How many Wireless LAN and WLC Scenarios questions are on this page?

This page has 9 Wireless LAN and WLC Scenarios scenario questions for the 350-701 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-701 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco SCOR / CCNP Security Core 350-701 questions

Scenario-based practice

Wireless LAN and WLC Scenarios

Practise Cisco SCOR / CCNP Security Core 350-701 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

350-701

exam code

Cisco

vendor

Scenario guide

How to approach wireless lan and wlc scenarios

Wireless questions on the CCNA cover 802.11 standards (ax/ac/n), WPA3, SSID/BSSID concepts, WLC architecture (FlexConnect, local switching), and client connectivity troubleshooting. These are mostly MCQ and multi-select.

Quick answer

Wireless security questions usually test authentication protocols (WPA2/WPA3), encryption modes, 802.11 standards and troubleshooting clients that cannot connect or associate.

WPA2 vs WPA3 authentication and encryption standards.

802.11 wireless standards, frequency bands and channel behaviour.

WLAN client troubleshooting — association, authentication and DHCP.

How SSID, authentication method and pre-shared key affect wireless access.

Practice scenarios

Question 1easymultiple choice

Read the full wireless explanation →

An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?

A
DNS records for the domain controller have not updated
Why wrong: DNS updates are unrelated to password caching; stale DNS would affect all users, not just those who changed passwords.
B
ISE has cached the previous password and is still using it for authentication
ISE caches credentials to improve performance; after a password change, the cached old password is still used until the cache refreshes, causing a delay of about 30 minutes.
C
The wireless controller has a local password cache
Why wrong: Wireless controllers do not cache passwords locally for 802.1X; they pass authentication requests to the RADIUS server.
D
The RADIUS server on the wireless controller is caching credentials
Why wrong: The RADIUS server (ISE) is the component that caches credentials, not the wireless controller.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full wireless explanation →

A network engineer is configuring Cisco ISE for wireless 802.1X authentication. The company wants to use certificate-based authentication for all corporate devices. Which EAP method should be configured?

A
EAP-MD5
Why wrong: EAP-MD5 is weak and deprecated; does not use certificates.
B
PEAP-MSCHAPv2
Why wrong: PEAP-MSCHAPv2 uses passwords, not certificates, for client authentication.
C
EAP-TLS
EAP-TLS requires client and server certificates for authentication.
D
LEAP
Why wrong: LEAP is a Cisco proprietary method that is insecure and not certificate-based.

Full breakdown with real-world context →

Question 3hardmultiple choice

Open the full VLAN trunking answer →

A large enterprise with over 2,000 employees recently experienced a security breach. An attacker gained initial access through a phishing email and then moved laterally across the network to reach a critical database server. The network currently has a flat Layer 2 topology with all devices in a single large VLAN. The company wants to prevent lateral movement in the future while maintaining operational simplicity. They have a Cisco ISE deployment already but it is only used for wireless guest access. The security team is evaluating options. Option A: Deploy 802.1X with dynamic VLAN assignment across all wired ports. This would authenticate users and assign them to different VLANs based on identity. Option B: Implement micro-segmentation using Cisco TrustSec with Security Group Tags (SGTs) on the existing switches and enforce SGT-based policies on the firewalls. This would allow traffic control between groups regardless of IP. Option C: Install a next-generation firewall at the internet edge and enable IPS to block known attack signatures. Option D: Upgrade all access switches to support Private VLANs (PVLANs) and configure promiscuous ports for servers. Which solution BEST addresses the lateral movement problem while leveraging existing infrastructure?

A
Install a next-generation firewall at the internet edge and enable IPS.
Why wrong: This protects inbound threats but does not prevent an attacker already inside from moving laterally.
B
Upgrade all access switches to support Private VLANs (PVLANs).
Why wrong: PVLANs can isolate ports, but they add administrative overhead and do not provide identity-based policy control like TrustSec.
C
Deploy 802.1X with dynamic VLAN assignment across all wired ports.
Why wrong: While it segments users into VLANs, intra-VLAN traffic is still allowed, enabling lateral movement within the same VLAN.
D
Implement micro-segmentation using Cisco TrustSec with SGTs and enforce policies on firewalls.
SGTs allow traffic control based on group identity, preventing lateral movement even within the same subnet, and leverages existing ISE.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full wireless explanation →

An organization wants to provide guest wireless access with a captive portal. Which Cisco ISE portal type should be used?

A
Sponsored Guest Portal
Why wrong: This requires an existing employee to sponsor the guest.
B
Central Web Authentication (CWA) Portal
Why wrong: CWA is used for device onboarding and BYOD, not guest self-registration.
C
Hotspot Guest Portal
Why wrong: This provides simple access without registration or authentication.
D
Self-Registered Guest Portal
This portal allows guests to register themselves and create credentials.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full wireless explanation →

A global company uses Cisco Umbrella to enforce security policies across roaming users. Recently, a user reported that they could not access a legitimate business application while connected to a guest Wi-Fi at an airport. The application is categorized as 'Productivity' in Umbrella. Other users outside the office can access it. What is the most likely reason?

