CCNA Switching and Network Access Practice Question
A wireless client can associate to the correct corporate SSID and authenticate successfully, but receives an address from the guest network instead of the employee network. Which troubleshooting area is strongest?
⚠ Common exam trap
Cisco often tests the distinction between authentication success and post-authentication authorization (VLAN/role mapping), tricking candidates into focusing on DHCP or IP configuration issues when the real problem is the VLAN assignment after authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incorrect WLAN-to-role or VLAN mapping after successful authentication.
The client successfully authenticates to the corporate SSID but receives an IP address from the guest network, indicating that the authentication phase is working correctly. The issue lies in the post-authentication mapping: the WLAN is likely mapped to the wrong VLAN or role (e.g., a RADIUS server attribute or local VLAN assignment is misconfigured), causing the client to be placed in the guest VLAN instead of the employee VLAN. This is a common misconfiguration in WLAN-to-VLAN or WLAN-to-role mapping after successful 802.1X authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Incorrect WLAN-to-role or VLAN mapping after successful authentication.
Why this is correct
After a wireless client successfully authenticates via methods such as 802.1X, the WLAN controller or lightweight AP maps the client to a VLAN based on the SSID's WLAN profile or RADIUS attributes like Tunnel-Private-Group-ID. If the WLAN is incorrectly bound to a guest VLAN, or the RADIUS server returns a mismatched VLAN ID, the client associates cleanly but receives an IP from the wrong subnet. This exact description matches an incorrect WLAN-to-role or VLAN mapping, which is a common configuration error in enterprise Wi-Fi.
- ✗
The client must be using the wrong subnet mask manually.
Why it's wrong here
A manually configured wrong subnet mask on the wireless client would prevent the host from communicating properly, but it would not cause the client to be 'assigned' to the wrong network—the client would still be in the correct VLAN and would not obtain a DHCP lease from a different subnet. This scenario describes a systematic placement into an unexpected subnet, which occurs on the network side due to faulty VLAN mapping, not a host-side static IP error. Also, the problem occurs for any client using the SSID, so it is not a per-device manual misconfiguration.
When this WOULD be correct
In a different scenario, if a question specified that a client is unable to connect to any network and is manually configured with an incorrect subnet mask, this option could be correct. For example, if a client is set to a subnet mask that does not match the network's addressing scheme, it would fail to communicate with the intended network.
- ✗
The AP must be missing PPP encapsulation.
Why it's wrong here
PPP (Point-to-Point Protocol) encapsulation is a Layer 2 protocol used on serial WAN links, not on wireless AP-to-switch/controller connections. Even if an AP were missing PPP framing, the wireless client's ability to associate and authenticate would be unaffected because WLAN traffic is carried over 802.11 and 802.1Q VLAN trunks. The symptom of landing in the wrong subnet after successful association points to a VLAN assignment error, not an encapsulation mismatch.
When this WOULD be correct
In a different scenario where the question involves a wireless client that cannot connect to the network at all, and the troubleshooting focuses on link-layer protocols, a question could ask about issues related to PPP encapsulation. If a client is unable to establish a connection due to misconfigured PPP settings, this option would be correct.
- ✗
The issue is that STP root election failed.
Why it's wrong here
Spanning Tree Protocol (STP) prevents loops in a wired Ethernet topology and determines which switch ports forward traffic; it does not control how a wireless client is assigned to a VLAN or IP subnet. An STP root failure could cause broadcast storms or blocked ports, but the client would still be placed into the correct VLAN after 802.1X authentication if the WLAN mapping is intact. Here the issue is specifically a wrong logical segment assignment, which is independent of STP's role.
When this WOULD be correct
In a different scenario, if the question involved a network where multiple VLANs are interconnected and STP is misconfigured, leading to network loops or blocked ports, then a failure in STP root election could cause devices to lose connectivity or receive incorrect IP addresses from unintended VLANs.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Incorrect WLAN-to-role or VLAN mapping after successful authentication.Correct answer▾
Why this is correct
After a wireless client successfully authenticates via methods such as 802.1X, the WLAN controller or lightweight AP maps the client to a VLAN based on the SSID's WLAN profile or RADIUS attributes like Tunnel-Private-Group-ID. If the WLAN is incorrectly bound to a guest VLAN, or the RADIUS server returns a mismatched VLAN ID, the client associates cleanly but receives an IP from the wrong subnet. This exact description matches an incorrect WLAN-to-role or VLAN mapping, which is a common configuration error in enterprise Wi-Fi.
✗The client must be using the wrong subnet mask manually.Wrong answer — click to see why▾
Why this is wrong here
The client receives an address from the guest network, indicating that the DHCP server or VLAN assignment is incorrect. A manually configured wrong subnet mask would not cause the client to obtain an IP from a different network; it would simply prevent proper communication within the assigned subnet. The issue is at the network assignment level, not a host configuration error.
★ When this WOULD be the correct answer
In a different scenario, if a question specified that a client is unable to connect to any network and is manually configured with an incorrect subnet mask, this option could be correct. For example, if a client is set to a subnet mask that does not match the network's addressing scheme, it would fail to communicate with the intended network.
Why candidates choose this
Students often think of IP configuration issues when a client gets an unexpected address, but the scenario describes successful association and authentication, pointing to a network-side mapping problem rather than a client-side manual setting.
✗The AP must be missing PPP encapsulation.Wrong answer — click to see why▾
Why this is wrong here
PPP encapsulation is used on serial WAN links, not in wireless LAN environments. Wireless clients connect via 802.11, and APs use Ethernet or CAPWAP to connect to the network. PPP has no role in VLAN assignment or DHCP for wireless clients.
★ When this WOULD be the correct answer
In a different scenario where the question involves a wireless client that cannot connect to the network at all, and the troubleshooting focuses on link-layer protocols, a question could ask about issues related to PPP encapsulation. If a client is unable to establish a connection due to misconfigured PPP settings, this option would be correct.
Why candidates choose this
PPP is a common topic in CCNA, and students might confuse it with other encapsulation protocols or think it applies to wireless connections. However, it is irrelevant to WLAN client-to-VLAN mapping.
✗The issue is that STP root election failed.Wrong answer — click to see why▾
Why this is wrong here
STP root election determines the root bridge in a switched network to prevent loops, but it does not affect VLAN assignment for wireless clients. Even if STP root election failed, it would not cause a client to receive an IP from the wrong network; it would more likely cause network instability or loops.
★ When this WOULD be the correct answer
In a different scenario, if the question involved a network where multiple VLANs are interconnected and STP is misconfigured, leading to network loops or blocked ports, then a failure in STP root election could cause devices to lose connectivity or receive incorrect IP addresses from unintended VLANs.
Why candidates choose this
STP is a fundamental switching concept, and students might incorrectly associate any network issue with STP. However, the symptom of wrong IP subnet assignment is clearly a VLAN mapping problem, not a spanning-tree issue.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Interpreting Packet Capture Output for Layer 2/3 Troubleshooting
Key term
Extensible Authentication Protocol
Extensible Authentication Protocol (EAP) is a flexible authentication framework used in network access control, particularly in wireless and point-to-point connections, that supports multiple authentication methods without requiring changes to the underlying protocol.
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.