20 Wireless LANs Practice Questions & Answers

Every Wireless LANs practice question from the Cisco CCNA 200-301 Practice Test, with the correct answer and a short explanation.

Start practice test →

1. A technician mounts three 2.4 GHz access points along one long corridor, and each cell slightly overlaps its neighbors. To minimize interference between them in North America, which channel assignment should the three APs use?
- A.Channels 3, 6 and 9
- B.Channels 1, 6 and 11✓ Answer
- C.Channel 6 on all three
- D.Channels 1, 2 and 3
A 2.4 GHz channel is roughly 20-22 MHz wide, but channel centers are only 5 MHz apart, so only channels 1, 6 and 11 are far enough apart (25 MHz) not to overlap. Adjacent numbers such as 1, 2, 3 or 3, 6, 9 overlap and cause adjacent-channel interference, and putting every AP on channel 6 creates co-channel contention, because all three cells must share the same airtime.
Ref QB-QA3Q2USource: Cisco CCNA 200-301 Exam Topics — 1.11.a Nonoverlapping Wi-Fi channelsReport a problem with this question
2. Users in an office break room report that their 2.4 GHz Wi-Fi slows down badly for a short time around noon every day, while users on the 5 GHz WLAN in the same room are unaffected. A survey finds no other access points nearby. What is the most likely cause?
- A.The DHCP scope running out of free addresses
- B.Reflection of the signal off metal furniture
- C.Absorption of the signal by people's bodies
- D.Microwave ovens emitting energy at 2.4 GHz✓ Answer
Microwave ovens leak energy near 2.45 GHz, a non-802.11 interference source that raises the noise floor only in the 2.4 GHz band and only while they run, which matches a lunchtime pattern that leaves 5 GHz untouched. Body absorption affects 5 GHz at least as much, a DHCP shortage would hit both WLANs, and reflections from fixed furniture would not come and go at a set time.
Ref QB-9TK7TVSource: Cisco CCNA 200-301 Exam Topics — 1.11.c RFReport a problem with this question
3. A manager proposes disabling SSID broadcast on the guest WLAN so that outsiders cannot connect to it. What is the accurate response?
- A.It works: a hidden network encrypts all frames until a client joins
- B.It fails: hiding the SSID also turns off WPA2 encryption
- C.It works: clients must also know the AP's BSSID before they can join
- D.It fails: the name still shows up in probe and association frames✓ Answer
Hiding the SSID only removes the name from beacons; clients that connect still send it in clear text in probe requests and association frames, so any capture tool reveals it within seconds. Real access control comes from authentication and encryption such as WPA2/WPA3 Personal or 802.1X, not from hiding the network name.
Ref QB-RAE28VSource: Cisco CCNA 200-301 Exam Topics — 1.11.b SSIDReport a problem with this question
4. A trainee asks why 802.11 stations use CSMA/CA rather than the CSMA/CD method used on early shared Ethernet. Which explanation is correct?
- A.A radio cannot reliably detect a collision while it transmits✓ Answer
- B.The AP detects collisions and then sends a jam signal to stations
- C.The AP schedules every frame, so stations never contend at all
- D.Wireless links are full duplex, so collisions never really occur
Wi-Fi is a half-duplex shared medium: a station's own transmission drowns out anything it might hear, and hidden stations may be out of its range, so collision detection is not practical. Instead, stations listen first, wait a random backoff, and rely on ACK frames; a missing ACK is treated as a failed delivery and the frame is retransmitted.
Ref QB-ATXHYWSource: IEEE 802.11 — DCF CSMA/CA medium accessReport a problem with this question
5. During a site survey, a laptop reports a received signal of -67 dBm and a noise floor of -92 dBm at one desk. What is the signal-to-noise ratio at that spot?
- A.92 dB
- B.159 dB
- C.25 dB✓ Answer
- D.-25 dB
SNR is the difference between the signal level and the noise floor: -67 dBm minus -92 dBm equals 25 dB. Because both values are absolute levels in dBm, their difference is a relative value in dB, and a higher SNR means the signal stands further above the noise, allowing faster, more reliable data rates.
Ref QB-SASCDWSource: Cisco CCNA 200-301 Exam Topics — 1.11.c RFReport a problem with this question
6. A retail chain's stores reach headquarters over a single WAN link, and the WLAN controller is at headquarters. If that link fails, each store's lightweight APs must keep serving the point-of-sale WLAN and switch its traffic directly onto the store LAN. What should be configured?
- A.Put the store APs in Monitor mode
- B.Put the store APs in Bridge mode
- C.Put the store APs in Local mode
