Free Cisco 300-425 Practice Questions 2026 | Designing Cisco Enterprise Wireless Networks (ENWLSD)

Explanation:

AP Failover Priority Levels

Cisco Wireless LAN Controllers (WLCs) use priority levels (1-4) to determine the order in which APs failover to a backup controller:

Priority 1 (Critical) → Highest priority (fails over first)

Priority 2 (High)

Priority 3 (Medium)

Priority 4 (Low) → Lowest priority (fails over last)

Why Option A is Correct

Priority 1 is the highest possible priority.

APs marked as critical (priority 1) will failover before lower-priority APs if the primary WLC fails.

This ensures mission-critical APs (e.g., for voice, medical, or security) reconnect fastest.

Why Other Options Are Incorrect

Option B (Wrong Priority Assignment) → Priority 4 is the lowest, not highest.

Option C (Correct Description, But Not Best Answer) → While true that priority 4 is lowest, it doesn’t answer the question about priority 1.

Option D (Incorrect Priority Definition) → Priority 1 is critical (highest), not medium.

Reference:

Cisco Wireless LAN Controller Configuration Guide, Release 8.10 → Documents AP failover priority levels (1-4).

Cisco High Availability Design Guide → Recommends priority 1 for critical APs (e.g., emergency services).

Explanation:

Issue Description:

APs in Location A are statically configured with:

Primary = WLC-A

Secondary = WLC-B

When WLC-A fails, APs successfully join WLC-B (as expected).

However, when WLC-A comes back online, APs do not automatically fail back to their primary controller.

Root Cause:

By default, AP Fallback is disabled on Cisco WLCs.

Even if APs are configured with a primary/secondary controller, they will not automatically revert to the primary unless fallback is enabled.

Solution:

Enable AP Fallback globally on the WLC (Option C).

This forces APs to reconnect to their primary controller (WLC-A) when it becomes available again.

Why Other Options Are Incorrect:

Option A (CAPWAP AP Controller IP Address command) → Already configured (static primary/secondary). This does not enable fallback.

Option B (DHCP Option 43) → Used for initial AP discovery, not fallback behavior.

Option D (AP Failover Priority) → Controls failover order, not fallback.

Reference:

Cisco Wireless LAN Controller Configuration Guide → States that AP Fallback must be manually enabled for automatic reversion to primary.

Cisco High Availability Best Practices → Recommends enabling fallback for redundancy setups.

Explanation:

Key Concepts:

RX-SOP (Receiver Start of Packet Threshold)

Controls the minimum signal strength (RSSI) at which an AP will process incoming 802.11 frames.

Higher RX-SOP values (e.g., -65 dBm) ignore weaker signals, reducing interference.

Lower RX-SOP values (e.g., -80 dBm) allow processing of weaker signals.

RX-SOP Levels for 802.11a (5 GHz)

Low: -85 dBm (default)

Medium: -82 dBm

High: -77 dBm

Scenario Details:

RSSI of received packets: -77 dBm

RX-SOP setting: Medium (-82 dBm)

Since -77 dBm > -82 dBm, the AP will process the frames.

Why Option D is Correct:

The 5 GHz radio (802.11a) receives and decodes the frames because:

The RSSI (-77 dBm) is stronger than the RX-SOP Medium threshold (-82 dBm).

The AP does not ignore the frames.

Why Other Options Are Incorrect:

Option A (Non-Wi-Fi frames) → Incorrect, because -77 dBm is above the RX-SOP threshold, so frames are valid Wi-Fi signals.

Option B (2.4 GHz radio) → Incorrect, because the frames are received on the 802.11a (5 GHz) radio, not 2.4 GHz.

Option C (Non-Wi-Fi on 2.4 GHz) → Incorrect for the same reasons as A and B.

Reference:

Cisco RF Profile Configuration Guide → Explains RX-SOP thresholds and their impact on frame processing.

