How should I use these Wireless Infrastructure practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Wireless Infrastructure questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Wireless Infrastructure domain.

350-401 · topic practice

Wireless Infrastructure practice questions

Practise ENCOR 350-401 Wireless Infrastructure practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Wireless Infrastructure

Practice 10 questions Browse domain →

What the exam tests

What to know about Wireless Infrastructure

Wireless security questions usually test authentication protocols (WPA2/WPA3), encryption modes, 802.11 standards and troubleshooting clients that cannot connect or associate.

WPA2 vs WPA3 authentication and encryption standards.

802.11 wireless standards, frequency bands and channel behaviour.

WLAN client troubleshooting — association, authentication and DHCP.

How SSID, authentication method and pre-shared key affect wireless access.

Watch out for

Common Wireless Infrastructure exam traps

▸WPA2-Enterprise uses 802.1X and a RADIUS server, not a pre-shared key.
▸WPA3 provides stronger encryption but backwards compatibility is not guaranteed.
▸A client can associate to an AP and still fail to reach the network.
▸5 GHz gives higher throughput but shorter range than 2.4 GHz.

Practice set

Wireless Infrastructure questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is deploying a new wireless LAN controller (WLC) in a campus network. The WLC must manage 200 access points across three buildings. The engineer configures the WLC with a management IP address and enables CAPWAP. However, the access points fail to join the WLC. The APs are in the same VLAN as the WLC and can ping the WLC's management IP. What is the most likely cause of the APs not joining?

Trap 1: The APs are not configured with DHCP option 43 to point to the WLC.

Incorrect because DHCP option 43 is used for APs in different subnets; since APs are in the same VLAN, they can use Layer 2 CAPWAP discovery and do not need option 43.

Trap 2: The APs are running an incompatible IOS version that does not…

Incorrect because CAPWAP is supported on most modern APs; version incompatibility would typically cause a different error, not a failure to join.

Trap 3: The APs must be assigned a static IP address to join the WLC.

Incorrect because APs can use DHCP to obtain an IP address; static IP is not a requirement for CAPWAP discovery.

Study all Wireless Infrastructure common traps →

A
The WLC does not have a CAPWAP source interface configured.
Correct because the CAPWAP source interface must be configured on the WLC so that APs can discover and communicate with it. Without it, the WLC may not respond to CAPWAP discovery requests.
B
The APs are not configured with DHCP option 43 to point to the WLC.
Why wrong: Incorrect because DHCP option 43 is used for APs in different subnets; since APs are in the same VLAN, they can use Layer 2 CAPWAP discovery and do not need option 43.
C
The APs are running an incompatible IOS version that does not support CAPWAP.
Why wrong: Incorrect because CAPWAP is supported on most modern APs; version incompatibility would typically cause a different error, not a failure to join.
D
The APs must be assigned a static IP address to join the WLC.
Why wrong: Incorrect because APs can use DHCP to obtain an IP address; static IP is not a requirement for CAPWAP discovery.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full wireless explanation →

A company is deploying a new wireless network in a large warehouse. The network engineer must choose between using a centralized WLC architecture (with CAPWAP tunnels) or a converged access (SD-Access) wireless architecture. The warehouse has high-density client areas and requires low latency for real-time applications like voice and video. Which architecture should the engineer choose and why?

Trap 1: Centralized WLC architecture, because it provides better RF…

Incorrect because centralized architecture adds latency due to CAPWAP tunneling, which is detrimental to real-time applications.

Trap 2: Centralized WLC architecture, because it requires fewer access…

Incorrect because the number of APs depends on coverage requirements, not the architecture type.

Trap 3: Converged access (SD-Access) wireless, because it requires fewer…

Incorrect because SD-Access may still require multiple WLCs for redundancy and scale; the primary advantage is local switching, not WLC count reduction.

