CCNA Wireless Fundamentals Practice Questions

How to work these questions

1. Identify the band first. If the question mentions 2.4 GHz, think three usable 20 MHz channels (1, 6, 11), more range and more interference; 5 GHz means many non-overlapping channels and support for wider channels; 6 GHz exists only with Wi-Fi 6E and newer.
2. Match the standard to the band: 802.11b and 802.11g are 2.4 GHz only, 802.11a and 802.11ac are 5 GHz only, 802.11n and 802.11ax work in both, and 802.11ax with 6E adds 6 GHz.
3. Decide whether the access point is autonomous or lightweight. A lightweight AP needs a WLC, builds CAPWAP tunnels on UDP 5246 (control) and 5247 (data), and splits the MAC functions with the controller.
4. For a lightweight AP, check the mode: local mode tunnels client traffic to the WLC; FlexConnect can switch it locally at the branch and keeps working if the WAN to the controller fails.
5. Trace the WLAN mapping on the controller: SSID to WLAN profile, WLAN to a dynamic interface, dynamic interface to a VLAN and subnet. The management interface is for managing the WLC and terminating CAPWAP, not for client traffic.
6. Read the security requirement last and translate it: shared passphrase means WPA2-Personal (PSK with AES-CCMP) or WPA3-Personal (SAE); per-user credentials means WPA2/WPA3-Enterprise with 802.1X and a RADIUS server; guests usually get open authentication plus web authentication.

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

1. Question 1 of 10Scenario

   An office floor has four access points that radiate only in the 2.4 GHz band. To spread the load, the previous administrator set them manually to channels 1, 4, 8 and 11 at 20 MHz width. Users in the middle of the floor report slow throughput even though their laptops show a received signal of -55 dBm. What should you change?

   1. Raise the transmit power on all four access points
   2. Set the channel width on every access point to 40 MHz
   3. Reassign the access points so they use only channels 1, 6 and 11
   4. Move all four access points to channel 6 so they share one channel
   Show the answer

   Answer: C

   In the 2.4 GHz band each 20 MHz channel is about 22 MHz wide while channel centres are only 5 MHz apart, so just three channels, 1, 6 and 11, can be used side by side without overlapping. Channels in between interfere with both neighbours. A good RSSI with poor throughput is a typical sign of channel interference rather than coverage.

   • A. Signal strength is already good at -55 dBm, so more power would not help; it would increase the area in which the overlapping channels interfere with each other.
   • B. A 40 MHz channel in 2.4 GHz covers most of the band, which leaves no room for neighbouring access points and makes the overlap worse, not better.
   • C. In 2.4 GHz only channels 1, 6 and 11 are far enough apart that 20 MHz channels do not overlap; channels 4 and 8 overlap with both neighbours and cause adjacent-channel interference, which shows up as poor throughput despite a strong signal.
   • D. Putting every access point on the same channel forces them all to share one channel's airtime through co-channel contention, so throughput would drop further.

2. Question 2 of 10Calculation

   During a site survey the analyser at a desk reports a received signal strength of -67 dBm and a noise floor of -94 dBm. What is the signal-to-noise ratio at that desk?

   1. 27 dB
   2. -27 dBm
   3. 67 dB
   4. 161 dB
   Show the answer

   Answer: A

   SNR = received signal (dBm) minus noise floor (dBm), and the result is in dB. Here -67 - (-94) = 27 dB. A higher SNR allows faster data rates; a stronger signal in a noisier room can still give a worse SNR than a weaker signal in a quiet one.

   • A. SNR is signal minus noise: -67 dBm minus -94 dBm equals 27 dB, a comfortable margin for data traffic.
   • B. The difference between two dBm values is expressed in dB, not dBm, and subtracting a more negative noise floor from the signal gives a positive result.
   • C. Using the signal strength alone ignores the noise floor; 67 is only the magnitude of the received signal.
   • D. Adding the two magnitudes together has no physical meaning; the ratio is the difference between them.

3. Question 3 of 10Concept

   Which two 802.11 standards can operate in both the 2.4 GHz and the 5 GHz band? (Choose two.)

   1. 802.11a
   2. 802.11n
   3. 802.11ac
   4. 802.11ax
   5. 802.11g
   Show the answer

   Answer: B and D

   Remember the bands by standard: b and g are 2.4 GHz only, a and ac are 5 GHz only, n and ax work in both, and ax with 6E adds 6 GHz. Exam questions often hide this behind a dual-band access point description, so check each radio separately.

