What the v1.1 topic list asks
Wireless is spread across three Cisco domains in v1.1, which is why it adds up to one of the larger areas on this site: RF and channel principles (1.11), wireless architectures and AP modes (2.6), physical connections of WLAN components (2.7), the WLC GUI for building a WLAN with its security and QoS profiles (2.9), WPA, WPA2 and WPA3 (5.9), and a WPA2-PSK WLAN configured in the GUI (5.10).
Controller and access points
An autonomous AP carries its own configuration and is managed one box at a time. A lightweight AP discovers a controller, joins it, and from then on the work is split, the split-MAC design: the AP handles the time-critical 802.11 functions such as beacons and acknowledgements, the controller handles association, authentication and policy. They talk over Control and Provisioning of Wireless Access Points (CAPWAP, RFC 5415), UDP port 5246 carrying control messages and 5247 carrying client data. Cloud-managed APs move the controller role to a hosted dashboard.
Before any of that, the AP has to find a controller. It can hear one by a local broadcast, receive its address in DHCP option 43, or resolve the DNS name CISCO-CAPWAP-CONTROLLER in its local domain. Once joined, the AP takes its configuration from the controller, and each WLAN is tied on the controller to an interface, which is to say a VLAN and subnet on the wired side.
On the wired side, an AP in local mode sits on an access port, since all client traffic rides inside CAPWAP; an AP that switches several VLANs locally needs a trunk. The controller reaches the switch over trunks, and link aggregation (LAG) bundles its ports into one static logical link, the controller-side cousin of the EtherChannel bundles in the previous study area.
From the radio side the route turns to Layer 3: routing tables and static routes is the next study area, and the heaviest one on this site by our estimate.
AP modes and what each is for
| Mode | Serves clients | What it does |
|---|---|---|
| Local | Yes | The default. Tunnels all client traffic to the controller inside CAPWAP. |
| FlexConnect | Yes | For branch sites: can switch client traffic at the AP instead of sending it across the WAN. |
| Monitor | No | Scans every channel for rogue devices and intrusion signatures. |
| Sniffer | No | Captures 802.11 traffic on one channel and forwards it to a remote packet analyzer. |
| Bridge / mesh | Yes | Links APs to each other over the air where running cable is impractical. |
| Flex+Bridge | Yes | Mesh backhaul combined with FlexConnect local switching. |
| SE-Connect | No | Gives the radio to spectrum analysis, for finding non-Wi-Fi interference. |
Radio terms worth owning
- BSS and BSSID
- One AP’s cell and its clients. The BSSID is the MAC address of the AP radio serving that WLAN.
- ESS
- Several BSSs sharing an SSID over a common wired network, so a client can roam from AP to AP.
- Channel overlap
- In 2.4 GHz, 20 MHz channels sit 5 MHz apart, so only a few avoid each other. 5 GHz has many more non-overlapping channels, and wider channels are built by bonding them.
- dBm and RSSI
- Received signal is quoted in dBm, a negative number where closer to zero is stronger. Every 3 dB doubles or halves the power.
- SNR
- Signal minus noise floor, in dB. A strong signal over a high noise floor still performs poorly.
- Interference
- Co-channel interference comes from other Wi-Fi on the same channel; non-Wi-Fi sources add noise that no channel plan removes.
Frames: Wireless LANs
Channels, AP modes, controller links and WLAN security, drawn from all six v1.1 topics. The wireless filter on the practice test repeats the domain in a mixed order.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 019 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 019
When two wireless access points are configured with the same SSID and security settings, what is used to determine which access point a device will connect to?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: with the same SSID and security, a client usually picks the AP it hears best, the one with the strongest signal (RSSI).
Note on B
MAC addresses identify each AP radio (the BSSID); a client does not choose by MAC value.
Note on C
The security protocol is identical on both APs in this setup, so it cannot decide between them.
Note on D
Channel frequency matters for interference, but a client does not prefer one channel over another; it chooses by signal.
Best answer: A · why
If two wireless access points have the same SSID and security settings, the device will typically connect to the one with the stronger signal strength. This ensures a more stable and faster connection.
