CCNA Switching and Network Access Practice Question
A user reports that a laptop can connect to the correct SSID but repeatedly fails authentication when joining the WLAN. Which category of issue is most strongly indicated?
⚠ Common exam trap
A common exam trap is selecting options related to routing protocols or DHCP relay issues when a client fails to authenticate on a WLAN. Candidates may incorrectly assume that IP configuration problems or routing mismatches cause authentication failures. However, authentication occurs before IP assignment, so DHCP or OSPF issues cannot cause repeated authentication failures. This trap distracts from the correct focus on wireless security settings and credentials, which are the root cause when a client sees the SSID but cannot authenticate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A security or authentication mismatch related to WLAN access
The strongest indication is a wireless security or authentication mismatch rather than a pure RF coverage problem. In practical terms, the laptop can already see and attempt to join the correct SSID, which means discovery is working. Repeated authentication failure points more directly to credentials, security settings, or authentication-policy alignment than to channel or signal absence. This question is about recognizing the stage of failure. The client is finding the WLAN, but it is not being accepted onto it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A security or authentication mismatch related to WLAN access
Why this is correct
The client can see and associate with the SSID, but the authentication exchange fails because of mismatched security parameters—such as an incorrect pre-shared key, incompatible WPA version, or an EAP/RADIUS misconfiguration on the WLAN profile. In 802.1X or WPA2/WPA3 PSK, the four-way handshake must complete before the client is granted access; when authentication credentials or cipher suites differ between client and AP, the handshake aborts, causing repeated association attempts and a visible SSID but no successful connection.
- ✗
A missing OSPF router ID on the access point
Why it's wrong here
A missing OSPF router ID on the access point is irrelevant to WLAN client authentication because OSPF is a dynamic routing protocol that operates at Layer 3 and is used for exchanging routes between network devices, not for securing wireless client access. The AP's OSPF configuration, or lack thereof, has no bearing on the 802.11 association or 802.1X/WPA supplicant process; client authentication depends on the wireless security settings and RADIUS/PSK validation. OSPF router ID issues would disrupt IP routing between the AP and other routers, but would not prevent a client from authenticating to a locally broadcast SSID.
When this WOULD be correct
If the question were about routing issues affecting network connectivity, such as a scenario where a device cannot communicate with other routers due to OSPF misconfigurations, then a missing OSPF router ID on the access point would be the correct answer.
- ✗
A routed-port mismatch on the switch uplink
Why it's wrong here
A routed-port mismatch on the switch uplink is a Layer 3 interface configuration problem affecting IP traffic between the switch and upstream devices, but it does not interfere with the client's ability to authenticate to the WLAN. Client authentication to the SSID occurs at the wireless link between the laptop and AP, involving 802.11 management frames and security handshakes; the switch uplink's port mode (routed vs. switched) only becomes relevant for forwarding user traffic after successful authentication. Therefore, this mismatch would cause routing or reachability issues for post-authentication traffic, not the described symptom of the client connecting to the correct SSID but repeatedly failing to gain access.
When this WOULD be correct
If the exam question described a scenario where a device is unable to route traffic due to mismatched configurations between a switch and a router, specifically mentioning routed ports, then option C would be correct. For example, if a user reported that they could not access the internet despite being connected to the WLAN, and troubleshooting revealed a routed-port mismatch, this option would apply.
- ✗
A DHCP relay problem on the client
Why it's wrong here
A DHCP relay problem on the client is not a valid failure point because DHCP relay functionality resides on routers or multilayer switches, not on the client itself. Even conceptually, DHCP address assignment occurs only after the client has successfully authenticated and associated at Layer 2; if authentication fails, the client never reaches the DHCP discovery phase. Thus, a DHCP relay issue would manifest as a missing IP address after successful association, not as repeated authentication failures or the inability to complete the WLAN security handshake.
When this WOULD be correct
In a scenario where a user reports that their device connects to the SSID but cannot obtain an IP address, and the question specifically asks about issues related to IP assignment rather than authentication, option D would be correct as it directly relates to DHCP relay configurations.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓A security or authentication mismatch related to WLAN accessCorrect answer▾
Why this is correct
The client can see and associate with the SSID, but the authentication exchange fails because of mismatched security parameters—such as an incorrect pre-shared key, incompatible WPA version, or an EAP/RADIUS misconfiguration on the WLAN profile. In 802.1X or WPA2/WPA3 PSK, the four-way handshake must complete before the client is granted access; when authentication credentials or cipher suites differ between client and AP, the handshake aborts, causing repeated association attempts and a visible SSID but no successful connection.
✗A missing OSPF router ID on the access pointWrong answer — click to see why▾
Why this is wrong here
Option B is incorrect because a missing OSPF router ID on the access point pertains to routing protocols and does not directly affect WLAN authentication issues. The user's inability to authenticate is related to security settings rather than routing configurations.
★ When this WOULD be the correct answer
If the question were about routing issues affecting network connectivity, such as a scenario where a device cannot communicate with other routers due to OSPF misconfigurations, then a missing OSPF router ID on the access point would be the correct answer.
Why candidates choose this
Candidates might choose this option due to a misunderstanding of the relationship between routing and wireless connectivity, mistakenly believing that routing issues could impact WLAN access and authentication.
✗A routed-port mismatch on the switch uplinkWrong answer — click to see why▾
Why this is wrong here
A routed-port mismatch on the switch uplink is unrelated to WLAN authentication issues; it pertains to Layer 2 and Layer 3 connectivity rather than wireless security protocols. The problem described involves authentication failures, which are not caused by switch uplink configurations.
★ When this WOULD be the correct answer
If the exam question described a scenario where a device is unable to route traffic due to mismatched configurations between a switch and a router, specifically mentioning routed ports, then option C would be correct. For example, if a user reported that they could not access the internet despite being connected to the WLAN, and troubleshooting revealed a routed-port mismatch, this option would apply.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of network layers, mistakenly linking switch configurations to wireless issues. They might also recall scenarios where switch configurations impacted overall connectivity, leading to confusion about the specific context of WLAN authentication.
✗A DHCP relay problem on the clientWrong answer — click to see why▾
Why this is wrong here
This option is wrong because a DHCP relay problem would typically result in the client not receiving an IP address, preventing it from connecting to the network at all, rather than failing authentication after connecting to the SSID.
★ When this WOULD be the correct answer
In a scenario where a user reports that their device connects to the SSID but cannot obtain an IP address, and the question specifically asks about issues related to IP assignment rather than authentication, option D would be correct as it directly relates to DHCP relay configurations.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of the authentication process, thinking that if a device connects to the SSID, it must be receiving an IP address, and therefore any issues must be related to DHCP rather than authentication.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Interpreting Packet Capture Output for Layer 2/3 Troubleshooting
Key term
Temporal Key Integrity Protocol
TKIP is a security protocol used in Wi-Fi networks to strengthen encryption by dynamically changing the encryption key for each data packet.
Key term
Wired Equivalent Privacy
Wired Equivalent Privacy (WEP) is a security protocol for wireless networks, designed to provide a level of data confidentiality comparable to a wired LAN.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.