350-401 Architecture Practice Question
A network administrator is deploying a Cisco Wireless LAN Controller (WLC) and access points in a branch office. The administrator wants to ensure that all management traffic between the WLC and APs is encrypted and that APs can discover the WLC across a Layer 3 network. Which protocol should be used for AP-to-WLC communication?
⚠ Common exam trap
The trap here is selecting LWAPP because it sounds similar, but it is an older protocol that lacks native DTLS encryption and is not used in modern deployments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CAPWAP with DTLS encryption enabled on the management interface.
CAPWAP is the current protocol for AP-to-WLC communication, and it supports DTLS encryption for control and data traffic. It also enables Layer 3 discovery through options like DHCP option 43 or DNS. LWAPP is deprecated, Mobility Express is for controller-less setups, and SNMPv3 is for management polling, not AP tunneling. Therefore, CAPWAP with DTLS is the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SNMPv3 with AES encryption for AP management and discovery.
Why it's wrong here
SNMPv3 is used for network management polling and traps, not for AP-to-WLC control and data tunneling. It cannot provide the CAPWAP tunnel needed for AP registration and configuration. While SNMPv3 offers encryption for management data, it does not handle AP discovery or the CAPWAP state machine, so it cannot satisfy the requirement for encrypted AP-to-WLC communication.
- ✗
LWAPP with IPsec encryption between AP and WLC.
Why it's wrong here
LWAPP (Lightweight Access Point Protocol) is the older, deprecated predecessor to CAPWAP. It does not natively support DTLS encryption and has been replaced by CAPWAP in modern Cisco WLC deployments. While IPsec could be added, LWAPP is not the current standard and does not meet the requirement for encrypted management traffic with native support. The scenario calls for current protocol, so LWAPP is incorrect.
- ✗
Mobility Express with HTTPS management and no CAPWAP tunnel.
Why it's wrong here
Mobility Express is a WLC function embedded in an AP, used for small deployments without a dedicated WLC appliance. It does not use CAPWAP tunnels for AP-to-WLC communication because the AP itself acts as the controller. The scenario describes a dedicated WLC and APs, so Mobility Express is not applicable. HTTPS management is for administrative access, not for AP-to-WLC protocol encryption.
- ✓
CAPWAP with DTLS encryption enabled on the management interface.
Why this is correct
CAPWAP (Control and Provisioning of Wireless Access Points) is the standard protocol for AP-to-WLC communication. It uses DTLS to encrypt control and data traffic, and it supports Layer 3 discovery via broadcast, DHCP option 43, or DNS. Enabling DTLS ensures management traffic is encrypted, and CAPWAP operates across Layer 3 networks, satisfying both requirements.
Visual reference
Go deeper
Related to this question
Learn chapter
QoS and Network Performance Management
Key term
Cisco AP Modes
Cisco AP Modes are different operational states a wireless access point can use, determining how it handles traffic, management, and security in a network.
Key term
SNMPv3
SNMPv3 is a network management protocol with strong security features like encryption and authentication, used to monitor and configure devices such as routers and switches.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.