- Frame 002 of 019Choose 2
What are two characteristics of Wi-Fi networks operating in the 2.4 GHz band? (Choose two.)
Choose 2 options, then Check answer. Open the note under any option to see why.
Note on A
The 2.4 GHz band has only three non-overlapping channels and is shared with many devices, so it is usually more congested.
Note on B
Narrower channels and fewer channel options mean 2.4 GHz WLANs generally reach lower data rates than 5 GHz ones.
Note on C
Correct. Microwave ovens, Bluetooth and neighboring WLANs all use 2.4 GHz, and only three channels do not overlap.
Note on D
Correct. Lower-frequency signals lose less strength over distance and pass through walls better, so coverage reaches further.
Best answers: C and D · why
Compared with 5 GHz, the 2.4 GHz band travels further and penetrates walls better because lower frequencies attenuate less. The trade-offs are crowding and lower throughput: there are only three non-overlapping 20 MHz channels (1, 6 and 11 in North America), and the band is shared with Bluetooth, microwave ovens and older devices. That is why designs push capable clients to 5 GHz or 6 GHz.
- Frame 003 of 019
In the context of wireless networking, which type of wireless frame is responsible for establishing and maintaining the connection with the access point?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Beacon frames are one type of management frame that advertises the network; on their own they do not handle authentication and association.
Note on B
Correct: management frames (beacons, probes, authentication, association and reassociation) set up and maintain the client’s connection to the AP.
Note on C
Control frames such as RTS, CTS and ACK manage access to the medium; they do not build the association.
Note on D
Data frames carry the user payload once the client is already associated.
Best answer: B · why
802.11 has three frame types. Management frames, such as beacons, probe requests and responses, authentication frames, and association and reassociation frames, discover the network and build and maintain the client’s connection to the AP. Control frames (RTS, CTS, ACK) coordinate access to the medium, and data frames carry the payload. Beacons are only one kind of management frame.
- Frame 004 of 019
What is the impact of WPA3 over WPA2 in securing wireless networks on Cisco devices?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
WPA3-Personal moves away from relying on the passphrase alone: SAE resists offline guessing even when the passphrase is short.
Note on B
Segmentation is still needed; WPA3 secures the wireless link, not the separation between user groups.
Note on C
Encryption changes nothing about radio range; coverage depends on transmit power, antennas and the band.
Note on D
Correct: WPA3-Personal replaces PSK authentication with SAE, makes management frame protection mandatory, and WPA3-Enterprise adds a 192-bit mode.
Best answer: D · why
WPA3 strengthens WPA2 in several ways. WPA3-Personal replaces PSK authentication with SAE, which resists offline dictionary attacks; protected management frames are mandatory; and WPA3-Enterprise offers a 192-bit security mode. It does not change radio range or remove the need for network segmentation.
- Frame 005 of 019
In a Cisco wireless LAN controller GUI, where would you configure client QoS profiles?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The Security section holds AAA, RADIUS and access-control settings; QoS profiles are not assigned there.
Note on B
Correct: on the controller GUI you open the WLAN under WLANs and use its QoS tab to choose the profile (Platinum, Gold, Silver or Bronze).
Note on C
Management covers how the controller itself is administered, such as HTTP, SNMP and SSH; it does not hold client QoS.
Note on D
Controller > General holds global settings such as the controller name and LAG mode, not per-WLAN QoS.
Best answer: B · why
On the AireOS controller GUI, client QoS is set per WLAN: open WLANs, edit the WLAN, and on its QoS tab choose a profile (Platinum for voice, Gold for video, Silver for best effort, Bronze for background). Security holds AAA and access-control settings, Management covers how the controller is administered, and Controller holds global settings.
- Frame 006 of 019
What is the purpose of an SSID in a wireless network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: the SSID is the network name (up to 32 characters) that clients see and use to pick which WLAN to join.
Note on B
Transmit power is a radio setting on the AP; the network name does not change it.
Note on C
Encryption comes from the security settings, such as WPA2 or WPA3; the SSID is only a label.
Note on D
Client limits are set separately on the WLAN or AP; the SSID itself caps nothing.
Best answer: A · why
The Service Set Identifier (SSID) is the primary name of a wireless network. Its purpose is to identify and distinguish one wireless network from another. When multiple wireless networks are available in the same area, devices use the SSID to identify which network they want to connect to. SSIDs can be up to 32 characters long and are case-sensitive.
- Frame 007 of 019
Which factor has the most significant impact on the range and coverage of a wireless network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The authentication method controls who may join, not how far the signal reaches.
Note on B
Hiding the SSID only removes it from beacons; radio coverage stays exactly the same.
Note on C
MAC filtering only decides which clients may associate; it has no effect on signal reach.
Note on D
Correct: transmit power, together with antennas and obstacles, sets how far the AP’s signal carries and so its coverage area.
Best answer: D · why
Transmit power has the most significant impact on the range and coverage of a wireless network. Higher transmit power allows the signal to travel farther and penetrate obstacles more effectively. However, regulatory limits on transmit power exist in most countries, and higher power can also increase interference with other networks.
- Frame 008 of 019
Which set of Wi-Fi channels in the 2.4 GHz band is the standard non-overlapping channel plan in North America?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: channels 1, 6 and 11 sit 25 MHz apart, so they do not overlap, and all three are within the 1 to 11 range used in North America.
Note on B
Channel 13 is outside the 1 to 11 range used in North America, so this set is not the plan used there.
Note on C
Channels 1 and 5 are only 20 MHz apart, less than the 22 MHz width of a 2.4 GHz channel, so their edges overlap.
Note on D
Channel 12 is outside the 1 to 11 range used in North America, so this set cannot be the standard plan there.
Best answer: A · why
Each 2.4 GHz channel is about 22 MHz wide, but channel centers are only 5 MHz apart, so neighboring channels overlap heavily. In North America, where channels 1 to 11 are used, 1, 6 and 11 are the only three that are 25 MHz apart and do not overlap, so they form the standard reuse plan. The 5 GHz band offers many more non-overlapping channels.
- Frame 009 of 019
What security issue can arise when a wireless access point is configured with WPA2-PSK but maintains the default SSID?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
WPA2-PSK authenticates clients normally whatever the SSID is called; the name does not stop the handshake.
Note on B
Nothing downgrades to WEP because of the SSID; the security mode is a separate setting.
Note on C
The SSID name has no effect on broadcast traffic inside the network.
Note on D
Correct: WPA2 mixes the SSID into the key derivation, so precomputed tables built for common default SSIDs speed up guessing a weak PSK.
Best answer: D · why
WPA2-Personal derives its key from the passphrase and the SSID. Attackers have precomputed tables for common default SSIDs, so a captured handshake from such a network can be tested against a weak passphrase much faster. A default SSID also reveals the vendor. The fixes are a unique SSID and a long, random passphrase, or WPA3-Personal with SAE.
- Frame 010 of 019
In which scenario is a standalone AP deployment most suitable?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A university campus has many APs over a wide area, which calls for central control by a WLC or the cloud.
Note on B
A large corporate office needs coordinated channels, roaming and policy, which standalone APs cannot provide at scale.
Note on C
Correct: a small office with one or a few APs can run autonomous APs, each configured on its own, with no controller to buy or manage.
Note on D
Remote branches are usually managed centrally, for example as FlexConnect APs controlled by a WLC at headquarters.
Best answer: C · why
Autonomous (standalone) APs are configured one by one and need no controller, which suits a small office with only a few APs. Campuses, large offices and fleets of remote branches need consistent configuration, roaming and RF management, so they use lightweight APs managed by a WLC, FlexConnect for branches, or cloud management.
- Frame 011 of 019
In a Cisco Wireless LAN Controller environment using lightweight APs, what is the primary reason for configuring distinct VLANs?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: mapping management and client WLANs to distinct VLANs keeps controller and AP management apart from user traffic, for security and control.
Note on B
EtherChannel (LAG on the controller) bundles ports; it does not depend on how many VLANs you create.
Note on C
VLANs separate traffic logically; adding them does not add bandwidth to the trunk.
Note on D
LLDP is a discovery protocol configured on its own; the VLAN design has nothing to do with it.