Study all Wireless Infrastructure common traps →

A
Centralized WLC architecture, because it provides better RF management and security.
Why wrong: Incorrect because centralized architecture adds latency due to CAPWAP tunneling, which is detrimental to real-time applications.
B
Converged access (SD-Access) wireless, because it allows local switching of traffic at the access layer, reducing latency.
Correct because SD-Access wireless enables local switching, which minimizes latency for real-time traffic by avoiding backhaul to a central WLC.
C
Centralized WLC architecture, because it requires fewer access points to cover the warehouse.
Why wrong: Incorrect because the number of APs depends on coverage requirements, not the architecture type.
D
Converged access (SD-Access) wireless, because it requires fewer WLCs to manage the network.
Why wrong: Incorrect because SD-Access may still require multiple WLCs for redundancy and scale; the primary advantage is local switching, not WLC count reduction.

Full breakdown with real-world context →

Question 3mediummultiple choice

Study the full ACL explanation →

A network engineer is troubleshooting a wireless network where clients in a conference room experience intermittent connectivity. The engineer notices that the access point in that room is showing a high number of CRC errors on its uplink interface. The AP is connected to a Cisco 9300 switch via a copper cable. What is the most likely cause of the CRC errors?

Trap 1: The AP is overloaded with too many clients.

Incorrect because client overload would affect wireless performance, not cause CRC errors on the wired uplink.

Trap 2: The switch port is configured with a duplex mismatch.

Incorrect because duplex mismatch typically causes runts, giants, and alignment errors, not just CRC errors.

Trap 3: The AP is not receiving enough power from Power over Ethernet (PoE).

Incorrect because insufficient PoE would cause the AP to reboot or not power on, not generate CRC errors.

Study all Wireless Infrastructure common traps →

A
The AP is overloaded with too many clients.
Why wrong: Incorrect because client overload would affect wireless performance, not cause CRC errors on the wired uplink.
B
The Ethernet cable is faulty or of poor quality.
Correct because CRC errors on a copper link are usually due to physical layer problems like faulty cables, bad connectors, or interference.
C
The switch port is configured with a duplex mismatch.
Why wrong: Incorrect because duplex mismatch typically causes runts, giants, and alignment errors, not just CRC errors.
D
The AP is not receiving enough power from Power over Ethernet (PoE).
Why wrong: Incorrect because insufficient PoE would cause the AP to reboot or not power on, not generate CRC errors.

Full breakdown with real-world context →

Question 4hardmultiple choice

Study the full ACL explanation →

An engineer is configuring a new Cisco 9800 WLC in a branch office. The WLC will manage 50 APs and must provide guest access with a captive portal. The engineer configures a guest SSID with open authentication and a redirect ACL for the captive portal. However, after the configuration, clients can associate to the guest SSID but cannot reach the captive portal page. What is the most likely cause?

Trap 1: The guest SSID is configured with open authentication, which does…

Incorrect because open authentication is commonly used with captive portals; the portal handles authentication after association.

Trap 2: The WLC does not have a dedicated guest interface configured.

Incorrect because a dedicated guest interface is not mandatory; the WLC can use a VLAN interface for guest traffic.

Trap 3: The captive portal requires a RADIUS server to be configured on the…

Incorrect because captive portal can use local authentication or an external web server; RADIUS is optional.

Study all Wireless Infrastructure common traps →

A
The guest SSID is configured with open authentication, which does not support captive portal.
Why wrong: Incorrect because open authentication is commonly used with captive portals; the portal handles authentication after association.
B
The redirect ACL is missing entries for DNS and HTTP traffic to the captive portal server.
Correct because the redirect ACL must permit DNS and HTTP traffic to the portal server so that the client's initial HTTP request is redirected to the captive portal.
C
The WLC does not have a dedicated guest interface configured.
Why wrong: Incorrect because a dedicated guest interface is not mandatory; the WLC can use a VLAN interface for guest traffic.
D
The captive portal requires a RADIUS server to be configured on the WLC.
Why wrong: Incorrect because captive portal can use local authentication or an external web server; RADIUS is optional.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full wireless explanation →

A network engineer is deploying a wireless mesh network using outdoor access points. The mesh APs are configured to use 802.11a/n on the 5 GHz band for backhaul and 802.11b/g/n on the 2.4 GHz band for client access. The engineer notices that the mesh backhaul links are unstable and have high packet loss. What is the most likely cause of the instability?

