CCNA Switching and Network Access Practice Question
This 200-301 practice question tests your understanding of switching and network access. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: dynamic VLAN assignment is common in enterprise WLANs.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A client connects to an employee WLAN using 802.1X authentication. The authentication process completes successfully, but the client fails to obtain an IP address via DHCP. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
The client is being placed into the wrong policy or VLAN after successful authentication.
Post‑authentication VLAN assignment via RADIUS attributes can override the default interface VLAN. If the assigned VLAN has no DHCP server, the client cannot obtain an address.
B
The WLAN is configured with the wrong SSID, which prevents DHCP packets from being forwarded.
Why wrong: This is wrong because the symptom is wrong network placement after successful assignment, not just a mask typo.
C
The client has a static IP address manually configured, causing a DHCP conflict.
Why wrong: This is wrong because STP root guard is not the primary clue in WLAN client-to-subnet placement.
D
The access point is configured with an incorrect default gateway, preventing DHCP relay.
Why wrong: This is wrong because client WLAN access does not depend on host-side BGP configuration.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The client is being placed into the wrong policy or VLAN after successful authentication.
Even after successful 802.1X authentication, the client may be assigned to the wrong VLAN or policy through RADIUS attributes (such as Tunnel-Type or Cisco AV-pair). If that VLAN lacks a DHCP server or correct subnet, the client will not receive an IP address. The other options describe issues that either prevent association entirely (wrong SSID) or are not typical causes in controller-based WLANs (static IP, AP gateway misconfiguration).
Key principle: Dynamic VLAN assignment is common in enterprise WLANs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
The client is being placed into the wrong policy or VLAN after successful authentication.
Why this is correct
Post‑authentication VLAN assignment via RADIUS attributes can override the default interface VLAN. If the assigned VLAN has no DHCP server, the client cannot obtain an address.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Dynamic VLAN assignment is common in enterprise WLANs.
✗
The WLAN is configured with the wrong SSID, which prevents DHCP packets from being forwarded.
Why it's wrong here
This is wrong because the symptom is wrong network placement after successful assignment, not just a mask typo.
When this WOULD be correct
In a different question scenario, if the context involved a client device that was configured with a static IP address and subnet mask that did not match the network's DHCP settings, this option could be correct, as it would explain why the device cannot communicate properly on the network.
✗
The client has a static IP address manually configured, causing a DHCP conflict.
Why it's wrong here
This is wrong because STProot guard is not the primary clue in WLAN client-to-subnet placement.
When this WOULD be correct
In a different question setup where the focus is on network topology and loop prevention, a scenario could involve a network experiencing broadcast storms due to STP misconfigurations, leading to clients being unable to communicate effectively, thus making this option correct.
✗
The access point is configured with an incorrect default gateway, preventing DHCP relay.
Why it's wrong here
This is wrong because client WLAN access does not depend on host-side BGP configuration.
When this WOULD be correct
In a different scenario where the question specifies that the client is part of a multi-site network with complex routing requirements, and the WLAN's operation is dependent on BGP for route advertisement, this option would be correct if the client fails to connect due to BGP misconfiguration.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The client is being placed into the wrong policy or VLAN after successful authentication.Correct answer▾
Why this is correct
Post‑authentication VLAN assignment via RADIUS attributes can override the default interface VLAN. If the assigned VLAN has no DHCP server, the client cannot obtain an address.
✗The WLAN is configured with the wrong SSID, which prevents DHCP packets from being forwarded.Wrong answer — click to see why▾
Why this is wrong here
A wrong SSID would stop the client from associating altogether; it would not allow successful authentication followed by a DHCP failure.
★ When this WOULD be the correct answer
In a different question scenario, if the context involved a client device that was configured with a static IP address and subnet mask that did not match the network's DHCP settings, this option could be correct, as it would explain why the device cannot communicate properly on the network.
Why candidates choose this
Students may think that a wrong subnet mask could cause connectivity issues, but here the client gets an address from a different subnet entirely, which is not caused by a mask typo. The mask typo would not change the subnet assigned by DHCP.
✗The client has a static IP address manually configured, causing a DHCP conflict.Wrong answer — click to see why▾
Why this is wrong here
A statically configured IP is not the most probable explanation when the client attempts DHCP and fails; a static IP would typically bypass DHCP entirely and is not indicated by an authentication‑then‑address‑failure scenario.
★ When this WOULD be the correct answer
In a different question setup where the focus is on network topology and loop prevention, a scenario could involve a network experiencing broadcast storms due to STP misconfigurations, leading to clients being unable to communicate effectively, thus making this option correct.
Why candidates choose this
Students might confuse STP root guard with other security features or think that STP issues could affect VLAN assignment. However, STP root guard does not influence DHCP or VLAN assignment for wireless clients.
✗The access point is configured with an incorrect default gateway, preventing DHCP relay.Wrong answer — click to see why▾
Why this is wrong here
In controller‑based WLANs, client DHCP traffic is tunneled to the controller or bridged directly; the AP’s own gateway plays no role in forwarding client DHCP requests.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that the client is part of a multi-site network with complex routing requirements, and the WLAN's operation is dependent on BGP for route advertisement, this option would be correct if the client fails to connect due to BGP misconfiguration.
Why candidates choose this
Students might think that BGP is needed for routing or that it is a common protocol in networking, but it is not used on client devices. The question is about basic WLAN connectivity, not inter-domain routing.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between authentication success and post-authentication network access, leading candidates to focus on pre-authentication issues (like wrong PSK or RADIUS timeout) when the real problem is VLAN assignment or DHCP relay misconfiguration.
Detailed technical explanation
How to think about this question
When a client authenticates via 802.1X, the RADIUS server can return a Tunnel-Private-Group-ID (IETF attribute 81) or Cisco AV-pair to specify the VLAN. If the VLAN ID is invalid, mismatched, or the switchport is not configured for that VLAN, the client's DHCP request never reaches a DHCP server. Additionally, Cisco WLCs can use VLAN pooling or local VLAN assignment, and misconfiguration in the WLAN's advanced settings (e.g., 'Override Interface ACL' or 'DHCP Required') can also cause this symptom.
KKey Concepts to Remember
Dynamic VLAN assignment is common in enterprise WLANs.
802.1X authentication often integrates with RADIUS for policy decisions.
Authorization profiles on a RADIUS server dictate VLAN assignment.
Incorrect policy mapping leads to clients being placed in the wrong subnet/VLAN.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Dynamic VLAN assignment is common in enterprise WLANs.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Switching and Network Access — This question tests Switching and Network Access — Dynamic VLAN assignment is common in enterprise WLANs..
What is the correct answer to this question?
The correct answer is: The client is being placed into the wrong policy or VLAN after successful authentication. — Even after successful 802.1X authentication, the client may be assigned to the wrong VLAN or policy through RADIUS attributes (such as Tunnel-Type or Cisco AV-pair). If that VLAN lacks a DHCP server or correct subnet, the client will not receive an IP address. The other options describe issues that either prevent association entirely (wrong SSID) or are not typical causes in controller-based WLANs (static IP, AP gateway misconfiguration).
What should I do if I get this 200-301 question wrong?
Review dynamic VLAN assignment is common in enterprise WLANs., then practise related 200-301 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Dynamic VLAN assignment is common in enterprise WLANs.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.