How to Scan Rogue APs on 2.4 and 5 GHz with Cisco 2800I?
Short answer
B Set the XOR radio to Monitor mode so it scans both 2.4 GHz and 5 GHz for rogues, while leaving the slot 1 radio in Client Serving mode for existing SSIDs.
Question
Key Takeaways
Tests whether you know the 2800I XOR radio can monitor both bands while the fixed slot 1 radio continues serving 5 GHz clients—the trap is choosing Sniffer mode or reversing the radio roles.
Cisco 2800I APs use a dedicated 5 GHz slot 1 radio and a flexible XOR radio to scan for rogue APs in both 2.4 GHz and 5 GHz without disrupting 5 GHz client service. This guide confirms the correct radio role configuration is XOR in Monitor mode and slot 1 in Client Serving mode (B).
Common mistake: Many pick D, setting the XOR radio to Sniffer mode, because 'sniffer' sounds like rogue detection; however, Sniffer mode captures packets to an external analyzer and does not provide the continuous off-channel scanning that Monitor mode performs.
Expert Analysis
Why the Answer Is Correct
The Cisco 2800I has a fixed 5 GHz slot 1 radio and an XOR radio that can be configured as 2.4 GHz, 5 GHz, or Monitor mode. Because all SSIDs are 5 GHz only, slot 1 must remain in Client Serving mode to preserve existing client connectivity. The XOR radio in Monitor mode serially scans both 2.4 GHz and 5 GHz for rogue APs, satisfying the mandate without adding hardware. This is exactly option B. As Farhad123 noted, "we need to use XOR radios on Monitor mode."Why the Other Options Are Wrong
Option A assigns the XOR radio to Client Serving and slot 1 to Sniffer; slot 1 is fixed to 5 GHz, so it cannot scan the 2.4 GHz band. Option C puts slot 1 in Monitor mode, again missing 2.4 GHz rogues, and leaves the XOR radio serving clients instead of scanning. Option D selects Sniffer mode for the XOR radio, but Sniffer mode is designed for packet capture to an external analyzer, not for continuous rogue detection. Jonycici correctly stated that "Sniffer mode should not be considered in this scenario" and that the XOR radio can "passively monitor both the bands" on the same AP.Community Comment Notes
Farhad123 and Jonycici both endorse answer B, with Farhad123 explaining the dual-radio architecture and Jonycici linking the Cisco XOR configuration guide. A single learner, 91f3856, chose D by arguing that XOR Sniffer plus slot 1 Client Serving would monitor both bands, but this conflates the Sniffer and Monitor radio roles. The Cisco document referenced by Jonycici describes the XOR radio's ability to serially scan both bands in Monitor mode while the other radio serves clients. The strong community consensus for B aligns with that official behavior.Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question asks to scan both bands without impacting clients, first identify which radio is fixed and which is flexible; then assign the fixed radio to client service and the flexible/XOR radio to Monitor mode. Remember that Sniffer mode is for packet capture, not rogue detection.
Frequently Asked Questions
Why is Sniffer mode wrong for rogue AP scanning on the 2800I?
Sniffer mode captures packets to a remote analyzer and is not the continuous off-channel scan that Monitor mode provides for dual-band rogue detection.
Why does slot 1 stay in Client Serving mode in option B?
Slot 1 is the fixed 5 GHz radio, and all SSIDs are 5 GHz only, so it must serve clients; the XOR radio handles dual-band monitoring without disrupting connectivity.
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors, not of islever. The comments shown first are the most substantive of the thread — ranked by depth, community endorsement and relevance; expand the list below to read the rest.
From public community threads 4
-
Jonycici 👍 1 Answered BB is correct. Sniffer mode should not be considered in this scenario because it is primarily used for capturing and analyzing network traffic, which can disrupt normal network operations. The XOR radio offer the ability to serve 2.4–GHz or 5–GHz bands or passively monitor both the bands on the same AP. These APs can be configured to serve clients in 2.4–GHz and 5–GHz bands, or serially scan both 2.4–GHz and 5–GHz bands on the flexible radio while the main 5–GHz radio serves clients.
-
Farhad123 👍 1 Answered BThe Cisco 2800 Series APs have a dual-radio architecture, which includes: Slot 1 (5 GHz radio) → Typically used for client connectivity. XOR Radio (Software-Defined Radio, 2.4 GHz or 5 GHz) → Can be configured in different roles. And if we want to find rogue AP we need to use XOR radios on Monitor mode.
-
91f3856 👍 1D. Set the XOR radio role to Sniffer mode and the slot 1 radio to Client Serving on all the APs. This setup allows the APs to monitor both the 2.4 GHz and 5 GHz bands for rogue APs while continuing to serve client devices on the 5 GHz band, ensuring that existing client connectivity is not impacted.
-
Jonycici 👍 1https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/16-11/config-guide/b_wl_16_11_cg/cisco-xor.pdf
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.