Trap 1: The 802.11a/n standard is obsolete and does not support mesh…

Incorrect because 802.11a/n is widely used for mesh backhaul and is not obsolete.

Trap 2: The mesh APs require a wired Ethernet connection to the root AP.

Incorrect because mesh APs communicate wirelessly; only the root AP needs a wired connection.

Trap 3: The 2.4 GHz band provides better range for backhaul than the 5 GHz…

Incorrect because 5 GHz typically offers higher throughput and is preferred for backhaul, though range is shorter; the issue is interference, not range.

Study all Wireless Infrastructure common traps →

A
The 5 GHz band is being used for both backhaul and client access, causing co-channel interference.
Correct because using the same band for backhaul and client access can cause interference if channels overlap; dedicated backhaul channels should be used.
B
The 802.11a/n standard is obsolete and does not support mesh networking.
Why wrong: Incorrect because 802.11a/n is widely used for mesh backhaul and is not obsolete.
C
The mesh APs require a wired Ethernet connection to the root AP.
Why wrong: Incorrect because mesh APs communicate wirelessly; only the root AP needs a wired connection.
D
The 2.4 GHz band provides better range for backhaul than the 5 GHz band.
Why wrong: Incorrect because 5 GHz typically offers higher throughput and is preferred for backhaul, though range is shorter; the issue is interference, not range.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full wireless explanation →

An engineer is configuring a Cisco 9800 WLC for high availability using a pair of WLCs in an active/standby configuration. The engineer configures the same SSID and security settings on both WLCs. However, when the active WLC fails, clients that were connected to the active WLC do not automatically reconnect to the standby WLC. What is the most likely cause?

Trap 1: Clients must be configured to roam between WLCs, which is not…

Incorrect because clients do not need to roam; APs handle the failover by rejoining the standby WLC.

Trap 2: The SSID name must be different on the standby WLC to avoid…

Incorrect because the SSID should be the same to provide seamless service after failover.

Trap 3: The APs must be rebooted after the active WLC fails to recognize…

Incorrect because APs automatically detect the failure and attempt to join the standby WLC if configured.

Study all Wireless Infrastructure common traps →

A
The APs are not configured with the standby WLC's IP address as a backup controller.
Correct because APs must have the secondary WLC IP configured so they can fail over to it when the primary is unavailable.
B
Clients must be configured to roam between WLCs, which is not supported in active/standby mode.
Why wrong: Incorrect because clients do not need to roam; APs handle the failover by rejoining the standby WLC.
C
The SSID name must be different on the standby WLC to avoid conflicts.
Why wrong: Incorrect because the SSID should be the same to provide seamless service after failover.
D
The APs must be rebooted after the active WLC fails to recognize the standby WLC.
Why wrong: Incorrect because APs automatically detect the failure and attempt to join the standby WLC if configured.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full wireless explanation →

A network engineer is troubleshooting a wireless network where clients in a specific area report slow speeds and frequent disconnections. The engineer uses a spectrum analyzer and finds high utilization on channel 11 in the 2.4 GHz band. The engineer also notices that several neighboring access points are using channel 11. What is the most likely cause of the issue?

Trap 1: Adjacent channel interference from access points using channels 10…

Incorrect because adjacent channel interference would occur if channels overlapped, but the scenario states other APs are using channel 11, not adjacent channels.

Trap 2: Non-WiFi interference from devices like microwaves or cordless…

Incorrect because the spectrum analyzer showed high utilization on channel 11, but non-WiFi interference would likely affect multiple channels or be intermittent.

Trap 3: The access point is overloaded with too many clients.

Incorrect because client overload would cause high utilization but not necessarily the specific pattern of disconnections; co-channel interference is more likely given neighboring APs.

