Cisco Certified Network Associate (CCNA) 200-301 Practice Test 63
Question 620
After replacing or upgrading the legacy barcode scanner, the controller's WLAN profile still requires WPA2 with AES-CCMP. The rollout owner needs confirmation that the new scanner is not silently falling back to WPA/TKIP. Which observation directly confirms the negotiated wireless protection?
- The scanner receives an IP address through a site-to-site VPN, with no WLAN association details.
- The controller client detail and wireless association security record show the scanner negotiated WPA2 with AES-CCMP for its active session.
- The access switch MAC address table includes one sticky address for the scanner's uplink.
- A door-access camera records the scanner operator entering the storage room.
Explanation
Correct Answer
B:The controller's current client association record can show the actual negotiated authentication mode and pairwise cipher. For this rollout it must report WPA2 and AES-CCMP on the scanner's live session, not merely those options saved in the WLAN profile. That ties the configured policy to operational behavior and confirms the replacement device supports the required security suite. Verify the correct client MAC, SSID, session time, and active cipher so a stale or unrelated record cannot satisfy the acceptance test.
Incorrect Answers
A:An IP address or a VPN route can demonstrate that some network path works, but it does not identify the 802.11 authentication and cipher suite negotiated over the WLAN. A device might obtain an address through a weaker wireless profile or a different interface. Because the acceptance criterion specifically excludes legacy WPA/TKIP fallback, the evidence must name the associated client and its active negotiated security mode. IP reachability is a useful later check, not a substitute for connection security details.
C:Port Security sticky MAC learning is a switchport access control that can restrict endpoint source MAC identities. It says nothing about which wireless cipher an associated client negotiated, and an access-switch MAC table may represent traffic from an AP uplink rather than the scanner's direct radio session. Even correctly learned MAC addresses can coexist with an insecure WLAN association. The relevant proof comes from the WLAN controller's client security details or corroborating wireless handshake evidence, not an Ethernet source-MAC limit.
D:A camera or physical access log can support facility security and accountability, but neither validates an 802.11 cipher negotiation. The scenario concerns a scanner's active WPA2 association and whether the session uses AES-CCMP rather than legacy TKIP. Physical entry records cannot answer that question, even if they identify the person operating the scanner. Record wireless controller security state for the device, then separately assess any physical access controls required by the facility.
Question 621
The earlier fault was recorded as follows: Clients use the correct SSID and strong signal but cannot complete the WPA2 key handshake because the PSK differs. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- The client uses the correct WPA2 PSK and AES-CCMP, completes the four-way handshake, and sends protected data successfully with no key-mismatch errors.
- The client still fails the four-way handshake but reports a strong Wi-Fi signal.
- Only the DHCP server scope exists; the client has not authenticated with a matching key.
- The AP advertises the correct SSID but uses WEP or TKIP instead of the required WPA2 AES-CCMP.
Explanation
Correct Answer
A:The previous defect occurred during secure key exchange; verify authentication and negotiated cipher, not merely SSID visibility or RF bars.
Incorrect Answers
B:RF reception was normal during the key mismatch.
C:Address configuration does not validate encrypted wireless association.
D:An SSID label alone does not establish compliant WPA2 security.
Question 622
A network security analyst has repaired a network problem. A client restricted to WPA2-PSK cannot authenticate to an SAE-only WLAN because the security methods are incompatible. Which device or protocol check is the strongest evidence that this particular failure is gone?
- The client remains WPA2-PSK-only while the WLAN remains SAE-only, yet the association is called successful after scanning.
- The WLAN is silently changed to WEP and the client can connect without SAE or PMF.
- Only a WLC AP-join session is healthy, while the target client has no negotiated WPA3 security.
- The updated SAE-capable client successfully negotiates WPA3-Personal SAE and required protected management frames (PMF), with authenticated traffic passing.
Explanation
Correct Answer
D:The previous client supported only WPA2-PSK and could not join SAE-only. An upgraded compatible client should demonstrate actual SAE authentication and required PMF, not a downgrade to insecure legacy security.
Incorrect Answers
A:Seeing the SSID is not SAE compatibility or completed authentication.
B:That evades the intended SAE-only protection rather than validating a compliant repair.
C:AP controller join and client SAE/PMF negotiation are separate.
Question 623
A proposed network design has this requirement: A WLC administrator must create and enable a WLAN profile bound to the intended SSID and AP deployment group. Which choice is technically appropriate for that deployment?
