Wireless LAN and WLC Scenarios

The use of Category 6a cabling for the backhaul

Why it fails: Category 6a cabling provides the data and power path to the access point but does not affect the wireless signal propagation itself. As long as the cable is within the 100-meter limit, it will provide a high-speed, stable connection that supports the maximum throughput of the wireless endpoint.

Configuring the access point for PoE+ (802.3at)

Why it fails: Power over Ethernet Plus is a standard for delivering electrical power over the data cable and does not interfere with the radio frequencies used for wireless communication. In fact, PoE+ is necessary for modern high-performance access points to ensure they have enough power to operate all their internal radios.

Using an LC-to-LC fiber patch cord

Why it fails: Fiber optic patch cords are used for high-speed data transmission and are completely immune to radio frequency interference. While they might be used to connect a switch to a media converter near an access point, they have no impact on the wireless signal's ability to reach mobile endpoints.

Support for WEP backward compatibility

Why it fails: WEP is a legacy encryption standard that is highly insecure and has been deprecated for many years. WPA3 does not include support for WEP as it aims to improve security by removing older, vulnerable protocols. Including WEP would introduce significant vulnerabilities that WPA3 was specifically designed to eliminate.

TKIP encryption by default

Why it fails: TKIP was introduced as a temporary fix for WEP vulnerabilities and was used in the original WPA standard. It is now considered insecure and is not used in WPA3. Modern wireless security relies on more robust encryption methods like AES-CCMP or GCMP-256 to ensure the integrity and confidentiality of data.

MAC address filtering

Why it fails: MAC address filtering permits or denies devices based on their hardware addresses. It can restrict access but does not create separate logical networks or isolate guest traffic from internal resources. It also requires maintaining lists and can be bypassed by spoofing, so it does not meet the separation requirement.

WPA2-Personal with a shared passphrase

Why it fails: WPA2-Personal encrypts wireless traffic using a pre-shared key, but all users of that SSID share the same key and the same logical network. It does not separate guests from employees or prevent guest devices from reaching internal hosts. Encryption alone is not segmentation.

SSID broadcast suppression

Why it fails: Hiding the SSID stops the network name from appearing in scan results, but it does not separate guest traffic from employee traffic. Clients that know the SSID can still associate, and the hidden network remains on the same Layer 2 domain. This is a weak security measure, not a segmentation feature.

Attenuation

Why it fails: Attenuation is the weakening of a signal as it travels through space or obstacles. While metal shelving can absorb some signal, the intermittent nature and presence of moving forklifts point more to reflection and multipath. Attenuation would cause a gradual decrease in signal strength, not the fluctuating connectivity typical of multipath interference.

Electromagnetic interference

Why it fails: Electromagnetic interference (EMI) from motors or other electrical equipment can disrupt wireless signals, but forklifts are typically battery-powered and do not emit strong EMI. The metal shelving and forklifts are more likely to cause reflections. EMI would affect all devices consistently, whereas the reported intermittent issues align better with multipath.

Channel overlap

Why it fails: Channel overlap happens when adjacent wireless access points use overlapping frequency channels, causing interference. While this can degrade performance, the scenario specifically mentions metal shelving and forklifts, which are physical reflectors. Channel overlap is a configuration issue, not directly caused by the environment's metal structures. Thus, it is less likely the primary cause here.

WPA2-Personal with a strong pre-shared key on the guest network

Why it fails: WPA2-Personal encrypts the wireless link and authenticates users who know the pre-shared key, but every guest who has the key joins the same logical network as other users. It provides no separation from internal resources, so an authenticated guest can still reach the file server. Encryption alone does not satisfy the isolation requirement.

Disabling SSID broadcast on the guest wireless network

Why it fails: Hiding the SSID is a weak obscurity measure that does not block any traffic. Guests who know the network name can still connect and, once associated, reach internal hosts just as before. It also complicates legitimate guest onboarding and offers no real access control, so it does not meet the manager's requirement.

MAC address filtering with a list of approved guest devices

Why it fails: MAC filtering only decides which client devices may associate with the wireless network; it does not restrict what an allowed guest can reach once connected. A guest whose MAC is approved could still browse the internal file server and printer. It also scales poorly and is trivially bypassed by spoofing, so it fails the stated goal.

