100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 710
A small-office WLAN uses a shared secret with AES-CCMP; clients do not need individual RADIUS EAP identities. Which WPA2 security mode matches that arrangement?
- Recognize WPA2-Personal PSK
- Use WPA2-Enterprise EAP/RADIUS for each user even though the question excludes individual identities
- Use WPA3-SAE-only and require incompatible clients to upgrade
- Use WPA1 TKIP-only instead of WPA2 AES-CCMP
Explanation
Correct Answer
A:WPA2-Personal uses a shared secret rather than a per-user enterprise EAP identity.
Incorrect Answers
B:Enterprise 802.1X is a different mode from the required single shared pre-shared-key WLAN.
C:WPA3 Personal uses SAE rather than the stipulated compatible WPA2-Personal PSK connection.
D:TKIP-only legacy WPA does not satisfy the stated WPA2-Personal AES-CCMP requirement.
Question 711
A WLAN administrator considers hiding the SSID to improve security on a WPA2-Personal employee network. What is the defensible security conclusion?
- Disabling the SSID broadcast makes the network invisible to any radio sniffer and replaces WPA2 encryption
- The SSID itself authenticates clients and therefore a hidden name is equivalent to a strong PSK
- Hiding the SSID does not provide meaningful confidentiality or authentication and can cause client compatibility issues
- Selecting a longer SSID automatically upgrades the network from WPA2-Personal to WPA3-SAE
Explanation
Correct Answer
C:Cisco notes that hiding SSIDs does not materially improve security and may hinder connection behavior; retain approved WPA2 security controls.
Incorrect Answers
A:The network name can still appear in other management frames; hiding a beacon name does not replace cryptographic access control.
B:An SSID is a network identifier, not a client credential or encryption protocol.
D:SSID length does not negotiate WPA3 or change the configured key-establishment method.
Question 712
A controller has a WLAN named `Lab-WiFi`, and the requirement is WPA2-Personal authentication instead of an open SSID or WPA3-only SAE. Which security mode should be selected in the GUI?
- Select Open authentication and rely on a strong SSID name
- Select WPA3-Personal SAE only
- Select WPA2-PSK security mode
- Select WPA2-Enterprise 802.1X without shared PSK
Explanation
Correct Answer
C:WPA2-Personal/PSK configures a shared-secret authentication method instead of permitting unauthenticated open associations. The PSK still has to match the clients and AES-CCMP must be configured for the protected data.
Incorrect Answers
A:A broadcast network name does not authenticate clients; an open network lacks the requested WPA2-Personal method.
B:SAE-only excludes endpoints that support only the requested WPA2-Personal PSK mode.
D:Enterprise EAP/RADIUS identities are a different authentication model from the specified WPA2-Personal network.
Question 713
A new WPA2-PSK WLAN is enabled but clients fail authentication because the controller PSK is empty or differs from the client. Which shared-secret entry must be configured identically on both sides?
- Reuse the controller management account password in place of a WLAN PSK
- Leave the WLAN PSK blank and increase radio transmit power
- Create a different passphrase for each client without a matching dynamic-PSK feature
- Enter a strong matching WPA2 pre-shared key
Explanation
Correct Answer
D:Both the controller WLAN profile and client must have the same approved pre-shared secret for the WPA2 key handshake to succeed. A correct SSID or VLAN assignment cannot repair a password mismatch.
Incorrect Answers
A:The controller admin login is not the WPA2-Personal pre-shared key entered by wireless stations.
B:WPA2-Personal needs a valid agreed secret to complete key establishment; stronger signal does not create that secret.
C:Ordinary WPA2-Personal PSK clients must use the key matching the configured WLAN; uncoordinated values fail authentication.
Question 714
The WPA2-Personal security policy is already selected, but the wireless data cipher is left at legacy TKIP. Which AES-based protection should be chosen for modern WPA2 client traffic?
- Select AES-CCMP data protection
- Keep TKIP-only encryption enabled for the WPA2 network
- Replace AES-CCMP with WEP while leaving PSK authentication
- Disable all cipher suites and rely on the WLAN passphrase alone
Explanation
Correct Answer
A:AES-CCMP provides WPA2 protected-frame encryption and integrity behavior, unlike deprecated TKIP-only configurations. Selecting the correct security mode without matching the encryption profile may leave a weak or incompatible WLAN.
Incorrect Answers
B:TKIP-only mode is the legacy confidentiality method explicitly excluded by the AES requirement.
C:WEP provides an older incompatible/insecure cipher and does not satisfy modern WPA2 AES-CCMP policy.
D:A passphrase without a valid protected data cipher does not provide the stated WPA2 confidentiality.
Question 715
An associated client connects to SSID `Lab-WiFi` but lands in staff VLAN 10 instead of intended guest VLAN 30. Which WLAN interface/VLAN mapping must be corrected?
- Map the WLAN to the correct VLAN or controller interface
- Change the WPA2 pre-shared key but keep the staff VLAN binding
- Rename the SSID while keeping its staff-VLAN interface mapping
- Increase the guest DHCP server lease duration
Explanation
Correct Answer
A:The WLAN-to-VLAN mapping determines the client wired network segment.