- Save an SSID text string but leave its WLAN disabled and expect it to beacon from every AP.
- In the WLC management interface, create the SSID/WLAN profile, enable it and apply it to the intended AP group/policy tags, with required security and VLAN settings.
- Create only a wired VLAN name and omit controller WLAN security and broadcast settings.
- Assign the new WLAN only to a different AP group that contains none of the intended radios.
Explanation
Correct Answer
B:A saved but disabled or unassigned WLAN profile does not provide active SSID service. Controller administration must apply an enabled WLAN to radios serving the desired clients.
Incorrect Answers
A:Inactive WLAN profiles are not active client-serving SSIDs.
C:A VLAN alone does not create a managed 802.11 WLAN service.
D:The target APs would not inherit the profile.
Question 624
A WLC is configured for an SSID `StaffNet` using WPA2-Personal with AES-CCMP. A laptop sees the SSID and associates, but its four-way handshake fails; controller logs indicate an incorrect pre-shared key. Other clients using the approved key connect normally. What is the most direct correction?
- Configure the laptop with the same approved WPA2-Personal PSK used by the controller, then retry authentication.
- Rotate the controller's PSK immediately without distributing the new value to any clients.
- Replace AES-CCMP with legacy WEP or TKIP because they avoid four-way handshakes.
- Disable the WLAN profile, since a hidden SSID makes an incorrect PSK valid.
Explanation
Correct Answer
A:The SSID is visible and the client reaches the WPA2 four-way handshake, but the keyed exchange fails while other clients succeed. That evidence isolates the laptop's PSK value or saved wireless profile rather than the RF channel, WLAN enablement or gateway. Configure the authorized approved key on the laptop, remove an obsolete saved credential if necessary, and retest successful key establishment followed by DHCP and protected data traffic. Do not display the PSK in logs or distribute it insecurely. The controller and endpoint must derive matching key material for WPA2-Personal authentication, and merely seeing or associating with an SSID does not prove that the cryptographic exchange succeeded. This is distinct from WPA2-Enterprise, where individual user credentials and an authentication server would be involved.
Incorrect Answers
B:A planned security-key rotation may be legitimate, but changing the controller to an undistributed new key would likely disconnect the currently working clients too. The logs show one affected laptop has a mismatch, not that the controller's approved key is compromised. Diagnose and correct the client's stored credential first, or use a coordinated key rotation if policy requires it. Arbitrary server-side rotation is not the direct least-disruptive remedy.
C:WEP is obsolete and insecure; TKIP is also deprecated for modern secure WLAN operation. Downgrading cipher protection does not solve a mismatch in the authorized WPA2-Personal pre-shared secret. The observed four-way handshake is a normal part of WPA2 key establishment, not evidence that AES-CCMP is wrong. Maintain the prescribed WPA2 AES profile and make client/controller keys agree.
D:Disabling a WLAN prevents normal wireless service and does not validate an incorrect pre-shared key. Hiding SSID advertisement also does not provide key agreement or secure authentication. Since the laptop already sees the SSID and reaches the handshake, discovery and WLAN enablement are not the current discriminating faults. The controller event explicitly identifies credential mismatch; address that cause rather than changing broadcast visibility.
Question 625
A wireless controller operates a WPA2-Personal (AES-CCMP) WLAN for a small managed lab. The administrator is scheduling a change from the current pre-shared key to a newly approved key at 22:00 and coordinating endpoint updates so service can resume afterward. Which controller-side change directly implements the authorized key rotation?
- Switch the WLAN security mode from WPA2/AES to WPA/TKIP without changing its key.
- Update the WLAN security profile with the new approved WPA2-Personal PSK during the scheduled window, then coordinate matching client secrets.
- Disable the WLAN permanently so no client can connect with any key.
- Change the SSID name only, keeping the old PSK and encryption settings unchanged.
Explanation
Correct Answer
B:For a WPA2-Personal WLAN, the controller security profile holds the configured pre-shared key that must match participating client configurations. Updating the profile to the newly authorized PSK during the approved maintenance window implements the server-side portion of the rotation; clients must then use the corresponding new secret for their authentication/key handshake. Retain AES-CCMP and document the effective activation time, affected SSID, rollback instructions, and sign-in confirmation. This is a controlled configuration choice; a related fault-isolation card tests what stale client credentials look like afterward.