Best answer: A · why
On a WLC, the management interface and each WLAN’s client traffic are mapped to VLANs. Keeping client data in VLANs separate from the management VLAN keeps users away from the controller and AP management network and lets each WLAN map to its own subnet and policy. VLANs do not add bandwidth and are unrelated to EtherChannel or LLDP.
- Frame 012 of 019
In FlexConnect wireless architecture, what happens to client data traffic when the WAN link to the controller is down?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
FlexConnect does not need another controller to keep local traffic moving; the AP switches it itself.
Note on B
Correct: a FlexConnect AP in standalone mode keeps switching locally switched WLAN traffic onto its own VLANs while the WAN link to the WLC is down.
Note on C
Clients on locally switched WLANs stay connected; this survival is the main reason to use FlexConnect at branches.
Note on D
Traffic is not held for later; it keeps flowing locally, while centrally switched traffic stops until the link returns.
Best answer: B · why
In FlexConnect wireless architecture, when the WAN link to the controller is down, client data traffic is switched locally at the access point. This allows clients to continue accessing local network resources even when the connection to the central controller is lost.
- Frame 013 of 019
Which of the following is NOT a valid connection type between a wireless access point and a wireless LAN controller?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Mesh APs reach the controller over a wireless backhaul through a root AP, so mesh is a valid way to connect.
Note on B
Correct: APs reach a WLC over IP using CAPWAP, across Ethernet or a wireless mesh; a serial link is not a way to connect an AP to a controller.
Note on C
CAPWAP is exactly how lightweight APs talk to a WLC, with control on UDP 5246 and data on UDP 5247.
Note on D
An AP is usually cabled by Ethernet to a switch and reaches the WLC through it, so Ethernet is a normal connection.
Best answer: B · why
Lightweight APs join a WLC through CAPWAP tunnels over an IP network, with control on UDP 5246 and data on UDP 5247. The AP’s own uplink is usually Ethernet to a switch, and mesh APs reach the network wirelessly through a root AP. A serial link is not used between APs and controllers.
- Frame 014 of 019
Which IEEE standard defines the specifications for wireless LAN (WLAN) implementation?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: IEEE 802.11 defines wireless LANs, with amendments such as 802.11a/b/g/n/ac/ax for bands and data rates.
Note on B
802.1Q is the VLAN tagging standard used on trunks.
Note on C
802.1X is port-based access control, used for WPA2 and WPA3 Enterprise authentication, not the WLAN itself.
Note on D
802.3 is the Ethernet standard for wired LANs.
Best answer: A · why
IEEE 802.11 is the standard that defines specifications for implementing wireless local area networks (WLANs). It includes various amendments (like 802.11a, 802.11b, 802.11g, 802.11n, 802.11ac, and 802.11ax) that specify different frequencies, data rates, and technologies for Wi-Fi communication.
- Frame 015 of 019
Which of the following is NOT a recommended practice for securing wireless guest networks?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: sharing one SSID with the corporate network mixes guests and employees on the same WLAN, which defeats the separation a guest network exists for.
Note on B
Bandwidth limits for guests are a recommended practice; they keep guests from crowding out business traffic.
Note on C
A captive portal is recommended; it adds terms acceptance or sign-in before guests get access.
Note on D
Isolating the guest network from corporate resources is the core recommendation, not something to avoid.
Best answer: A · why
Using the same SSID for guest and corporate networks is not a recommended practice for securing wireless guest networks. This could lead to confusion and potential security breaches. Guest networks should have a separate SSID, be isolated from the corporate network, use captive portals for authentication, and have appropriate bandwidth limitations.
- Frame 016 of 019
What is the standard protocol used for wireless authentication in enterprise networks that supports multiple EAP methods?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
MAC filtering only checks a hardware address that is easy to spoof; it does not use EAP.
Note on B
Correct: 802.1X is the enterprise framework that carries EAP methods such as PEAP or EAP-TLS between the client, the AP or WLC, and a RADIUS server.
Note on C
WEP is an obsolete encryption method with a static key; it supports no EAP methods.
Note on D
WPA2-PSK uses one shared passphrase for everyone, the opposite of per-user EAP authentication.
