Wireless questions on the CCNA cover 802.11 standards (ax/ac/n), WPA3, SSID/BSSID concepts, WLC architecture (FlexConnect, local switching), and client connectivity troubleshooting. These are mostly MCQ and multi-select.
Start Scenario PracticeWhich option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?
Explanation: The Authorization Profile in Cisco ISE is where you set attributes like VLAN assignment, dACL, SGT, and reauthentication timers that are returned to the NAD after successful authorization. For wireless clients, the VLAN is typically delivered via RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) configured in the Authorization Profile.
When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?
Explanation: The NAS-Port-Type RADIUS attribute (attribute 61) identifies the physical port type used by the network access server (NAS) to authenticate the user. Common values include Ethernet (15) for wired and Wireless-IEEE-802.11 (19) for wireless. ISE policy sets commonly use this attribute to differentiate between wired and wireless requests because it is sent by the NAD in the Access-Request and reliably indicates the access medium.
A security engineer is configuring Cisco ISE BYOD with a single SSID for both employee onboarding and corporate access. The engineer wants to ensure that devices without a valid certificate are redirected to the BYOD portal, while devices with a valid certificate are granted full access. The engineer has created a client provisioning policy that provisions the native supplicant with the corporate SSID and a certificate template. However, after provisioning, devices are still being redirected to the BYOD portal on subsequent connections. Which configuration change is required to allow onboarded devices to bypass the portal?
Explanation: After a device is onboarded and presents a valid certificate, the authorization policy must have a rule that matches certificate authentication and grants full access. If the redirection rule is evaluated first or there is no certificate-based permit rule, the device will continue to be redirected. The correct fix is to add or reorder the authorization policy so that certificate-based access is granted before redirection.
A company uses Cisco ISE BYOD with certificate-based authentication. Employees report that their devices successfully onboard and receive a certificate, but after a few days, they are unable to connect to the corporate SSID. The administrator checks ISE and finds that the devices are failing authentication with the error 'Certificate revoked'. The administrator verifies that the certificates are still valid and not expired. Which ISE feature should the administrator check to resolve this issue?
Explanation: The 'Certificate revoked' error means ISE's revocation check is determining the certificate is revoked. This typically occurs when the CRL distribution point is unreachable, the CRL is stale, or the certificate is incorrectly listed as revoked. The administrator should verify the CRL distribution point in the certificate and ISE's revocation settings. Ensuring ISE can retrieve a current CRL and that the certificate is not actually revoked will resolve the authentication failures.
You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?
Explanation: The NetworkDevice:Name condition in Cisco ISE allows you to match requests based on the name of the network device (WLC) as defined in ISE's network device repository. This is the correct condition to ensure a policy set only applies to requests originating from a specific WLC, because the WLC is a network device and its name is a unique identifier in ISE.
+4 more scenario questions available
Practice all Wireless LAN and WLC ScenariosWireless questions on the CCNA cover 802.11 standards (ax/ac/n), WPA3, SSID/BSSID concepts, WLC architecture (FlexConnect, local switching), and client connectivity troubleshooting. These are mostly MCQ and multi-select. These appear throughout the SISE and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the SISE. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free SISE scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Wireless LAN and WLC Scenarios session with instant scoring and detailed explanations.
Start Scenario Practice →