CCNP Wireless WLCOR 350-101 Study Guide: Domains, Plan and Labs

WLCOR (350-101, Implementing and Operating Cisco Wireless Core Technologies) is the core exam of CCNP Wireless and satisfies the core exam requirement for CCIE Wireless. It is a 120-minute exam, first available on 19 March 2026, that covers seven domains: RF fundamentals, 802.11 fundamentals, wireless network implementation and operation, client connectivity, monitoring and management, and automation and AI. Passing it on its own earns the Cisco Certified Specialist – Wireless Core certification.

WLCOR exists because Cisco split wireless out of the enterprise track. Cisco said the CCNP Enterprise core exam would no longer cover wireless concepts, and the current ENCOR v1.2 exam topics have no wireless section at all. If you studied wireless for ENCOR in the past, that material now belongs here, at a much greater depth. This guide covers what each domain asks of you, a 12-week plan and the labs that are realistic to build. Before you book, read Cisco's official WLCOR exam topics; that page is the only source that counts.

WLCOR 350-101 at a glance

Where WLCOR fits in CCNP Wireless

CCNP Wireless follows the same pattern as the other CCNP tracks: one core exam plus one concentration exam of your choice. Every exam you pass also earns its own Specialist certification.

If you are still deciding between tracks: ENCOR is the core of CCNP Enterprise and now concentrates on architecture, virtualization, routing and switching infrastructure, assurance, security and automation. The CCNP ENCOR study guide covers that exam, and you can check your level with the CCNP ENCOR practice test.

What is on the WLCOR exam?

Seven domains. The weights tell you roughly how much of the exam each one takes:

Look at the verbs. The first three domains are mostly "describe"; domains 4 and 5, 40% of the exam between them, are "configure" and "implement". The exam wants you to know how a controller is actually set up, not just what a WLAN is. Here is what each domain contains according to the official topics, and what that means for your preparation.

Get the math automatic, because it feeds everything else. dB is a ratio and dBm an absolute power referenced to 1 mW: 0 dBm is 1 mW, +3 dB roughly doubles the power, +10 dB multiplies it by ten. EIRP is transmit power minus cable and connector loss plus antenna gain (in dBi). SNR is the received signal minus the noise floor, so −65 dBm over a −92 dBm floor gives 27 dB. For propagation, know free-space path loss and the behaviours that change a signal on its way: absorption, reflection, refraction, diffraction and scattering, and why multipath was a problem for older radios but is used by MIMO. For antennas, know omnidirectional versus directional patterns, how to read azimuth and elevation charts, and beamwidth. The device-capabilities item is a reminder that the client, usually a phone with less transmit power and fewer spatial streams than the AP, is often the limit in a design.

Keep the three bodies apart: regulators decide which frequencies and power levels are legal in a region, the IEEE writes the 802.11 standards, and the Wi-Fi Alliance certifies interoperability and owns names such as Wi-Fi 6, 6E and 7 and WPA3. Know the three bands (2.4, 5 and 6 GHz), why 2.4 GHz has only three non-overlapping 20 MHz channels in most regions, and what wider channels cost you in a dense deployment: fewer independent channels and more co-channel contention. For modulation, know the path from DSSS to OFDM, what OFDMA adds in Wi-Fi 6, and that higher QAM orders need a cleaner signal. MLO (Multi-Link Operation) is the Wi-Fi 7 feature that lets a device use links in more than one band at once. Learn the three frame types (management, control, data) with examples of each, such as beacons, probes, authentication and association frames, RTS/CTS and ACKs. RRM fundamentals here means what Radio Resource Management does in principle: automatic channel assignment and transmit power control, plus coverage hole detection.

Know where traffic goes in each architecture. In a centralized (local mode) design, APs tunnel client traffic to the controller over CAPWAP. With FlexConnect, traffic can be switched locally at the AP. In SD-Access fabric wireless, the controller handles the control plane while client data goes into the fabric at the edge node over VXLAN. Mesh APs use a wireless backhaul to a root AP. Cloud means Meraki, where the dashboard manages APs and client traffic does not pass through it. For the physical side, think about switch ports (access or trunk depending on AP mode), PoE budget, and the controller's uplinks. Management access covers the controller GUI and CLI, AP console and SSH access, and dashboard accounts.

The AP join process is the classic exam topic and the classic outage. An AP needs an IP address, then has to find a controller: a previously learned or primed controller, DHCP option 43, a DNS lookup of CISCO-CAPWAP-CONTROLLER in the local domain, or a broadcast on the local subnet. It then joins over CAPWAP (UDP 5246 for control, 5247 for data) with a DTLS-protected control channel, and may download a new image before it is ready. Learn to say where in that sequence a given failure happens. Know the AP modes and what each is for: local, FlexConnect, monitor, sniffer, bridge (mesh), and the dedicated sensor and spectrum-analysis roles. On the Catalyst 9800 the configuration model is built from profiles and tags: a WLAN profile and a policy profile joined in a policy tag, plus a site tag and an RF tag, all applied to the AP. If you learned the older AireOS controllers, this is the biggest change to absorb, and it is worth labbing until you can build it without notes.

"Outside the controller" means a RADIUS server such as ISE: 802.1X with EAP methods (EAP-TLS with certificates, PEAP with credentials), the controller as authenticator, and RADIUS attributes that return a VLAN or policy. "On the controller" covers PSK, WPA3-Personal with SAE, WPA3-Enterprise, OWE, MAC filtering and local web authentication. Remember that the 6 GHz band requires WPA3 or OWE, so an old WPA2 WLAN cannot simply be extended there. For roaming, separate the layers: Layer 2 roams within the same VLAN, Layer 3 roams between controllers or subnets with mobility (anchor and foreign), and the fast-roaming helpers 802.11r (Fast Transition), 802.11k (neighbor reports) and 802.11v (BSS transition management). Guest networking is usually central web authentication with ISE: the client gets a redirect, signs in on a portal, and a Change of Authorization updates its session. The operating-systems item is practical: know how Windows, macOS, iOS and Android present certificates, profiles and 802.1X settings, because many "the WLAN is broken" tickets are a client setting.

