Cisco Certified Network Associate (CCNA) 200-301 Practice Test 28
Question 270
A switching team is evaluating a deployment. A controller must provide WPA2-Personal using AES-CCMP and an exact shared passphrase matching the clients. What approach correctly addresses the stated requirement?
- Configure WPA2-Enterprise 802.1X/RADIUS and expect the client’s PSK-only profile to use the same authentication method.
- Select legacy WEP encryption while requiring WPA2 AES-CCMP handshake compatibility.
- Use different passphrases at the controller and client and expect AES encryption alone to reconcile them.
- Configure WPA2-Personal with AES-CCMP and an identical strong pre-shared key on the WLC and authorized clients.
Explanation
Correct Answer
D:WPA2-Personal derives session keys from the shared passphrase and four-way handshake. A mismatched PSK or unsupported cipher prevents successful key exchange even if 802.11 association and RF strength are normal.
Incorrect Answers
A:Enterprise EAP credentials and Personal PSK are distinct security modes.
B:WEP is not WPA2-CCMP and fails the stated security method.
C:The parties must derive matching key material for the WPA2-Personal handshake to succeed.
Question 271
A proposed network design has this requirement: A voice SSID must preserve and schedule latency-sensitive frames ahead of best-effort bulk traffic under congestion. Which choice is technically appropriate for that deployment?
- Map all voice packets to the lowest-priority background access category during bulk downloads.
- Change only the SSID name and assume radio queues will recognize voice without classification.
- Disable WMM and QoS while demanding bounded voice latency during RF congestion.
- Apply the supported voice/WMM QoS policy and preserve voice marking and priority treatment on AP/WLC and wired uplink queues.
Explanation
Correct Answer
D:WMM maps appropriate traffic classes to contention/access categories on Wi-Fi. Real end-to-end voice performance under load also depends on compatible wired QoS markings and queue admission/scheduling.
Incorrect Answers
A:Background treatment makes latency-sensitive frames wait behind competing traffic.
B:An SSID label does not by itself establish traffic class mapping or scheduling.
C:Removing prioritization conflicts with the requested latency-sensitive contention treatment.
Question 272
A switching team must implement a change. A WLAN SSID should map to the intended dynamic interface/VLAN that provides the right DHCP scope and gateway. Which technical decision most directly meets these requirements?
- Map the SSID to VLAN 999 guest when users must receive the VLAN 30 corporate DHCP scope.
- Bind the production SSID to the intended WLC dynamic interface/policy profile and VLAN 30, with corresponding wired VLAN and DHCP/default gateway service.
- Create the correct DHCP pool but keep the WLAN policy mapped to a different VLAN.
- Enable stronger PSK encryption without inspecting or correcting the SSID-to-VLAN mapping.
Explanation
Correct Answer
B:A WLAN-to-interface/VLAN mapping determines where associated client data enters the LAN. The correct subnet lease and gateway must match the intended WLAN segment, not just successful radio authentication.
Incorrect Answers
A:That places client data in the wrong broadcast domain and likely yields the wrong addressing/segmentation.
C:A DHCP scope elsewhere does not change the VLAN to which the WLAN data path forwards client frames.
D:Authentication and L2 client placement are distinct WLAN functions.
Question 273
Troubleshooting report: APs are joined and transmitting beacons for other WLANs, but this SSID is disabled in the controller profile and never appears in client scans. Which finding best accounts for the behavior?
- The affected SSID must be transmitting because other WLANs from the same AP appear in scans.
- The client default gateway is wrong, which by itself prevents disabled SSID beacons from being transmitted.
- All APs have lost electrical power because one profile is disabled.
- The target WLAN/SSID profile is administratively disabled despite APs being joined and other SSIDs broadcasting.
Explanation
Correct Answer
D:Controller join and functioning other WLANs do not imply every SSID profile is enabled. The affected WLAN needs to be activated/applied and broadcast as intended.