- D.Put the store APs in FlexConnect mode✓ Answer
FlexConnect lets a remote AP switch client traffic locally onto its own VLANs and keep serving already-configured WLANs when the CAPWAP path to the controller is lost. Local mode tunnels all client traffic to the controller, so a WAN failure cuts the clients off; Monitor mode serves no clients; Bridge mode builds wireless backhaul links rather than branch survivability.
Ref QB-BTAV5YSource: Cisco CCNA 200-301 Exam Topics — 2.6 Cisco Wireless Architectures and AP modesReport a problem with this question
7. A firewall sits between a branch's lightweight APs and the WLAN controller. The APs join the controller and appear as registered, but no client traffic passes through the CAPWAP tunnel. Which firewall rule is most likely missing?
- A.Permit TCP 5247 between the APs and controller
- B.Permit UDP 1812 between the APs and controller
- C.Permit UDP 5247 between the APs and controller✓ Answer
- D.Permit UDP 5246 between the APs and controller
CAPWAP uses two UDP channels: control on UDP 5246 (DTLS-protected), which the AP needs to discover and join the controller, and data on UDP 5247, which carries encapsulated client frames. Because the join succeeded, the control port is already open; the data port is the one being blocked. CAPWAP never uses TCP, and UDP 1812 is RADIUS authentication traffic from the controller, not AP tunnel traffic.
Ref QB-TA5QJXSource: IETF RFC 5415 — CAPWAP control and data portsReport a problem with this question
8. In a split-MAC architecture with lightweight APs and a WLAN controller, which function is performed by the AP itself rather than by the controller?
- A.Sending beacons and answering probe requests✓ Answer
- B.Managing client roaming between different APs
- C.Authenticating clients against a RADIUS server
- D.Running radio resource management for the site
Split-MAC keeps time-sensitive 802.11 tasks on the AP: beacons, probe responses, ACKs, frame transmission and reception, and encryption, because they need microsecond timing that a remote controller cannot provide. The controller handles centralized management tasks such as RF management (RRM), client authentication with RADIUS, association control, QoS policy, and roaming.
Ref QB-CTN7BZSource: Cisco CCNA 200-301 Exam Topics — 2.6 Cisco Wireless Architectures and AP modesReport a problem with this question
9. On an AireOS controller, a security team wants a spare AP that serves no clients and keeps its radio off. Instead, it should watch the wired network for the MAC addresses of rogue devices that other APs have heard over the air. Which mode fits?
- A.Set the spare access point to Sniffer mode
- B.Set the spare access point to Rogue Detector mode✓ Answer
- C.Set the spare access point to Monitor mode
- D.Set the spare access point to SE-Connect mode
In Rogue Detector mode the AP's radio is disabled and the AP listens on the wire for ARP traffic, comparing the MAC addresses it sees with the rogue client and AP lists collected by the controller to prove a rogue is attached to the wired network. Monitor mode uses the radio as an over-the-air sensor, Sniffer mode captures 802.11 frames for an analyzer, and SE-Connect performs spectrum analysis.
Ref QB-UAG2RYSource: Cisco CCNA 200-301 Exam Topics — 2.6 Cisco Wireless Architectures and AP modesReport a problem with this question
10. On an AireOS controller, an engineer suspects a non-802.11 device, such as an analog wireless video camera, is degrading Wi-Fi on one floor. She wants to dedicate an AP to full RF spectrum analysis and view the raw spectrum data in a remote analysis application. Which configuration fits?
- A.Set the access point to Monitor mode
- B.Set the access point to FlexConnect mode
- C.Set the access point to SE-Connect mode✓ Answer
- D.Set the access point to Sniffer mode
SE-Connect (Spectrum Expert Connect) turns the AP into a dedicated spectrum sensor that streams raw RF data to a remote spectrum analysis application, which can identify non-Wi-Fi energy such as cameras, microwaves or jammers. Sniffer mode only captures decodable 802.11 frames for a protocol analyzer, Monitor mode is for wIPS, rogue and location scanning, and FlexConnect serves clients at branches.
Ref QB-N9Q3UCSource: Cisco CCNA 200-301 Exam Topics — 2.6 Cisco Wireless Architectures and AP modesReport a problem with this question
11. A new lightweight AP in Local mode will serve three WLANs that the controller maps to VLANs 10, 20 and 30. How should the switch port facing the AP be configured?
- A.Access port in the AP's management VLAN✓ Answer
- B.Access port in VLAN 10 for the first WLAN
- C.Trunk port allowing VLANs 10, 20 and 30
- D.Trunk port with VLAN 10 as the native VLAN