Maintenance means software upgrades, configuration backups and keeping APs and controllers on supported releases. For client troubleshooting, think in the order a client connects: association, authentication, then IP address, then traffic. The question is always at which step the client stopped. On the 9800, learn to read the client state and its run state, and use the debugging tools built into the controller (radioactive tracing on a client MAC address is the one to know). Integrations means how the controller works with the rest of the stack: ISE for policy, Catalyst Center for assurance, Spaces for location services, and syslog and SNMP for monitoring.

You won't write code; you will read it. Know Python's basic types (strings, lists, dictionaries), loops and functions, and be able to say which endpoint a script calls, how it authenticates and what it does with the JSON it gets back. NETCONF runs over SSH (port 830 by default) and uses YANG models to describe configuration and operational data; RESTCONF exposes the same models over HTTPS. "Wireless infrastructure APIs" covers the controller, the Catalyst Center REST API and the Meraki Dashboard API. For the AI items, know what each does at a high level: AI Analytics turns Assurance data into insights and baselines, AI Operations is about using that data to troubleshoot and act faster, and AI-RRM moves radio resource management calculations to the cloud through Catalyst Center so that channel and power decisions use more history than a controller alone keeps.

How hard is WLCOR?

Cisco doesn't publish pass rates or the passing score, so any number you read is a guess. What makes WLCOR hard is that it spans two different kinds of knowledge. The first three domains are physics and standards: RF math, modulation, channel planning. The last four are product operation across several platforms: the 9800 controller, ISE, Catalyst Center, the Meraki dashboard and Spaces. Few people work with all of them day to day.

If you come from routing and switching, RF will be the new part, and the 9800 tag model will feel unusual at first. If you come from a wireless background, the hard part is more likely domain 7 and the integrations with ISE and Catalyst Center. Either way, 120 minutes is enough if you know the material, but not enough to work things out from scratch.

One practical point: recognizing a topic when you read about it is not the same as answering correctly under time pressure. Test yourself before you book, not after.

How long should you study for WLCOR?

A realistic range is 12 to 20 weeks at 8 to 10 hours a week, depending on how much hands-on wireless experience you have. The plan below is 12 weeks for someone with CCNA-level networking; if you have never configured a wireless controller, double weeks 5 to 7.

Which labs should you build for WLCOR?

Wireless is harder to lab than routing, because you need real radios. You don't need a lot of hardware, though: a virtual controller, one or two access points and Cisco's free sandboxes cover most of the blueprint.

1. Catalyst 9800-CL controller. The 9800-CL is the virtual Catalyst 9800 controller, with images for VMware ESXi, KVM and Hyper-V on software.cisco.com; check what your Cisco account is entitled to download. Cisco's documentation says the 9800-CL needs no license to boot and that the evaluation license gives you all 9800 functionality for 90 days, which cannot be reset once it expires. Run the day-0 setup, then join an AP: first with DHCP option 43, then with DNS, and watch the CAPWAP join on the controller.
2. One or two physical APs. A Catalyst 9100-series AP bought second-hand is the usual choice; check that your controller release supports the model before you buy. Build a policy tag, site tag and RF tag from scratch. Create a PSK WLAN, a WPA3-SAE WLAN and an OWE WLAN, move the AP between local and FlexConnect mode, and with two APs test roaming with 802.11r on and off.
3. ISE in evaluation mode. A new ISE installation includes a 90-day evaluation license for up to 100 endpoints with all features. Use it as the RADIUS server for an 802.1X WLAN with PEAP, then EAP-TLS, return a VLAN with an authorization profile, and build a central web authentication guest flow with CoA. ISE needs a lot of RAM, so check your host first.
4. Catalyst Center sandbox. Cisco DevNet offers a free Catalyst Center sandbox: an always-on instance and a reservable one. Use it to learn the screens, the Assurance views and the REST API rather than to manage your own APs.
5. Packet captures. A laptop that can capture 802.11 frames, or an AP in sniffer mode streaming to Wireshark, lets you see beacons, probes, authentication and association, the 4-way handshake and an 802.1X exchange. Reading real frames makes the frame-type and roaming questions much easier.
6. APIs and Meraki. DevNet's reservable Meraki sandboxes give you a Meraki organization with virtual MX, MS and MR devices. Call the Meraki Dashboard API and the Catalyst Center API with a short Python script, and enable NETCONF on your 9800-CL to pull configuration with YANG models. Writing one script makes the "interpret this script" questions much easier.

How to study for WLCOR

• Work from the official v1.0 topics. Older CCNP Enterprise wireless material (ENWLSD and ENWLSI) and older ENCOR chapters overlap with WLCOR but don't map onto it; check every topic against the official list.
• Do the RF math by hand until it is boring. These are some of the cheapest marks on the exam if you are fluent, and a time sink if you are not.
• Learn each platform the same way. What does it control, where does the client's traffic go, what are its policy objects, and where do you look when a client can't connect?
• Practise against the clock. Timed practice is also how you find the domains you've been avoiding.

WLCOR FAQ

CertAce is not affiliated with or endorsed by Cisco Systems. Cisco, CCNP, CCIE, Catalyst and Meraki are trademarks of Cisco Systems, Inc. Exam facts on this page come from Cisco's published exam page and exam topics for 350-101 WLCOR v1.0; check those pages for changes before you book.