Free Cisco 300-425 Practice Questions 2026 | Designing Cisco Enterprise Wireless Networks (ENWLSD)

Explanation:

Why Option A (firewall port 16666) is Correct?

Mobility Tunnels Use UDP Port 16666
In Cisco Wireless LAN Controllers (WLCs), inter-controller mobility tunnels rely on UDP port 16666 for communication.
If a firewall is blocking this port, the mobility tunnel will fail to establish.

Validation Steps:
Check firewall rules to ensure UDP 16666 is allowed between all WLCs in the mobility group.
Use tools like telnet (TCP test) or nc (netcat for UDP) to verify reachability.

Why Option B (mapping) is Correct?

The mapping Command Tests Mobility Tunnel Connectivity
The mapping command on the WLC checks if:
The UDP 16666 tunnel can be established.
The peer WLC is reachable.
If this fails, it confirms a network/firewall issue.

Why Other Options Are Incorrect?

Option C (mepping) – Typo, Invalid Command
This is a misspelling of mapping and does not exist as a valid command.

Option D (rping) – Not Relevant for Mobility Tunnels
rping is used for CAPWAP discovery, not mobility tunnel troubleshooting.

Option E (firewall IP protocol 97) – Incorrect Protocol
Protocol 97 is not used for mobility tunnels (they use UDP 16666).

This is a distractor with no relevance to WLC mobility.

Reference:
Cisco Wireless LAN Controller Configuration Guide
Mobility tunnels require UDP 16666 between controllers.
The mapping command is the primary tool for testing tunnel connectivity.

Firewall Requirements:
Must allow UDP 16666 bidirectional traffic between all WLCs in the mobility group.

Explanation:

Why Option C is Correct?

FlexConnect APs Require a FlexConnect Group for 802.11r Fast Transition (FT):

802.11r Fast Transition (FT) is supported on FlexConnect APs, but only if they are part of a FlexConnect group.

Without being in a FlexConnect group, the APs do not properly apply the WLAN’s 802.11r FT policies, leading to roaming failures.

Impact of Missing FlexConnect Group:

Local mode APs handle 802.11r FT natively, but FlexConnect APs require:

A FlexConnect group to enforce consistent roaming policies.

The WLAN’s 802.11r FT settings to be properly inherited.

If the APs are not in a group, they default to basic roaming, causing delays and voice quality issues.

Why Other Options Are Incorrect?

Option A: "They do not support 802.11r FT."

False. FlexConnect APs do support 802.11r FT, but only when properly configured in a FlexConnect group.

Option B: "They must be added into AP groups along with a common RF profile."

AP groups (different from FlexConnect groups) help with RF settings but do not enable 802.11r FT for FlexConnect APs.

Option D: "They must be added to AP groups to support fast roaming methods."

AP groups are for RF tuning, not 802.11r FT enforcement—FlexConnect groups are mandatory for FT.

Reference:

Cisco FlexConnect Deployment Guide

802.11r FT requires FlexConnect groups for proper roaming behavior.

Cisco Wireless LAN Controller Configuration Guide

FlexConnect APs must be in a group to apply advanced WLAN features like 802.11r.

Solution:

Create a FlexConnect group (if not existing).

Add the APs to the group.

Verify 802.11r FT is enabled on the WLAN.

Explanation:

Why Option D is Correct?

802.11v BSS Transition Management (BTM) Provides Roaming Recommendations

802.11v BTM allows APs to suggest or direct clients (especially VoWLAN devices) to roam to a better AP without forcing non-voice clients to comply.

This is ideal for VoWLAN because:

Voice clients get assisted roaming (better call quality).

Data clients remain unaffected (no forced roaming).

How It Works:

APs send BSS Transition Management frames to recommend roaming.

Voice clients (like IP phones) prioritize these hints for seamless handoffs.

Non-voice clients ignore suggestions if their connection is stable.

Why Other Options Are Incorrect?

Option A: 802.11r Fast Transition

802.11r speeds up reauthentication during roaming but does not provide roaming suggestions.

It’s useful for fast roaming but doesn’t differentiate between voice/data clients.

Option B: 802.11k Neighbor Lists

802.11k helps clients discover nearby APs but does not actively recommend roaming.

It’s a passive tool for scanning, not proactive steering like 802.11v.

Option C: CCKM with 802.1X

CCKM (Cisco Centralized Key Management) is for fast secure roaming (reduces reauthentication time).

It does not provide roaming recommendations—it’s purely a security optimization.

Reference:

Cisco Wireless LAN Configuration Guide, "802.11v BSS Transition Management"

Describes how BTM improves VoWLAN roaming without impacting data clients.

Cisco VoWLAN Design Best Practices

Recommends 802.11v for voice clients to reduce latency during calls.

Explanation:

Why Option A is Correct?

Sticky Client Problem occurs when wireless clients remain connected to a distant or weak AP (low RSSI) instead of roaming to a stronger one, degrading performance.

Configuring an RSSI Threshold forces clients to disconnect when their signal strength drops below a set level, encouraging them to roam to a better AP.