A Local-mode AP encapsulates all client traffic in CAPWAP and tunnels it to the controller, where the frames are placed onto VLANs 10, 20 and 30. The AP itself only needs one IP address to reach the controller, so its switch port is an access port in the AP's own VLAN; the client VLANs belong on the trunk toward the controller. Trunks to the AP are needed only for autonomous APs or FlexConnect APs that switch several VLANs locally.
Ref QB-6SV8EDSource: Cisco CCNA 200-301 Exam Topics — 2.7 Physical infrastructure connections of WLAN componentsReport a problem with this question
12. An engineer enables LAG on an AireOS-based WLAN controller and cables all four distribution system ports to one switch. On the switch, those four ports are placed in a channel group running LACP in active mode, but the bundle never comes up. What must change?
- A.Split the ports into two LAGs of two ports each
- B.Set the switch channel group to static mode on✓ Answer
- C.Set the switch channel group to PAgP desirable
- D.Set the switch channel group to LACP passive
Controller LAG bundles the distribution system ports into one EtherChannel but does not speak LACP or PAgP, so the switch side must be an unconditional static channel (mode on). LACP passive or PAgP desirable still wait for negotiation packets the controller never sends, and a controller supports only one LAG, so splitting the ports into two LAGs is not an option.
Ref QB-P93EZDSource: Cisco CCNA 200-301 Exam Topics — 2.7 Physical infrastructure connections of WLAN components (LAG)Report a problem with this question
13. A new WLAN is mapped to a dynamic interface on VLAN 40. Clients associate and authenticate but never receive an IP address, while clients on the existing WLANs (VLANs 10 and 20) work normally. The dynamic interface's IP, gateway and DHCP server settings are correct. What should the technician check first?
- A.Whether the trunk to the controller allows VLAN 40✓ Answer
- B.Whether the AP's access port must move to VLAN 40
- C.Whether the WLAN must use TKIP instead of AES
- D.Whether SSID broadcast must be on for DHCP to work
Association and authentication succeed, so the wireless side works; the failure begins when the controller forwards the client's DHCP request out the VLAN 40 dynamic interface. If the switch trunk to the controller does not allow VLAN 40, those frames are dropped and DHCP never completes, while VLANs 10 and 20 keep working. The AP port does not carry client VLANs in Local mode, and cipher choice or SSID broadcast has nothing to do with addressing.
Ref QB-7S8KKESource: Cisco CCNA 200-301 Exam Topics — 2.7 Physical infrastructure connections of WLAN componentsReport a problem with this question
14. A WLAN for wireless IP phones was created, and its QoS profile was left at the default, Silver. Call quality suffers whenever the network is busy. Which statement is accurate?
- A.Silver is best effort; voice should use Platinum✓ Answer
- B.Silver is for video; voice should use Bronze
- C.Silver is the voice profile; raise the AP power
- D.Silver is background; voice should use Gold
The four controller QoS profiles map to traffic classes: Platinum for voice, Gold for video, Silver for best effort (the default), and Bronze for background. Leaving a voice WLAN at Silver gives the phones the same priority as ordinary data, so their packets queue behind bulk traffic under load; selecting Platinum gives voice the highest over-the-air and wired priority.
Ref QB-Q9ER6FSource: Cisco CCNA 200-301 Exam Topics — 2.9 Interpret the wireless LAN GUI configuration (QoS profiles)Report a problem with this question
15. A WLAN uses 802.1X with a RADIUS server that returns a VLAN assignment for each user group. Despite this, every user still lands in the VLAN of the interface configured on the WLAN. Which WLAN setting is most likely disabled?
- A.Client Exclusion after repeated failures
- B.Allow AAA Override for RADIUS attributes✓ Answer
- C.Web Policy for a Layer 3 web login
- D.Broadcast SSID in the beacon frames
By default a client is placed on the interface mapped to the WLAN, and the controller ignores VLAN and other attributes returned by RADIUS unless Allow AAA Override is enabled on the WLAN's Advanced tab. Broadcast SSID only controls whether the name appears in beacons, Client Exclusion blocks clients after repeated failures, and Layer 3 web policy adds a web login, so none of them applies RADIUS-assigned VLANs.
Ref QB-8SKWRFSource: Cisco CCNA 200-301 Exam Topics — 2.9 Interpret the wireless LAN GUI configuration (advanced settings)Report a problem with this question
