How many Wireless LAN and WLC Scenarios questions are on this page?

This page has 7 Wireless LAN and WLC Scenarios scenario questions for the SISE exam, each with detailed explanations and wrong-answer analysis.

How should I approach SISE scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) questions

Scenario-based practice

Wireless LAN and WLC Scenarios

Practise Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SISE

exam code

Cisco

vendor

Scenario guide

How to approach wireless lan and wlc scenarios

Wireless questions on the CCNA cover 802.11 standards (ax/ac/n), WPA3, SSID/BSSID concepts, WLC architecture (FlexConnect, local switching), and client connectivity troubleshooting. These are mostly MCQ and multi-select.

Quick answer

Wireless security questions usually test authentication protocols (WPA2/WPA3), encryption modes, 802.11 standards and troubleshooting clients that cannot connect or associate.

WPA2 vs WPA3 authentication and encryption standards.

802.11 wireless standards, frequency bands and channel behaviour.

WLAN client troubleshooting — association, authentication and DHCP.

How SSID, authentication method and pre-shared key affect wireless access.

Practice scenarios

Question 1mediummultiple choice

Read the full wireless explanation →

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

A
NetworkDevice:Name
NetworkDevice:Name allows matching based on the device defined in the ISE Network Devices list.
B
Radius:NAS-IP-Address
Why wrong: While functional, NetworkDevice:Name is the preferred object-based approach in policy sets.
C
Radius:Called-Station-ID
Why wrong: This identifies the AP or SSID, not the WLC itself.
D
Device:Model
Why wrong: This is a hardware attribute, not a policy set filter condition.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full wireless explanation →

You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?

A
Radius:Service-Type equals Framed
Why wrong: This is a generic RADIUS attribute for network access.
B
Session:AuthenticationStatus equals Guest
This condition verifies the session authentication status matches the guest state.
C
Device:DeviceType equals Wireless
Why wrong: This verifies the device type, not the authentication outcome.
D
Radius:Called-Station-ID
Why wrong: This identifies the AP, not the user's authentication method.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full wireless explanation →

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

A
Framed-IP-Address
Why wrong: This is the client IP, unrelated to the connection medium.
B
NAS-Port-Type
NAS-Port-Type indicates if the request is wired or wireless.
C
Calling-Station-ID
Why wrong: This is the MAC address, not the medium type.
D
Device-Name
Why wrong: Device name depends on manual configuration, not the actual medium.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full wireless explanation →

You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?

A
In the Authorization Policy rule conditions
The authorization policy rule conditions allow you to match the request against the Internal Endpoint Group attribute.
B
In the Results section of the Authentication Policy
Why wrong: Results in the authentication policy relate to identity stores, not endpoint groups.
C
In the RADIUS dictionary under Policy Elements
Why wrong: Dictionaries define attributes but do not enforce policy logic.
D
In the Policy Set general authentication settings
Why wrong: Authentication settings verify identity, not group-based authorization.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A user reports that a device was incorrectly identified as a 'Cisco IP Phone' when it is actually a 'Cisco Access Point'. Which troubleshooting step should you take first?

A
Check the endpoint attributes in Context Visibility to see why it matched that policy.
Identifying the source of the incorrect attribute match is the first step.
B
Re-register the device.
Why wrong: Re-registering does not fix the logic error.
C
Delete all profiling policies.
Why wrong: This is too drastic.
D
Restart the ISE node.
Why wrong: A restart is unlikely to fix a policy logic error.

Full breakdown with real-world context →

Question 6easymultiple choice

Open the full VLAN trunking answer →

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

A
Policy Set Condition
Why wrong: Conditions determine if a rule is hit, not the result assigned.
B
Authorization Profile
VLAN tagging is a standard attribute provided by the Authorization Profile.
C
Identity Source Sequence
Why wrong: This handles user lookups only.
D
Authentication Policy
Why wrong: Authentication only verifies user credentials.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

You are troubleshooting a scenario where guest users are not being redirected when connecting to an open SSID. The WLC reports that the client is stuck in the 'Webauth' state but the portal never loads. Which component should you verify first?

A
Increase the idle timeout on the WLC's WLAN configuration.
Why wrong: Idle timeout settings affect session termination, not the initial portal redirection process.
B
Verify the WLC's 'Web Auth Redirect' configuration and ensure the 'Virtual Gateway' address is reachable.
Why wrong: While important, the most frequent point of failure in CWA redirection is the client's inability to resolve the ISE FQDN.
C
Re-import the Guest Portal certificate on the WLC.
Why wrong: The WLC does not require the ISE portal certificate for the initial redirect handshake.
D
Check if the client can resolve the ISE FQDN via DNS.
For the redirect to occur, the client must be able to resolve the ISE FQDN to an IP address; otherwise, the browser will timeout.

Full breakdown with real-world context →

These SISE practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style SISE questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Wireless LAN and WLC Scenarios

How to approach wireless lan and wlc scenarios

Quick answer

Related SISE topic practice pages

Network Access Device Administration practice questions

BYOD practice questions

Endpoint Compliance practice questions

Web Auth And Guest Services practice questions

Profiler practice questions

Policy Enforcement practice questions

Architecture And Deployment practice questions

SISE fundamentals practice questions

SISE scenario practice questions

SISE troubleshooting practice questions

Practice scenarios

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?

A user reports that a device was incorrectly identified as a 'Cisco IP Phone' when it is actually a 'Cisco Access Point'. Which troubleshooting step should you take first?

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

You are troubleshooting a scenario where guest users are not being redirected when connecting to an open SSID. The WLC reports that the client is stuck in the 'Webauth' state but the portal never loads. Which component should you verify first?