Example: Setting an RSSI threshold of -75 dBm ensures clients proactively seek a stronger AP before the connection degrades.

Optimized Roaming Feature relies on RSSI thresholds to improve client handoffs.

Why Other Options Are Incorrect?

Option B: Disable DFS

DFS (Dynamic Frequency Selection) is used for 5GHz channel selection and has no impact on sticky clients. Disabling it would reduce available channels, worsening performance.

Option C: Disable 802.11k

802.11k (Neighbor Reports) helps clients discover nearby APs for better roaming decisions. Disabling it would worsen roaming, not improve it.

Option D: Enable Data Rates

While adjusting data rates can influence client behavior, it does not directly solve sticky clients. RSSI thresholds are the proven method for forcing better roaming.

Reference:

Cisco Wireless LAN Controller Configuration Guide – Recommends RSSI thresholds for sticky client mitigation.

Enterprise Mobility 4.1 Design Guide – Highlights Optimized Roaming with RSSI-based client steering.

Explanation:

Why Option B (Kitchen) is Correct?

Microwave Ovens

Operate in the 2.4 GHz band (same as Wi-Fi) and cause significant interference.

Even modern "RF-shielded" microwaves can leak noise.

Bluetooth Devices (Wireless Headsets, Thermometers)

Many medical/kitchen Bluetooth devices use 2.4 GHz, adding to congestion.

Why Option E (Patient Room) is Correct?

Wireless Medical Devices

Patient monitors, infusion pumps, and IoT sensors often use 2.4 GHz or 5 GHz bands.

Example: Zigbee (2.4 GHz) for hospital equipment.

Wi-Fi Clients (Tablets, Smartphones, VoWiFi Phones)

High density of personal/medical devices leads to co-channel interference.

Why Other Options Are Incorrect?

Option A (Magnetic Resonance Imaging - MRI)

MRI machines generate strong magnetic fields, not RF noise in Wi-Fi bands.

They do not operate at 2.4/5 GHz; interference is rare unless poorly shielded.

Option C (Gamma Knife Radiation Treatment)

Gamma Knife uses focused gamma rays, not RF emissions.

No overlap with Wi-Fi frequencies.

Option D (X-ray Radiography)

X-rays are ionizing radiation, not RF signals.

They do not interfere with Wi-Fi.

Reference:

Cisco Wireless LAN Design Guide for Healthcare

Identifies kitchens and patient rooms as high-interference zones due to microwaves and medical IoT.

Explanation:

Why Option B is Correct?

RSSI (Received Signal Strength Indicator) for Voice Services

For VoWiFi (Voice over Wi-Fi), Cisco recommends a minimum RSSI of -67 dBm to ensure clear voice quality.

-67 dBm ensures sufficient signal strength for low-latency, jitter-free calls.

Lower values (e.g., -70 dBm or worse) lead to choppy audio and dropped calls.

Why Option C is Correct?

Retransmission Rate for Voice Quality

A retransmission rate ≤ 15% is critical for voice traffic.

High retransmissions (>15%) indicate:

Interference (co-channel or non-Wi-Fi).

Poor signal strength (weak RSSI).

Congestion (too many clients).

Voice traffic is latency-sensitive, so excessive retransmissions degrade call quality.

Why Other Options Are Incorrect?

Option A: Noise floor ≤ -87 dBm
While a low noise floor is good, -87 dBm is too lenient for voice.

Cisco recommends ≤ -90 dBm for voice networks.

Option D: Retransmissions ≤ 20%
20% is too high for voice.

VoWiFi requires ≤ 15% for acceptable quality.

Option E: RSSI ≥ -65 dBm
While -65 dBm is excellent, -67 dBm is the Cisco minimum requirement.

This option is too strict for general deployment.

Reference:
Cisco VoWLAN Design Guide (7925G/8821 IP Phones)
RSSI ≥ -67 dBm for voice coverage.

Retransmissions ≤ 15% for reliable voice.

CWNP (Certified Wireless Network Professional) Voice over Wi-Fi Best Practices

Confirms 15% retransmission threshold for voice.

Explanation:

Why Option B is Correct?

Mobility Tunnels Use UDP 16666

Primary Data Path: Cisco WLCs use UDP port 16666 for inter-controller mobility tunneling (client roaming data).

Firewall Requirement: Must allow UDP 16666 bidirectionally between WLCs.

Protocol 97 for Control Path (Management Ports)

Secondary Control Path: Some WLCs (especially in split-MAC architectures) use Protocol 97 (EtherIP) for management communication.

Firewall Requirement: Must allow IP Protocol 97 between WLC management interfaces.

Testing with mapping Command

Use mapping to verify UDP 16666 connectivity.

Ensure Protocol 97 is open for management sync (if applicable).

Why Other Options Are Incorrect?

Option A: Protocol 96

Protocol 96 is invalid—Cisco mobility uses Protocol 97 (EtherIP) for management.

