CCNA Network Infrastructure and Connectivity Practice Question
Network Topology
You are connected to a Cisco 9800 WLC (WLC1) via its management interface. A wireless client reports association failures with SSID 'CorpNet'. The client uses WPA3-Personal, but the WLAN is configured for WPA2. Additionally, the SSID is hidden and the client is on the wrong VLAN (VLAN 20 instead of VLAN 100). Fix these issues so the client can associate successfully with WPA3, on VLAN 100, and with the SSID broadcast enabled.
⚠ Common exam trap
Be careful to distinguish between WPA2 and WPA3, and between Personal (PSK) and Enterprise (802.1X). Also, remember that a hidden SSID must be broadcast for clients to discover it, and VLAN assignment is done in the policy tag, not the SSID configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.
The WLAN was configured for WPA2-PSK with a hidden SSID, and the policy tag assigned VLAN 20 instead of VLAN 100. To fix: (1) Enable SSID broadcast with 'broadcast-ssid'. (2) Change security to WPA3-Personal by removing WPA2 and enabling WPA3 with 'security wpa wpa3' and 'security wpa psk set-ccmp'. (3) Assign VLAN 100 in the policy tag with 'vlan 100'. The client should then associate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.
Why this is correct
Ly addresses all three issues: enabling broadcast-ssid, configuring WPA3-Personal (by removing WPA2 and enabling WPA3 with PSK and CCMP), and setting the VLAN to 100 in the policy tag. These steps allow the client to associate successfully.
- ✗
Enable SSID broadcast, change security to WPA2-PSK, and assign VLAN 20 in the policy tag.
Why it's wrong here
Enabling the broadcast solves discovery, but switching to WPA2-PSK is incompatible with the client's WPA3-Personal configuration, because WPA3-Personal mandates the SAE (Simultaneous Authentication of Equals) handshake, not the older PSK key exchange. Furthermore, assigning VLAN 20 in the policy tag places this client on the wrong Layer 2 segment; the access point would tag its traffic with VLAN 20, isolating the client from the resources on VLAN 100 even if authentication somehow succeeded.
- ✗
Disable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.
Why it's wrong here
Disabling SSID broadcast would keep the wireless LAN cloaked from clients performing active scanning; the client specifically needs a broadcasted SSID to discover the network during the probe/scan phase and cannot initiate association to an SSID it never sees. Even though WPA3-Personal and VLAN 100 would otherwise be acceptable, the hidden SSID prevents the client from even attempting connectivity, so this option fails to resolve the problem. Hiding the SSID is not a valid substitute for a proper security configuration.
- ✗
Enable SSID broadcast, change security to WPA3-Enterprise, and assign VLAN 100 in the policy tag.
Why it's wrong here
WPA3-Enterprise requires an IEEE 802.1X/EAP framework with a RADIUS server, whereas the client is configured for WPA3-Personal, which uses a pre-shared key negotiated via the SAE handshake; without valid enterprise credentials and backend authentication infrastructure, the AP will not complete the 4-way handshake. Although broadcast is enabled and VLAN 100 is correct, the security mode mismatch prevents the client from associating successfully.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.Correct answer▾
Why this is correct
Ly addresses all three issues: enabling broadcast-ssid, configuring WPA3-Personal (by removing WPA2 and enabling WPA3 with PSK and CCMP), and setting the VLAN to 100 in the policy tag. These steps allow the client to associate successfully.
✗Enable SSID broadcast, change security to WPA2-PSK, and assign VLAN 20 in the policy tag.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the client uses WPA3-Personal, so changing to WPA2-PSK does not meet the requirement. Also, VLAN 20 is the wrong VLAN.
Why candidates choose this
Candidates might pick this if they overlook the client's WPA3 requirement and mistakenly think WPA2 is sufficient, or if they confuse the current VLAN with the desired one.
✗Disable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that the SSID is currently hidden and the client cannot see it; enabling broadcast is required, not disabling.
Why candidates choose this
Candidates might think hiding the SSID adds security and choose to keep it hidden, but the client needs the SSID to be broadcast to associate.
✗Enable SSID broadcast, change security to WPA3-Enterprise, and assign VLAN 100 in the policy tag.Wrong answer — click to see why▾
Why this is wrong here
The specific factual error is that WPA3-Personal uses a pre-shared key, while WPA3-Enterprise requires 802.1X authentication. The client is configured for Personal mode.
Why candidates choose this
Candidates might confuse WPA3-Personal with WPA3-Enterprise, or think that Enterprise is always better, but the client's configuration dictates Personal.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Collision Domains and Broadcast Domains
Key term
Temporal Key Integrity Protocol
TKIP is a security protocol used in Wi-Fi networks to strengthen encryption by dynamically changing the encryption key for each data packet.
Key term
WLC
A Wireless LAN Controller is a centralized device that manages, configures, and secures multiple wireless access points in a network.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.