Cisco Wireless LAN Controller Best Practices → Recommends adjusting RX-SOP to balance coverage and interference.

Explanation:

Key Concept:

The human body causes signal attenuation (weakening) of approximately 3 dB when obstructing a wireless signal.

This means the signal strength is halved (since a 3 dB loss = 50% power reduction).

Why This Matters in Wireless Design:

In high-density environments (e.g., offices, stadiums), human movement can cause fluctuations in signal strength.

Designers must account for this when planning AP placement and coverage overlap.

Why Other Options Are Incorrect:

Option B (4 dB) & Option C (6 dB) → Overestimates typical human body attenuation.

Option D (12 dB) → Far too high; this would apply to denser obstructions (e.g., concrete walls).

Reference:

Cisco Wireless LAN Design Best Practices: Recommends accounting for 3 dB human attenuation in capacity planning.

Explanation:

Key Problem:

Co-channel interference in a 5 GHz network with 40 MHz channels and three SSIDs.

Wider channels (40 MHz) reduce the number of non-overlapping channels, increasing interference.

Solution 1: Decrease Channel Bonding to 20 MHz (Option D)

Why?

5 GHz has more non-overlapping channels at 20 MHz (e.g., 25 channels in UNII-1/2/2e/3) vs. fewer at 40 MHz.

Reduces co-channel interference by increasing available channels for APs.

Impact:

Sacrifices some throughput (lower max data rates) but improves reliability.

Solution 2: Reduce AP Power (Option E)

Why?

Lowering transmit power shrinks cell sizes, reducing overlap between APs on the same channel.

Works best in high-density deployments (e.g., open-plan offices).

Impact:

Requires careful tuning to avoid coverage gaps.

Why Other Options Are Incorrect:

Option A (Increase SSIDs) → More SSIDs = more management overhead and airtime contention (worsens interference).

Option B (40 MHz in 2.4 GHz) → 2.4 GHz should never use 40 MHz (only 3 non-overlapping channels; bonding causes severe interference).

Option C (Disable Band Steering) → Band steering pushes clients to 5 GHz (reducing 2.4 GHz congestion). Disabling it does not help 5 GHz interference.

Reference:

Cisco Wireless Design Guide: Recommends 20 MHz channels in 5 GHz for high-density deployments.

Explanation:

Key Issue:

After SSO (Stateful Switchover) failover, only half the clients are visible on the secondary (now active) WLC.

The secondary WLC shows Active role, confirming SSO is operational, but client sessions are missing.

Root Cause:

WebAuth-Req State Clients:

Clients in Web Authentication (WebAuth) pending state (e.g., waiting for portal login) are not fully established.

SSO does not sync these partially authenticated sessions to the standby WLC.

After failover, these clients must reauthenticate, causing the drop in client count.

Why Other Options Are Incorrect:

Option A (Secondary WLC Capacity) → If the WLC couldn’t handle the load, it would reject new clients, not lose existing ones.

Option B (Incomplete Database Sync) → SSO syncs all client states (except WebAuth-Req). If sync failed, far fewer clients would appear.
Option C (SSO Misconfiguration) → If SSO were broken, the secondary WLC would not take over as Active.

Reference:

Cisco High Availability SSO Deployment Guide: Confirms that WebAuth-pending sessions are not synced during failover.

Cisco Wireless LAN Controller Troubleshooting: Lists WebAuth as a common cause of client count discrepancies in SSO.

Solution:

Ensure fast WebAuth redirection or use PSK/MAB for critical clients to avoid session loss.

Explanation:

Key Issue:

Handheld mobile scanners (used for credit card payments) are experiencing roaming problems in a high-density environment.

These devices typically use low-power radios and struggle with interference and weak signals during AP transitions.

Why RX-SOP (Option A) is the Correct Solution:

RX-SOP adjusts the minimum signal strength (RSSI) at which an AP will process incoming frames.

