350-101 Exam Study Guide: The Ultimate 2026 Practice Test

Dynamic endpoint profiling in Cisco wireless networks is used to classify devices based on type, behavior, and attributes, enabling policy enforcement that adapts to device posture. In a deployment integrated with Cisco ISE, profiling groups are created to define rules and categories for device types such as smartphones, laptops, printers, and IoT devices. These profiling groups allow the wireless controller to map devices to the correct ISE policy sets dynamically, ensuring that security policies, VLAN assignments, and access controls are applied according to the device profile. Option A (device-type groups) is a generic categorization that does not fully leverage ISE dynamic profiling capabilities. Option C (user ID groups) focuses on user identity rather than device characteristics. Option D (endpoint group mapping) is typically applied after device profiling and classification, but initial enforcement requires creating profiling groups. By configuring profiling groups, the IT team ensures that the network can classify endpoints automatically, enforce access policies consistently, and integrate with ISE for context-aware security and compliance monitoring. Reference topics:Wireless Monitoring and Management — Dynamic endpoint profiling, Cisco ISE policy integration, profiling groups, device classification for secure access.

The log is a Layer 2 802.1X authentication failure, not an AP join or WLAN encryption mismatch. In WPA3-Enterprise, the client authenticates with 802.1X/EAP through the configured AAA path. Cisco’s Catalyst 9800 WPA3 Enterprise configuration requires the necessary RADIUS or AAA servers and authentication lists before enabling WPA3 Enterprise, and the WLAN must reference the dot1x authentication list. Therefore, aCred Failreason points directly at the user/device credential validation path: the supplicant credentials, Active Directory identity source, RADIUS policy match, or RADIUS reachability.

Cisco’s 9800 802.1X configuration workflow also shows the controller defining a RADIUS server, adding it to a RADIUS group, creating a dot1x AAA authentication method list, and applying that list to the WLAN. It further recommends checking whether the RADIUS server is alive and using ISE RADIUS Live Logs to inspect authentication requests and results. Option A is wrong because the AP is not the supplicant in this WLAN client authentication event. Option B downgrades the security model and avoids 802.1X rather than fixing it. Option D addresses NAC behavior, not a credential authentication failure. Reference topics:Client Connectivity Configuration — WPA3-Enterprise, 802.1X/EAP, RADIUS authentication, and client authentication troubleshooting.

Optimized roaming is a Cisco WLC feature designed to reduce sticky-client behavior. A sticky client remains associated to an AP even after moving far enough away that another AP would provide better RF service. Cisco describes optimized roaming as actively monitoring client data RSSI and disconnecting clients when received signal strength falls below the configured threshold. The official Catalyst 9800 documentation states that optimized roaming “disassociates client when the RSSI is lower than the set threshold,” which directly matches option A.

This function does not calculate device location through peer-to-peer beaconing, does not depend on external experience services, and is not static load balancing. It is an RF/client-roaming enforcement mechanism controlled by the wireless infrastructure. In practical operation, the AP/WLC evaluates client signal quality and, when the configured optimized roaming criteria are met, forces the client to disconnect so it can reassess the RF environment and roam to a better AP. Cisco also notes that optimized roaming helps maintain client connectivity by managing disassociationn based on RSSI and data-rate thresholds. Reference topics:Client Connectivity Configuration — client roaming behavior, sticky-client mitigation, RSSI thresholds, and WLC roaming optimization