Wireless Security practice questions

Drag and drop the wireless terms on the left to the correct descriptions on the right.

Trap 1: BSSID: The MAC address of the access point's radio interface, used…

This is incorrect because BSSID is indeed the MAC address of the AP's radio, but the description is accurate; however, the correct answer for the given description is SSID. This option is a distractor that matches a different term.

Trap 2: RSSI: A measurement of the power level of the received radio…

This is incorrect because RSSI (Received Signal Strength Indicator) measures signal strength, but the description in the question is for SSID. This option correctly defines RSSI but does not match the given description.

Trap 3: DFS: A mechanism that allows wireless devices to avoid interference…

This is incorrect because DFS (Dynamic Frequency Selection) is a channel selection mechanism to avoid radar, not a network name. The description in the question is for SSID.

A
SSID: The network name broadcast by an access point to identify the wireless network.
SSID (Service Set Identifier) is the human-readable name that identifies a wireless network. Clients use it to select and connect to the desired network.
B
BSSID: The MAC address of the access point's radio interface, used to uniquely identify a BSS.
Why wrong: This is incorrect because BSSID is indeed the MAC address of the AP's radio, but the description is accurate; however, the correct answer for the given description is SSID. This option is a distractor that matches a different term.
C
RSSI: A measurement of the power level of the received radio signal, indicating signal strength.
Why wrong: This is incorrect because RSSI (Received Signal Strength Indicator) measures signal strength, but the description in the question is for SSID. This option correctly defines RSSI but does not match the given description.
D
DFS: A mechanism that allows wireless devices to avoid interference with radar systems by dynamically selecting channels.
Why wrong: This is incorrect because DFS (Dynamic Frequency Selection) is a channel selection mechanism to avoid radar, not a network name. The description in the question is for SSID.

Question 2mediummatching

Drag and drop the wireless LAN terms on the left to the correct descriptions on the right.

Trap 1: Service Set Identifier (SSID)

This is incorrect because the SSID is the network name that identifies a wireless network, not a device that connects wireless to wired.

Trap 2: Basic Service Set (BSS)

This is incorrect because a BSS describes a single AP with its associated clients, not the device that connects wireless to wired.

Trap 3: Wireless LAN Controller (WLC)

This is incorrect because a WLC manages multiple APs centrally, but it does not directly connect wireless clients to the wired network; that is the AP's role.

A
Access Point (AP)
An Access Point (AP) is a device that connects wireless clients to a wired network, acting as a bridge between the wireless and wired domains.
B
Service Set Identifier (SSID)
Why wrong: This is incorrect because the SSID is the network name that identifies a wireless network, not a device that connects wireless to wired.
C
Basic Service Set (BSS)
Why wrong: This is incorrect because a BSS describes a single AP with its associated clients, not the device that connects wireless to wired.
D
Wireless LAN Controller (WLC)
Why wrong: This is incorrect because a WLC manages multiple APs centrally, but it does not directly connect wireless clients to the wired network; that is the AP's role.

Question 3mediummulti select

Which statement correctly describes a feature of WPA3 security in wireless LANs?

Trap 1: WPA3 uses TKIP encryption for backward compatibility with legacy…

WPA3 does not support TKIP; it requires GCMP-256 encryption and mandates CCMP-128 for compatibility, but TKIP is deprecated.

Trap 2: WPA3 relies solely on 802.1X/EAP authentication for both personal…

WPA3 Personal uses SAE, not 802.1X. 802.1X/EAP is used only in WPA3 Enterprise mode.

Trap 3: WPA3 mandates the use of GCMP-256 encryption for enhanced security.

GCMP-256 is the default encryption suite for WPA3, offering stronger cryptographic protection than the CCMP-AES used in WPA2.

A
WPA3 uses TKIP encryption for backward compatibility with legacy devices.
Why wrong: WPA3 does not support TKIP; it requires GCMP-256 encryption and mandates CCMP-128 for compatibility, but TKIP is deprecated.
B
WPA3 introduces Simultaneous Authentication of Equals (SAE) to resist offline dictionary attacks.
SAE replaces WPA2's PSK handshake, providing a secure key exchange that prevents attackers from cracking the password offline.
C
WPA3 relies solely on 802.1X/EAP authentication for both personal and enterprise modes.
Why wrong: WPA3 Personal uses SAE, not 802.1X. 802.1X/EAP is used only in WPA3 Enterprise mode.
D
WPA3 mandates the use of GCMP-256 encryption for enhanced security.
Why wrong: GCMP-256 is the default encryption suite for WPA3, offering stronger cryptographic protection than the CCMP-AES used in WPA2.
E
WPA3 makes Protected Management Frames (PMF) optional to support older clients.
Why wrong: WPA3 requires PMF to be enabled (mandatory), not optional, to protect against deauthentication attacks.

