Which specific action takes place during a standard Cisco wireless Layer 3 inter-controller roam?

350-401 By islever Editorial Last updated

Short answer

D Client traffic is tunneled back to the original controller after a Layer 3 roam occurs.

Question

Which action occurs during a Layer 3 roam?
  1. The client receives a new IP address after authentication occurs.
  2. The client is marked as "Foreign" on the original controller.
  3. The client database entry is moved from the old controller to the new controller.
  4. Client traffic is tunneled back to the original controller after a Layer 3 roam occurs. Correct Answer

Key Takeaways

During Layer 3 roam, the original anchor controller keeps the full client entry, and foreign controller tunnels all client traffic back to the anchor to preserve the client's original IP address.

This question validates core knowledge of Cisco WLC Layer 3 roaming behaviors, testing the critical difference between client entry copy/move logic and mobility tunneling functionality.

Common mistake: 32% of candidates incorrectly select Option C, failing to notice the wording "moved" is wrong: the client entry is copied, not fully transferred away from the original anchor controller.

Expert Analysis

Correct Option Justification

  • Option D is fully aligned with Cisco's official Layer 3 roaming specifications. After the mobility handshake completes between the new foreign controller and the original anchor controller, a CAPWAP EoIP mobility tunnel is established to encapsulate and forward all the roaming client's traffic back to the original anchor controller. This design ensures the client maintains its original IP address across different Layer 3 subnets without IP reconfiguration, making the roam completely transparent to the end device.

Incorrect Option Analysis

  • Option A: The client does not receive a new IP address during Layer 3 roaming, which is the core purpose of the mobility tunnel to preserve the original existing IP assignment.
  • Option B: The client is marked as "Anchor" on the original controller, and only marked as "Foreign" on the new visiting controller, so this statement is factually reversed.
  • Option C: The client database entry is ‌copied‌ instead of moved from the old controller to the new one. The original anchor controller retains the full, authoritative client entry permanently, so the "moved" description is incorrect.

Related Technical Principle

Official Reference

Cisco documentation: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/overview.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Spot the trick wording first: "moved" invalidates Option C, confirm Layer 3 roam requires traffic tunneling back to the original anchor controller.

Community Votes

D
68%
C
32%

68% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 20 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 20

  1. shefo1 👍 12
    maybe D is right because , from cisco Layer 3 roaming is similar to Layer 2 roaming in that the controllers exchange mobility messages on the client roam. However, instead of moving the client database entry to the new controller, the original controller marks the client with an “Anchor” entry in its own client database. The database entry is copied to the new controller client database and marked with a “Foreign” entry in the new controller. The roam remains transparent to the wireless client, and the client maintains its original IP address. https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/overview.html
  2. ExamTaker1017 👍 4 Answered D
    Mobility Tunneling: The new WLC (foreign controller) establishes a tunnel to the original WLC (anchor controller) where the client was first associated. This tunnel allows the client to retain its original IP address. The original WLC (anchor controller) keeps the client's database entry, including its session information, security context, and original IP address. The foreign controller creates a new client entry in its database for the client but marks it as a "foreign" entry.
  3. 8577773 👍 3 Answered D
    Answer is D based on the definition of a layer 3 roam from the official cert guide: "A Layer 3 intercontroller roam consists of an extra tunnel that is built between the client’s original controller and the controller it has roamed to. The tunnel carries data to and from the client as if it is still associated with the original controller and IP subnet. Figure 19-9 shows the results of a Layer 3 roam. The original controller (WLC 1) is called the anchor controller, and the controller with the roamed client is called the foreign controller. Think of the client being anchored to the original controller no matter where it roams later. When the client roams away from its anchor, it moves into foreign territory."
  4. Miro07 👍 2 Answered C
    I believe there is an emphasis on word "during" A - happens when roaming is not enable B - wrong since it marked as Anchor on original controller (happens during roam) C - correct and happens during Layer 3 roaming D - answer itself says "after a layer 3 roam occurs" - "during" requirement not met
  5. [Removed] 👍 2 Answered D
    after reading this, im going with D https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/overview.html#:~:text=Layer%203%20roaming%20is%20similar,in%20its%20own%20client%20database.
Show 15 more comments
  1. lohitnadimpalli 👍 2
    Answer is C The database entry is copied to the new controller client database and marked with a “Foreign” entry in the new controller. Option B says : as a Foreign in OLD controller , So wrong.
  2. Beehurls 👍 2 Answered D
    Client stays anchored to the original controller so the client database entry does not move. It is copied.
  3. zbeugene7 👍 2
    Correct answer is D. Database entry is not moved because tunnel is estabished to original controller.
  4. RickAO76 👍 2 Answered C
    Original Controller would have it anchored New Controller would have it listed as foreign.
  5. wengzaii96 👍 1
    In a Layer 3 roam, the client moves to a different subnet and thus a different controller. The new controller takes over managing the client, and the client database entry is updated and transferred from the old controller to the new one. This ensures that client sessions and context are maintained even as the client moves between different network segments.
  6. Eyad_Alotaibi 👍 1
    It is a tricky question, in choice C the word "moved" is wrong it should be "copied" because after the client roaming from AP1 to AP2; the database entry in this case copied from WLC1 to WLC2 (All WLC share the same database entry), NOT moved, MOVED meaning is the database of WLC1 became clear. so C is incorrect. The correct answer is D.
  7. OoxYxoO 👍 1 Answered D
    Layer 2 Roaming: The client database entry can be moved to the new controller as the client remains within the same Layer 2 domain. Layer 3 Roaming: The client database entry does not move to the new controller; instead, the new controller tunnels the client traffic back to the original controller to maintain the original IP address.
  8. d4c4159 👍 1
    D is the correct answer because the key here is the work "Layer 3 Roam" in a layer 3 roam the client connect remains with it's original controller so that it maintains it's original Layer 3 IP Address and thus it would be marked an Anchor on the original controller.
  9. post20 👍 1
    the correct answer is C. Once the association between the anchor and the foreign controller is established, the foreign controller is in charge of forwarding the client's data. That's the reason why the right answer can't be D
  10. Kan3184 👍 1 Answered D
    "The database entry is COPIED to the new controller" and "The database entry is MOVED to the new controller" is not the same!!! That is why answer C is not correct.
  11. c05e44e 👍 1
    D is the correct answer, Client traffic is tunneled back to the original WLC via CAPWAP Tunnel.
  12. leehyoeun 👍 2 Answered C
    answer is c
  13. sharonmiller 👍 1 Answered D
    The correct answer is D
  14. Agba 👍 1
    D is correct.
  15. 111dd84 👍 1 Answered D
    100% d

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide