How to Scan Rogue APs on 2.4 and 5 GHz with Cisco 2800I?
A customer has a Cisco wireless network that has these configurations and components: • two Cisco Catalyst 9800 Series WLCs in a high availability cluster • 50 Cisco 2800I APs • all SSIDs and services are 5 GHz only A security mandate requires that rogue APs be scanned and identified in 2.4 GHz and 5 GHz bands and must not impact existing client connectivity. How must the wireless network be reconfigured to meet the requirement without purchasing additional APs?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests whether you know the 2800I XOR radio can monitor both bands while the fixed slot 1 radio continues serving 5 GHz clients—the trap is choosing Sniffer mode or reversing the radio roles.
Cisco 2800I APs use a dedicated 5 GHz slot 1 radio and a flexible XOR radio to scan for rogue APs in both 2.4 GHz and 5 GHz without disrupting 5 GHz client service. This guide confirms the correct radio role configuration is XOR in Monitor mode and slot 1 in Client Serving mode (B).
Many pick D, setting the XOR radio to Sniffer mode, because 'sniffer' sounds like rogue detection; however, Sniffer mode captures packets to an external analyzer and does not provide the continuous off-channel scanning that Monitor mode performs.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The Cisco 2800I has a fixed 5 GHz slot 1 radio and an XOR radio that can be configured as 2.4 GHz, 5 GHz, or Monitor mode. Because all SSIDs are 5 GHz only, slot 1 must remain in Client Serving mode to preserve existing client connectivity. The XOR radio in Monitor mode serially scans both 2.4 GHz and 5 GHz for rogue APs, satisfying the mandate without adding hardware. This is exactly option B. As Farhad123 noted, "we need to use XOR radios on Monitor mode."Why the Other Options Are Wrong
Option A assigns the XOR radio to Client Serving and slot 1 to Sniffer; slot 1 is fixed to 5 GHz, so it cannot scan the 2.4 GHz band. Option C puts slot 1 in Monitor mode, again missing 2.4 GHz rogues, and leaves the XOR radio serving clients instead of scanning. Option D selects Sniffer mode for the XOR radio, but Sniffer mode is designed for packet capture to an external analyzer, not for continuous rogue detection. Jonycici correctly stated that "Sniffer mode should not be considered in this scenario" and that the XOR radio can "passively monitor both the bands" on the same AP.Community Comment Notes
Farhad123 and Jonycici both endorse answer B, with Farhad123 explaining the dual-radio architecture and Jonycici linking the Cisco XOR configuration guide. A single learner, 91f3856, chose D by arguing that XOR Sniffer plus slot 1 Client Serving would monitor both bands, but this conflates the Sniffer and Monitor radio roles. The Cisco document referenced by Jonycici describes the XOR radio's ability to serially scan both bands in Monitor mode while the other radio serves clients. The strong community consensus for B aligns with that official behavior.Official Reference
Exam Strategy
When a question asks to scan both bands without impacting clients, first identify which radio is fixed and which is flexible; then assign the fixed radio to client service and the flexible/XOR radio to Monitor mode. Remember that Sniffer mode is for packet capture, not rogue detection.
Frequently Asked Questions
Why is Sniffer mode wrong for rogue AP scanning on the 2800I?
Sniffer mode captures packets to a remote analyzer and is not the continuous off-channel scan that Monitor mode provides for dual-band rogue detection.
Why does slot 1 stay in Client Serving mode in option B?
Slot 1 is the fixed 5 GHz radio, and all SSIDs are 5 GHz only, so it must serve clients; the XOR radio handles dual-band monitoring without disrupting connectivity.