The access point's radio is operating on a channel with high interference from neighboring APs.

Why it fails: Interference degrades throughput and can cause disconnects or retries, but the client has already associated successfully. Association proves the radio link is functional enough to exchange management frames. Interference would more likely cause slow speeds or dropped sessions, not a clean association followed by total DHCP failure while wired clients work fine.

The DHCP server's scope for the wired VLAN has run out of available leases.

Why it fails: If the DHCP scope were exhausted, wired clients on the same VLAN would also fail to obtain addresses. The scenario states that wired clients on that VLAN obtain leases normally, so scope exhaustion is ruled out. The problem is specific to the wireless path, pointing to a VLAN or trunking issue rather than a server-side address shortage.

The wireless client has an incorrect DNS server address configured manually.

Why it fails: A wrong DNS server would cause name resolution failures but would not prevent the client from obtaining an IP address via DHCP. DNS settings are typically delivered by DHCP itself, so a manual misconfiguration would only matter after a lease is obtained. This symptom occurs before any DNS interaction, so DNS settings are not the cause.

The Access Point is experiencing a DHCP exhaustion attack.

Why it fails: DHCP exhaustion would prevent new users from joining the network but would not typically cause slow speeds for users who are already connected and have valid IP addresses. The presence of physical appliances like microwaves strongly suggests a physical layer interference problem rather than a logical security-based network attack.

The Access Point is configured with the wrong SSID.

Why it fails: An incorrect SSID configuration would prevent users from connecting to the network entirely. It would not manifest as slow performance for users who are already successfully associated with the Access Point. SSID issues are typically 'all or nothing' connectivity problems rather than intermittent performance degradation during specific times of day.

The switch port connecting the Access Point is in half-duplex mode.

Why it fails: While a half-duplex mismatch on the backhaul link could cause slowness, it would likely be constant regardless of the time of day. The specific mention of microwaves and cordless phones—which are well-known sources of 2.4GHz interference—points directly to wireless signal degradation as the primary root cause.

Enable BPDU Guard across all access switch ports connected to powered VoIP telephone hardware.

Why it fails: BPDU Guard err-disables ports receiving spanning-tree BPDUs; it neither measures nor limits PoE wattage, so PSU overload persists. It is tempting because it hardens access ports against rogue switches, which is its real role — unrelated to power budgeting.

Activate Storm Control with strict multicast drop thresholds to reduce switch power draw.

Why it fails: Storm Control drops flooded multicast frames; it does not reduce the power drawn by powered devices, so the PSU stays near maximum. It is tempting because it protects switch CPU and bandwidth during broadcast storms, which is its actual purpose — not PoE budget management.

Implement Port Security with maximum static MAC address bindings to restrict power usage.

Why it fails: Port Security restricts MAC addresses, not electrical power draw, so it cannot prevent PSU overload. It is tempting because it limits connected devices, but PoE power budgeting requires configuring per-port power allocation or priority, not MAC binding limits.

900 MHz

Why it fails: While 900 MHz is used for some long-range proprietary wireless systems and older cordless phones, it is not a standard frequency for common Wi-Fi endpoints like laptops and smartphones. It lacks the bandwidth required for modern high-speed data transmission and is not part of the 802.11 standards.

60 GHz

Why it fails: The 60 GHz band is used by the 802.11ad standard for extremely high-speed, very short-range communication, but it is not commonly supported by standard office endpoints. Its inability to penetrate walls makes it unsuitable for general-purpose office Wi-Fi, where mobility and coverage are essential requirements.

10 GHz

Why it fails: The 10 GHz range is generally reserved for specialized radar or satellite communications and is not used by consumer or enterprise Wi-Fi endpoints. Using this frequency for standard networking would require specialized hardware and licenses, as it falls outside the unlicensed ISM bands used by 802.11 devices.

The access point is experiencing high interference.

Why it fails: High interference on the access point would affect all devices in the area, not just the laptop. Since other devices connect fine, interference is unlikely to be the sole cause. Interference might cause slow speeds or intermittent connectivity, but not a complete failure to connect for a single device while others work. Therefore, this is not the most likely cause.

