100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 700
A Cisco Catalyst 9800 WLAN uses a single 802.1X SSID for staff and contractors. After identity authentication, Cisco ISE must assign staff to VLAN 30 and contractors to VLAN 40 dynamically without requiring two different SSIDs. Which RADIUS authorization response mechanism determines the assigned VLAN?
- Send only a Syslog notification identifying the authenticated username, without RADIUS attributes
- Force every associated user to inherit the trunk native VLAN regardless of the RADIUS reply
- Return Access-Accept with the VLAN tunnel attributes, including Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-ID
- Replace the WLAN SSID name with the VLAN number so that no user authorization attributes are required
Explanation
Correct Answer
C:After successful 802.1X authentication, a RADIUS Access-Accept can carry IETF tunnel attributes 64 (VLAN type), 65 (802 medium) and 81 (VLAN/group ID), allowing the controller to assign the authorized user to the specified VLAN.
Incorrect Answers
A:Syslog can record a result, but a log message does not carry the network-access authorization attributes that tell the controller which VLAN to use.
B:A trunk native VLAN concerns untagged Ethernet transport; it does not override per-user RADIUS-assigned WLAN policy for an 802.1X client.
D:An SSID is the wireless service identity, not a per-user authorization attribute; renaming it cannot dynamically assign different VLANs to staff and contractors.
Question 701
A warehouse uses a WPA2-Personal WLAN with AES-CCMP. Some scanners can support only WPA2, but newer clients support WPA3-Personal SAE. The team must improve authentication security without abruptly disconnecting the scanners, and it plans to retire WPA2 clients after replacement. Which migration is appropriate, acknowledging the interim security trade-off?
- Use a documented WPA2-Personal/WPA3-Personal transition mode temporarily, permit SAE clients, and phase out WPA2-PSK when scanners are replaced
- Require SAE-only WPA3-Personal on the existing SSID immediately and assume the WPA2-only scanners will continue to authenticate
- Allow WEP as a compatibility fallback on the existing WLAN so that all scanner generations can connect
- Keep WPA2-Personal only but rename the SSID to WPA3 to obtain SAE handshake protection without changing the security profile
Explanation
Correct Answer
A:Transition mode can advertise both supported personal AKM methods during a constrained migration. Legacy WPA2 scanners can still associate while capable clients use SAE; WPA2 clients retain WPA2-PSK exposure until the weaker mode is disabled.
Incorrect Answers
B:A WPA2-only client does not implement SAE authentication. Forcing SAE-only before scanner replacement would disconnect those clients, contrary to the migration constraint.
C:WEP is cryptographically obsolete and not a valid WPA2/WPA3 interoperability setting. Adding it would introduce a weaker security mode rather than enable modern clients to negotiate SAE.
D:An SSID is a service identifier, not an authentication algorithm. Changing the WLAN name without enabling WPA3 and SAE does not change the WPA2-Personal handshake or its attack model.
Question 702
A legacy WLAN must remain specifically WPA2-Personal (not WPA3 or Enterprise) because of a constrained client fleet. The administrator must encrypt protected data frames and require a shared passphrase. Which approved WPA2 setting meets those conditions?
- Use AES-CCMP with a strong pre-shared key
- WPA2-Personal using TKIP-only legacy data protection instead of AES-CCMP
- WPA2-Enterprise 802.1X using a per-user RADIUS identity and no common PSK
- Open authentication with SSID hiding but without WPA2 encryption or passphrase checks
Explanation
Correct Answer
A:WPA2-Personal authenticates clients using a shared secret while AES-CCMP encrypts protected data frames. This differs from legacy TKIP-only deployments and from WPA2-Enterprise 802.1X identity authentication.
Incorrect Answers
B:TKIP-only protection is the deprecated legacy choice and does not provide the requested modern WPA2 AES-CCMP data confidentiality.
C:Enterprise mode replaces the common preshared-key authentication design with individual 802.1X credentials and misses the explicit personal-mode requirement.
D:Suppressing SSID beacon advertising cannot provide encryption or shared-key authentication for the client data frames.
Question 703
A WPA2-Personal network is exposed to passive capture of the four-way handshake, and the replacement client fleet supports WPA3-Personal. The goal is password-authenticated key exchange with stronger resistance to offline guessing. Which personal authentication method meets the objective?
- WPA2-Personal PSK with its original captured four-way handshake and the same shared passphrase
- WPA2 with SSID hiding but the same PSK association and key establishment
- WPA2-Personal using AES-CCMP but no SAE password-authenticated key exchange
- Use WPA3-Personal with SAE where compatible
Explanation
Correct Answer
D:WPA3-Personal uses SAE password-authenticated key establishment, improving resistance to passive offline dictionary attacks compared with WPA2-PSK capture workflows. Both infrastructure and clients must support the selected mode.
Incorrect Answers
A:Reusing the same WPA2-PSK design preserves the offline handshake-verification exposure that the replacement explicitly intends to mitigate.
B:Hidden SSID does not change PSK handshake cryptography or stop capture by a nearby wireless observer.
C:AES-CCMP protects WPA2 traffic data, but it does not itself add the SAE authentication mechanism requested for WPA3-Personal.
Question 704
An employee WLAN must authenticate each individual through EAP/802.1X and a backend identity service, rather than use one shared household PSK. Which enterprise WLAN security model is appropriate?
- Use WPA3-Personal with SAE and a single shared passphrase for all employees
- Use an 802.1X/EAP enterprise WLAN security profile
- Use WPA2-Personal with AES-CCMP and a shared pre-shared key
- Use only WPA2-Personal/WPA3-Personal PSK/SAE transition mode without any RADIUS or EAP identity service
Explanation
Correct Answer
B:Enterprise WLAN access uses 802.1X/EAP exchanges and backend AAA/RADIUS validation for individual user or device identities, unlike PSK/SAE-only personal modes.