Option C/D: UDP 16667

UDP 16667 is incorrect—Cisco’s official docs specify UDP 16666 for mobility tunnels.

Reference:

Cisco Wireless LAN Controller Configuration Guide

Mobility tunnels require UDP 16666 for data and Protocol 97 (EtherIP) for management.

Cisco TAC Bulletin on Firewall Rules for Mobility

Confirms UDP 16666 and Protocol 97 must be open.

Explanation:

Why Option A is Correct?

Impact of Full Reauthentication on Voice Calls

When a VoWiFi client roams and performs full 802.1X reauthentication, it introduces latency (100–300 ms).

This causes gaps or drops in voice conversations, degrading call quality.

Solution: Use fast roaming methods (e.g., 802.11r, CCKM, OKC) to skip full reauth.

Why Option E is Correct?

802.1X Alone Forces Full Reauthentication

By default, 802.1X without fast roaming requires:

A new 4-way handshake (WPA2/WPA3).

Full EAP reauthentication (e.g., PEAP, EAP-TLS).

This slows roaming and disrupts real-time traffic like voice.

Solution: Enable 802.11r (Fast Transition) or CCKM for seamless roaming.

Why Other Options Are Incorrect?

Option B: Roaming time increases with 802.1X + CCKM

False. CCKM (Cisco Centralized Key Management) reduces roaming time by caching keys and skipping full EAP.

Option C: Roaming requires seeing four APs

False. Roaming decisions are based on RSSI, SNR, and band steering, not a fixed AP count.

Option D: Roaming at -80 dBm

Misleading. While clients may roam at -80 dBm, this is not a strict rule.

Voice networks often enforce -67 dBm RSSI thresholds for proactive roaming.

Reference:

Cisco VoWLAN Design Guide

Recommends 802.11r/CCKM to avoid full reauthentication gaps.

CWNP Voice over Wi-Fi Best Practices

Confirms 802.1X alone is unsuitable for voice roaming.

Key Takeaways for Voice Roaming:

Avoid full 802.1X reauthentication (use 802.11r/CCKM).

Set RSSI thresholds (e.g., -67 dBm) to force timely roaming.

Enable 802.11k/v for assisted roaming.

Explanation:

Why Option A (Interface Group) is Correct?

Interface Groups allow multiple dynamic interfaces (VLANs) to be mapped to a single WLAN.

This is useful when different sites/facilities need unique VLAN assignments for the same SSID.

Example:

Site A uses VLAN 10 for the "Employee" WLAN.

Site B uses VLAN 20 for the same "Employee" WLAN.

Flexibility:

Simplifies WLAN-to-VLAN mappings without creating separate WLANs for each location.

Why Option C (AP Group) is Correct?

AP Groups enable per-AP or per-site VLAN assignments.

APs in different facilities can be grouped and assigned unique VLANs for the same WLAN.

Example:

AP Group "HQ" maps "Employee" WLAN to VLAN 10.

AP Group "Branch" maps "Employee" WLAN to VLAN 20.

Granular Control:

Allows site-specific policies (VLANs, QoS, RF settings) without extra WLAN configurations.

Why Other Options Are Incorrect?

Option B (Mobility Group)

Mobility groups facilitate inter-controller roaming but do not control VLAN mappings.

Option D (Controller Group)

Controller groups (not a standard Cisco term) are irrelevant to WLAN-to-VLAN flexibility.

Option E (RF Group)

RF groups optimize channel and power management across controllers but do not affect VLAN assignments.

Reference:

Cisco Wireless LAN Controller Configuration Guide

Interface Groups: Allow WLANs to map to multiple VLANs dynamically.

AP Groups: Assign VLANs based on AP location/role.

Enterprise Mobility 4.1 Design Guide

Recommends AP Groups + Interface Groups for multi-site VLAN flexibility.

Explanation:

Why Option D is Correct?

Mismatch in Encryption Settings Between AireOS and Catalyst 9800-CL:

AireOS 5520 (v8.8.120.0) supports encrypted mobility tunnels by default (if configured).

Catalyst 9800-CL (v16.10.1e) requires explicit data-link-encryption configuration to match the AireOS encryption setting.

If 9800-CL lacks this config, the data path fails (control path may still work).

Symptom:

Control path up (mobility peer shows as "UP" in show mobility summary).

Data path down (no client traffic passes between controllers).

Why Other Options Are Incorrect?

Option A: Incorrect Certificate Hash Key

Certificate issues would break both control and data paths (not just data).

Option B: Encrypted Mobility on AireOS 5520

Encrypted mobility is supported between AireOS and Catalyst 9800-CL.

The issue is missing config on 9800-CL, not incompatibility.

Option C: Disabled Data-DTLs on AireOS 5520

data-dtl s is not a valid AireOS command (misleading option).

Reference:

Cisco Catalyst 9800-CL Configuration Guide (v16.10)

Requires data-link-encryption enable for encrypted mobility with AireOS.

Cisco TAC Case Study #WLC-MOBILITY-ENC

Confirms control path up + data path down is typical of encryption mismatches.