350-401 Infrastructure Practice Question
A network engineer is configuring a Cisco Wireless LAN Controller (WLC) to support a new WLAN that requires 802.1X authentication with EAP-TLS. The engineer must ensure that the WLC forwards authentication requests to an external RADIUS server. Which configuration is required on the WLC?
⚠ Common exam trap
The trap here is assuming the WLC can locally terminate EAP-TLS, when it typically proxies EAP to an external RADIUS server for certificate validation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a RADIUS server on the WLC and set the WLAN security to 802.1X with the RADIUS server selected.
To support 802.1X with EAP-TLS, the WLC must be configured with an external RADIUS server and the WLAN must use 802.1X security referencing that server. The WLC then relays EAP messages between the client and the RADIUS server, which performs certificate-based authentication. This is the standard deployment for enterprise wireless with EAP-TLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable PSK on the WLAN and configure a pre-shared key.
Why it's wrong here
PSK uses a shared secret for authentication and does not involve 802.1X or EAP-TLS. It cannot forward authentication to a RADIUS server and does not provide per-user credentials or certificate-based authentication. This option fails the requirement for EAP-TLS.
- ✓
Define a RADIUS server on the WLC and set the WLAN security to 802.1X with the RADIUS server selected.
Why this is correct
For 802.1X with EAP-TLS, the WLC must act as a RADIUS client and forward EAP messages to an external RADIUS server. Configuring the server on the WLC and selecting it in the WLAN's security settings enables this. The WLC does not terminate EAP-TLS; it passes the authentication to the RADIUS server.
- ✗
Set the WLAN security to 802.1X and enable the local EAP server on the WLC.
Why it's wrong here
The local EAP server on the WLC can terminate EAP, but EAP-TLS requires certificate validation and is typically handled by an external RADIUS server. Enabling local EAP would not forward requests to the external RADIUS server as required. This option misconfigures the authentication path.
- ✗
Configure the WLAN with Web Policy authentication and a local net user.
Why it's wrong here
Web Policy authentication uses a web portal for user login, often with local or external authentication, but it is not 802.1X/EAP-TLS. It does not support certificate-based mutual authentication and does not forward EAP messages to a RADIUS server in the same way. This does not meet the EAP-TLS requirement.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
EIGRP: Basics and Advanced Configuration
Key term
Cisco TrustSec
Cisco TrustSec is a security architecture that uses identity-based access control and encryption to protect network traffic, rather than relying only on IP addresses and VLANs.
Key term
802.1X Authentication
802.1X is a network access control protocol that prevents unauthorized devices from connecting to a wired or wireless network by requiring them to authenticate before gaining access.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.