Incorrect Answers
A:SAE is a WPA3-Personal password-authenticated key exchange and does not by itself provide the requested per-user 802.1X/EAP enterprise identity check.
C:AES-CCMP secures data frames, but a shared WPA2-Personal passphrase does not supply individual enterprise EAP identity authentication.
D:Transition mode using only personal PSK and SAE allows compatibility between personal authentication mechanisms, not the requested centralized 802.1X/EAP enterprise AAA policy.
Question 705
A user confuses an SSID name with WLAN encryption. The controller must separately define the advertised network identity and its WPA security settings. Which configuration distinction is correct?
- Configure SSID identity separately from the WLAN security mode
- Hide the SSID and assume it replaces WPA2 or WPA3 encryption
- Use the BSSID MAC value as the client passphrase and skip cipher selection
- Use VLAN ID numbers as a substitute for selecting WPA authentication
Explanation
Correct Answer
A:SSID is a service name, not a method that authenticates or encrypts traffic.
Incorrect Answers
B:An unadvertised network name is not a cryptographic confidentiality or authentication method.
C:BSSID identifies the AP radio and does not establish a security cipher suite or authentication policy.
D:VLAN identity controls Layer 2 segmentation, not the WPA security mode and key exchange.
Question 706
A migration inventory lists a legacy WLAN using RC4-based TKIP rather than AES-CCMP. Which older WPA security behavior does this describe?
- Recognize WPA with TKIP legacy behavior
- Identify TKIP as the AES-CCMP encryption mode required by modern WPA2-only clients
- Identify TKIP as WPA3 SAE password authentication
- Identify TKIP as the unencrypted open 802.11 mode with no packet cryptography
Explanation
Correct Answer
A:Original WPA often used TKIP, now deprecated for modern secure WLAN deployments.
Incorrect Answers
B:TKIP is RC4-based legacy protection, whereas AES-CCMP is a different modern cipher suite.
C:SAE is an authentication/key establishment protocol rather than the legacy RC4-based TKIP cipher.
D:TKIP encrypts frames using legacy mechanisms; an open unprotected SSID provides no such link encryption.
Question 707
A Cisco WLAN supports WPA2-Personal with AES-CCMP and rejects TKIP-only clients. Which data-confidentiality cipher choice corresponds to modern WPA2?
- Choose TKIP-only because WPA2 always requires RC4
- Use WEP encryption with a longer static key for equivalent WPA2 security
- Enable only WPA3 SAE key exchange without a WPA2 cipher configuration
- Recognize AES-CCMP under WPA2
Explanation
Correct Answer
D:AES-CCMP is the usual WPA2 protected-data cipher.
Incorrect Answers
A:WPA2 with AES-CCMP is the standard modern security choice and the scenario explicitly disallows TKIP-only clients.
B:WEP is a separate obsolete cipher and does not implement the requested AES-CCMP confidentiality.
C:SAE authentication alone is not the WPA2 AES-CCMP confidentiality profile asked for.
Question 708
A controller supports WPA3-Personal where compatible clients perform a password-authenticated key exchange resistant to offline dictionary capture. Which WPA3 SAE mechanism is being used?
- Recognize Simultaneous Authentication of Equals
- Choose legacy WPA2-PSK four-way handshake with no SAE exchange
- Choose WEP shared-key authentication as the password-authenticated exchange
- Choose open 802.11 authentication with no cryptographic credential exchange
Explanation
Correct Answer
A:SAE replaces ordinary PSK four-way authentication weaknesses for WPA3-Personal.
Incorrect Answers
B:A WPA2 preshared-key setup is not the WPA3-Personal SAE password-authenticated key exchange specified.
C:WEP is obsolete and does not supply SAE’s password-authenticated key establishment.
D:An open authentication mode cannot provide the described WPA3-SAE password proof.
Question 709
An enterprise WLAN authenticates each staff identity through 802.1X/EAP rather than a shared PSK while using WPA2 data confidentiality. What WPA2 security mode is this?
- Use WPA2-Personal PSK shared by all staff instead of unique 802.1X identities
- Recognize WPA2-Enterprise 802.1X/EAP
- Use WPA3-Personal SAE with one shared password in place of 802.1X
- Use WEP static key encryption with no central identity verification
Explanation
Correct Answer
B:Enterprise WLAN authentication uses EAP and typically RADIUS rather than one shared passphrase.
Incorrect Answers
A:A shared passphrase does not supply the employee-specific EAP/RADIUS authentication requirement.
C:SAE Personal is not the described WPA2-Enterprise credential-based EAP authentication.
D:WEP lacks the specified strong WPA2 data confidentiality and 802.1X enterprise identity system.
Question 710
A small-office WLAN uses a shared secret with AES-CCMP; clients do not need individual RADIUS EAP identities. Which WPA2 security mode matches that arrangement?
- Recognize WPA2-Personal PSK
- Use WPA2-Enterprise EAP/RADIUS for each user even though the question excludes individual identities
- Use WPA3-SAE-only and require incompatible clients to upgrade
- Use WPA1 TKIP-only instead of WPA2 AES-CCMP
Explanation
Correct Answer
A:WPA2-Personal uses a shared secret rather than a per-user enterprise EAP identity.
Incorrect Answers
B:Enterprise 802.1X is a different mode from the required single shared pre-shared-key WLAN.
C:WPA3 Personal uses SAE rather than the stipulated compatible WPA2-Personal PSK connection.
D:TKIP-only legacy WPA does not satisfy the stated WPA2-Personal AES-CCMP requirement.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
