CCNA Network Infrastructure and Connectivity Practice Question
Exhibit
=== WLC Configuration (Partial) === WLAN ID: 1 Profile Name: CorpSecure SSID: CorpSecure Status: Enabled Security: WPA2-PSK (AES) PSK Passphrase: Cisco123! VLAN: 20 Interface: VLAN20 Broadcast SSID: Disabled === Interface Configuration === Management Interface: IP Address: 192.168.1.10/24 VLAN: 10 Default Gateway: 192.168.1.1 === Show summary (from CLI) === (Cisco Controller) >show wlan summary Number of WLANs.................................. 1 WLAN ID WLAN Profile Name / SSID Status Interface ------- ------------------------------------ ------- --------- 1 CorpSecure / CorpSecure Enabled VLAN20 (Cisco Controller) >show client summary Number of Clients................................ 0 (Cisco Controller) >show interface detailed management Interface Name................................... management MAC Address...................................... 00:1a:2b:3c:4d:5e IP Address....................................... 192.168.1.10 IP Netmask....................................... 255.255.255.0 Default Router................................... 192.168.1.1 VLAN............................................ 10 (Cisco Controller) >show interface detailed vlan20 Interface Name................................... vlan20 MAC Address...................................... 00:1a:2b:3c:4d:5f IP Address....................................... 10.0.20.1 IP Netmask....................................... 255.255.255.0 Default Router................................... 10.0.20.254 VLAN............................................ 20
You are managing a Cisco WLC (192.168.1.10) via its web UI. The wireless network 'CorpSecure' has been configured but clients cannot associate. Some report 'wrong password' errors; others see the SSID but fail to connect. Additionally, management access to the WLC web UI is intermittent. Identify and resolve the issues so that wireless clients can successfully associate with 'CorpSecure' using WPA3-Personal and the WLC web UI is reliably accessible from the management VLAN (VLAN 10).
⚠ Common exam trap
Candidates might mistakenly conclude the SSID broadcast is disabled and enable it unnecessarily, overlooking that the visible SSID indicates broadcast is already on, or they might ignore the management VLAN configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the SSID with WPA3-Personal; verify management interface is on VLAN 10 with correct gateway.
The primary issue is a security mismatch: the SSID is set to WPA2-PSK while clients expect WPA3, causing 'wrong password' errors. Since clients can see the SSID, broadcast is already enabled; the secondary connection failures may be due to incompatible devices, but the correct fix is to change the security to WPA3-Personal (AES). Additionally, verify that the management interface is on VLAN 10 with the correct gateway to ensure reliable WLC web UI access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the SSID with WPA3-Personal; verify management interface is on VLAN 10 with correct gateway.
Why this is correct
WPA3-Personal is the required security mode, and because the SSID is already visible to clients, SSID broadcast is not the issue. A WPA2/WPA3 protocol mismatch prevents clients from associating, so reconfiguring the SSID to WPA3-Personal corrects the root cause. Separately, verifying that the management interface is on VLAN 10 with the correct gateway ensures the web UI is reachable from the admin network; a misconfigured gateway would cause intermittent management access even after the SSID is fixed.
- ✗
Change the SSID security to WPA2-PSK and disable SSID broadcast; reset the WLC to factory defaults.
Why it's wrong here
Selecting WPA2-PSK directly violates the requirement for WPA3-Personal security, and WPA2-PSK does not support SAE (Simultaneous Authentication of Equals), leaving the network vulnerable to offline dictionary attacks. Disabling SSID broadcast is counterproductive because the reported issue is that clients cannot see the SSID, so hiding it would worsen visibility. Resetting the WLC to factory defaults is an unnecessary and destructive step that would erase all existing configuration, including the required VLAN and gateway settings, making the problem worse.
- ✗
Update the WLC firmware to the latest version and change the management VLAN to VLAN 1.
Why it's wrong here
Updating the WLC firmware is a generic troubleshooting step that does not address the specific misconfiguration: the SSID is using the wrong security type (WPA2 instead of WPA3-Personal) and the management interface may be on the wrong VLAN. Changing the management VLAN to VLAN 1 is poor practice because VLAN 1 is the default native VLAN and is commonly targeted, plus it does not align with the stated requirement that management should be on VLAN 10. This action would not restore client connectivity to the SSID nor fix the intermittent web UI access.
- ✗
Reconfigure the SSID with WPA3-Enterprise and enable SSID broadcast; set the management interface to use DHCP.
Why it's wrong here
WPA3-Enterprise requires an 802.1X/RADIUS authentication server, and the scenario explicitly specifies WPA3-Personal with a pre-shared key; enabling WPA3-Enterprise would cause authentication to fail because no RADIUS server is defined. Enabling SSID broadcast is unnecessary because the SSID is already visible, so this does not address the security mismatch. Setting the management interface to use DHCP is risky because a DHCP lease change could alter the gateway or IP address, making the web UI unreachable intermittently; a static management IP with the correct VLAN 10 gateway is required.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure the SSID with WPA3-Personal; verify management interface is on VLAN 10 with correct gateway.Correct answer▾
Why this is correct
WPA3-Personal is the required security mode, and because the SSID is already visible to clients, SSID broadcast is not the issue. A WPA2/WPA3 protocol mismatch prevents clients from associating, so reconfiguring the SSID to WPA3-Personal corrects the root cause. Separately, verifying that the management interface is on VLAN 10 with the correct gateway ensures the web UI is reachable from the admin network; a misconfigured gateway would cause intermittent management access even after the SSID is fixed.
✗Change the SSID security to WPA2-PSK and disable SSID broadcast; reset the WLC to factory defaults.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: WPA2-PSK is not compatible with clients expecting WPA3-Personal, and hiding the SSID prevents clients from seeing it.
Why candidates choose this
Candidates might think resetting the WLC is a quick fix, or they may confuse WPA2 and WPA3 requirements.
✗Update the WLC firmware to the latest version and change the management VLAN to VLAN 1.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: VLAN 1 is the default and often discouraged for management; the issue is not firmware-related but configuration-based.
Why candidates choose this
Candidates may assume a firmware bug causes intermittent access, or they may think VLAN 1 is always correct for management.
✗Reconfigure the SSID with WPA3-Enterprise and enable SSID broadcast; set the management interface to use DHCP.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error: WPA3-Enterprise is not appropriate without a RADIUS server, and DHCP for management can lead to unreliable access.
Why candidates choose this
Candidates might confuse WPA3-Personal with WPA3-Enterprise, or think DHCP is more reliable than static IP for management.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Collision Domains and Broadcast Domains
Key term
WLC
A Wireless LAN Controller is a centralized device that manages, configures, and secures multiple wireless access points in a network.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.