An engineer is using Cisco Prime Infrastructure reporting to monitor the state of security on the WLAN. Which output is produced when the Adaptive wIPS Top 10 AP report is run?

The "Adaptive wIPS Top 10 AP" report in Cisco Prime Infrastructure identifies the access points that have detected the highest number of security threats. The report lists the top 10 access points ranked by the total count of Wireless Intrusion Prevention System (wIPS) events. This security monitoring function relies on Access Points configured in monitor mode. In this mode, an AP dedicates its radios to off-channel scanning, continuously monitoring all channels in its band to detect rogue devices and security attacks, which is the foundation of the Adaptive wIPS system.

A: This is incorrect because the report lists the top 10 Access Points based on event count, not the last 10 wIPS events. B: This is incorrect for the same reason as A; it focuses on events instead of APs. Additionally, it incorrectly specifies sniffer mode. C: This is incorrect because the primary mode for dedicated wIPS scanning is monitor mode, not sniffer mode. Sniffer mode is used for packet captures.

1. Cisco Wireless LAN Controller Configuration Guide, Release 8.5, "Configuring Intrusion Prevention System" chapter, "Information About Intrusion Prevention System" section. This guide explains the roles of different AP modes. It states, "An access point in monitor mode is dedicated to wIPS and rogue detection and does not serve clients." This confirms that monitor mode is the dedicated mode for wIPS functionality.

2. Cisco Prime Infrastructure 3.5 User Guide, "Reports" chapter, "Security Reports" section. This document describes the available security reports. The "Adaptive wIPS Top N APs" report is detailed as showing the "Top N access points that have detected the maximum number of attacks," confirming the report's focus on ranking APs by threat detection volume.

3. Cisco, "Adaptive Wireless Intrusion Prevention System Deployment Guide," "Cisco Adaptive wIPS Architecture" section. This document outlines the system's architecture, specifying that "Monitor Mode APs are dedicated to security monitoring and do not provide client service... They are placed in a network to scan all channels including the channels not used by the local infrastructure." This directly links monitor mode APs to the core function of Adaptive wIPS.