A
The user's Umbrella roaming client is unable to authenticate, so the request uses the default policy which blocks the category.
Identity not resolved, fallback policy applies.
B
The application's category is blocked globally in the Umbrella policy.
Why wrong: Other users can access it.
C
The user is in a different geographic location with a stricter policy.
Why wrong: Policy is typically not location-based.
D
The guest Wi-Fi's public IP address is on a block list.
Why wrong: Not specific to the user.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full wireless explanation →

A small business uses Cisco ISE to authenticate employees via Active Directory. The company has a single ISE node and two Catalyst 2960-X switches. Employees connect to the network and are successfully authenticated using 802.1X with PEAP. The business wants to provide guest wireless access using a separate SSID with a captive portal. The engineer configures a new WLAN on the WLC (Cisco 2504) pointing to the same ISE node. Guest users can associate to the WLAN and get an IP address, but when they open a browser, they do not see the captive portal page; instead, they get a 'Connection refused' error. The engineer verifies that the guest portal is enabled on ISE and the WLC is configured to use ISE for RADIUS. What is the most likely cause?

A
The ISE guest portal service is not running
Why wrong: The engineer says portal is enabled, so service is likely running.
B
The guest user's device does not have a valid DNS server
Why wrong: If DNS is missing, the portal redirection may fail, but the typical redirection is IP-based and should work without DNS.
C
The WLC is not configured with the ISE portal IP address for redirection
The WLC needs to know where to redirect HTTP traffic; without that, the captive portal cannot appear.
D
The guest WLAN does not have a pre-authentication ACL
Why wrong: Pre-auth ACL is needed to allow DNS/DHCP before auth, but not the portal page.

Full breakdown with real-world context →

Question 7hardmultiple choice

Open the full VLAN trunking answer →

A hospital is deploying Cisco ISE for network access control. They have a mix of employee laptops, medical devices (e.g., infusion pumps), and guest smartphones. The network uses Cisco Catalyst 9300 switches and Aironet 3700 series access points. For medical devices, the policy must use Machine Authentication (MAB) since they are 802.1X incapable. The ISE policy authenticates via MAB and then assigns the device to a specific VLAN for medical devices. During a pilot, the network team notices that some infusion pumps (MAC: 00:1A:2B:3C:4D:5E) are failing MAB authentication. The switch logs show 'Authentication failed for MAC 001a.2b3c.4d5e on interface GigabitEthernet1/0/10'. ISE logs show 'Authentication failed - RADIUS server rejected - Reason: Invalid Endpoint ID'. The engineer has verified the MAC address is in the ISE endpoint repository with correct identity group. What should the engineer check next to resolve this issue?

A
Verify that the switch port is configured with 'authentication port-control auto'
Why wrong: That is needed but the logs show authentication attempt, so the port is configured.
B
Check the MAC address format in the ISE endpoint identity store (such as using lowercase with a hyphen separator)
The switch sends MAC in form '001a.2b3c.4d5e' (no delimiter) or '00-1a-2b-3c-4d-5e'? ISE expects a specific format; mismatch causes 'Invalid Endpoint ID'.
C
Confirm that the ISE policy for MAB allows the device to authenticate
Why wrong: If the endpoint ID is invalid, the policy is never evaluated.
D
Ensure the RADIUS shared secret is correct on the switch and ISE
Why wrong: If shared secret was wrong, the authentication would not reach ISE or would be rejected with a different error.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full wireless explanation →

A network administrator wants to centrally manage and enforce access policies for wired and wireless users. Which Cisco product provides this functionality?

A
Cisco Identity Services Engine (ISE)
Central policy engine for network access.
B
Cisco Prime Infrastructure
Why wrong: Network management tool, not policy enforcement.
C
Cisco Adaptive Security Appliance (ASA)
Why wrong: Primarily a firewall.
D
Cisco Wireless LAN Controller (WLC)
Why wrong: Manages wireless only.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full wireless explanation →

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

A
Profiling policy
Why wrong: Profiling policy is used to identify device attributes, not to grant access.
B
Authentication policy
Why wrong: Authentication policy only determines how users are authenticated, not the resulting access.
C
Authorization policy
Authorization policy defines what access is granted after authentication.
D
Policy set
Why wrong: Policy set is a container that groups authentication and authorization policies; it does not directly enforce access.

Full breakdown with real-world context →

These 350-701 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-701 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Wireless LAN and WLC Scenarios

How to approach wireless lan and wlc scenarios

Quick answer

Related 350-701 topic practice pages

Security Concepts practice questions

Network Security practice questions

Cloud Security practice questions

Content Security practice questions

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

350-701 fundamentals practice questions

350-701 scenario practice questions

350-701 troubleshooting practice questions

Practice scenarios

An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?

A network engineer is configuring Cisco ISE for wireless 802.1X authentication. The company wants to use certificate-based authentication for all corporate devices. Which EAP method should be configured?

An organization wants to provide guest wireless access with a captive portal. Which Cisco ISE portal type should be used?

A network administrator wants to centrally manage and enforce access policies for wired and wireless users. Which Cisco product provides this functionality?

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?