CCNA Network Infrastructure and Connectivity Practice Question
Network Topology
You are connected to WLC-1 via SSH. A new SSID 'CorpSecure' must be configured for 5 GHz clients using WPA3-Personal. However, after creation, clients can see the SSID but fail to associate. Review the WLC configuration and fix the issue so that clients can successfully associate and obtain an IP address from VLAN 100 (subnet 10.0.100.0/24).
⚠ Common exam trap
Students often forget to change the radio policy from 'All' to a specific band, or they confuse WPA2 with WPA3. Also, they may overlook enabling the WLAN after configuration. Ensure you understand the specific requirements for WPA3 and the need to match the radio policy to the client band.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, set the radio policy to 5 GHz, and ensure the WLAN is mapped to the dynamic interface for VLAN 100.
The SSID was configured with WPA2 instead of WPA3. The WLC also had no radio policy set for 5 GHz only. To fix, change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, and set the radio policy to 5 GHz. Additionally, ensure the WLAN is mapped to the appropriate dynamic interface for VLAN 100, not the management interface, and that client VLAN 100 is reachable. The commands to modify the WLAN are: config wlan security wpa3 1 enable, config wlan security wpa3 psk ascii CorpSecurePass123 1, config wlan radio policy 802.11a-only 1, and config wlan enable 1.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, set the radio policy to 5 GHz, and ensure the WLAN is mapped to the dynamic interface for VLAN 100.
Why this is correct
This is correct because WPA3-Personal requires AES-CCMP encryption, and the radio policy must be set to 5 GHz to match the requirement. Additionally, the management interface must be on the correct VLAN for client traffic to reach VLAN 100.
- ✗
Change the WLAN security to WPA2-Personal, enable TKIP encryption, and set the radio policy to 5 GHz.
Why it's wrong here
Selecting WPA2-Personal with TKIP directly violates the stated security requirement of WPA3-Personal. WPA3 mandates AES-CCMP as the encryption cipher; TKIP is a legacy protocol that is not supported in any WPA3 configuration and is considered cryptographically broken. Moreover, while setting the radio policy to 5 GHz matches the client requirement, the security suite and encryption cipher are non-negotiable and must be WPA3-Personal with AES-CCMP.
- ✗
Change the WLAN security to WPA3-Personal, enable AES-CCMP, but leave the radio policy as 'All' (both 2.4 GHz and 5 GHz).
Why it's wrong here
This is incorrect because the requirement specifies that the SSID should be for 5 GHz clients only. Leaving the radio policy as 'All' would allow 2.4 GHz clients to associate, which is not desired and could cause configuration issues.
- ✗
Change the WLAN security to WPA3-Personal, enable AES-CCMP, set the radio policy to 5 GHz, but do not enable the WLAN after changes.
Why it's wrong here
Although this option correctly specifies WPA3-Personal, AES-CCMP, and a 5 GHz radio policy, it omits the critical step of enabling the WLAN after the changes are applied. On Cisco wireless controllers, a newly configured or modified WLAN remains administratively down until explicitly enabled with the 'config wlan enable <id>' command or the 'no shutdown' equivalent. Without this step, the access points will not broadcast the SSID and clients cannot associate, making the configuration functionally ineffective despite all other parameters being correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, set the radio policy to 5 GHz, and ensure the WLAN is mapped to the dynamic interface for VLAN 100.Correct answer▾
Why this is correct
This is correct because WPA3-Personal requires AES-CCMP encryption, and the radio policy must be set to 5 GHz to match the requirement. Additionally, the management interface must be on the correct VLAN for client traffic to reach VLAN 100.
✗Change the WLAN security to WPA2-Personal, enable TKIP encryption, and set the radio policy to 5 GHz.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that WPA2-Personal with TKIP does not meet the WPA3-Personal requirement; WPA3 mandates AES-CCMP.
Why candidates choose this
Candidates might pick this because they are more familiar with WPA2 and may not realize that WPA3 is required, or they confuse TKIP with AES.
✗Change the WLAN security to WPA3-Personal, enable AES-CCMP, but leave the radio policy as 'All' (both 2.4 GHz and 5 GHz).Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the radio policy must be set to 5 GHz only, not 'All', to restrict access to 5 GHz clients.
Why candidates choose this
Candidates might pick this because they think 'All' is acceptable or they forget to change the radio policy, assuming it defaults correctly.
✗Change the WLAN security to WPA3-Personal, enable AES-CCMP, set the radio policy to 5 GHz, but do not enable the WLAN after changes.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the WLAN remains disabled, so clients cannot associate even if other settings are correct.
Why candidates choose this
Candidates might pick this because they focus only on security and radio settings, forgetting the final step of enabling the WLAN, which is a common oversight.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
IPv4 Addressing and Address Classes
Key term
AES
AES is a fast and secure encryption standard used worldwide to protect sensitive data by scrambling it so only authorized parties can read it.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.