Study all Wireless Infrastructure common traps →

A
Co-channel interference from neighboring access points using the same channel.
Correct because multiple APs on the same channel cause co-channel interference, leading to collisions and poor performance.
B
Adjacent channel interference from access points using channels 10 and 12.
Why wrong: Incorrect because adjacent channel interference would occur if channels overlapped, but the scenario states other APs are using channel 11, not adjacent channels.
C
Non-WiFi interference from devices like microwaves or cordless phones.
Why wrong: Incorrect because the spectrum analyzer showed high utilization on channel 11, but non-WiFi interference would likely affect multiple channels or be intermittent.
D
The access point is overloaded with too many clients.
Why wrong: Incorrect because client overload would cause high utilization but not necessarily the specific pattern of disconnections; co-channel interference is more likely given neighboring APs.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full wireless explanation →

An engineer is deploying a wireless network in a hospital that requires strict security and client isolation. The network must support 802.1X authentication for employees and a separate guest SSID with a captive portal. The engineer configures the WLC with RADIUS servers for 802.1X and a local web server for the captive portal. However, guest users can access the internal network after authentication. What configuration change is needed?

Trap 1: Configure 802.1X authentication for the guest SSID as well.

Incorrect because guest SSID typically uses open authentication with a captive portal; 802.1X would require credentials and is not suitable for guests.

Trap 2: Apply a VLAN ACL on the guest VLAN to block access to internal…

Incorrect while a VLAN ACL could help, it does not prevent guest-to-guest communication; client isolation is more direct and effective.

Trap 3: Place the guest SSID on the same VLAN as the employee SSID.

Incorrect because placing guest and employee traffic on the same VLAN would defeat security; they should be on separate VLANs.

Study all Wireless Infrastructure common traps →

A
Enable client isolation (peer-to-peer blocking) on the guest SSID.
Correct because client isolation prevents guest clients from communicating with each other and with internal network resources, ensuring security.
B
Configure 802.1X authentication for the guest SSID as well.
Why wrong: Incorrect because guest SSID typically uses open authentication with a captive portal; 802.1X would require credentials and is not suitable for guests.
C
Apply a VLAN ACL on the guest VLAN to block access to internal subnets.
Why wrong: Incorrect while a VLAN ACL could help, it does not prevent guest-to-guest communication; client isolation is more direct and effective.
D
Place the guest SSID on the same VLAN as the employee SSID.
Why wrong: Incorrect because placing guest and employee traffic on the same VLAN would defeat security; they should be on separate VLANs.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full wireless explanation →

A network engineer is upgrading a legacy wireless network that uses autonomous access points to a centralized WLC-based architecture. The engineer has installed a Cisco 9800 WLC and is converting the autonomous APs to lightweight mode. After the conversion, the APs join the WLC, but the engineer notices that the APs are not broadcasting any SSIDs. What is the most likely cause?

Trap 1: The APs require a separate management IP address to broadcast SSIDs.

Incorrect because APs use the IP address assigned by the WLC; they do not need a separate management IP for SSID broadcast.

Trap 2: The WLC is running an IOS version that does not support the AP…

Incorrect because if the APs joined the WLC, the IOS version is compatible; otherwise, they would not join at all.

Trap 3: The APs must be rebooted after joining the WLC to start…

Incorrect because APs do not require a reboot after joining; they begin broadcasting once configured.

Study all Wireless Infrastructure common traps →

A
The APs are in discovery mode and have not yet downloaded their configuration from the WLC.
Correct because lightweight APs initially join the WLC in discovery mode and then download the full configuration, including SSID definitions.
B
The APs require a separate management IP address to broadcast SSIDs.
Why wrong: Incorrect because APs use the IP address assigned by the WLC; they do not need a separate management IP for SSID broadcast.
C
The WLC is running an IOS version that does not support the AP model.
Why wrong: Incorrect because if the APs joined the WLC, the IOS version is compatible; otherwise, they would not join at all.
D
The APs must be rebooted after joining the WLC to start broadcasting SSIDs.
Why wrong: Incorrect because APs do not require a reboot after joining; they begin broadcasting once configured.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full wireless explanation →

A network engineer runs the following command on a Cisco WLC:

WLC# show ap inventory all

AP Inventory Information ----------------------- AP Name: AP-1 Base MAC: aabb.cc00.0100 Model: AIR-CAP3702I-A-K9 Software: 8.5.151.0

AP Name: AP-2 Base MAC: aabb.cc00.0200 Model: AIR-AP2802I-B-K9 Software: 8.5.151.0

AP Name: AP-3 Base MAC: aabb.cc00.0300 Model: AIR-AP3802I-A-K9 Software: 8.5.151.0

Based on this output, what can be concluded?

