CCNA Network Infrastructure and Connectivity Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The WLC’s WLAN is misconfigured for WPA3-Enterprise, and the laptop lacks a supplicant for 802.1X authentication.

  Why it's wrong here

  This option contradicts the scenario, which explicitly states the WLAN is configured for WPA3-Personal using the SAE protocol with a pre-shared key. WPA3-Personal does not use 802.1X/EAP or RADIUS at all, so a missing 802.1X supplicant would be irrelevant. Even if the network were WPA3-Enterprise, authentication failure would manifest as EAPOL timeouts during the 802.1X phase, not as a failure to establish PMF during association.

• ✓

  The laptop’s wireless adapter does not support Protected Management Frames, which are mandatory for WPA3-Personal.

  Why this is correct

  For WPA3-Personal, the client and access point must negotiate Protected Management Frames (PMF) as part of the RSN information element during association; PMF is not optional but mandatory in WPA3. If the laptop's wireless adapter does not advertise or enable the Management Frame Protection Capable bit, the WLC cannot complete the handshake, causing SAE authentication to time out. This explains why only this 802.11ax-capable device fails while others succeed—it reflects a client-side capability gap, not a network-wide configuration error.

• ✗

  The WLC has disabled 802.11ax OFDMA on the 5 GHz band, preventing the 802.11ax laptop from associating.

  Why it's wrong here

  OFDMA is a 802.11ax data-plane feature that schedules subchannel resource units for more efficient transmissions after a client has successfully associated and authenticated. Disabling 802.11ax OFDMA on the 5 GHz band would not prevent a station from sending association requests or completing WPA3 authentication; it may degrade throughput or multi-user efficiency, but association itself remains unaffected. Therefore, this setting cannot explain why the laptop fails to associate, making the option incorrect.

• ✗

  The laptop’s driver is configured for 160 MHz channel width, which is incompatible with the WLC’s channel plan, causing authentication to fail.

  Why it's wrong here

  Channel width support is negotiated during the association process, but a mismatch does not prevent the initial authentication frames from being exchanged. If the laptop is configured for 160 MHz while the WLC uses a channel plan that does not permit that width, the client will typically fall back to a smaller supported width, such as 80 MHz or 40 MHz, based on the AP's beacons and the negotiated capabilities. This may reduce performance or cause channel switching, but it will not cause an authentication failure, so this option is not a valid cause of the problem.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question