   • A. 802.11a was defined for the 5 GHz band only and never operated in 2.4 GHz.
   • B. 802.11n (Wi-Fi 4) was the first standard specified for both 2.4 GHz and 5 GHz, with optional 40 MHz channels.
   • C. 802.11ac (Wi-Fi 5) operates in the 5 GHz band only; a dual-band access point that advertises 802.11ac uses 802.11n for its 2.4 GHz radio.
   • D. 802.11ax (Wi-Fi 6) runs in both 2.4 GHz and 5 GHz, and the Wi-Fi 6E extension adds the 6 GHz band.
   • E. 802.11g is a 2.4 GHz standard that raised rates to 54 Mbps while staying compatible with 802.11b.

4. Question 4 of 10Exhibit

   Refer to the exhibit. IoT sensors that connect to the ravena-iot SSID receive addresses in 10.10.10.0/24, the same subnet as the controller's management address, and the security team wants them in their own VLAN. What is the cause?

   WLC1 > WLANs
   ID  Profile  SSID          Interface    VLAN  L2 Security          Status
   1   CORP     ravena-corp   corp-data    20    WPA2 (AES) 802.1X    Enabled
   2   GUEST    ravena-guest  guest-net    90    None + Web Auth      Enabled
   3   IOT      ravena-iot    management   10    WPA2 (AES) PSK       Enabled
   
   WLC1 > Controller > Interfaces
   Name         VLAN  IP address
   management   10    10.10.10.5/24
   corp-data    20    10.10.20.5/24
   guest-net    90    10.10.90.5/24

   1. WLAN 3 uses PSK security, which places clients in the controller's VLAN by default
   2. WLAN 3 is mapped to the management interface instead of a dynamic interface for the IoT VLAN
   3. WLAN 3 was created after WLAN 1 and therefore inherits the interface of the first WLAN
   4. The access points serving WLAN 3 run in FlexConnect mode and switch the IoT traffic locally
   Show the answer

   Answer: B

   On a WLC, the SSID is tied to a WLAN profile and the WLAN is mapped to an interface; that interface carries a VLAN and a subnet, which is where clients get their addresses. The management interface is for managing the controller and terminating CAPWAP. Client WLANs belong on dynamic interfaces, one per VLAN.

   • A. The Layer 2 security method decides how clients authenticate and encrypt; it has no influence on which VLAN the clients are placed in.
   • B. A WLAN puts its clients in the VLAN of the interface it is mapped to; WLAN 3 points at the management interface in VLAN 10, so the sensors land in 10.10.10.0/24. The fix is a new dynamic interface in a dedicated IoT VLAN and remapping WLAN 3 to it.
   • C. WLANs do not inherit settings from each other; each WLAN is mapped to an interface explicitly, and WLAN 1 uses corp-data anyway, not management.
   • D. Nothing in the exhibit shows FlexConnect, and locally switched traffic would use a VLAN at the branch switch, not the controller's management subnet.

5. Question 5 of 10Scenario

   Twenty lightweight access points in local mode were installed in a new building. They receive addresses by DHCP in 10.20.40.0/24, learn the controller's address 10.10.10.5 through DHCP option 43 and can ping it, but none of them joins the controller. A firewall sits between the two subnets. Which traffic must the firewall allow from the access points to the controller?

   1. TCP 5246 and TCP 5247
   2. UDP 1812 and UDP 1813
   3. TCP 22 and TCP 443
   4. UDP 5246 and UDP 5247
   Show the answer

   Answer: D

   A lightweight access point joins its controller with CAPWAP, which uses UDP 5246 for control and UDP 5247 for data. Ping succeeding only proves IP reachability. If a firewall or ACL blocks those UDP ports the access point discovers the controller but never completes the join, and in local mode no client traffic can flow because it all travels through the data tunnel.

   • A. The port numbers are the right ones but CAPWAP does not use TCP; a rule written for TCP would not match the UDP datagrams the access points send.
   • B. Those are the RADIUS authentication and accounting ports, used between the controller and the RADIUS server for 802.1X, not between an access point and its controller.
   • C. SSH and HTTPS are used by administrators to manage the controller or an access point; they are not part of the join process.
   • D. CAPWAP runs over UDP: port 5246 carries the control channel through which the access point discovers, joins and is configured by the controller, and port 5247 carries the tunnelled client data.