Incorrect Answers
A:Replacing WPA2 with legacy WPA/TKIP does not perform the authorized pre-shared-key rotation and can reduce the wireless security properties of the deployment. WPA2-Personal can use AES-CCMP with a pre-shared key; the requested change is to replace that secret while retaining the approved security mode. Changing the cipher suite would introduce an unrelated compatibility and security risk. Verify the active WLAN profile and scheduled secret revision rather than equating encryption-mode changes with password rotation.
C:Disabling a WLAN indefinitely is an availability change, not a completed credential rotation. It may prevent any clients from connecting, including those holding the approved new PSK. A maintenance procedure can include a brief service interruption, but successful completion requires the WLAN to be enabled with the new secret and clients to connect using it. The question asks for the controller setting that implements scheduled PSK replacement, so permanent shutdown would fail its purpose and its subsequent acceptance criteria.
D:The SSID is the network name advertised to clients; changing it can affect discovery and user experience, but does not modify the pre-shared key used in WPA2-Personal authentication. A client knowing the old key would still have the valid secret if only the name changed, and updated clients might fail due to a mismatched SSID. The required security action is a change to the configured PSK in the WLAN profile, coordinated with client secret updates.
Question 626
An SSID exists as a saved profile but its WLAN state is disabled, so clients never see advertised beacons. The team should investigate which specific technical cause?
- The target WLAN/SSID is administratively disabled at the controller, so APs can remain joined while no beacons are sent for that particular WLAN.
- The SSID must appear in every scan because its name exists as saved text in the WLC.
- Working controller AP join proves every stored WLAN profile is enabled.
- A corporate gateway lacks a default route, which directly prevents a disabled SSID from beacons.
Explanation
Correct Answer
A:WLC AP registration and a saved SSID profile are not sufficient to advertise it. The WLAN must be enabled and applied to the relevant APs with an appropriate SSID broadcast setting.
Incorrect Answers
B:A disabled profile is not an operational advertised WLAN.
C:Join and per-WLAN administrative state are independent.
D:Layer 3 external routing is not the switch that enables WLAN radio advertisement.
Question 627
An administrator rotates the WPA2-Personal key on a WLC. The SSID remains enabled and new clients configured with the replacement passphrase authenticate successfully, but several older laptops still fail the key handshake while storing the previous passphrase. What correction addresses the different results?
- Recreate the WLAN because the SSID must have been disabled for every client.
- Update or forget and rejoin the WLAN on affected clients so they use the new shared key.
- Change the WLAN to WPA3 SAE-only although all clients and the controller are still operating WPA2-PSK.
- Modify the DHCP default gateway option even though the clients fail before receiving a lease.
Explanation
Correct Answer
B:The affected laptops retain the former PSK, whereas the WLC now expects the rotated key; the four-way key handshake fails until stored credentials are replaced. Updating the passphrase restores matching shared-key material without changing encryption mode.
Incorrect Answers
A:New devices see and use the SSID successfully, proving that the WLAN profile is available. Recreating it does not correct stale client credentials and may interrupt working clients.
C:Moving to SAE-only is a different security migration and may introduce client compatibility issues. The described outage follows a known WPA2 PSK rotation and is limited to devices with the previous saved key.
D:DHCP options are delivered after link authentication and key setup. The failure occurs during the security handshake, before DHCP gateway values can affect the connection.
Question 628
After a controller changes the WPA2-Personal PSK on SSID LAB-20, newly provisioned clients connect normally, but three older laptops still fail during the WPA2 four-way handshake. Their saved wireless profiles contain the previous PSK, and RF signal strength is normal. Which root cause is most specific to the observed failures?
- The WLAN has no enabled SSID beacon, so no client can discover LAB-20.
- The three laptops retain the previous pre-shared key and cannot complete the handshake against the controller’s new PSK.
- The access switch uplink is shut, so the controller receives no user traffic from any access point.
- The DHCP server has exhausted its lease pool after those clients have already passed authentication.
Explanation
Correct Answer
B:WPA2-Personal derives authentication and encryption key material from the configured PSK and session parameters. After the controller changes its key, a client that still uses the previous PSK cannot generate the matching handshake MIC and fails to complete the four-way handshake. The normal RF signal and successful newly provisioned clients rule against a broad radio or controller outage. Remove or update the stale wireless profiles on the three laptops, retry using the new authorized PSK, and inspect handshake success while keeping AES-CCMP enabled. This fault diagnosis is distinct from the previous configuration question about scheduling the key rotation itself.