Question 4mediummulti select

Which two statements accurately describe CAPWAP in a controller-based WLAN context?

Trap 1: It is the same thing as a client SSID.

This is wrong because CAPWAP is not the WLAN name.

Trap 2: It is a replacement for WPA2 and WPA3.

This is wrong because CAPWAP is not a wireless security standard.

Trap 3: It is used only for IPv4 ACL filtering.

This is wrong because CAPWAP is not an ACL concept.

A
It is associated with communication between lightweight APs and the wireless LAN controller.
This is correct because CAPWAP is part of the AP-controller architecture.
B
It is relevant in controller-based WLAN designs.
This is correct because CAPWAP is tied to that architecture model.
C
It is the same thing as a client SSID.
Why wrong: This is wrong because CAPWAP is not the WLAN name.
D
It is a replacement for WPA2 and WPA3.
Why wrong: This is wrong because CAPWAP is not a wireless security standard.
E
It is used only for IPv4 ACL filtering.
Why wrong: This is wrong because CAPWAP is not an ACL concept.

Read the full DHCP explanation →

Question 5harddrag order

Drag and drop the following steps into the correct order to configure a new WLAN on a Cisco WLC using IOS-XE CLI, including WPA3-Personal security, and to complete a wireless client association with DHCP.

Trap 1: Enter global configuration mode, create WLAN profile, enable WLAN,…

This is incorrect because security must be configured before enabling the WLAN; enabling a WLAN without security first can leave it open temporarily.

Trap 2: Enter global configuration mode, configure WPA3-Personal (SAE)…

This is incorrect because the WLAN profile must be created before security can be applied to it; security parameters are part of the WLAN profile configuration.

Trap 3: Enter global configuration mode, create WLAN profile, configure…

This is incorrect because the client must associate with the WLAN before obtaining an IP via DHCP; DHCP occurs after association.

A
Enter global configuration mode, create WLAN profile, configure WPA3-Personal (SAE) security, enable WLAN, client associates, client obtains IP via DHCP.
This is the correct order per Cisco IOS-XE WLC CLI: first enter global config, create the WLAN profile, set security (WPA3-Personal/SAE), enable the WLAN, then the client associates and gets an IP via DHCP.
B
Enter global configuration mode, create WLAN profile, enable WLAN, configure WPA3-Personal (SAE) security, client associates, client obtains IP via DHCP.
Why wrong: This is incorrect because security must be configured before enabling the WLAN; enabling a WLAN without security first can leave it open temporarily.
C
Enter global configuration mode, configure WPA3-Personal (SAE) security, create WLAN profile, enable WLAN, client associates, client obtains IP via DHCP.
Why wrong: This is incorrect because the WLAN profile must be created before security can be applied to it; security parameters are part of the WLAN profile configuration.
D
Enter global configuration mode, create WLAN profile, configure WPA3-Personal (SAE) security, enable WLAN, client obtains IP via DHCP, client associates.
Why wrong: This is incorrect because the client must associate with the WLAN before obtaining an IP via DHCP; DHCP occurs after association.

Open the full VLAN trunking answer →

Question 6hardScenario

You are managing a Cisco WLC (192.168.1.10) via its web UI. The wireless network 'CorpSecure' has been configured but clients cannot associate. Some report 'wrong password' errors; others see the SSID but fail to connect. Additionally, management access to the WLC web UI is intermittent. Identify and resolve the issues so that wireless clients can successfully associate with 'CorpSecure' using WPA3-Personal and the WLC web UI is reliably accessible from the management VLAN (VLAN 10).

Exhibit

=== WLC Configuration (Partial) ===
WLAN ID: 1
Profile Name: CorpSecure
SSID: CorpSecure
Status: Enabled
Security: WPA2-PSK (AES)
PSK Passphrase: Cisco123!

