Cisco 350-101 Exam Dumps

The failure is caused by the redirect ACL not being available where enforcement occurs. In FlexConnect local switching, client data-plane handling occurs on the AP, so the CWA redirect ACL cannot exist only as a controller ACL or only as a policy-profile reference. Cisco states that the redirect ACL is a punt ACL and that, for FlexConnect local switching, the ACL must be predefined on the AP because the AAA server returns only the ACL name, not the ACL definition.

The exhibit shows Redirect ACL failure and EXCLUDE_PUNT_ACL_FAIL, which aligns with an AP-side punt/redirect ACL application failure. Cisco's Catalyst 9800 CWA configuration specifically requires the redirect ACL definition to be sent through the FlexConnect profile; in the GUI this is done under the Flex Profile Policy ACL tab by adding the ACL, enabling central web authentication, and applying the change. The equivalent CLI is wireless profile flex followed by acl-policy and central-webauth, after which the AP uses the ACL for client redirection. AP-Join profiles do not carry client redirect ACL policy, and adding the ACL only to the policy profile does not push it to FlexConnect APs for local switching. Reference topics: FlexConnect local switching, CWA redirect ACLs, Catalyst 9800 policy ACLs, and ISE URL-redirect authorization.

The correct expression is accessPoints[0].interfaces[1].macAddress. The JSON object contains a top-level key named accessPoints, whose value is an array. Array indexing begins at zero, so accessPoints[0] selects the first access point object, ap-west-1. Inside that object, the interfaces key also contains an array. Therefore, interfaces[1] selects the second interface object, which has slot: 1, status: 'down', and macAddress: 'CC:FA:00:11:22:34'. The final selector, .macAddress, returns that MAC address value.

This structure is directly aligned with Cisco automation workflows, where RESTCONF and Catalyst Center APIs exchange structured data in JSON. Cisco documents that Catalyst Center REST API payloads are JSON-formatted, and its example describes JSON as key-value data separated by colons. Cisco also states that Catalyst 9800 RESTCONF uses structured XML or JSON with YANG models for programmatic device access. Option B selects ap-east-2. Option C selects the first interface on ap-west-1. Option D references a non-existent second interface on ap-east-2. Reference topics: Automation and AI --- JSON parsing, REST APIs, Catalyst Center programmability, RESTCONF, and wireless telemetry data structures.

The correct configuration is aaa-override followed by nac under the existing Catalyst 9800 wireless policy profile. The exhibit already places the administrator in policy-profile configuration mode with wireless profile policy my-policy, so the missing commands must be policy-profile subcommands, not another profile declaration. Cisco's Catalyst 9800 configuration examples show the exact sequence: enter wireless profile policy , enable aaa-override, enable nac, then configure VLAN and no shutdown.

aaa-override permits authorization attributes returned by AAA or Cisco ISE, such as VLAN, ACL, QoS, redirect ACL, or posture-related access controls, to override the locally defined policy. Cisco's documentation explicitly states that AAA override applies policies coming from AAA or ISE servers, while nac enables Network Access Control in the policy profile. This is the required behavior when endpoints must be posture-validated before normal network access is granted. Cisco also notes that NAC State is enabled in the policy profile and can only be enabled when AAA override is enabled.

Option A is invalid because nac-policy is not the correct CLI keyword. Options B and D omit NAC. Reference topic: Client Connectivity Configuration --- Catalyst 9800 policy profiles, AAA override, NAC State, posture enforcement, and ISE-based access control.

In decibel calculations, the formula used to convert a power ratio to decibels (dB) is:

Thus, the power ratio of 10:1 corresponds to a 10 dB change in power.

Option A: -20 dB would correspond to a ratio of 0.01:1, not 10:1.

Option B: 5 dB would correspond to a power ratio of approximately 3.16:1, not 10:1.

Option D: 15 dB would correspond to a ratio of 31.62:1, not 10:1.

Therefore, Option C: 10 dB is the correct answer, as it is the result of a power ratio of 10:1.

Thus, the power ratio of 10:1 corresponds to a 10 dB change in power.

Option A: -20 dB would correspond to a ratio of 0.01:1, not 10:1.

Option B: 5 dB would correspond to a power ratio of approximately 3.16:1, not 10:1.

Option D: 15 dB would correspond to a ratio of 31.62:1, not 10:1.

Therefore, Option C: 10 dB is the correct answer, as it is the result of a power ratio of 10:1.

After assigning an IP address to the management interface of a Cisco 9800 WLC, the next step in Day-0 deployment is configuring the default route to ensure management traffic can reach devices outside the local subnet. The correct command is ip route 0.0.0.0 0.0.0.0 <gateway>, which establishes a default route for all traffic destined for networks not explicitly known in the routing table. In this case, ip route 0.0.0.0 0.0.0.0 10.1.10.1 sets the upstream router at 10.1.10.1 as the default gateway, allowing the WLC to communicate with the broader network for management and client services. Option A, route add default gw, is Cisco IOS classic syntax but not valid in IOS XE WLC CLI. Option B is invalid syntax for default routing. Option C, ip default-gateway, is only used for Layer 2 management devices without routing capabilities, whereas a WLC requires a proper Layer 3 route. Configuring the default route ensures that remote administration, SNMP, syslog, and device registration functions operate correctly. Cisco Wireless Core Technologies recommend this step as part of initial WLC setup to establish full network reachability for management access. Reference topics: Wireless Network Implementation --- Day-0 WLC setup, management interface configuration, default route, IP routing in Cisco 9800 IOS XE.