Trap 1: AP-1 is a lightweight AP and AP-2 and AP-3 are autonomous APs.

All APs are lightweight (CAP and AIR-AP models) and managed by the WLC.

Trap 2: AP-3 has a hardware failure because its model is different.

Different models are normal; no failure is indicated.

Trap 3: The WLC is running a software version that only supports AP-2 and…

All APs are supported as they are all running the same software version.

Study all Wireless Infrastructure common traps →

A
All APs are running the same software version and are compatible with the WLC.
The output shows all APs have the same software version 8.5.151.0, indicating compatibility.
B
AP-1 is a lightweight AP and AP-2 and AP-3 are autonomous APs.
Why wrong: All APs are lightweight (CAP and AIR-AP models) and managed by the WLC.
C
AP-3 has a hardware failure because its model is different.
Why wrong: Different models are normal; no failure is indicated.
D
The WLC is running a software version that only supports AP-2 and AP-3.
Why wrong: All APs are supported as they are all running the same software version.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full wireless explanation →

A network administrator issues the following command on a Cisco WLC:

WLC# show ap config general AP-1

AP Name: AP-1 MAC Address: aabb.cc00.0100 Country Code: US - United States Regulatory Domain: 802.11bg: -A 802.11a: -A AP Submode: Normal AP Mode: Local AP Join Priority: 1 Primary Controller: WLC-1 Secondary Controller: WLC-2 Tertiary Controller: WLC-3

Based on this output, what can be concluded?

Trap 1: The AP is operating in FlexConnect mode.

The output clearly shows AP Submode: Normal and AP Mode: Local, not FlexConnect.

Trap 2: The AP is in Monitor mode and will not serve clients.

The mode is Local, which serves clients.

Trap 3: The AP has a join priority of 1, meaning it is the highest priority.

Join priority is a value used for AP selection, but the output does not indicate it is the highest; typically lower numbers are higher priority, but 1 is indeed high.

Study all Wireless Infrastructure common traps →

A
The AP is operating in FlexConnect mode.
Why wrong: The output clearly shows AP Submode: Normal and AP Mode: Local, not FlexConnect.
B
The AP will attempt to join the primary controller WLC-1 first.
The primary controller is configured as WLC-1, and APs try to join their primary controller first.
C
The AP is in Monitor mode and will not serve clients.
Why wrong: The mode is Local, which serves clients.
D
The AP has a join priority of 1, meaning it is the highest priority.
Why wrong: Join priority is a value used for AP selection, but the output does not indicate it is the highest; typically lower numbers are higher priority, but 1 is indeed high.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full wireless explanation →

A network engineer runs the following command on a Cisco WLC:

WLC# show ap rf-profile summary

RF-Profile Name: default-rf-profile Description: Default RF Profile Band: 5 GHz Channel Width: 20/40/80 MHz Data Rates: 6,9,12,18,24,36,48,54 Mbps Power Level: 1 (max)

RF-Profile Name: high-density Description: High Density RF Profile Band: 5 GHz Channel Width: 20 MHz Data Rates: 12,18,24,36,48,54 Mbps Power Level: 3

Based on this output, what can be concluded?

Trap 1: The default profile uses only 20 MHz channels.

The default profile uses 20/40/80 MHz, meaning it can use up to 80 MHz channels.

Trap 2: The high-density profile disables all data rates below 12 Mbps.

It disables rates 6 and 9 Mbps, but not all below 12; 12 is included.

Trap 3: The default profile is used for 2.4 GHz band.

Both profiles are for 5 GHz band as indicated.