VLAN: 20
Interface: VLAN20

Broadcast SSID: Disabled

=== Interface Configuration ===
Management Interface:
  IP Address: 192.168.1.10/24
  VLAN: 10
  Default Gateway: 192.168.1.1

=== Show summary (from CLI) ===
(Cisco Controller) >show wlan summary

Number of WLANs.................................. 1

WLAN ID  WLAN Profile Name / SSID               Status  Interface
-------  ------------------------------------  -------  ---------
1        CorpSecure / CorpSecure                Enabled  VLAN20

(Cisco Controller) >show client summary

Number of Clients................................ 0

(Cisco Controller) >show interface detailed management

Interface Name................................... management
MAC Address...................................... 00:1a:2b:3c:4d:5e
IP Address....................................... 192.168.1.10
IP Netmask....................................... 255.255.255.0
Default Router................................... 192.168.1.1
VLAN............................................ 10

(Cisco Controller) >show interface detailed vlan20

Interface Name................................... vlan20
MAC Address...................................... 00:1a:2b:3c:4d:5f
IP Address....................................... 10.0.20.1
IP Netmask....................................... 255.255.255.0
Default Router................................... 10.0.20.254
VLAN............................................ 20

Trap 1: Change the SSID security to WPA2-PSK and disable SSID broadcast;…

This is incorrect because WPA2-PSK is not the required security (WPA3-Personal is needed), and disabling SSID broadcast would worsen client visibility. Resetting to factory defaults is unnecessary and would erase all configurations.

Trap 2: Update the WLC firmware to the latest version and change the…

This is incorrect because changing the management VLAN to VLAN 1 is not recommended and does not address the SSID security or broadcast issues. Firmware update may not resolve the specific configuration errors.

Trap 3: Reconfigure the SSID with WPA3-Enterprise and enable SSID…

This is incorrect because WPA3-Enterprise requires a RADIUS server, which is not mentioned; the scenario specifies WPA3-Personal. Using DHCP for the management interface could cause IP address changes, worsening intermittent access.

A
Configure the SSID with WPA3-Personal; verify management interface is on VLAN 10 with correct gateway.
The root cause is the WPA2 vs WPA3 mismatch; the SSID is already visible, so broadcast is fine. Ensuring the management interface is on VLAN 10 resolves intermittent web UI access.
B
Change the SSID security to WPA2-PSK and disable SSID broadcast; reset the WLC to factory defaults.
Why wrong: This is incorrect because WPA2-PSK is not the required security (WPA3-Personal is needed), and disabling SSID broadcast would worsen client visibility. Resetting to factory defaults is unnecessary and would erase all configurations.
C
Update the WLC firmware to the latest version and change the management VLAN to VLAN 1.
Why wrong: This is incorrect because changing the management VLAN to VLAN 1 is not recommended and does not address the SSID security or broadcast issues. Firmware update may not resolve the specific configuration errors.
D
Reconfigure the SSID with WPA3-Enterprise and enable SSID broadcast; set the management interface to use DHCP.
Why wrong: This is incorrect because WPA3-Enterprise requires a RADIUS server, which is not mentioned; the scenario specifies WPA3-Personal. Using DHCP for the management interface could cause IP address changes, worsening intermittent access.

Question 7mediummulti select

Which two statements accurately describe good design thinking for wireless guest access?

Trap 1: Guest WLANs should avoid all security to make access easier.

This is wrong because guest networks still need security and policy control.

Trap 2: Guest WLANs should automatically use the same permissions as…

This is wrong because that defeats the purpose of guest isolation.

Trap 3: Guest access means the AP no longer needs controller coordination.

This is wrong because controller architecture is a separate question from guest policy.

A
Guest access should normally be isolated from internal corporate resources.
This is correct because guest segmentation is a core design principle.
B
Guest access policies should usually reflect lower trust than employee access.
This is correct because guest users usually require more limited access.
C
Guest WLANs should avoid all security to make access easier.
Why wrong: This is wrong because guest networks still need security and policy control.
D
Guest WLANs should automatically use the same permissions as internal employee WLANs.
Why wrong: This is wrong because that defeats the purpose of guest isolation.
E
Guest access means the AP no longer needs controller coordination.
Why wrong: This is wrong because controller architecture is a separate question from guest policy.