ExtremeCloud IQ Certification flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

ExtremeCloud IQ

A cloud-delivered management platform for Extreme switches, access points, and routers that centralizes configuration, policy, telemetry, and monitoring across wired and wireless networks.

Account hierarchy

The top-level tenant contains sites and devices; devices are assigned to a site, and the site determines which network policy the device inherits.

Management tunnel

A persistent outbound connection from a managed device to the cloud, carrying configuration and telemetry without requiring inbound firewall ports.

Zero-touch onboarding

A device with cloud connectivity discovers the redirector, contacts the cloud, and appears as a new device awaiting claim and approval before becoming managed.

Device template

A reusable baseline configuration applied to many devices, with CLI supplements or device-level overrides layered on top for exceptions.

Network policy

The container that binds SSIDs, VLANs, radio profiles, and device settings together; it is applied to a site or device and inherited by its devices.

SSID security modes

Open, WPA2-PSK, WPA3-SAE, WPA2/WPA3 Enterprise with 802.1X, and captive portal; WPA3 provides stronger handshake protection than WPA2-PSK.

Dynamic VLAN assignment

A RADIUS server returns a VLAN attribute per user or group, letting one SSID place clients into different segments based on role.

Client 360

A per-client view aggregating association history, authentication events, signal quality, and traffic, used as the first stop for client complaints.

Disconnected device behavior

A device that loses its cloud tunnel shows offline but continues forwarding client traffic using its last-known configuration; it cannot receive new configuration.

RBAC roles

Super User has full account control, Operator can manage devices and policies, and Monitor is read-only; permissions can be scoped to specific sites.

Audit log

A record of administrative actions such as logins, configuration changes, and device onboarding, used for change tracking and compliance evidence.

No IP after association

The client associates but fails DHCP, usually caused by an SSID-to-VLAN mismatch or upstream switching/DHCP problem rather than RF or credentials.

Captive portal walled garden

A list of permitted pre-authentication destinations, typically portal and DNS endpoints, that must be configured or the portal page will not load.

Firmware staged rollout

Scheduling upgrades in maintenance windows, piloting on a small site, verifying health, then expanding to the fleet to limit disruption.

Configuration drift

A difference between a device's running configuration and its intended cloud policy or template, detected by comparison and investigated for cause.

REST API token

A credential used to authenticate automation against the cloud API; it should be scoped to minimum operations, rotated, and stored securely.

Alarm severity levels

Critical, major, minor, and warning categories that determine routing and urgency, mapped to notification channels for on-call staff.

Band steering

A feature that moves capable clients to 5 GHz or 6 GHz to relieve 2.4 GHz congestion and improve overall capacity and experience.

Channel width trade-off

Wider channels raise peak throughput but reduce non-overlapping channels and increase co-channel interference risk.

Guest network isolation

Guest SSIDs use a separate VLAN, client isolation, rate limiting, and firewall rules blocking access to corporate networks.

802.1X authentication

Per-user credentials validated by a RADIUS server, enabling dynamic VLAN and role assignment without multiplying SSIDs.

License entitlement

Managed devices require active subscription entitlement; devices without it fall back to standalone operation and are not managed by the cloud.

Site assignment

Each device belongs to exactly one site; the site determines the inherited network policy and scopes RBAC permissions for administrators.

Per-device push results

After a bulk policy or firmware operation, the platform reports success or failure for each device, which must be reviewed rather than assumed.

WPA3-SAE

A security mode providing forward secrecy and resistance to offline dictionary attacks, preferred over WPA2-PSK where clients support it.

RSSI and SNR

Signal strength and signal-to-noise ratio metrics used to distinguish RF or coverage problems from authentication or DHCP failures.

Retry rate

The proportion of wireless frames requiring retransmission; high values with low SNR indicate RF or interference problems.

On-premises deployment

A private deployment where management infrastructure runs in the customer environment, requiring the customer to plan compute, storage, and redundancy.

DHCP option 43

A DHCP option that can supply the cloud redirector address so a device discovers and connects to the management platform for onboarding.

Configuration rollback

Restoring a prior policy or template version, or a prior firmware image, to recover from a change that caused regressions.

Change correlation

Matching client complaints or alarms to configuration push and firmware upgrade timestamps using audit and event logs to identify cause.