16. A technician creates a new WLAN in the controller GUI, maps it to the correct dynamic interface, and configures WPA2 PSK with AES. After applying the changes, no client can see or join the new SSID on any AP, although the other WLANs work. What was most likely missed?
- A.DHCP Address Assignment was not required
- B.Coverage hole detection was left enabled
- C.The QoS profile was left at the default
- D.The WLAN was never enabled and stayed disabled✓ Answer
A newly created WLAN stays administratively disabled until Status Enabled is checked on the General tab, and a disabled WLAN is not advertised or accepted by any AP. Leaving QoS at Silver, keeping coverage hole detection on, or not requiring DHCP address assignment all leave the WLAN usable; at most they affect priority, RF tuning, or how clients get addresses.
Ref QB-R9S3CGSource: Cisco CCNA 200-301 Exam Topics — 5.10 Configure and verify WLAN within the GUI using WPA2 PSKReport a problem with this question
17. An office moves its WLAN from WPA2-Personal to WPA3-Personal. Which mechanism replaces the PSK-based key exchange and keeps a captured handshake from being cracked with an offline dictionary attack?
- A.Temporal Key Integrity Protocol (TKIP)
- B.Protected Management Frames (802.11w)
- C.Simultaneous Authentication of Equals (SAE)✓ Answer
- D.Extensible Authentication Protocol (EAP)
WPA3-Personal uses SAE, a password-authenticated key exchange in which each guess requires a live exchange with the AP, so capturing the handshake gives an attacker nothing to test offline; it also provides forward secrecy. PMF (802.11w) is mandatory in WPA3 but protects management frames such as deauthentication, not the key exchange; TKIP belongs to the original WPA, and EAP is used by Enterprise (802.1X) mode.
Ref QB-9SX8XGSource: Cisco CCNA 200-301 Exam Topics — 5.9 Describe wireless security protocols (WPA, WPA2, and WPA3)Report a problem with this question
18. A company's WPA2-Enterprise WLAN authenticates users with PEAP and an inner MSCHAPv2 method against a RADIUS server. Which statement about certificates in this design is accurate?
- A.No certificates are used; a PAC file replaces them all
- B.Only the server needs a certificate; users send passwords✓ Answer
- C.Both the server and every client must hold certificates
- D.Only the clients need certificates; the server needs none
PEAP builds a TLS tunnel using only the authentication server's certificate, which the client validates, and then the user proves identity inside the tunnel with a password method such as MSCHAPv2. EAP-TLS is the method that requires certificates on both the server and every client, and EAP-FAST is the method that can use a Protected Access Credential (PAC) instead of certificates.
Ref QB-S95EHHSource: Cisco CCNA 200-301 Exam Topics — 5.9 Describe wireless security protocols (802.1X/EAP methods)Report a problem with this question
19. A technician builds a WLAN in the controller GUI with Layer 2 Security set to WPA+WPA2, WPA2 Policy checked, AES encryption, and a passphrase entered. When laptops connect, they prompt users for a username and password instead of the passphrase. What is wrong?
- A.The encryption should be TKIP instead of AES
- B.SSID broadcast must be turned off to use PSK
- C.Key management is set to 802.1X instead of PSK✓ Answer
- D.The passphrase must be entered in hex format
The Auth Key Management field decides whether the WLAN is Personal or Enterprise: with 802.1X selected, the WLAN advertises enterprise authentication, so clients ask for EAP credentials and the passphrase is never used. For a WPA2 PSK WLAN, 802.1X must be unchecked and PSK selected; AES is the correct WPA2 cipher, an ASCII passphrase of 8-63 characters is valid, and SSID broadcast has no effect on the key method.
Ref QB-ASAK4JSource: Cisco CCNA 200-301 Exam Topics — 5.10 Configure and verify WLAN within the GUI using WPA2 PSKReport a problem with this question
20. Auditors require a company to stop offering WPA on a legacy WLAN, noting that its cipher is deprecated and that WPA2 uses a stronger one. Which pairing of security protocol and encryption cipher is correct?
- A.WPA uses RC4-WEP; WPA2 uses TKIP
- B.WPA uses TKIP; WPA2 uses GCMP-256
- C.WPA uses AES-CCMP; WPA2 uses TKIP
- D.WPA uses TKIP; WPA2 uses AES-CCMP✓ Answer
WPA was an interim fix for WEP that kept the RC4 cipher but wrapped it in TKIP with per-packet keys and a MIC, so it could run on old hardware; TKIP has since been deprecated. WPA2 (802.11i) requires AES-CCMP, a far stronger block-cipher mode. GCMP-256 belongs to WPA3, specifically its 192-bit Enterprise mode, and WEP is the broken method that WPA replaced.
Ref QB-ZHEXD5Source: IEEE 802.11i — TKIP and CCMP; Cisco CCNA 200-301 Exam Topics — 5.9 Wireless security protocolsReport a problem with this question