Incorrect Answers
B:The client already associates; changing the PSK does not correct its authenticated traffic being bridged into the wrong network.
C:An SSID name does not modify the controller client VLAN binding.
D:Lease time does not move the client data path from VLAN 10 into the required guest VLAN 30.
Question 716
A WPA2-Personal guest WLAN uses a short common passphrase that was posted publicly. Devices still connect normally, but the WLAN secret can now be guessed or reused. Which GUI credential change directly reduces that exposure?
- Keep the leaked short PSK and only reduce SSID beacon visibility
- Replace the shared PSK with a long unpredictable secret and securely update authorized clients
- Change only the guest VLAN mapping without rotating the exposed PSK
- Switch to TKIP-only encryption while retaining the leaked PSK
Explanation
Correct Answer
B:The compromised WPA2-Personal pre-shared key must be rotated to a strong new value and distributed securely to permitted clients. Hiding an SSID, changing VLANs or switching to TKIP does not remediate the leaked credential.
Incorrect Answers
A:SSID hiding does not protect a weak known/shared passphrase against offline guessing once handshake traffic is observed.
C:Segmentation does not revoke a compromised WPA2-Personal credential, which remains usable for WLAN authentication.
D:TKIP is not a remedy for a disclosed shared secret and weakens the required modern WLAN data protection.
Question 717
A test SSID is accidentally set to open authentication even though company policy requires WPA2-Personal shared-secret authentication. Which GUI security-mode selection fixes the missing authentication?
- Keep Open authentication and enable only 802.11 management frame protection
- Set a strong controller administrator password without changing WLAN security
- Rename the SSID to include the text WPA2
- Enable WPA2-Personal instead of open authentication
Explanation
Correct Answer
D:The WPA2-PSK security profile requires authenticated protected access.
Incorrect Answers
A:Frame-management protections do not add WPA2-Personal PSK authentication to an intentionally open WLAN.
B:The controller management login cannot replace the WLAN client authentication method.
C:An SSID name has no security effect; the WLAN authentication/AKM mode must actually change.
Question 718
A Catalyst 9800 has a WPA2-Personal guest WLAN in a policy tag, but that WLAN is associated with a policy profile selecting staff VLAN 20; visitors must instead land in guest VLAN 30. Which GUI mapping needs correction?
- Only change the SSID name from Guest to Guest30
- Bind the guest WLAN to an enabled policy profile selecting VLAN 30
- Increase the DHCP pool size in VLAN 20 so it serves more guests
- Change the AES data cipher while retaining the wrong policy profile
Explanation
Correct Answer
B:On Catalyst 9800, the policy tag maps a WLAN to a policy profile whose access-policy VLAN determines client network placement. Rebinding to a profile using VLAN 30 corrects the guest data path without changing the WPA2 PSK.
Incorrect Answers
A:SSID identity does not determine the VLAN selected by the controller policy profile.
C:Expanding the wrong staff VLAN does not send guest client frames into VLAN 30 as required.
D:Layer-2 encryption cannot correct a WLAN-to-VLAN 20 policy binding.
Question 719
All parameters of a new WLAN are configured, but its admin status is disabled and the SSID is not advertised as required. Which WLAN enable/broadcast settings must be corrected for clients to discover it?
- Increase SSID transmit power while keeping the WLAN administratively disabled
- Alter the WPA2 PSK only and leave advertisement disabled
- Map the WLAN to a different VLAN but leave the WLAN disabled
- Enable the WLAN and correct its broadcast state
Explanation
Correct Answer
D:A disabled WLAN cannot accept ordinary client associations.
Incorrect Answers
A:RF power cannot advertise a WLAN whose service is disabled by the controller configuration.
B:Authentication keys apply when clients join; they cannot enable a hidden/disabled WLAN to appear.
C:A different client subnet does not activate the SSID on the required AP radios.
Question 720
A WPA2-Personal wireless security profile still permits legacy TKIP in mixed cipher mode. The security baseline requires clients to negotiate AES-CCMP and prohibits TKIP. What setting must be validated and enforced?
- Configure AES-CCMP as the permitted WPA2 data cipher and disable TKIP
- Enable WPA2 with both TKIP and AES while leaving legacy TKIP selectable
- Change the WLAN SSID name to include AES
- Enable open authentication and depend on upstream VPNs for encryption
Explanation
Correct Answer
A:The WLAN encryption policy should permit AES-CCMP for WPA2-Personal data and remove TKIP negotiation under the AES-only baseline. Changing SSIDs or management settings cannot enforce the negotiated cipher.
Incorrect Answers
B:The compliance requirement explicitly prohibits TKIP-only and legacy cipher negotiation; leaving TKIP enabled is not a verified AES-only posture.
C:An SSID name does not control or prove the negotiated data cipher.
D:A VPN may protect selected applications but does not satisfy WPA2-Personal AES-CCMP radio-link confidentiality requirements.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