Incorrect Answers
A:A disabled WLAN or missing beacon would prevent discovery for all clients in the affected coverage area, not selectively affect only older devices with stale saved credentials. The incident states that newly provisioned clients connect normally and that the three failing clients reach the security handshake. Those clues place the failure after SSID discovery and radio association. Inspect the stored network profiles and authentication events before changing SSID advertisement, which is a different operational control.
C:If the access switch uplink were shut and AP/controller connectivity depended on it, the failure would typically affect a broader set of clients or prevent the controller from serving the WLAN. Here newly provisioned clients connect successfully and the three failures occur at the WPA2 key handshake, not during IP packet forwarding. An uplink problem is therefore inconsistent with the comparison evidence. Check AP and uplink health if additional symptoms emerge, but do not treat a targeted stale-PSK mismatch as a Layer 1 or trunk outage.
D:A DHCP pool exhaustion problem occurs during IP configuration after a client has associated and successfully completed required wireless security exchanges. The three laptops fail earlier, during the WPA2 four-way handshake. They cannot request a normal DHCP lease over the data connection until the security process succeeds. Address-pool capacity could be checked after authentication is restored, but it cannot be the immediate cause of the logged PSK mismatch. This distinction identifies the failing stage of the client join process.
Question 629
The earlier fault was recorded as follows: An SSID exists as a saved profile but its WLAN state is disabled, so clients never see advertised beacons. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- The specific WLAN is enabled/applied to the serving APs and its SSID is observed in intended client scans, followed by successful association.
- The WLAN stays disabled but its SSID name is visible in the WLC configuration database.
- Another SSID is visible while the target WLAN still sends no beacons.
- The controller is reachable by HTTPS but the intended WLAN remains disabled.
Explanation
Correct Answer
A:The prior fault was saved-but-disabled WLAN. Actual advertised beacon/SSID and client association verify active service rather than just a WLC profile record.
Incorrect Answers
B:A saved profile without enabled service reproduces the problem.
C:Unrelated active WLANs do not establish this profile is enabled.
D:Management-plane reachability is separate from WLAN operational state.
Question 630
A Cisco wireless controller GUI is configured for WPA2-Personal with a pre-shared key and AES-CCMP. A client successfully joins the SSID. Before approving the WLAN, the security administrator must confirm that it is not using legacy TKIP encryption. Which evidence directly demonstrates compliance?
- The SSID name appears in an over-the-air beacon without cipher information
- The client receives a DHCP lease after association, without any negotiated security details
- The controller client session reports WPA2-PSK with the negotiated CCMP/AES data cipher
- A basic controller log entry says the client joined but omits the pairwise cipher suite
Explanation
Correct Answer
C:The controller session information showing WPA2-Personal/PSK with CCMP/AES is direct evidence that this client is using the intended pairwise data confidentiality mechanism. WPA2-Personal authenticates the client using the shared secret and normally performs a four-way handshake before protected data traffic is exchanged. CCMP is the AES-based cipher suite required by this design, whereas TKIP is a legacy protection mechanism that the security policy excludes. Examine the negotiated session or capture, not merely the saved WLAN profile, and test an actual associated client to ensure the active connection matches the authorized security posture.
Incorrect Answers
A:A wireless beacon may expose the network name and capabilities, but the visible SSID alone does not establish what pairwise encryption a particular associated client actually negotiated. Multiple security policies and clients can share an SSID across operational changes. The requirement is to prove that TKIP was not used for this session. Inspect session security details or an equivalent capture that identifies the negotiated cipher suite rather than relying on network name discovery.
B:Obtaining an IP address through DHCP indicates that some Layer 2 connectivity and DHCP communication succeeded, but it is not proof of the negotiated Wi-Fi data cipher. A network can issue leases through a WLAN even when its security design permits an unwanted legacy algorithm. The security question concerns WPA2-PSK encryption specifically. DHCP lease state is useful in a separate client-connectivity investigation but cannot establish whether CCMP/AES was negotiated.
D:A successful join event without pairwise-cipher details only shows that the controller accepted a client association; it leaves open the security protocol and encryption actually used. A policy might advertise multiple transition choices, and logging labels can omit the cryptographic distinction important to the audit. To demonstrate exclusion of TKIP, the evidence must name the negotiated AES-CCMP cipher for the client session or show equivalent validated handshake data.