The laptop's wireless adapter driver is outdated.

Why it fails: An outdated wireless adapter driver could cause connectivity issues, but it would typically affect all networks, not just the corporate Wi-Fi. Since other devices connect and the laptop sees available networks, the driver is likely functioning enough to scan. However, it is a possible cause, but less likely than a wrong SSID configuration. The most direct and common cause is incorrect SSID.

The laptop has an incorrect IP address configuration.

Why it fails: An incorrect IP address configuration would prevent communication after association, but the laptop cannot connect to the Wi-Fi network at all. If the IP configuration were the issue, the laptop would still associate with the SSID but fail to obtain an IP or communicate. Since the laptop cannot connect, the problem is more likely at the wireless association level, not IP.

WEP with a 128-bit shared key

Why it fails: WEP is deprecated and trivially broken because its initialization vectors repeat and can be harvested to recover the key within minutes. Even setting aside its weakness, WEP authenticates the device to the network but never proves the network's identity to the device, so it fails the rogue access point requirement outright.

Open authentication with a captive portal

Why it fails: Open authentication performs no cryptographic verification of the access point or client, so any rogue device can impersonate the network and capture the portal session. A captive portal only gates access until a form is submitted and does not provide the mutual authentication or encryption of credentials that the scenario demands.

WPA2-Personal with a pre-shared key

Why it fails: With a pre-shared key, every client uses the same secret and the access point is not authenticated to the client, so a rogue access point configured with the same SSID and password can still lure clients. The shared secret also means one leaked key compromises every device on the network, violating the requirement for per-user credential protection.

Wi-Fi (802.11ax)

Why it fails: While 802.11ax (Wi-Fi 6) is highly efficient, it still has a relatively short range, typically less than 100 meters indoors. It is not suitable for a large agriculture field covering several kilometers, and the power requirements are too high for a small sensor to last years on a single battery.

Bluetooth Low Energy (BLE)

Why it fails: Bluetooth Low Energy is excellent for saving battery life, but its effective range is limited to about 10 to 100 meters. It is designed for personal area networks, such as connecting a smartwatch to a phone, and cannot provide the multi-kilometer coverage needed for wide-area agricultural monitoring.

Gigabit Ethernet

Why it fails: Gigabit Ethernet is a wired technology that requires physical copper or fiber connections to every sensor. It is completely impractical for a large-scale agricultural field due to the massive cost of cabling and the fact that wired connections do not support the mobility or battery-operated nature of these sensors.

DHCP snooping

Why it fails: DHCP snooping filters DHCP messages on untrusted ports to prevent rogue DHCP servers, but it does not restrict which MAC addresses may use a port. An unauthorized switch or access point with a static IP configuration would not be blocked by DHCP snooping, so it fails to meet the device restriction goal.

Private VLAN edge

Why it fails: Private VLAN edge, also called protected port, prevents hosts on the same switch from communicating with each other at Layer 2, which is useful for guest isolation. It does not control which MAC addresses are permitted on a port, so an unauthorized access point could still connect and reach upstream resources.

Dynamic ARP Inspection

Why it fails: Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table to block ARP spoofing, but it does not limit which physical devices can connect to a port. A rogue access point could still link up and pass non-ARP traffic, so DAI does not address the requirement of restricting unauthorized devices on wall jacks.

DHCP snooping

Why it fails: DHCP snooping is a switch feature that filters DHCP messages to prevent rogue DHCP servers and starvation attacks. It operates on wired switch ports and has no role in encrypting wireless traffic. Enabling it does nothing to keep neighbors from reading Wi-Fi data.

MAC address filtering

Why it fails: MAC address filtering restricts which client hardware addresses may associate with the access point. It does not encrypt frames, and MAC addresses are easily spoofed. A neighbor can still capture and read all wireless traffic, so this does not meet the privacy goal.

SSID broadcast disabled

Why it fails: Disabling SSID broadcast only hides the network name from casual scanning. The radio frames are still transmitted in clear text, so a neighbor with a wireless analyzer can capture and read the traffic. It does not provide encryption and therefore fails the privacy requirement.