Study all Wireless Infrastructure common traps →

A
The high-density profile is designed to support more clients by using narrower channels and lower power.
Narrower channels (20 MHz) and lower power reduce co-channel interference, which is beneficial in high-density environments.
B
The default profile uses only 20 MHz channels.
Why wrong: The default profile uses 20/40/80 MHz, meaning it can use up to 80 MHz channels.
C
The high-density profile disables all data rates below 12 Mbps.
Why wrong: It disables rates 6 and 9 Mbps, but not all below 12; 12 is included.
D
The default profile is used for 2.4 GHz band.
Why wrong: Both profiles are for 5 GHz band as indicated.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full wireless explanation →

A network engineer runs the following command on a Cisco WLC:

WLC# show client summary

Client MAC Address AP Name WLAN State Protocol RSSI SNR 00:11:22:33:44:55 AP-1 1 Run 802.11ac -65 25 00:11:22:33:44:66 AP-2 2 Run 802.11n -70 20 00:11:22:33:44:77 AP-1 1 Run 802.11ac -60 30 00:11:22:33:44:88 AP-3 3 Probe 802.11ax -75 15

Based on this output, what can be concluded?

Trap 1: All clients are fully associated and passing traffic.

The client with MAC 00:11:22:33:44:88 is in Probe state, not Run.

Trap 2: The client with MAC 00:11:22:33:44:55 has the best signal strength.

The client with MAC 77 has RSSI -60, which is better than -65.

Trap 3: All clients are using 802.11ac or higher.

One client uses 802.11n, which is not ac or higher.

Study all Wireless Infrastructure common traps →

A
All clients are fully associated and passing traffic.
Why wrong: The client with MAC 00:11:22:33:44:88 is in Probe state, not Run.
B
The client with MAC 00:11:22:33:44:88 is attempting to associate but is not yet connected.
Probe state indicates the client is sending probe requests but not yet associated.
C
The client with MAC 00:11:22:33:44:55 has the best signal strength.
Why wrong: The client with MAC 77 has RSSI -60, which is better than -65.
D
All clients are using 802.11ac or higher.
Why wrong: One client uses 802.11n, which is not ac or higher.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full wireless explanation →

A network engineer runs the following command on a Cisco WLC:

WLC# show ap stats ap-name AP-1

AP Statistics for AP-1 ---------------------- Channel Utilization: 45% Interference: 10% Noise Floor: -95 dBm Total Packets Received: 15000 Total Packets Sent: 12000 Total Errors: 200

Based on this output, what can be concluded?

Trap 1: The channel is heavily congested with utilization above 80%.

Utilization is 45%, not above 80%.

Trap 2: The noise floor is high, indicating potential interference.

A noise floor of -95 dBm is actually very good (low noise).

Trap 3: The AP is experiencing a significant number of errors relative to…

200 errors out of 15000 is about 1.3%, which is acceptable.

Study all Wireless Infrastructure common traps →

A
The channel is heavily congested with utilization above 80%.
Why wrong: Utilization is 45%, not above 80%.
B
The noise floor is high, indicating potential interference.
Why wrong: A noise floor of -95 dBm is actually very good (low noise).
C
The AP is experiencing a significant number of errors relative to packets received.
Why wrong: 200 errors out of 15000 is about 1.3%, which is acceptable.
D
The channel utilization is moderate and the noise floor is low.
45% utilization is moderate, and -95 dBm noise floor is low, indicating a relatively clean channel.

Full breakdown with real-world context →

Question 15easymultiple choice

Open the full VLAN trunking answer →

A network engineer runs the following command on a Cisco WLC:

WLC# show wlan summary

WLAN ID SSID Status Security Interface 1 Guest Enabled Open guest-vlan 2 Corporate Enabled WPA2 corp-vlan 3 IoT Disabled WPA2 iot-vlan 4 Management Enabled WPA2 mgmt-vlan

Based on this output, what can be concluded?

Trap 1: All WLANs are currently active and serving clients.

WLAN 3 is disabled.

Trap 2: The Guest WLAN uses WPA2 security.

The Guest WLAN uses Open security.

Trap 3: The Management WLAN is on the guest-vlan interface.

Management WLAN is on mgmt-vlan, not guest-vlan.