Best answer: B · why
802.1X is the IEEE standard protocol used for wireless authentication in enterprise networks. It provides a framework that supports multiple EAP (Extensible Authentication Protocol) methods and works with an authentication server like RADIUS to authenticate wireless clients.
- Frame 017 of 019
Which of the following wireless networking standards operates solely in the 5 GHz band?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
802.11n works in both the 2.4 GHz and 5 GHz bands.
Note on B
Correct: 802.11a uses only the 5 GHz band, with rates up to 54 Mbps.
Note on C
802.11b uses only the 2.4 GHz band.
Note on D
802.11g also uses only 2.4 GHz, with OFDM rates up to 54 Mbps.
Best answer: B · why
802.11a uses only the 5 GHz band. 802.11b and 802.11g use only 2.4 GHz, and 802.11n can use either band. Of the later standards, 802.11ac is 5 GHz only, while 802.11ax works in 2.4 and 5 GHz and, as Wi-Fi 6E, in 6 GHz.
- Frame 018 of 019
Which security feature of a wireless network ensures that eavesdroppers cannot understand the network traffic?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Integrity checks detect changed data, but without encryption an eavesdropper could still read it.
Note on B
Authentication proves who is joining; on its own it does not hide the traffic from listeners.
Note on C
Anti-replay protection stops captured frames from being resent; it does not make them unreadable.
Note on D
Correct: encryption (AES-CCMP in WPA2, for example) turns frames into ciphertext that only holders of the key can read.
Best answer: D · why
Encryption keeps eavesdroppers from understanding captured traffic; WPA2 uses AES-CCMP and WPA3 uses AES-based ciphers as well. Authentication proves the identity of a user or device, integrity checks detect changes to frames, and anti-replay protection rejects frames that were captured and sent again.
- Frame 019 of 019Choose 3
Which three types of devices are typically considered as access points within a network? (Choose three.)
Choose 3 options, then Check answer. Open the note under any option to see why.
Note on A
Correct: a range extender relays the signal and offers its own access point radio for clients to join.
Note on B
A core switch forwards traffic in the wired backbone; it has no radio for clients.
Note on C
A firewall filters traffic by policy; it is not a wireless access device.
Note on D
Correct: a dedicated AP exists only to bridge wireless clients onto the wired network.
Note on E
Correct: a home or small-office wireless router has a built-in access point alongside its routing and switching functions.
Best answers: A, D and E · why
An access point bridges wireless clients onto the wired network. Dedicated APs do only that, wireless routers combine an AP with a router and a switch, and range extenders repeat the signal with their own AP radio. Core switches and firewalls work on wired traffic and have no radio for clients.
What stays and what goes in v2.0
| Point of comparison | v1.1 (current) | v2.0 |
|---|---|---|
| RF, channels, SSID | 1.11 | 1.5 |
| Interference | Inside RF principles | Named in 1.5 |
| Architectures and AP modes | 2.6 | Not listed |
| WLC physical connections | 2.7 | Not listed |
| WLC GUI: WLAN, security, QoS | 2.9 | Not listed |
| WPA, WPA2, WPA3 | 5.9 | 1.5 (security protocols) |
| WPA2-PSK built in the GUI | 5.10 | Not listed |
Sources: v1.1 exam topics and v2.0 exam topics. When the switch happens: v2.0 changeover page.
Wireless, briefly
Can I rehearse the controller GUI without hardware?
Yes. Packet Tracer includes wireless LAN controller models with a web GUI, enough to build a WLAN with WPA2-PSK security for topics 2.9 and 5.10, and Cisco’s CCNA certification page recommends Packet Tracer for hands-on practice.
Is CAPWAP a VPN tunnel?
Not in the IPsec sense. CAPWAP (RFC 5415) carries control traffic and, in local mode, client data between AP and controller; the control channel is protected with DTLS and data encryption is optional. Site-to-site and remote-access VPNs belong to security concepts and VPNs.
Why does a lightweight AP need a controller at all?
Because the split-MAC design leaves association, authentication and policy to the controller. A local-mode AP that loses its controller stops serving clients and goes back to discovery until it joins one again.
Concepts in this study area
- WPA2 vs WPA3PSK vs SAE, Personal vs Enterprise, and what WPA3 changes.