Incorrect Answers
A:An AP can advertise some enabled WLANs while a separate profile remains disabled.
B:IP gateway settings operate after association; they do not directly determine whether a disabled WLAN is advertised.
C:Other visible WLANs from these radios contradict a complete AP power loss.
Question 274
A WLC is broadcasting the corporate WPA2-Personal SSID, and client passphrases match the configured key. Client RSSI is strong, but a security trace shows the WLAN is configured for legacy TKIP while the clients require AES-CCMP; authentication cannot finish. Which WLAN policy error best explains the failure?
- The SSID is disabled and no beacons are being transmitted.
- The controller permits TKIP instead of a compatible AES-CCMP WPA2 pairwise cipher policy.
- The clients receive addresses from a wrong VLAN after authentication has already succeeded.
- Voice traffic is mapped to best-effort queues instead of an assured-service class.
Explanation
Correct Answer
B:The security methods must match: WPA2 clients requiring AES-CCMP cannot complete a negotiated handshake against a TKIP-only profile, even if the passphrase matches. Select an allowed WPA2/AES policy consistent with device capabilities and retest.
Incorrect Answers
A:The SSID is visible and clients reach the security exchange, so WLAN enablement and beaconing are already functioning. This is not a missing broadcast SSID problem.
C:A wrong dynamic-interface/VLAN mapping can cause bad addressing after a client authenticates, but it does not explain a cipher negotiation failure during the authentication/key process.
D:QoS mapping can degrade voice latency after association and data flow, but it does not change the WPA2 security cipher expected by the client during key negotiation.
Question 275
A switching team must explain an outage. Voice packets share default best-effort queues with large downloads, and jitter increases sharply only during congestion. Which diagnosis follows from these observations?
- Voice is already consistently prioritized in every relevant queue, so best-effort contention cannot explain any jitter.
- The voice WLAN lacks appropriate WMM/QoS prioritization, so real-time packets compete in best-effort queues with large transfers and experience congestion jitter.
- A single incorrect DNS record is responsible for variable frame scheduling during large downloads.
- An STP root bridge election is always the immediate cause of rising Wi-Fi voice jitter only when bulk downloads occur.
Explanation
Correct Answer
B:A bottleneck only under load is consistent with insufficient classification/scheduling for time-sensitive packets. Confirm actual wireless and wired queue behavior before changing RF power or default gateways.
Incorrect Answers
A:The evidence specifically states voice shares default queues under congestion.
C:DNS resolution is not the mechanism described for congestion-specific packet queue delay.
D:Spanning tree controls wired loop-free topology, not the observed best-effort wireless contention queues.
Question 276
A switching team collects this evidence: Clients authenticate successfully but get DHCP addresses from the guest VLAN instead of the corporate subnet. Which root-cause interpretation best fits the observations?
- Authentication success guarantees the WLAN used the corporate VLAN even if the client leased a guest-scope address.
- The WLAN-to-VLAN/dynamic interface mapping sends authenticated client data to the guest VLAN instead of the intended corporate VLAN.
- The guest DHCP address proves the radio is on the wrong 2.4 GHz RF channel rather than the wrong L2 data segment.
- The AP must be absent from the controller, although the client has already associated and authenticated.
Explanation
Correct Answer
B:Successful authentication proves the client reached WLAN security controls, not the proper wired VLAN. A guest-subnet DHCP lease points to data-path VLAN mapping, switch tags or a corresponding scope/relay error.
Incorrect Answers
A:WPA/802.1X success and VLAN data placement are separate phases and can diverge.
C:RF channel selection does not directly determine which DHCP broadcast domain responds.
D:A working authenticated session contradicts a blanket AP-join failure and supports investigating the WLAN data mapping.
Question 277
The earlier fault was recorded as follows: APs are joined and transmitting beacons for other WLANs, but this SSID is disabled in the controller profile and never appears in client scans. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- The WLAN is enabled and correctly applied to its serving AP group, its intended SSID appears in client scans, and a test client associates.