Study all Wireless Infrastructure common traps →

A
All WLANs are currently active and serving clients.
Why wrong: WLAN 3 is disabled.
B
WLAN 3 is not operational because it is disabled.
The Status column shows Disabled for WLAN 3.
C
The Guest WLAN uses WPA2 security.
Why wrong: The Guest WLAN uses Open security.
D
The Management WLAN is on the guest-vlan interface.
Why wrong: Management WLAN is on mgmt-vlan, not guest-vlan.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full wireless explanation →

A network engineer runs the following command on a Cisco WLC:

WLC# show ap config general AP-2

AP Name: AP-2 MAC Address: aabb.cc00.0200 Country Code: US - United States Regulatory Domain: 802.11bg: -A 802.11a: -A AP Submode: FlexConnect AP Mode: FlexConnect AP Join Priority: 2 Primary Controller: WLC-1 Secondary Controller: WLC-2 Tertiary Controller: WLC-3

Based on this output, what can be concluded?

Trap 1: The AP is operating in Local mode and will tunnel all traffic to…

The mode is FlexConnect, not Local.

Trap 2: The AP will only work if the WLC is directly connected at Layer 2.

FlexConnect is designed for remote sites over WAN.

Trap 3: The AP is in Monitor mode and will not serve clients.

FlexConnect mode serves clients.

Study all Wireless Infrastructure common traps →

A
The AP is operating in Local mode and will tunnel all traffic to the WLC.
Why wrong: The mode is FlexConnect, not Local.
B
The AP can locally switch client traffic and maintain connectivity even if the WLC is unreachable.
FlexConnect APs can locally switch traffic and operate independently if the WLC is unreachable.
C
The AP will only work if the WLC is directly connected at Layer 2.
Why wrong: FlexConnect is designed for remote sites over WAN.
D
The AP is in Monitor mode and will not serve clients.
Why wrong: FlexConnect mode serves clients.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full wireless explanation →

A network engineer runs the following command on a Cisco WLC:

WLC# show ap rf-profile summary

RF-Profile Name: default-rf-profile Description: Default RF Profile Band: 2.4 GHz Channel Width: 20 MHz Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps Power Level: 1 (max)

RF-Profile Name: low-power Description: Low Power Profile Band: 2.4 GHz Channel Width: 20 MHz Data Rates: 1,2,5.5,11,6,9,12,18,24,36,48,54 Mbps Power Level: 5

Based on this output, what can be concluded?

Trap 1: The default profile uses 40 MHz channels.

Both profiles use 20 MHz channels.

Trap 2: The low-power profile disables all data rates below 12 Mbps.

All data rates are enabled in both profiles.

Trap 3: The low-power profile is for 5 GHz band.

Both are for 2.4 GHz band.

Study all Wireless Infrastructure common traps →

A
The low-power profile reduces the transmit power of the AP.
Power level 5 is lower than level 1, so the AP transmits at lower power.
B
The default profile uses 40 MHz channels.
Why wrong: Both profiles use 20 MHz channels.
C
The low-power profile disables all data rates below 12 Mbps.
Why wrong: All data rates are enabled in both profiles.
D
The low-power profile is for 5 GHz band.
Why wrong: Both are for 2.4 GHz band.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full wireless explanation →

A network engineer runs the following command on a Cisco WLC:

WLC# show ap stats ap-name AP-3

AP Statistics for AP-3 ---------------------- Channel Utilization: 75% Interference: 30% Noise Floor: -80 dBm Total Packets Received: 5000 Total Packets Sent: 4500 Total Errors: 1500

Based on this output, what can be concluded?

Trap 1: The AP is operating in a clean environment with low interference.

Interference is 30% and noise floor is -80 dBm, which is high.

Trap 2: The channel utilization is low, indicating spare capacity.

75% utilization is high.

Trap 3: The noise floor is excellent at -80 dBm.

-80 dBm is considered a high noise floor (poor).

Study all Wireless Infrastructure common traps →

A
The AP is operating in a clean environment with low interference.
Why wrong: Interference is 30% and noise floor is -80 dBm, which is high.
B
The high error rate suggests possible co-channel interference or signal issues.
30% error rate is high and indicates problems, likely from interference or noise.
C
The channel utilization is low, indicating spare capacity.
Why wrong: 75% utilization is high.
D
The noise floor is excellent at -80 dBm.
Why wrong: -80 dBm is considered a high noise floor (poor).

