CCNP Practice Question: Examine the following configuration on a Cisco…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  This profile configures the SSID for the AP.

  Why it's wrong here

  AP profiles in Cisco wireless architectures control physical radio parameters such as antenna selection, channel width, and transmit power, but they do not advertise or create an SSID. SSID naming, broadcast settings, and client VLAN mapping are configured in a WLAN profile, which is applied to APs separately from the AP profile. Therefore, stating that this AP profile configures the SSID conflates RF-level hardware settings with the client-facing service policy.

• ✓

  The country code is set to the United States, affecting allowed channels and transmit power.

  Why this is correct

  The statement is correct because the AP profile sets the country code to the United States, forcing the access point to comply with the FCC regulatory domain. That country code dictates which 2.4 GHz channels are valid (typically 1–11 rather than 12–14), which 5 GHz channels are available, including DFS restrictions, and the maximum allowable transmit power (EIRP) per channel. Setting the wrong country code can cause illegal transmissions or harmful interference, so the country code is a mandatory, compliance-relevant field within the AP profile.

• ✗

  This profile enables 802.11r fast roaming.

  Why it's wrong here

  802.11r fast roaming, also known as Fast BSS Transition (FT), reduces roaming latency by allowing the client and the target AP to derive a fresh PTK during reassociation using the PMK from the current AP. This is a security and mobility feature that depends on the selected authentication method (such as PSK or 802.1X), so it is configured inside a WLAN profile or a security profile, not an AP profile. AP profiles lack any mechanism for FT key management and only handle radio-level settings like channels, power, and data rates.

• ✗

  The management user 'admin' is used for client authentication.

  Why it's wrong here

  The management user 'admin' is a local account used for administrative access to the controller's CLI, web UI, or REST API, and is never leveraged for wireless client authentication. Clients authenticate through the WLAN's security settings, which may include WPA2-PSK, WPA3-Enterprise, or 802.1X/EAP, and those credentials are stored in external RADIUS servers or as pre-shared keys, not in the AP or controller's management user database. Mixing management and client credentials would expose privileged access to every wireless user, so Cisco keeps these two authentication realms completely isolated.