Courseiva
← 200-301
Full test
Network Infrastructure and Connectivity →hardTroubleshootingObjective-mapped

CCNA Network Infrastructure and Connectivity Practice Question

Exhibit

WLC Configuration (partial)

interface Management
 ip address 192.168.1.10 255.255.255.0
 no shutdown
!
wlan CorpNet 1 CorpNet
 ssid CorpNet
 security wpa3-sae
 security wpa akm sae
 security wpa psk ascii 7 1234567890abcdef
 no security wpa2
 no security wpa
 no security wpa3-sae
!
interface wlan 1
 vlan 100
!
wlan enable 1
!
wlan ssid CorpNet
 broadcast-ssid disable
!
! End of configuration

You are troubleshooting a wireless client association failure on a Cisco WLC. The client is unable to connect to the corporate SSID 'CorpNet' and reports an authentication error. Review the WLC configuration and fix the issue so that the client can associate and obtain an IP address from VLAN 100. The WLC management IP is 192.168.1.10/24.

⚠ Common exam trap

Be careful not to confuse the management interface VLAN with the client data VLAN. Also, remember that SSID broadcast must be enabled for clients to discover the network, and security settings must match client capabilities. Always verify DHCP scope placement matches the client VLAN.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change the WLAN security to WPA2, enable SSID broadcast, and configure the WLAN interface to use VLAN 100 with a DHCP scope on that VLAN.

The client authentication and DHCP issues are caused by: (1) WPA3 being configured while the client only supports WPA2, (2) SSID broadcast disabled, preventing client discovery, and (3) the WLAN's client VLAN (100) lacking a DHCP server or scope. The management interface VLAN (1) does not interfere with client DHCP. To resolve, change security to WPA2, enable SSID broadcast, and ensure the WLAN is associated with the correct VLAN (100) and a DHCP scope exists on that VLAN.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Change the WLAN security to WPA2, enable SSID broadcast, and configure the WLAN interface to use VLAN 100 with a DHCP scope on that VLAN.

    Why this is correct

    Ly addresses all three issues: WPA3 is not backward compatible with WPA2 clients, so switching to WPA2 (or enabling WPA2/WPA3 mixed mode) allows the client to authenticate. Enabling SSID broadcast lets the client discover the network. Configuring the WLAN interface for VLAN 100 and ensuring a DHCP scope exists on that VLAN provides IP addressing.

  • ✗

    Change the WLAN security to WPA3 only, enable SSID broadcast, and change the management interface IP to 192.168.100.10/24.

    Why it's wrong here

    This is incorrect because WPA3 only would still not work if the client does not support WPA3. Changing the management interface IP is unnecessary and does not fix the VLAN mismatch for client traffic; the WLAN interface should be mapped to VLAN 100, not the management interface.

  • ✗

    Keep WPA3, disable SSID broadcast for security, and configure the WLAN interface to use VLAN 100 with a DHCP scope on VLAN 1.

    Why it's wrong here

    This is incorrect because keeping WPA3 may still cause authentication failure if the client does not support it. Disabling SSID broadcast prevents the client from seeing the SSID. Configuring the WLAN interface for VLAN 100 but placing the DHCP scope on VLAN 1 means clients on VLAN 100 cannot obtain an IP address.

  • ✗

    Change the WLAN security to WPA2, keep SSID broadcast disabled, and configure the WLAN interface to use VLAN 1.

    Why it's wrong here

    This is incorrect because while changing to WPA2 fixes the authentication issue, keeping SSID broadcast disabled prevents the client from seeing the SSID. Configuring the WLAN interface to use VLAN 1 would place clients on the management VLAN, not VLAN 100 as required.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

✓Change the WLAN security to WPA2, enable SSID broadcast, and configure the WLAN interface to use VLAN 100 with a DHCP scope on that VLAN.Correct answer▾

Why this is correct

Ly addresses all three issues: WPA3 is not backward compatible with WPA2 clients, so switching to WPA2 (or enabling WPA2/WPA3 mixed mode) allows the client to authenticate. Enabling SSID broadcast lets the client discover the network. Configuring the WLAN interface for VLAN 100 and ensuring a DHCP scope exists on that VLAN provides IP addressing.

✗Change the WLAN security to WPA3 only, enable SSID broadcast, and change the management interface IP to 192.168.100.10/24.Wrong answer — click to see why▾

Why this is wrong here

The specific factual error is that WPA3-only security may not be supported by the client, and changing the management interface IP does not resolve the client VLAN assignment issue.

Why candidates choose this

Candidates might think that since the management IP is on VLAN 1, changing it to a different subnet could help, but the management interface is separate from the WLAN interface used for client data.

✗Keep WPA3, disable SSID broadcast for security, and configure the WLAN interface to use VLAN 100 with a DHCP scope on VLAN 1.Wrong answer — click to see why▾

Why this is wrong here

The specific factual errors are: WPA3 may not be compatible, disabling SSID broadcast hides the network, and DHCP scope must be on the same VLAN as the client (VLAN 100).

Why candidates choose this

Candidates might believe that disabling SSID broadcast improves security and that DHCP can be served from a different VLAN, but in this scenario the client cannot get an IP from a different subnet.

✗Change the WLAN security to WPA2, keep SSID broadcast disabled, and configure the WLAN interface to use VLAN 1.Wrong answer — click to see why▾

Why this is wrong here

The specific factual errors are: SSID broadcast must be enabled for client discovery, and the WLAN interface must be mapped to VLAN 100, not VLAN 1.

Why candidates choose this

Candidates might think that since the management interface is on VLAN 1, using VLAN 1 for clients is simpler, but the requirement specifies VLAN 100 for client traffic.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Client DHCP Server 1 Discover (broadcast) 2 Offer (IP: 192.168.1.10) 3 Request (I accept) 4 Acknowledge (lease confirmed) DORA — the four-step DHCP lease process

About these practice questions

Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.