350-401 Infrastructure Practice Question
A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to authenticate corporate users using 802.1X with a RADIUS server. The requirement is to ensure that only users with valid credentials can access the wireless network, and that the RADIUS server is reachable. Which WLC configuration step is required to enable 802.1X authentication?
⚠ Common exam trap
Candidates often confuse WPA2 Personal (PSK) with WPA2 Enterprise (802.1X); only Enterprise mode uses a RADIUS server for per-user authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the WLAN with WPA2 Enterprise security and specify the RADIUS server IP address and shared secret.
802.1X authentication on a Cisco WLC requires the WLAN to be configured with WPA2 Enterprise security. This setting enables the use of EAP, which relays authentication to a RADIUS server. The RADIUS server IP address and shared secret must be configured so the WLC can communicate with the server. This ensures that only users with valid credentials, as verified by the RADIUS server, can access the wireless network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable MAC filtering on the WLC and add the MAC addresses of authorized users.
Why it's wrong here
MAC filtering is a form of access control based on device MAC addresses, not user credentials. It does not provide 802.1X authentication and does not involve a RADIUS server for credential validation. MAC addresses can be spoofed, and it does not scale well. This option does not satisfy the requirement for user authentication with a RADIUS server.
- ✓
Configure the WLAN with WPA2 Enterprise security and specify the RADIUS server IP address and shared secret.
Why this is correct
To enable 802.1X authentication on a WLC, the WLAN must be configured with WPA2 Enterprise security, which uses 802.1X/EAP. The RADIUS server details, including IP address and shared secret, must be specified so the WLC can communicate with the authentication server. This configuration ensures that clients authenticate via the RADIUS server before gaining network access.
- ✗
Configure the WLAN with WPA2 Personal security and specify a pre-shared key.
Why it's wrong here
WPA2 Personal uses a pre-shared key (PSK) for authentication, not 802.1X. It does not involve a RADIUS server. While it provides encryption, it does not meet the requirement for individual user authentication via RADIUS. This option would allow anyone with the PSK to access the network, which is not the desired outcome.
- ✗
Configure the WLAN with Open security and enable web authentication using the RADIUS server.
Why it's wrong here
Open security with web authentication is a captive portal method where users enter credentials in a web page. While it can use a RADIUS server, it is not 802.1X. It does not provide the same level of security as 802.1X/EAP, and it is typically used for guest access. This option does not meet the requirement for 802.1X authentication.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Wireless Fundamentals and 802.11 Standards
Key term
802.1X Authentication
802.1X is a network access control protocol that prevents unauthorized devices from connecting to a wired or wireless network by requiring them to authenticate before gaining access.
Key term
Cisco ISE
Cisco Identity Services Engine is a security policy management platform that controls who can access a network and what they can do once connected.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.