CCNA Network Services and Security Practice Question
A company wants wireless guest users to authenticate with a username and password stored on a central server, without deploying client certificates. The wireless LAN controller must forward authentication requests to the server. Which protocol should be used between the WLC and the authentication server?
⚠ Common exam trap
The trap here is conflating device administration protocols like TACACS+ with wireless user authentication, which relies on RADIUS in Cisco WLAN deployments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RADIUS
Wireless LAN controllers use RADIUS to communicate with authentication servers for 802.1X and other centralized authentication methods. RADIUS supports username and password credentials through EAP methods like PEAP, so guest or employee users can authenticate without client certificates while the WLC forwards requests to the server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kerberos
Why it's wrong here
Kerberos is a ticket-based authentication protocol used mainly in Windows domain environments. Wireless controllers do not use Kerberos directly to authenticate supplicants; they rely on RADIUS for 802.1X. Selecting Kerberos would not provide the required integration with the WLC's authentication process.
- ✗
LDAP
Why it's wrong here
LDAP is a directory access protocol used to query user information, but it is not the authentication protocol between a WLC and a RADIUS server during 802.1X. While LDAP may sit behind the authentication server, the WLC does not speak LDAP directly for wireless client authentication, so this choice does not fit.
- ✓
RADIUS
Why this is correct
RADIUS is the standard protocol for centralized authentication of wireless users, including 802.1X/EAP exchanges. The WLC acts as a RADIUS client, forwarding credentials to the authentication server. It supports username and password methods such as PEAP-MSCHAPv2 without requiring client certificates on the supplicant.
- ✗
TACACS+
Why it's wrong here
TACACS+ is primarily used for device administration, separating authentication, authorization, and accounting for CLI access to network equipment. It is not the standard protocol for wireless user authentication against a central server like ISE or RADIUS. Using it here would not integrate properly with the WLC's 802.1X authentication flow.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
OSPF Authentication
Key term
Extensible Authentication Protocol
Extensible Authentication Protocol (EAP) is a flexible authentication framework used in network access control, particularly in wireless and point-to-point connections, that supports multiple authentication methods without requiring changes to the underlying protocol.
Key term
WLC
A Wireless LAN Controller is a centralized device that manages, configures, and secures multiple wireless access points in a network.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,450 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.