- The WLC lists the AP as joined but the target SSID is still disabled and absent from scans.
- A different SSID is visible but the repaired SSID remains missing.
- Client VLAN 30 exists in a wired switch database while the WLAN profile remains disabled.
Explanation
Correct Answer
A:Previously, APs were joined but the target WLAN profile was disabled. Validate that particular profile’s active state and beacon/association operation, not just continued AP join.
Incorrect Answers
B:An AP can be joined to its controller while a particular WLAN profile remains administratively disabled. If that SSID is not advertised in beacons or client scans, AP join status alone does not prove that the required WLAN was enabled.
C:Other WLANs were already functioning and cannot validate the affected profile.
D:Wired VLAN existence does not make an inactive SSID advertise.
Question 278
A switching team has repaired a network problem. Clients see strong RF and can associate, but the four-way handshake fails because the configured PSK differs from the client key. Which device or protocol check is the strongest evidence that this particular failure is gone?
- A test client completes the WPA2 four-way handshake using the intended PSK/AES settings and the WLC/AP security logs report successful key exchange, not PSK mismatch.
- The client can see the SSID and associates at 802.11 but the four-way handshake still fails.
- The WLC records repeated MIC/PSK key-exchange failures while the operator declares success based on RF signal strength.
- An unrelated VLAN interface responds to ping while the client never establishes a protected WLAN session.
Explanation
Correct Answer
A:RF association can succeed before WPA2 key authentication. The original failure was mismatched PSK; successful secure association and authenticated traffic distinguish repair from just seeing a beacon.
Incorrect Answers
B:Visibility and association were present during the original authentication failure.
C:Strong signal cannot repair incompatible WPA2 key material.
D:L3 reachability elsewhere does not demonstrate secure 802.11 key negotiation.
Question 279
A network acceptance test follows this reported failure: Voice packets share default best-effort queues with large downloads, and jitter increases sharply only during congestion. Which verification most specifically demonstrates the repaired function rather than checking an unrelated feature?
- Voice stays mapped to best effort and jitter rises under the same mixed-load test.
- The WLAN SSID is visible but QoS category counters and markings are not checked.
- With mixed voice and bulk traffic, controller/WMM policy and packet markings show voice in the intended priority access category and measured jitter is reduced under load.
- WPA2 association succeeds without comparing delay during competing large downloads.
Explanation
Correct Answer
C:The initial issue occurred under contention. An appropriate test combines actual queue mapping with real-time performance during congestion, rather than reading only the configured policy label.
Incorrect Answers
A:If voice RTP still competes in best-effort scheduling with bulk transfers, sustained egress congestion can continue to introduce queueing delay and jitter. Evidence of unchanged best-effort marking and elevated jitter disproves successful QoS repair.
B:Beacon visibility does not demonstrate prioritized media access or wired queue handling.
D:Authentication alone does not prove the latency-sensitive scheduling defect is fixed.
Question 280
A switching team is validating a repair. Earlier, clients authenticate successfully but get DHCP addresses from the guest VLAN instead of the corporate subnet. Which postchange check most directly establishes the specific problem is resolved?
- The client still gets a guest VLAN address but can resolve a public DNS name.
- An authenticated client on the repaired corporate SSID receives an address, gateway and DNS from the intended corporate VLAN, with WLAN mapping and wired tags confirmed.
- The client completes WPA authentication but no WLAN-to-VLAN mapping is inspected.
- Only the AP management IP is in the corporate subnet while station leases remain guest.
Explanation
Correct Answer
B:The prior clients authenticated but leased from guest. Inspect effective policy interface/VLAN and the client’s actual scope/gateway to prove correct segmentation rather than simply any DHCP success.
Incorrect Answers
A:Internet reachability does not prove placement in the required corporate VLAN.
C:Authentication already worked and was not the failed requirement.
D:AP management and user client VLANs are independent in many designs.
