence; SSO with HSRP preserves the HSRP virtual gateway state during an RP switchover.

🔗 References:

Cisco Documentation - SSO HSRP: "When an RP is active and the other RP is standby, SSO enables the standby RP to take over if the active RP fails... HSRP SSO information is synchronized to the standby RP, allowing traffic that is sent using the HSRP virtual IP address to be continuously forwarded during a switchover without a loss of data or a path change"

Cisco FHRP-SSO Aware HSRP: "If the active RP fails, no change occurs to the HSRP group itself and traffic continues to be forwarded through the current active gateway router"

✅ Explanation:

The language used to model configuration and state data is YANG (Yet Another Next Generation). YANG is a data modeling language originally designed to model configuration and state data manipulated by the Network Configuration Protocol (NETCONF), as well as Remote Procedure Calls and notifications . Since its inception, YANG has also been adopted for use with other protocols like RESTCONF, cementing its role as the standard language for network data modeling .

Why other options are incorrect

A. JSON:
JSON (JavaScript Object Notation) is a data encoding format, not a data modeling language. While YANG-modeled data can be encoded in JSON for transmission , JSON itself does not define the structure or constraints of the data—it is the representation, not the model.

B. XML:
XML (Extensible Markup Language) is also a data encoding format, not a modeling language. Similar to JSON, YANG data can be encoded in XML , but XML only defines the syntax of the data instance, not the underlying data model, which is defined by YANG.

C. XDR:
XDR (External Data Representation) is a standard for data serialization, commonly used in systems like Sun RPC (Remote Procedure Call). It is not a data modeling language used for network configuration protocols like NETCONF or RESTCONF, nor is it the standard for modeling configuration and state data in modern network management.

🔗 References

RFC 7950: Defines YANG as a data modeling language for configuration and state data .

IETF YANG 2.0 Draft: States YANG is used to model configuration data, state data, Remote Procedure Calls, and notifications .