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full wireless explanation →

Given the following configuration snippet on a Cisco 9800 WLC:

wireless profile policy test-policy

no security ft
 aaa-override
 no mac-filtering
 no wlan-switch

central-switching

What is the effect of this configuration?

Trap 1: Client traffic is locally switched at the AP.

The 'central-switching' command enables central switching, not local switching.

Trap 2: Fast roaming (802.11r) is enabled for this policy.

The 'no security ft' command disables 802.11r fast transition.

Trap 3: MAC filtering is enabled for client authentication.

The 'no mac-filtering' command disables MAC filtering.

Study all Wireless Infrastructure common traps →

A
Client traffic is locally switched at the AP.
Why wrong: The 'central-switching' command enables central switching, not local switching.
B
Client traffic is centrally switched through the WLC.
Central switching means all client data is tunneled to the WLC.
C
Fast roaming (802.11r) is enabled for this policy.
Why wrong: The 'no security ft' command disables 802.11r fast transition.
D
MAC filtering is enabled for client authentication.
Why wrong: The 'no mac-filtering' command disables MAC filtering.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full wireless explanation →

Examine the following configuration on a Cisco 9800 WLC:

ap profile default-ap-profile

description "Default AP Profile"

country US management-user admin

Which statement is true about this configuration?

Trap 1: This profile configures the SSID for the AP.

AP profiles do not configure SSIDs; SSIDs are configured in WLAN profiles.

Trap 2: This profile enables 802.11r fast roaming.

Fast roaming is configured in security or policy profiles, not in AP profiles.

Trap 3: The management user 'admin' is used for client authentication.

The management user is for device management, not client authentication.

Study all Wireless Infrastructure common traps →

A
This profile configures the SSID for the AP.
Why wrong: AP profiles do not configure SSIDs; SSIDs are configured in WLAN profiles.
B
The country code is set to the United States, affecting allowed channels and transmit power.
The country code determines regulatory compliance for radio operation.
C
This profile enables 802.11r fast roaming.
Why wrong: Fast roaming is configured in security or policy profiles, not in AP profiles.
D
The management user 'admin' is used for client authentication.
Why wrong: The management user is for device management, not client authentication.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Wireless Infrastructure sessions

Start a Wireless Infrastructure only practice session

Every question in these sessions is drawn from the Wireless Infrastructure domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Wireless Infrastructure questions →Mixed 350-401 session

Frequently asked questions

What does the 350-401 exam test about Wireless Infrastructure?: Wireless security questions usually test authentication protocols (WPA2/WPA3), encryption modes, 802.11 standards and troubleshooting clients that cannot connect or associate.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Wireless Infrastructure questions in a focused session?: Yes — the session launcher on this page draws every question from the Wireless Infrastructure domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-401 topics?: Use the topic links above to move to related areas, or go back to the 350-401 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-401 exam covers. They are not copied from any real exam or dump site.

Wireless Infrastructure only

10 questions 20 questions 30 questions 50 questions

Mixed 350-401 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-401 questions Wireless Infrastructure domain overview 350-401 exam guide

Exam traps to avoid

▸WPA2-Enterprise uses 802.1X and a RADIUS server, not a pre-shared key.
▸WPA3 provides stronger encryption but backwards compatibility is not guaranteed.
▸A client can associate to an AP and still fail to reach the network.
▸5 GHz gives higher throughput but shorter range than 2.4 GHz.

Wireless Infrastructure practice questions

What to know about Wireless Infrastructure

Common Wireless Infrastructure exam traps

Wireless Infrastructure questions

Track your progress over time

Start a Wireless Infrastructure only practice session

Related 350-401 topic practice pages

Architecture practice questions

Enterprise Network Design practice questions

SD-Access Architecture practice questions

SD-WAN Architecture practice questions

QoS Architecture practice questions

Virtualization practice questions

Network Function Virtualization practice questions

Virtual Machines and Hypervisors practice questions

VRF and Path Isolation practice questions

Infrastructure practice questions

OSPF practice questions

BGP practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid