Exam 350-401 topic 1 question 217 discussion

C and E are correct. Rogue Detection is performed by Local and Flex-Connect (in connected mode) mode APs and utilizes a time-slicing technique which allows client service and channel scanning with the usage of the same radio. With the move to off channel for a period of 50ms every 16 seconds, the AP, by default, only spends a small percentage of its time to not serve clients. Monitor mode serves only to scan, not to serve clients. Monitor mode APs are also far superior at the detection of rogue clients as they have a more comprehensive view of the activity that occurs in each channel. Just as @YTAKE, @Adrenalina73, @xziomal9, @wifishark and others say. https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/112045-handling-rogue-cuwn-00.html#anc8

Shouldn't it be C & E?

C & E are correct

Why in the Question 214 the answer is Monitor and here is Local?

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/112045-handling-rogue-cuwn-00.html Local Mode APs Serves clients with time-slicing off-channel scan Monitor Mode APs Dedicated Scan Flex-Connect Facts A FlexConnect AP (with rogue detection enabled) in the connected mode takes the containment list from the controller. If auto-contain SSID and auto contain adhoc are set in the controller, then these configurations are set to all FlexConnect APs in the connected mode and the AP stores it in its memory.

Answer is C & E, because "Monitor" mode is not used for client serving, none of them is except "Local" and "FlexConnect"

B,C, and E are all correct. But they only want two answers so probably C and E.

CE +In a dense RF environment, where maximum rogue access points are suspected, the chances of detecting rogue access points by a local mode access point and FlexConnect mode access point in channel 157 or channel 161 are less when compared to other channels. To mitigate this problem, we recommend that you use dedicated monitor mode access points. +The local and FlexConnect mode access points are designed to serve associated clients. These access points spend relatively less time performing off-channel scanning: about 50 milliseconds on each channel. If you want to perform high rogue detection, a monitor mode access point must be used. Alternatively, you can reduce the scan intervals from 180 seconds to a lesser value, for example, 120 or 60 seconds, ensuring that the radio goes offchannel more frequently, which improves the chances of rogue detection. However, the access point continues to spend about 50 milliseconds on each channel.

I agree with the others. Monitor mode does not transmit. Therefore, it cannot serve client's.

it say; ..one or more wireless channels for rogue ap.. so, the ans. = C&E

• Local: The default lightweight mode that offers one or more functioning BSSs on a specific channel. During times when it is not transmitting, the AP scans the other channels to measure the level of noise, measure interference, discover rogue devices, and match against intrusion detection system (IDS) events. Monitor: The AP does not transmit at all, but its receiver is enabled to act as a dedicated sensor. The AP checks for IDS events, detects rogue access points, and determines the position of stations through location-based services.

It should be CE

CE because only both bring services of BSS to clients and scans the channel when there is no traffic

correct CE

The correct answer is: C. FlexConnect E. local

Hello I suppose is C and E ... look there about FlexConnect architecture: https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/emob73dg/emob73/ch7_HREA.pdf

C ^& E 100%