Domain 1: FlexConnect
- FlexConnect exists so that traffic between two devices at the same branch does not cross a wide area link twice. Everything else about it follows from that single idea, including its complications.
- Two choices are made per WLAN and they are independent: where the client's data is put onto a wired network, and where the client's identity is checked. The combination is what decides what survives a wide area outage.
- A WLAN survives standalone operation only when neither the data path nor the identity check depends on the controller. One remaining dependency is enough to take it down, which is why a branch fails an outage test it was expected to pass.
- Local switching puts a frame onto a real VLAN at the branch, so that VLAN has to exist and be permitted on the switch port. This makes it as much a wired configuration task as a wireless one.
- A FlexConnect group collects the access points at one site so they share configuration and client state. The shared state is what makes roaming tolerable, and the shared mappings are why a group must not span two sites.
- Split tunnelling divides one client's traffic by destination, so a teleworker prints locally while corporate traffic still passes through the controller. The list of local destinations has to be maintained as the home or branch network changes.
- Fault tolerance preserves client sessions across a change between connected and standalone operation, provided nothing is edited while the access point is standalone. Editing during an outage is what forces a whole branch to reconnect on recovery.
- Moving a WLAN to local switching moves its traffic out from under every rule the controller was applying. Nothing fails and nothing is logged, which makes it a security consequence of a bandwidth decision.
Domain 2: QoS on a Wireless Network
- A radio cell cannot queue per port because every device contends for the same air. Shaping who transmits first is the only lever available, which is why the wireless scheme is quite different from the wired one.
- The advantage a priority gives is a shorter wait before contending rather than a reserved slot. It is statistical rather than absolute, which is why a congested cell still degrades voice even with the marking applied perfectly.
- The wired marking and the wireless priority are different values, so the boundary translates rather than copies. A translation table nobody has examined is where most end to end quality problems live.
- Wired devices see only the tunnel's outer header, so a tunnel whose outer marking does not reflect its contents makes every wired policy useless.
- A profile caps the priority a WLAN's clients may reach. A cap set for a general purpose WLAN silently prevents voice reaching the category it was marked for, and nothing about it looks like a failure.
- Per client and per WLAN limits cover different failures. A WLAN limit is satisfied by one device consuming all of it, which is why the per client control exists alongside it rather than instead of it.
- Application identification turns a claim about traffic into something the network can verify, and it supports marking, rate limiting and dropping. Encryption steadily reduces how much of the traffic can be identified at all.
- Priority allocates the capacity that exists and never creates any. A cell whose voice quality falls at every busy period is a capacity finding rather than a tuning one.
Domain 3: Multicast
- A multicast frame on a radio cell is sent once, slowly, and unacknowledged. The low rate consumes disproportionate airtime and the absence of an acknowledgement means loss cannot be recovered on that hop.
- A controller can deliver multicast to its access points as one copy per access point or as a single copy the network replicates. The second scales far better and requires the network to be able to replicate at all.
- Watching which clients requested which groups is what keeps a cell carrying one stream instead of every stream on the network. The query interval decides how long an unwanted stream lingers after its viewer leaves.
- Converting a stream to unicast at the access point buys acknowledgement and a proper rate, at the cost of one copy per subscribed client. It has to be limited and applied to named streams rather than everything.
- Link-local service discovery stays within one subnet, which is why a printer is invisible to wireless clients on a corporate network. A gateway listens, caches and answers queries from elsewhere without the advertisements crossing subnets.
- An unfiltered discovery gateway offers every service to every client however distant. Filtering by service type and by the client's location is what turns the list into something short enough to use.
- Broadcast shares multicast's cost on a radio medium. Answering address resolution requests from what the infrastructure already knows removes a steady stream of slow frames from every cell.
- Buffered broadcast and multicast wait until every sleeping client is awake, which turns a steady stream into a periodic burst. Unicast delivery escapes both the wake schedule and the loss.
Domain 4: Location Services
- Location is computed from how loudly several access points hear the same transmission. Every limitation of the service follows from that, including the need for several listeners with accurately known positions.
- Positions are computed against where the access points are believed to be, so an inaccurate map produces answers that are confidently and consistently wrong. Scale and access point placement both have to be right.
- Serving a client needs one good signal and locating it needs several. Location is a design requirement in its own right rather than something adequate coverage provides for free.
- Access points around the perimeter matter as much as density, because a device beyond every listener can only be estimated by extrapolation. Raising transmit power does not help, since the differences between measurements are what the computation uses.
- A position is only ever a record of the last time a device was heard, so a quiet device appears stationary long after it has moved. A tag's transmission interval trades currency against battery life.
- Interference and unauthorised networks are located exactly as clients are, provided enough capable access points hear them. Detection needs one listener and location needs several, which is why a site can know interference exists without saying where.