1. A technician mounts three 2.4 GHz access points along one long corridor, and each cell slightly overlaps its neighbors. To minimize interference between them in North America, which channel assignment should the three APs use?

2. Users in an office break room report that their 2.4 GHz Wi-Fi slows down badly for a short time around noon every day, while users on the 5 GHz WLAN in the same room are unaffected. A survey finds no other access points nearby. What is the most likely cause?

3. A manager proposes disabling SSID broadcast on the guest WLAN so that outsiders cannot connect to it. What is the accurate response?

4. A trainee asks why 802.11 stations use CSMA/CA rather than the CSMA/CD method used on early shared Ethernet. Which explanation is correct?

5. During a site survey, a laptop reports a received signal of -67 dBm and a noise floor of -92 dBm at one desk. What is the signal-to-noise ratio at that spot?

6. A retail chain's stores reach headquarters over a single WAN link, and the WLAN controller is at headquarters. If that link fails, each store's lightweight APs must keep serving the point-of-sale WLAN and switch its traffic directly onto the store LAN. What should be configured?

7. A firewall sits between a branch's lightweight APs and the WLAN controller. The APs join the controller and appear as registered, but no client traffic passes through the CAPWAP tunnel. Which firewall rule is most likely missing?

8. In a split-MAC architecture with lightweight APs and a WLAN controller, which function is performed by the AP itself rather than by the controller?

9. On an AireOS controller, a security team wants a spare AP that serves no clients and keeps its radio off. Instead, it should watch the wired network for the MAC addresses of rogue devices that other APs have heard over the air. Which mode fits?

10. On an AireOS controller, an engineer suspects a non-802.11 device, such as an analog wireless video camera, is degrading Wi-Fi on one floor. She wants to dedicate an AP to full RF spectrum analysis and view the raw spectrum data in a remote analysis application. Which configuration fits?

11. A new lightweight AP in Local mode will serve three WLANs that the controller maps to VLANs 10, 20 and 30. How should the switch port facing the AP be configured?

12. An engineer enables LAG on an AireOS-based WLAN controller and cables all four distribution system ports to one switch. On the switch, those four ports are placed in a channel group running LACP in active mode, but the bundle never comes up. What must change?

14. A WLAN for wireless IP phones was created, and its QoS profile was left at the default, Silver. Call quality suffers whenever the network is busy. Which statement is accurate?

15. A WLAN uses 802.1X with a RADIUS server that returns a VLAN assignment for each user group. Despite this, every user still lands in the VLAN of the interface configured on the WLAN. Which WLAN setting is most likely disabled?

16. A technician creates a new WLAN in the controller GUI, maps it to the correct dynamic interface, and configures WPA2 PSK with AES. After applying the changes, no client can see or join the new SSID on any AP, although the other WLANs work. What was most likely missed?

17. An office moves its WLAN from WPA2-Personal to WPA3-Personal. Which mechanism replaces the PSK-based key exchange and keeps a captured handshake from being cracked with an offline dictionary attack?

18. A company's WPA2-Enterprise WLAN authenticates users with PEAP and an inner MSCHAPv2 method against a RADIUS server. Which statement about certificates in this design is accurate?

19. A technician builds a WLAN in the controller GUI with Layer 2 Security set to WPA+WPA2, WPA2 Policy checked, AES encryption, and a passphrase entered. When laptops connect, they prompt users for a username and password instead of the passphrase. What is wrong?

20. Auditors require a company to stop offering WPA on a legacy WLAN, noting that its cipher is deprecated and that WPA2 uses a stronger one. Which pairing of security protocol and encryption cipher is correct?

Other topics in this exam