CCNA Switching and Network Access Practice Question
Exhibit
WLAN security: WPA2-Enterprise AP log: RADIUS server timeout SSID is visible and clients associate, but login fails
Exhibit: Clients can see the corporate SSID but fail authentication after entering valid usernames and passwords. Which issue is the best explanation?
⚠ Common exam trap
Remember that WPA2-Enterprise relies on a RADIUS server. Authentication issues often stem from server communication problems, not client-side settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RADIUS path or shared secret is failing
WPA2-Enterprise relies on 802.1X with a RADIUS server. If the RADIUS server is unreachable or the shared secret is wrong, users can see the SSID and attempt to authenticate, but the login process fails. Option A is incorrect because RF channel issues would cause connectivity problems, not authentication failures after association. Option C is incorrect because hiding the SSID is irrelevant to enterprise authentication; the issue is server-side. Option D is incorrect because a voice VLAN is not required for standard client authentication and would not cause login failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The AP is using the wrong RF channel
Why it's wrong here
An incorrect RF channel assignment would prevent the AP from operating on the expected frequency, typically making the SSID undetectable or severely degrading signal quality so that clients cannot associate at all. Since the clients can see the corporate SSID, they are receiving beacons and successfully probing, meaning the RF channel is functioning at the physical layer. An authentication failure after a visible SSID points to a higher-layer issue such as RADIUS or EAP, not channel misconfiguration.
When this WOULD be correct
In a different scenario, if a question asks why clients are unable to connect to an SSID despite being in range, and mentions issues like poor signal strength or interference, then stating that the AP is using the wrong RF channel could be a valid explanation for connectivity problems.
- ✓
The RADIUS path or shared secret is failing
Why this is correct
In WPA2-Enterprise, the access point acts as an 802.1X authenticator and forwards EAP credentials to a RADIUS server. If the shared secret is misconfigured or the RADIUS server is unreachable, the authentication exchange fails after the client associates, precisely matching the symptom of seeing the SSID but being unable to connect. This is the only option that directly impacts the authentication stage rather than association or RF visibility.
- ✗
The SSID must be hidden for enterprise authentication
Why it's wrong here
Hiding the SSID only suppresses the SSID from beacon frames and some probe responses; it does not alter the 802.1X/EAP authentication flow or RADIUS requirements. Enterprise authentication functions identically with a broadcast SSID, and clients that already know the SSID can still find and attempt to authenticate to a hidden network. The failure described occurs after the SSID is visible, so hiding it would not resolve or explain the authentication failure.
When this WOULD be correct
In a scenario where a question states that clients are unable to connect to the network because the SSID is not visible, and the context involves a security policy requiring hidden SSIDs for enterprise authentication, this option would be correct.
- ✗
The clients need a voice VLAN assignment first
Why it's wrong here
Voice VLANs are a switch-level mechanism used to separate and prioritize VoIP traffic, often via LLDP-MED or CDP, and are not a prerequisite for wireless client authentication. In a WPA2-Enterprise network, the VLAN assignment is an outcome of successful RADIUS authentication, where the server returns attributes like Tunnel-Private-Group-ID, rather than a condition that must exist beforehand. Requiring a voice VLAN before authentication would create a circular dependency and misinterprets the role of VLANs in 802.1X.
When this WOULD be correct
In a different scenario where the question states that clients are required to connect to a voice VLAN for specific services, and they fail to authenticate until they are assigned to that VLAN, this option would be correct. For instance, if the question specifies that voice traffic must be prioritized and VLANs are configured accordingly, then this option would be valid.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The RADIUS path or shared secret is failingCorrect answer▾
Why this is correct
In WPA2-Enterprise, the access point acts as an 802.1X authenticator and forwards EAP credentials to a RADIUS server. If the shared secret is misconfigured or the RADIUS server is unreachable, the authentication exchange fails after the client associates, precisely matching the symptom of seeing the SSID but being unable to connect. This is the only option that directly impacts the authentication stage rather than association or RF visibility.
✗The AP is using the wrong RF channelWrong answer — click to see why▾
Why this is wrong here
RF channel issues affect signal quality, coverage, or client discovery, but do not impact the authentication process after the client has associated with the SSID. Since clients can see the SSID, channel is not the problem.
★ When this WOULD be the correct answer
In a different scenario, if a question asks why clients are unable to connect to an SSID despite being in range, and mentions issues like poor signal strength or interference, then stating that the AP is using the wrong RF channel could be a valid explanation for connectivity problems.
Why candidates choose this
Students often associate wireless problems with RF interference or channel overlap, but authentication failures point to higher-layer issues like RADIUS or credentials.
✗The SSID must be hidden for enterprise authenticationWrong answer — click to see why▾
Why this is wrong here
Hiding the SSID is a security-by-obscurity measure that does not affect 802.1X authentication. Enterprise authentication works identically whether the SSID is broadcast or hidden.
★ When this WOULD be the correct answer
In a scenario where a question states that clients are unable to connect to the network because the SSID is not visible, and the context involves a security policy requiring hidden SSIDs for enterprise authentication, this option would be correct.
Why candidates choose this
Some believe hiding the SSID adds security, but it is unrelated to authentication success and can actually cause client connectivity issues.
✗The clients need a voice VLAN assignment firstWrong answer — click to see why▾
Why this is wrong here
Voice VLANs are used to separate voice traffic from data traffic on wired switches, not for wireless client authentication. They have no role in the 802.1X authentication process.
★ When this WOULD be the correct answer
In a different scenario where the question states that clients are required to connect to a voice VLAN for specific services, and they fail to authenticate until they are assigned to that VLAN, this option would be correct. For instance, if the question specifies that voice traffic must be prioritized and VLANs are configured accordingly, then this option would be valid.
Why candidates choose this
Students may confuse VLAN assignment with authentication, thinking a specific VLAN is required before authentication, but VLANs are applied after successful authentication.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Interpreting Packet Capture Output for Layer 2/3 Troubleshooting
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
Key term
WPA2
WPA2 is a security protocol used to protect Wi-Fi networks by encrypting data transmitted between devices and the access point.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.