CCNA Switching and Network Access Practice Question
Exhibit
Client observations: - Joined SSID: Corp-Employee - Authentication: success - Assigned IP: 10.90.200.44/24 Expected employee subnet: 10.90.10.0/24 Observed guest subnet: 10.90.200.0/24
A client connects to an employee WLAN using 802.1X authentication. The authentication process completes successfully, but the client fails to obtain an IP address via DHCP. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between authentication success and post-authentication network access, leading candidates to focus on pre-authentication issues (like wrong PSK or RADIUS timeout) when the real problem is VLAN assignment or DHCP relay misconfiguration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The client is being placed into the wrong policy or VLAN after successful authentication.
Even after successful 802.1X authentication, the client may be assigned to the wrong VLAN or policy through RADIUS attributes (such as Tunnel-Type or Cisco AV-pair). If that VLAN lacks a DHCP server or correct subnet, the client will not receive an IP address. The other options describe issues that either prevent association entirely (wrong SSID) or are not typical causes in controller-based WLANs (static IP, AP gateway misconfiguration).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The client is being placed into the wrong policy or VLAN after successful authentication.
Why this is correct
After successful 802.1X/RADIUS authentication, the controller or switch can assign a VLAN through attributes such as Tunnel-Private-Group-ID. If that assigned VLAN lacks a DHCP server or is not properly configured on the trunk, the client ends up in the wrong subnet with no usable IP. This is the strongest explanation because it directly maps the symptom to the post-authentication policy, rather than a client-side or AP-management issue.
- ✗
The WLAN is configured with the wrong SSID, which prevents DHCP packets from being forwarded.
Why it's wrong here
Configuring the wrong SSID would cause the client to associate to a different WLAN profile, not a post-authentication policy override. The symptom here is that the client successfully authenticates but ends up in an unexpected subnet, which points to VLAN assignment after authentication rather than the SSID itself. A wrong SSID would typically prevent association or place the client on a clearly different network from the start, not a subtle VLAN mismatch.
When this WOULD be correct
In a different question scenario, if the context involved a client device that was configured with a static IP address and subnet mask that did not match the network's DHCP settings, this option could be correct, as it would explain why the device cannot communicate properly on the network.
- ✗
The client has a static IP address manually configured, causing a DHCP conflict.
Why it's wrong here
A manually configured static IP on the client would cause an address conflict if the DHCP server grants the same address, but it would not move the client to a different VLAN or subnet. The client would still be in the correct VLAN after authentication; only the IP layer would be broken. Thus, this explains a DHCP failure, not the observed wrong IP subnet or network placement.
When this WOULD be correct
In a different question setup where the focus is on network topology and loop prevention, a scenario could involve a network experiencing broadcast storms due to STP misconfigurations, leading to clients being unable to communicate effectively, thus making this option correct.
- ✗
The access point is configured with an incorrect default gateway, preventing DHCP relay.
Why it's wrong here
The access point's default gateway is used for management traffic and reaching the controller/WLC; it is not used as the source for client DHCP relay. DHCP relay on a WLAN is sourced from the AP's or controller's IP address in the client VLAN, using the switch's IP helper address. An incorrect AP default gateway would impair management connectivity, but it would not affect the client's DHCP request forwarding or VLAN assignment.
When this WOULD be correct
In a different scenario where the question specifies that the client is part of a multi-site network with complex routing requirements, and the WLAN's operation is dependent on BGP for route advertisement, this option would be correct if the client fails to connect due to BGP misconfiguration.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The client is being placed into the wrong policy or VLAN after successful authentication.Correct answer▾
Why this is correct
After successful 802.1X/RADIUS authentication, the controller or switch can assign a VLAN through attributes such as Tunnel-Private-Group-ID. If that assigned VLAN lacks a DHCP server or is not properly configured on the trunk, the client ends up in the wrong subnet with no usable IP. This is the strongest explanation because it directly maps the symptom to the post-authentication policy, rather than a client-side or AP-management issue.
✗The WLAN is configured with the wrong SSID, which prevents DHCP packets from being forwarded.Wrong answer — click to see why▾
Why this is wrong here
A wrong SSID would stop the client from associating altogether; it would not allow successful authentication followed by a DHCP failure.
★ When this WOULD be the correct answer
In a different question scenario, if the context involved a client device that was configured with a static IP address and subnet mask that did not match the network's DHCP settings, this option could be correct, as it would explain why the device cannot communicate properly on the network.
Why candidates choose this
Students may think that a wrong subnet mask could cause connectivity issues, but here the client gets an address from a different subnet entirely, which is not caused by a mask typo. The mask typo would not change the subnet assigned by DHCP.
✗The client has a static IP address manually configured, causing a DHCP conflict.Wrong answer — click to see why▾
Why this is wrong here
A statically configured IP is not the most probable explanation when the client attempts DHCP and fails; a static IP would typically bypass DHCP entirely and is not indicated by an authentication‑then‑address‑failure scenario.
★ When this WOULD be the correct answer
In a different question setup where the focus is on network topology and loop prevention, a scenario could involve a network experiencing broadcast storms due to STP misconfigurations, leading to clients being unable to communicate effectively, thus making this option correct.
Why candidates choose this
Students might confuse STP root guard with other security features or think that STP issues could affect VLAN assignment. However, STP root guard does not influence DHCP or VLAN assignment for wireless clients.
✗The access point is configured with an incorrect default gateway, preventing DHCP relay.Wrong answer — click to see why▾
Why this is wrong here
In controller‑based WLANs, client DHCP traffic is tunneled to the controller or bridged directly; the AP’s own gateway plays no role in forwarding client DHCP requests.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that the client is part of a multi-site network with complex routing requirements, and the WLAN's operation is dependent on BGP for route advertisement, this option would be correct if the client fails to connect due to BGP misconfiguration.
Why candidates choose this
Students might think that BGP is needed for routing or that it is a common protocol in networking, but it is not used on client devices. The question is about basic WLAN connectivity, not inter-domain routing.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
802.1X
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.