CCNA Network Infrastructure and Connectivity Practice Question
Network Topology
You are connected to WLC-1 via the management interface (192.168.1.100/24). The wireless network 'CustomerNet' uses WPA3-Personal, but clients are failing to associate. The SSID is hidden and the correct VLAN is 30. Configure the WLAN and SSID parameters to allow successful client associations and verify the configuration.
⚠ Common exam trap
A common trap is to assume that modifying the existing WLAN is sufficient, but you must also ensure the correct VLAN interface exists and is assigned. Additionally, candidates often forget that a hidden SSID must be broadcast for clients to discover it, especially when clients are failing to associate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new interface 'vlan30' with VLAN 30, then create a new WLAN with SSID 'CustomerNet', set security to WPA3-Personal, enable SSID broadcast, and assign the 'vlan30' interface.
The GuestNet WLAN (ID 2) currently uses WPA2 with PSK, but clients expect WPA3-Personal. Additionally, the SSID is hidden (broadcast disabled) and the interface is set to guest (VLAN 20) instead of the required VLAN 30. To fix, create a new WLAN (or modify WLAN 2) to use WPA3-Personal, enable SSID broadcast, and assign it to a new interface mapped to VLAN 30. Configure the interface first, then apply to the WLAN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a new interface 'vlan30' with VLAN 30, then create a new WLAN with SSID 'CustomerNet', set security to WPA3-Personal, enable SSID broadcast, and assign the 'vlan30' interface.
Why this is correct
This is correct because it addresses all three issues: the interface must be created and mapped to VLAN 30, the WLAN must use WPA3-Personal, and SSID broadcast must be enabled for clients to discover the hidden SSID.
- ✗
Modify the existing GuestNet WLAN: change security to WPA3-Personal, enable SSID broadcast, and change the interface to 'guest' (VLAN 20).
Why it's wrong here
Selecting the 'guest' interface during WLAN modification binds that SSID to guest VLAN 20 (assuming the interface is mapped accordingly). Even after updating the security to WPA3-Personal and enabling broadcast, all client traffic is still switched into VLAN 20 rather than VLAN 30, which is explicitly required for the customer network. The interface assignment determines Layer 2 segmentation for wireless clients; unless it points to an interface mapped to VLAN 30, the WLAN remains on the incorrect segment.
- ✗
Create a new WLAN with SSID 'CustomerNet', set security to WPA2-PSK, enable SSID broadcast, and assign the 'guest' interface (VLAN 20).
Why it's wrong here
WPA2-PSK is not functionally equivalent to WPA3-Personal because WPA3 uses the Simultaneous Authentication of Equals (SAE) handshake, providing stronger protection against offline dictionary attacks. Additionally, assigning the 'guest' interface places the new CustomerNet SSID on VLAN 20 instead of the required VLAN 30, meaning clients are placed in the wrong broadcast domain and DHCP scope. Even though a new SSID is created and broadcast is enabled, this option simultaneously violates two mandatory requirements for the WLAN configuration.
- ✗
Modify the GuestNet WLAN: change security to WPA3-Personal, keep SSID broadcast disabled, and change the interface to a new interface mapped to VLAN 30.
Why it's wrong here
Keeping SSID broadcast disabled makes CustomerNet a hidden network, meaning clients must manually probe for the exact SSID name to discover and associate. The requirement explicitly states that SSID broadcast must be enabled, so even with WPA3-Personal and the correct VLAN-30 interface, this option does not allow automatic discovery by client devices. Hidden SSIDs also introduce probe overhead and can cause connectivity issues with some client implementations, making this configuration functionally incomplete.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a new interface 'vlan30' with VLAN 30, then create a new WLAN with SSID 'CustomerNet', set security to WPA3-Personal, enable SSID broadcast, and assign the 'vlan30' interface.Correct answer▾
Why this is correct
This is correct because it addresses all three issues: the interface must be created and mapped to VLAN 30, the WLAN must use WPA3-Personal, and SSID broadcast must be enabled for clients to discover the hidden SSID.
✗Modify the existing GuestNet WLAN: change security to WPA3-Personal, enable SSID broadcast, and change the interface to 'guest' (VLAN 20).Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the interface remains set to 'guest' (VLAN 20) instead of being changed to VLAN 30 as required.
Why candidates choose this
Candidates might think modifying the existing WLAN is sufficient and overlook the VLAN requirement, assuming the guest interface is acceptable.
✗Create a new WLAN with SSID 'CustomerNet', set security to WPA2-PSK, enable SSID broadcast, and assign the 'guest' interface (VLAN 20).Wrong answer — click to see why▾
Why this is wrong here
The specific factual errors are using WPA2-PSK (clients expect WPA3-Personal) and assigning the wrong VLAN (20 instead of 30).
Why candidates choose this
Candidates may confuse WPA2 and WPA3 or think that WPA2 is backward compatible, and may not realize the VLAN mismatch.
✗Modify the GuestNet WLAN: change security to WPA3-Personal, keep SSID broadcast disabled, and change the interface to a new interface mapped to VLAN 30.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the SSID broadcast remains disabled, which means clients cannot see the SSID and will not attempt to associate.
Why candidates choose this
Candidates may think that hiding the SSID is a security feature and should be kept, not realizing that the clients are failing to associate because they cannot find the network.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Collision Domains and Broadcast Domains
Key term
WPA3
WPA3 is the latest security standard for Wi-Fi networks, providing stronger encryption and protection against password guessing attacks compared to its predecessor WPA2.
Key term
Pre-shared Key
A secret password or passphrase that two devices share beforehand to prove they are allowed to connect and communicate securely.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.