- Devices that never join the network are still located while they transmit, so the data covers everybody within earshot rather than everybody who signed in. That is a privacy decision to take before the system is switched on.
- Aggregate counts answer most of the questions an organisation actually has about its buildings, and they do it without holding anything about an individual.
Domain 5: Advanced Location Services
- Presence services answer whether a device is in the venue rather than exactly where, which is what makes them workable at a site with one or two access points. The distinction is drawn from signal strength and duration.
- Dwell is measured from the first to the last time a device was heard, so a device in a pocket appears to leave early. The figures are a trend to compare with themselves rather than a census.
- Client devices deliberately change the identifier they transmit, which undercounts returning visitors and inflates arrivals at the same time. Analytics from this data have to be presented honestly.
- A location aware portal needs both a deployment that can tell one area from another and a portal that can vary its content. Either half alone produces a page that is the same everywhere.
- A cloud location service depends on a relay on site that has to be deployed, sized and monitored. Its failure is silent from the wireless side, which is why it goes unnoticed for months.
- High precision location adds a directional measurement from an antenna array and aims at roughly a metre. It needs particular hardware, a dense deployment and an accurately recorded orientation for each access point.
- A resilient location platform is an active member and a standby holding a copy with a small lag. It provides continuity rather than additional capacity, and the feed has to follow the takeover.
- Wireless intrusion detection looks for attack patterns in the frames rather than inside encrypted sessions. It produces far more alarms than expected at first, and containment is transmission aimed at somebody else's equipment.
Domain 6: Security for Wireless Client Connectivity
- Three roles: the client presents an identity, the infrastructure relays it and the server decides. The relay role is what lets an access point in a public area hold nothing worth stealing.
- In a password based method the client must check the server's certificate before sending its password. Disabling that check makes a stubborn client connect and is the most serious mistake in the whole area.
- A pushed profile fixes the method, the authority to trust and the server name expected. Leaving those to users produces a fleet where some devices check the server and others do not.
- Authentication and key derivation are separate stages, so a client accepted by the server can still fail to connect. The server's verdict and the controller's record of what happened next bracket the gap.
- Profiling is a well informed guess assembled from what a device says and how it behaves. It is excellent for placing a printer and inadequate for deciding whether to trust a laptop with sensitive access.
- Guest networks are open so a browser can reach the page, which means the traffic is unprotected on the air until something else protects it. Sponsorship is only meaningful when each sponsor uses their own account.
- Onboarding configures a device the organisation does not manage, and a certificate issued during it can be revoked when a device is lost or its owner leaves. Revocation only works where something checks it.
- Identity based networking decides what a client may do by who it is rather than where it connected. Everything the server names has to exist consistently at every site that might receive it.
Domain 7: Monitoring
- A management platform adds history and a view across every controller. Whether a problem seen today was also happening last month is the question that genuinely requires one.
- Retention shorter than the time complaints take to arrive makes the whole capability useless, because the period in question has already been discarded when somebody asks.
- A baseline records what normal looks like so a departure can be noticed. It has to be taken while the deployment is known to be working and over long enough to include ordinary variation.
- An alarm asserts that somebody should look at something now. An alarm nobody would act on should be a log entry, and a severity scale collapses once most alarms sit at the top of it.
- One failure produces an alarm from everything downstream, so relating alarms to one another matters as much as detecting them. Suppression during planned work needs both a scope and an expiry.
- Most unauthorised network findings are neighbours. What raises one to serious is evidence of a relationship with the organisation: appearing on its wired network, or its own clients associating to it.
- Interference does not take turns on the medium, so the network's own politeness offers no protection. A busy medium with light network traffic in part of the band is the distinctive signature.
- A client that cannot connect failed at one of four stages, and establishing which one eliminates most possibilities immediately. Asking whether the same client works elsewhere and whether others work in the same place narrows it fastest.
Domain 8: Device Hardening
- Central administrative accounts mean one change reaches every device and a server outage removes the access. A local fallback has to remain, and it deserves more care than an ordinary account rather than less.
- A protocol that authorises individual commands makes a read only role possible, which is what most people who need access actually require. One protocol protects the whole exchange and another protects only the password.
- A record of administrative commands answers what changed and who changed it, which is the question after every unexplained outage. It has to be sent off the device or it disappears with it.
- Traffic addressed to a controller and traffic passing through it are filtered by entirely different mechanisms. A client filter says nothing about who may reach the controller's own services.
- Reachability and credentials are separate questions: strong credentials resist guessing and do nothing about a flaw in the service itself. Naming the sources administrators work from is worth more than any password policy.
- A configuration backup holds credentials and secrets and deserves protection at least as strong as the devices themselves. A backup that has never been restored is a file rather than a backup.
- An access point's manufacturer certificate establishes that the hardware is genuine, not that it belongs to this organisation. A record of the devices actually owned is what completes the check.
