View Full Cisco CCNP 300-425 Exam Dumps and Practice Test Dumps.

Question 201. Which UDP port carries CAPWAP control traffic

1. 1812
2. 5246
3. 5247
4. 16666

Correct Answer: 2. 5246

Explanation:

CAPWAP control traffic between a Cisco access point and wireless controller uses UDP port 5246. The control tunnel carries management information required to establish and maintain the relationship between the AP and controller. This includes discovery related communication, join processing, configuration information, and tunnel maintenance messages. Firewalls positioned between access points and controllers must allow the required CAPWAP communication. UDP port 5247 serves a different role because it carries CAPWAP data traffic. Understanding these ports is important when designing wireless deployments across routed networks or security boundaries.

Question 202. Which UDP port carries CAPWAP data traffic

1. 443
2. 22
3. 5246
4. 5247

Correct Answer: 4. 5247

Explanation:

CAPWAP data traffic uses UDP port 5247. The CAPWAP data tunnel carries wireless client data between lightweight access points and the wireless controller when the deployment uses centralized forwarding. UDP port 5246 is reserved for CAPWAP control communication. Network designers must make sure that routing devices, firewalls, and security policies permit the required CAPWAP ports between access points and controllers. Blocking the data port can prevent normal client traffic from traversing a centrally switched WLAN even if the AP successfully establishes its control relationship with the controller.

Question 203. What is established after an AP receives a valid controller Discovery Response

1. DTLS session
2. DHCP scope
3. Mobility anchor
4. RF group

Correct Answer: 1. DTLS session

Explanation:

After an access point receives a valid Discovery Response from a wireless controller, the AP and controller establish a DTLS session. DTLS secures subsequent CAPWAP communication by authenticating the devices and encrypting the traffic exchanged between them. During the DTLS handshake, certificates are used so the AP and controller can validate each other’s identity. Once the secure tunnel is established, the AP proceeds with the controller join process. This security mechanism prevents an AP from simply joining an untrusted controller without identity verification and helps protect management communication across the network.

Question 204. What happens if the AP software image differs from the controller image

1. The AP enters monitor mode
2. The AP disables its radios permanently
3. The AP downloads the matching image
4. The controller changes its image

Correct Answer: 3. The AP downloads the matching image

Explanation:

During the join sequence, the access point performs an image comparison with the wireless controller. If the AP already has the correct software version, the process continues toward configuration and the RUN state. If the versions differ, the AP downloads the required image from the controller. After the download completes, the AP reboots and begins the discovery and join process again using the new software. This behavior helps maintain software compatibility between lightweight access points and the controller that manages them. Designers should account for the additional recovery time required when image downloads occur during controller migrations.

Question 205. What maintains the CAPWAP control tunnel while an AP is in RUN state

1. DHCP renewals
2. Echo messages
3. DNS queries
4. RADIUS accounting

Correct Answer: 2. Echo messages

Explanation:

While an access point is operating in the RUN state, CAPWAP control tunnel maintenance uses Echo Request and Echo Response messages. The AP periodically sends an Echo Request to the wireless controller and expects the corresponding response. This exchange verifies that control connectivity between the devices remains operational. If the controller becomes unreachable and the control relationship fails, the AP can begin recovery procedures and search for another configured controller according to its high availability settings. CAPWAP data tunnel maintenance uses a different mechanism based on keepalive exchanges.

Question 206. What maintains the CAPWAP data tunnel in RUN state

1. Keepalive messages
2. DNS lookups
3. RADIUS probes
4. ARP requests only

Correct Answer: 1. Keepalive messages

Explanation:

CAPWAP data tunnel maintenance uses keepalive messages while the access point operates in RUN state. These exchanges help confirm that the data path between the access point and wireless controller remains available. The CAPWAP control tunnel is maintained separately through Echo Request and Echo Response exchanges. Distinguishing the two mechanisms is useful when troubleshooting an AP that remains registered but experiences data forwarding problems. A network path must support both CAPWAP control and data communication for centrally switched WLAN operation to work correctly.

Question 207. What maximum CAPWAP path MTU does an AP initially negotiate during join

1. 576 bytes
2. 1200 bytes
3. 1500 bytes
4. 1485 bytes

Correct Answer: 4. 1485 bytes

Explanation:

During CAPWAP join, Cisco access points initially attempt to negotiate a maximum CAPWAP path MTU of 1485 bytes. The AP tests whether packets of this size can cross the network path without fragmentation. This is important because CAPWAP adds encapsulation overhead to traffic. If the path cannot support the attempted size, the AP can reduce the MTU to complete the join process. Designers should make sure intermediate routers, tunnels, and security devices support suitable packet sizes so unnecessary fragmentation or reduced CAPWAP efficiency does not occur.

Question 208. To what CAPWAP MTU can an AP fall back during join when the larger probe fails

1. 1500 bytes
2. 1280 bytes
3. 576 bytes
4. 9000 bytes

Correct Answer: 3. 576 bytes

Explanation:

If the initial CAPWAP path MTU probe fails during the join process, the access point can fall back to 576 bytes so that it can complete the controller join more quickly. Cisco documents this behavior when the AP receives an ICMP fragmentation message or does not receive the expected response to its larger probe. After reaching RUN state, the AP can continue testing the path and attempt to increase the CAPWAP MTU. This design favors successful controller registration even when the underlying network initially cannot support larger CAPWAP packets.

Question 209. Which certificate is factory installed on physical Catalyst 9800 controllers and Cisco APs

1. Manufacturing Installed Certificate
2. User certificate
3. Web portal certificate
4. RADIUS certificate

Correct Answer: 1. Manufacturing Installed Certificate

Explanation:

Physical Catalyst 9800 controller platforms and Cisco access points are shipped with a Manufacturing Installed Certificate. Cisco also provides the manufacturing certificate authority information required to validate these device certificates. During the AP join process, the access point and controller use certificate based identity verification as part of the secure DTLS handshake. This establishes trust before the AP completes its join. Manufacturing installed certificates simplify secure deployment because administrators do not normally need to manually install an initial device identity certificate on every new physical AP and appliance controller.

Question 210. What certificate type does a Catalyst 9800 CL normally use for AP join

1. MIC only
2. Client certificate only
3. RADIUS certificate
4. Self signed certificate

Correct Answer: 4. Self signed certificate

Explanation:

The Catalyst 9800 CL is a virtual wireless controller and therefore does not contain the same factory installed hardware Manufacturing Installed Certificate found on physical controller appliances. Cisco uses a self signed certificate for the virtual controller AP join process. This certificate is generated as part of the controller initialization workflow after required wireless management and country configuration is completed. Access points and controllers still verify identities as part of DTLS establishment before the AP completes its join. The certificate approach therefore maintains secure controller authentication even when the controller exists as virtual software rather than dedicated hardware.

Question 211. When are the AP and controller identities verified

1. During DHCP discovery
2. During the DTLS handshake
3. During DNS resolution
4. During RRM calculation

Correct Answer: 2. During the DTLS handshake

Explanation:

The access point and Catalyst 9800 controller verify each other’s identity during the DTLS handshake. Certificate information is exchanged and validated before the secure CAPWAP relationship is fully established. This prevents unauthorized devices from establishing trusted controller management sessions simply because they can reach the wireless management address. Physical controllers and APs normally use manufacturing installed certificates, while virtual controller deployments can use the supported self signed certificate model. Certificate validation therefore forms an important security layer within the overall AP discovery and join workflow.

Question 212. What does LSC mean in Cisco AP certificate design

1. Local Service Channel
2. Lightweight Security Control
3. Locally Significant Certificate
4. Logical System Certificate

Correct Answer: 3. Locally Significant Certificate

Explanation:

LSC means Locally Significant Certificate. Cisco supports LSC as an alternative certificate based authentication mechanism for access points and controllers. An organization can use its own certificate infrastructure and trustpoints rather than relying exclusively on the factory installed manufacturing certificate model. The design includes configuring the appropriate LSC trustpoint, certificate policy, and allowed access point information. LSC deployments are useful when an enterprise requires its own certificate authority hierarchy or stronger administrative control over which access points are authorized to join the wireless controller.

Question 213. How many AP failover priority levels are available

1. Two
2. Three
3. Five
4. Four

Correct Answer: 4. Four

Explanation:

Catalyst 9800 access points support four failover priority levels. These levels range from one through four and determine which APs receive preference when the controller does not have enough capacity for every AP attempting to connect. Priority four is the highest and priority one is the lowest. Failover priority does not normally change day to day wireless operation when sufficient controller capacity exists. Its value appears during controller failure or other capacity constrained conditions, allowing the most important access points to remain connected before lower priority devices.

Question 214. Which AP failover priority level is highest

1. Priority 4
2. Priority 1
3. Priority 2
4. Priority 3

Correct Answer: 1. Priority 4

Explanation:

Priority four is the highest Catalyst 9800 AP failover priority level. When controller capacity becomes limited, APs assigned a higher priority are favored over lower priority devices. Administrators can therefore assign priority four to access points serving critical business areas while assigning lower priorities to locations where temporary service interruption is more acceptable. The priority setting is not intended to influence normal client performance or RF behavior. It is specifically a controller association preference that becomes important when AP connection demand exceeds available controller capacity.

Question 215. What is the default AP failover priority level

1. Priority 4
2. Priority 2
3. Priority 1
4. Priority 3

Correct Answer: 3. Priority 1

Explanation:

Cisco assigns access points failover priority one by default. Priority one is the lowest of the four available levels. Administrators should increase priority only for access points that require preference during controller capacity shortages or failure conditions. For example, APs serving operationally critical locations can receive higher priority while ordinary coverage areas remain at the default. Cisco recommends using higher priorities selectively rather than assigning every AP the same elevated value because prioritization is most useful when it clearly distinguishes critical devices from less important ones.

Question 216. When does AP failover priority affect controller association

1. During every client roam
2. When controller capacity is limited
3. During every RF calculation
4. When DNS is unavailable

Correct Answer: 2. When controller capacity is limited

Explanation:

AP failover priority becomes relevant when access point connection requests exceed available controller capacity, such as when a primary controller fails and many APs attempt to join a backup system. During ordinary operation with sufficient capacity, the priority value does not affect normal wireless behavior. When resources are constrained, higher priority APs receive preference so that critical coverage areas can remain operational. Designers should therefore estimate backup controller capacity and assign AP priorities according to business importance rather than treating priority as a general radio or performance setting.

Question 217. What can an AP priming profile define

1. Primary secondary and tertiary controllers
2. Client encryption keys
3. DNS root servers
4. RF interference sources

Correct Answer: 1. Primary secondary and tertiary controllers

Explanation:

An AP priming profile can define primary, secondary, and tertiary controller assignments for access points. It allows administrators to centrally apply controller preferences to groups of APs or individual devices instead of manually configuring every AP. Cisco also uses priming profiles to automate fallback and reconnection behavior when access points lose connectivity to their assigned controllers. This can simplify large deployments in which deterministic controller assignment is important for capacity planning and troubleshooting. Filters can be used to determine which APs receive a particular priming configuration.

Question 218. What is the maximum number of AP priming profiles supported

1. 32
2. 64
3. 256
4. 128

Correct Answer: 4. 128

Explanation:

Cisco documents a maximum of 128 AP priming profiles. Priming profiles provide scalable assignment of primary, secondary, and tertiary wireless controllers to access points. They can be combined with filters so groups of APs receive appropriate controller preferences without requiring separate manual configuration on every device. This is useful in large enterprise networks where deterministic controller relationships improve capacity management and failure recovery. Designers should organize priming profiles logically because unnecessarily creating many overlapping profiles can make controller assignment behavior difficult to understand and maintain.

Question 219. What does an AP normally do while joined to a secondary controller if its primary is unavailable

1. Stops all discovery permanently
2. Reboots continuously
3. Continues probing for the primary
4. Disables CAPWAP

Correct Answer: 3. Continues probing for the primary

Explanation:

By default, an access point that joins its secondary or tertiary controller while the primary controller is unavailable continues sending discovery requests toward the preferred primary. This reflects the AP’s primary controller preference. When the primary becomes reachable again, the AP can return to it according to fallback behavior. Administrators can modify fallback behavior through the AP join profile when automatic return is not desirable. Deterministic primary and secondary assignments help make controller capacity and recovery behavior more predictable in large wireless environments.

Question 220. What is the default state of DHCP fallback in an AP join profile

1. Disabled permanently
2. Enabled
3. Available only for mesh APs
4. Available only for virtual controllers

Correct Answer: 2. Enabled

Explanation:

Cisco documents DHCP fallback as enabled by default within the Catalyst 9800 AP join profile. AP join profiles contain several settings related to CAPWAP behavior, high availability, IPv4 and IPv6 operation, retransmission parameters, management access, and other AP characteristics. DHCP fallback provides additional flexibility when an access point needs to obtain network information during its controller connectivity process. Wireless designers should review the default AP join profile and modify settings only when deployment requirements justify a change, because the profile can affect many access points that share the same configuration.