In high-density deployments:

Lowering RX-SOP (e.g., to -85 dBm) allows APs to hear weak client signals better, improving roaming.

Prevents APs from ignoring scanners during handoffs.

Impact:

Scanners maintain connectivity even at the edge of AP coverage, reducing roaming failures.

Why Other Options Are Incorrect:

Option B (802.11w - Management Frame Protection) → Secures control frames but does not improve roaming.

Option C (AP Heartbeat Timeout) → Detects AP failures but does not affect client roaming.

Option D (Application Visibility Control - AVC) → Provides QoS for apps but does not address signal/roaming issues.

Reference:

Cisco High-Density Design Guide: Recommends tuning RX-SOP for low-power devices in dense environments.

PCI DSS Wireless Guidelines: Emphasizes reliable roaming for payment terminals.

Explanation:

Key Issue:

Guest anchoring is configured, but mobility tunnels are down.

EPING (Echo Ping) fails between the foreign WLC and anchor WLC, indicating a firewall blockage.

Required Firewall Rule:

UDP Port 16666 must be open between the controllers for:

Mobility tunneling (guest traffic encapsulation).

Control-plane communication (e.g., EPING, CAPWAP mobility messages).

Why Other Options Are Incorrect:

Option B (IP Protocol 97) → Incorrect. IP protocol 97 is EIGRP, unrelated to WLC mobility.

Option C (UDP Port 97) → Incorrect. UDP 97 is NIOSH (a legacy protocol), not used by Cisco WLCs.

Option D (TCP Port 97) → Incorrect. TCP 97 is unused in Cisco mobility architectures.

Reference:

Cisco Wireless LAN Controller Mobility Groups Guide: Explicitly states UDP 16666 for inter-controller tunnels.

Cisco Firewall Best Practices for WLCs: Mandates allowing UDP 16666 between anchor/foreign WLCs.

Explanation:

Key Requirements for the Wireless Services:

Internet, Email, Voice, and Inventory Database

Voice (VoWLAN): Demands high-quality RF (low latency, minimal jitter/packet loss).

Inventory Database: Requires reliable data throughput (low retries, strong signal).

Why Option A is Correct:

Signal Strength: -67 dBm

Ideal for real-time apps (voice) and data reliability.

Meets Cisco’s minimum recommended coverage (-67 dBm for VoWLAN).

SNR: 25 dB

Ensures clear signal distinction from noise (critical for voice and database apps).

Cisco recommends ≥25 dB SNR for HD voice/video.

Packet Loss: ≤1%

Mandatory for voice quality (VoIP tolerates <1% loss).

Why Other Options Fail:

Option B: 20 dB SNR and 5% packet loss are too low for voice/database apps.

Option C: +67 dBm is impossible (signal strength is always negative in dBm).

Option D: -70 dBm is too weak, and 10% packet loss breaks voice calls.

Reference:

Cisco Wireless LAN Design Best Practices (CVD):

-67 dBm signal strength for voice/data mixed networks.

25 dB SNR for high-density deployments.

Explanation:

Key Requirements for a Point-to-Multipoint Mesh Network Survey:

Tx Power (Transmit Power) (Option E)

Must be adjusted to balance coverage and interference between mesh APs.

Too high: Causes co-channel interference.

Too low: Weak backhaul links.

Rx Power (Receive Sensitivity) (Option B)

Determines the minimum signal strength needed for reliable backhaul links.

Critical for link budget calculations (ensuring MAPs can "hear" RAPs).

Why Other Options Are Incorrect:

Option A (MAP Hostnames): Administrative, not RF-related.

Option C (Mesh on 2.4 GHz): Avoid 2.4 GHz for mesh (only 3 non-overlapping channels; use 5 GHz instead).

Option D (Bridge Group Name): Logical grouping, not a survey parameter.

Reference:

Cisco Outdoor Mesh Deployment Guide: Recommends Tx/Rx power tuning for optimal backhaul performance.