- Hiding a network name, filtering by hardware address and changing names at intervals are obscurity rather than protection. A credential and encryption are what keep somebody off a network.
Cisco ENWLSI 300-430 Enterprise Wireless exam tips
- Read each scenario for what has been observed rather than what might be true. Several options are usually real Cisco wireless concepts and only one answers the question that was actually asked.
- For any FlexConnect question, work out where the WLAN switches and where it authenticates. Those two settings predict almost everything about how the branch behaves during an outage.
- Treat 'the client associated but has no connectivity' as a question about what happens after association, and never as a question about coverage or credentials.
- Distinguish faults that appear only at the busy hour from faults that appear at any hour. The first is capacity or contention; the second is configuration, and mixing them up sends an investigation the wrong way.
- On multicast and broadcast questions, remember that the cost is airtime rather than bandwidth. A slow frame that serves nobody is paid for by every device on the cell.
- For location questions, ask how many access points hear the device and how accurately their positions are recorded. Nearly every accuracy problem reduces to one of those two.
- In the security domain, keep authentication, authorisation and the treatment applied afterwards separate. Questions are often built on a client being accepted and then receiving something unexpected.
- Where a question offers a measure that adds capability and one that removes unnecessary exposure, prefer the removal. Hardening is a series of small removals rather than a single large addition.
Study guide FAQ
What is the ENWLSI 300-430 exam format?
It is a 90-minute concentration exam for the CCNP Enterprise certification. Cisco uses scaled scoring and does not publish a fixed cut score, so the threshold shown here is a practice figure rather than an official pass mark.
What does ENWLSI cover?
Eight domains: FlexConnect (15%), QoS on a Wireless Network (10%), Multicast (10%), Location Services (10%), Advanced Location Services (10%), Security for Wireless Client Connectivity (20%), Monitoring (15%) and Device Hardening (10%). Client security is the largest single domain.
Which certification does ENWLSI count towards?
It is one of the concentration exams for CCNP Enterprise, taken alongside the ENCOR 350-401 core exam. It also counts towards the Cisco Certified Specialist recognition for enterprise wireless implementation.
Does the exam still refer to Cisco DNA Center?
The published topic sheet is dated 2023 and still uses that name. Cisco has since renamed the product to Catalyst Center, and this bank uses the current name for the same capability, which is the same convention applied to the CCNA bank.
How much of the exam is troubleshooting rather than configuration?
A great deal of it is phrased as a described symptom with several plausible causes. Following a client through association, authentication, addressing and reaching a destination matters more than recalling individual settings.
How many questions are in this practice bank?
The bank holds 767 questions drawn to the official domain weights, so a full mock reproduces the proportions of the real exam rather than the topics that were easiest to write.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Cisco - 300-120 WLSI exam topicsBlueprint revised v1.2 (2025 Cisco Public) · link and content verified 8 September 2026Eight domains totalling 100%: FlexConnect 15%, QoS on a Wireless Network 10%, Multicast 10%, Location Services 10%, Advanced Location Services 10%, Security for Wireless Client Connectivity 20%, Monitoring 15%, Device Hardening 10% - our eight domain names and our eight weights, exactly. 90 minutes, also ours. The detailed outline is at https://learningcontent.cisco.com/documents/marketing/exam-topics/300-120-WLSI-v1.2-1.pdf
- Cisco - certification exam policieslink and content verified 8 September 2026"Cisco does not publish exam passing scores because exam questions and passing scores are subject to change and may vary exam to exam, without notice." Passing scores are "set by using statistical analysis". This is why no Cisco page here prints a cut score as Cisco's: the 825/1000 and 750/1000 figures repeated across study sites are not Cisco's, and CertGrid's own threshold is labelled as a practice figure. Read through a rendered browser - cisco.com answers a plain fetch with HTTP 403.
This page and the current vendor source differ. The blueprint matches; the exam identity does not, and nothing has been relabelled. We call this exam ENWLSI 300-430 and place it under CCNP Enterprise. Cisco's current pages carry no 300-430: learningnetwork.cisco.com/s/enwlsi-exam-topics is a 404, the CCNP Enterprise concentration list (ENARSI, ENSDWI, ENSLD, ENAUTO, ENCC, ENNA) has no wireless entry, and the same eight domains at the same eight weights now appear as 300-120 WLSI, Implementing Cisco Wireless Advanced Solutions v1.2, a concentration exam under a separate CCNP Wireless track whose core is 350-101 WLCOR. So this is an exam-identity change - code, name and parent certification - rather than a version bump. Domain-level alignment is already proven exact, which scopes the remaining work: WLSI v1.2 names Cisco Spaces Connector, Catalyst Center and ISE in its sub-objectives, and our 767 questions are written product-agnostically (zero mentions of any of the three), so sub-objective coverage is what needs verifying before the code and title move.