You save $34.99
A campus egress link drops bulk-traffic bursts and the engineer must control send rate smoothly.
What result would provide the most convincing deployment evidence?
Measured egress conforms to the intended service rate without unnecessary burst drops for the selected application profile. That is the relevant result for traffic policing versus shaping. Traffic shaping delays packets to smooth bursts, whereas policing enforces a rate by dropping or remarking nonconforming traffic; operational tradeoffs differ.
That result—Queue counters and packet markings confirm trusted voice traffic receives priority while guest bulk flows remain appropriately classified—concerns trust and QoS marking boundary. Blindly trusting endpoint markings lets untrusted traffic dominate queues; classification must reflect approved service importance. It can be healthy even while the current traffic policing versus shaping problem remains.
Low PHY data rates use more airtime per transmitted bit; rate changes must be constrained by coverage and device support. The indicated result—the pilot shows less management/data airtime overhead while required legacy clients remain supported or have a documented exception—checks a different mechanism and would not confirm the required traffic policing versus shaping outcome.
This would validate uplink oversubscription tuning, not traffic policing versus shaping. Access port sum can greatly exceed distribution bandwidth, so congestion and burst tolerance must be planned rather than inferred from port speed labels. It is therefore insufficient acceptance evidence for the reported condition.
A company wants certificate-based corporate Wi-Fi instead of a widely shared password.
How should the team correct the underlying network condition?
Configure an enterprise WLAN with appropriate EAP-TLS and trusted RADIUS/certificate services. EAP-TLS verifies certificate-based identities through the configured authentication system; a shared PSK does not give per-device certificate identity. The acceptance check should establish: A representative approved device completes certificate-based enterprise authentication and receives its authorized network role.
That action—Validate client security-mode capability and stage a compatible secure WLAN migration—is relevant to WPA3 and legacy clients. WLAN security changes can exclude devices with unsupported cipher, authentication or protected-management-frame capabilities. It does not correct the observed corporate EAP-TLS SSID condition.
The alternative targets central configuration audit, where management intent, synchronization status and the running device state are distinct; failed changes or local overrides can leave unintended effective configuration. It does not establish the intended corporate EAP-TLS SSID behavior described in the scenario.
Wireless association is only the first hop; downstream tunnel, VLAN and gateway mappings must agree for application access. Ensure SSID VLAN or role forwarding matches the actual bridge or gateway transport design. would address SSID-to-forwarding path consistency, but the reported facts instead point to corporate EAP-TLS SSID. That change would leave the actual requirement unresolved.
A corporate client rejects the enterprise SSID after a new RADIUS server certificate is deployed.
Which approach best preserves the required campus service?
Inspect EAP-TLS certificate trust, validity and identity on both authentication sides. EAP-TLS relies on a trusted certificate path; successful network reachability does not bypass expired or unknown issuing authorities. The acceptance check should establish: Authentication logs and client diagnostics show a valid trusted handshake and correct certificate identity verification.
That action—Trace DHCP relay, VLAN forwarding and server responses after successful WLAN authentication—is relevant to wireless DHCP failure stage. Client association and 802.1X success occur before address allocation; VLAN or relay faults can prevent DHCP without an RF fault. It does not correct the observed EAP-TLS trust-chain failure condition.
The alternative targets OSPF neighbor area mismatch, where OSPF requires compatible area identity, network type and essential adjacency parameters; IP reachability alone does not establish a neighbor. It does not establish the intended EAP-TLS trust-chain failure behavior described in the scenario.
A successful authentication indicates identity acceptance, while authorization attributes and local mapping determine permitted services. Compare RADIUS authorization attributes with actual assigned session role and policy. would address incorrect RADIUS role result, but the reported facts instead point to EAP-TLS trust-chain failure. That change would leave the actual requirement unresolved.
A hotel allows anonymous WLAN attachment although its service design requires a portal consent step.
Which next step best resolves the observed campus requirement?
Implement the authorized guest captive-portal workflow and associated access policy. That targets guest captive-portal flow directly. Association and address assignment alone cannot enforce guest registration or policy acceptance; the portal and post-login role must be connected. The expected confirmation is that a first-time visitor is presented the expected portal and gains only the approved access after completing it.
That action—Register and assign each device to the correct authorized Central organization and inventory before configuring it—is relevant to central device inventory onboarding. A functioning Ethernet link does not establish cloud-management ownership; onboarding requires the correct device identity, management association and supported connectivity. It does not correct the observed guest captive-portal flow condition.
MAC authentication can support devices without a supplicant but is weaker than cryptographic identity, so narrow policy and inventory are essential. Apply authorized MAC-based device classification with restrictive role enforcement where 802.1X is unavailable. would address MAC authentication for headless devices, but the reported facts instead point to guest captive-portal flow. That change would leave the actual requirement unresolved.
The alternative targets AP uplink power and negotiation, where wireless features depend on the wired uplink and power available to the AP; sufficient coverage does not prove the device is operating at full capacity. It does not establish the intended guest captive-portal flow behavior described in the scenario.
An enterprise WLAN has correct certificates but authentication packets never reach the policy server.
Which engineering action is most directly justified by these facts?
Validate the AAA server path, UDP service and allowed transport before changing identity policies. That targets RADIUS server reachability directly. A silent RADIUS transport failure prevents normal authentication regardless of whether the user certificate or role rules are correct. The expected confirmation is that RADIUS requests and responses traverse the approved path and the client reaches its intended authorized role.
Client association and 802.1X success occur before address allocation; VLAN or relay faults can prevent DHCP without an RF fault. Trace DHCP relay, VLAN forwarding and server responses after successful WLAN authentication. would address wireless DHCP failure stage, but the reported facts instead point to RADIUS server reachability. That change would leave the actual requirement unresolved.
That action—Check VLAN operational state and active interface membership when an SVI is down—is relevant to SVI down due to VLAN state. A configured SVI cannot act as the client gateway without operational Layer 2 underlay and correct interface state. It does not correct the observed RADIUS server reachability condition.
The alternative targets captive portal redirect fault, where a guest can associate and receive a lease without completing the portal flow; redirect and pre-auth policy must permit necessary portal dependencies. It does not establish the intended RADIUS server reachability behavior described in the scenario.
A switch pair experiences ambiguous peer liveness when both its inter-switch link and keepalive share failure dependencies.
How should the engineer proceed without introducing unrelated changes?
Design and verify independent VSX peer keepalive connectivity relative to the inter-switch link. That targets VSX keepalive isolation directly. Separate failure detection helps peers distinguish link disruption from peer loss, reducing the risk of harmful split-brain behavior. The expected confirmation is that an isolated link-failure exercise records the intended peer health state and avoids duplicate active forwarding.
The alternative targets VSX peer synchronization, where VSX peers retain independent control planes and only designated supported feature sets synchronize; unchecked settings may diverge. It does not establish the intended VSX keepalive isolation behavior described in the scenario.
That action—Distinguish Central's site/location assignment from the group-based configuration scope in Classic Central—is relevant to classic Central site versus group. Classic Central uses groups to distribute shared configuration while sites provide physical-location organization, so modifying location alone need not change running intent. It does not correct the observed VSX keepalive isolation condition.
A virtual first-hop gateway provides a stable client next-hop while authorized peers coordinate active forwarding after failure. Configure a supported redundant virtual gateway mechanism with correct priorities and tracking. would address VRRP gateway resilience, but the reported facts instead point to VSX keepalive isolation. That change would leave the actual requirement unresolved.
An engineer changes QoS and AP power together, then cannot identify which affected latency.
Which observed outcome would confirm that the chosen action succeeded?
The strongest evidence is that the report contrasts like-for-like baseline and post-change throughput, latency, retries and error statistics. Optimization claims require equivalent loads, test methods and service metrics before and after; otherwise changes in demand confound comparison. A configuration entry alone would not prove the service behavior.
That result—Peak-load tests show better aggregate throughput and fewer collisions with the selected width—concerns WLAN channel-width optimization. Wide channels can improve peak rates per connection yet shrink available channel separation, raising cochannel contention in dense networks. It can be healthy even while the current baseline before optimization problem remains.
This would validate failure recovery time objective, not baseline before optimization. Resilience depends on recovery behavior, routing/bridging convergence and application tolerance, not the number of installed redundant devices. It is therefore insufficient acceptance evidence for the reported condition.
A performance gain is not acceptable if it weakens required access boundaries; improvements must meet both service and security acceptance criteria. The indicated result—post-change tests show better permitted-traffic performance and unchanged denial of prohibited flows—checks a different mechanism and would not confirm the required baseline before optimization outcome.
A team proposes removing segmentation ACLs to improve service latency without assessing data exposure.
What should the campus engineer implement to address this condition?
Retain mandatory authorization and segmentation controls while optimizing forwarding or QoS. A performance gain is not acceptable if it weakens required access boundaries; improvements must meet both service and security acceptance criteria. The acceptance check should establish: Post-change tests show better permitted-traffic performance and unchanged denial of prohibited flows.
The alternative targets legacy low-rate airtime overhead, where low PHY data rates use more airtime per transmitted bit; rate changes must be constrained by coverage and device support. It does not establish the intended security-preserving optimization behavior described in the scenario.
A change may help one metric while degrading another; phased deployment and recovery thresholds protect production service continuity. Pilot optimization with measurable success criteria and a tested rollback condition. would address optimization with rollback, but the reported facts instead point to security-preserving optimization. That change would leave the actual requirement unresolved.
That action—Capture a comparable pre-change performance baseline and define a repeatable post-change test—is relevant to baseline before optimization. Optimization claims require equivalent loads, test methods and service metrics before and after; otherwise changes in demand confound comparison. It does not correct the observed security-preserving optimization condition.
An engineer sees flooding and MAC flaps while every affected port reports link up.
Which operational measurement or record should show success?
Rapid MAC moves and broadcast amplification indicate switching topology instability, not a problem fixed by adding a default route. Therefore, verify the specific outcome: The repaired topology has stable learned MAC locations and broadcast volume returns to expected baseline.
That result—The repaired link remains stable under load and physical error counters stop increasing unexpectedly—concerns physical layer link fault. Repeated link transitions and frame errors point to Layer 1 quality or negotiation rather than an unseen WLAN authentication issue. It can be healthy even while the current MAC learning and unintended loops problem remains.
LACP only selects compatible links for aggregation; forcing an incompatible member can create unexpected hashing or forwarding behavior. The indicated result—the bundle shows all intended collecting/distributing members with consistent partner and interface parameters—checks a different mechanism and would not confirm the required MAC learning and unintended loops outcome.
This would validate central API unauthorized response, not MAC learning and unintended loops. A valid login or token does not imply access to every management resource; 403 generally indicates denied permissions rather than a switch port failure. It is therefore insufficient acceptance evidence for the reported condition.
A campus advertises a 6 GHz-only SSID to a large population of older Wi-Fi devices.
What result would provide the most convincing deployment evidence?
Pilot devices supporting the target band join securely and unsupported clients have a documented alternative network. That is the relevant result for 6 GHz WLAN compatibility. 6 GHz operation requires capable client hardware and supported regulatory and security settings; enabling the band does not upgrade legacy adapters.
That result—Walking-call tests show successful transitions with latency and loss remaining within the voice application's limits—concerns roaming voice coverage overlap. A reliable voice WLAN needs usable signal and timely authentication/roaming behavior between neighboring cells, not maximum isolated AP range. It can be healthy even while the current 6 GHz WLAN compatibility problem remains.
This would validate 2.4 GHz interference planning, not 6 GHz WLAN compatibility. The 2.4 GHz band has limited nonoverlapping channel choices in typical regulatory domains, so channel overlap and wide channels intensify contention. It is therefore insufficient acceptance evidence for the reported condition.
More APs cannot solve exhaustion of the IP-address pool; usable addresses, lease duration and peak devices must be evaluated together. The indicated result—a peak-client calculation leaves suitable address headroom and test devices obtain leases without pool-exhaustion errors—checks a different mechanism and would not confirm the required 6 GHz WLAN compatibility outcome.
A campus security incident finds DHCP offer packets sourced from a workstation-facing switch port.
Which modification would be the most defensible response?
Apply DHCP snooping with trusted server-facing ports and untrusted client-facing ports. That targets unauthorized DHCP server directly. DHCP snooping restricts untrusted hosts from responding as servers and can help preserve legitimate addressing information on the VLAN. The expected confirmation is that offers from untrusted access ports are dropped and clients receive leases only from the approved DHCP service.
The alternative targets MAC authentication fallback fault, where endpoints without a supported supplicant need a deliberate alternative classification mechanism, not general unrestricted VLAN access. It does not establish the intended unauthorized DHCP server behavior described in the scenario.
IPv4 ARP safeguards do not inspect ICMPv6 router announcements; RA protection constrains unauthorized router information on client segments. Apply appropriate IPv6 RA protection on untrusted access ports. would address IPv6 router-advertisement spoofing, but the reported facts instead point to unauthorized DHCP server. That change would leave the actual requirement unresolved.
That action—Trace VLAN membership across each intervening trunk and restore the missing permitted VLAN—is relevant to missing trunk VLAN. A frame cannot traverse a trunk on which its tagged VLAN is not allowed; local endpoint configuration can be fully correct. It does not correct the observed unauthorized DHCP server condition.
Please check your mailbox for a message from support@examlabs.com and follow the directions.