6. Question 6 of 10Config

   On a Cisco WLC you created WLAN ravena-staff mapped to the corp-data interface. On the Security tab you set Layer 2 security to WPA+WPA2 with AES encryption and authentication key management PSK, and on the AAA Servers tab you selected the RADIUS server 10.10.50.20. The requirement is that staff sign in with their own Active Directory username and password. Which change meets the requirement?

   1. Set the authentication key management to 802.1X instead of PSK on the Layer 2 tab
   2. Change the encryption from AES to TKIP so the RADIUS server can read the frames
   3. Enable Layer 3 web authentication so users are prompted for their credentials
   4. Move the WLAN from the corp-data interface to the management interface
   Show the answer

   Answer: A

   WPA2-Personal and WPA2-Enterprise use the same AES-CCMP encryption; the difference is the key management. PSK means one shared passphrase, 802.1X means each user authenticates through the controller to a RADIUS server. Selecting a RADIUS server on the AAA tab does nothing until the WLAN's key management is set to 802.1X.

   • A. With 802.1X as the key management the controller forwards each user's credentials to the RADIUS server, which checks them against Active Directory; this is WPA2-Enterprise, and the RADIUS server you already selected is then actually used.
   • B. TKIP is a deprecated cipher kept only for legacy WPA clients, and the RADIUS server never decrypts wireless frames; encryption and authentication are separate settings.
   • C. Web authentication gives a browser login page typical for guest access; it does not provide per-user 802.1X authentication of the wireless association and would still leave PSK in place.
   • D. The interface mapping decides the VLAN the clients land in and has nothing to do with how they authenticate.

7. Question 7 of 10Config

   A branch office with 30 users connects to headquarters over a single WAN link. The branch access points are lightweight and join the WLC at headquarters. During the last WAN outage every wireless user at the branch lost access to the local file server, even though the switch and server stayed up. Which access point mode and WLAN setting keep local traffic working during the next outage?

   1. Local mode, with the WLAN mapped to a dynamic interface on the controller
   2. FlexConnect mode, with local switching enabled on the branch WLAN
   3. Monitor mode, with the WLAN broadcast enabled on the branch radios
   4. Bridge mode, with the branch VLAN trunked across the WAN to the controller
   Show the answer

   Answer: B

   Local mode centralises everything at the WLC, which is fine on a campus LAN but makes a branch depend on the WAN. FlexConnect keeps the access point managed by the controller while letting it switch client traffic locally and keep working in standalone mode if the CAPWAP tunnel drops. The per-WLAN local switching setting decides which WLANs stay at the branch.

   • A. In local mode every client frame is tunnelled through CAPWAP to the controller, so when the WAN fails the branch clients cannot reach even a server in the same building; this is the configuration that caused the outage.
   • B. A FlexConnect access point with local switching puts client traffic directly on the branch switch VLAN instead of tunnelling it, and it keeps serving already-configured WLANs when the controller becomes unreachable.
   • C. Monitor mode turns the radios into dedicated sensors for rogue detection and spectrum analysis; a monitor-mode access point serves no clients at all.
   • D. Bridge mode is for point-to-point or mesh links between access points, and extending the branch VLAN over the WAN would still depend on that WAN link.

8. Question 8 of 10Scenario

   A small clinic uses one shared passphrase on its staff SSID. The owner asks for two guarantees: an attacker who records the association handshake must not be able to run an offline dictionary attack against the passphrase, and traffic captured today must stay unreadable even if the passphrase leaks next year. All client devices are recent. Which configuration meets both requirements?

   1. WPA2-Personal with AES-CCMP and a 63-character random passphrase
   2. Open authentication with web authentication on the controller
   3. WPA3-Personal with SAE authentication
   4. WPA2-Personal with SSID broadcasting disabled on the access points
   Show the answer

   Answer: C

   WPA3-Personal keeps a shared passphrase but authenticates with SAE (Simultaneous Authentication of Equals) instead of the WPA2 PSK handshake. That blocks offline dictionary attacks and provides forward secrecy. WPA2-Personal with AES-CCMP is still strong encryption, but its handshake does not offer either of those two properties.

   • A. A long passphrase makes a dictionary attack impractical, but the WPA2 four-way handshake still allows offline guessing, and anyone who later learns the passphrase can decrypt previously captured sessions.
   • B. Open authentication with a web login page sends the wireless frames without encryption; it is a guest-access model, not a protection for staff traffic.
   • C. SAE replaces the PSK handshake with a password-authenticated key exchange: each guess requires a live exchange with the access point, so offline dictionary attacks fail, and the derived session keys give forward secrecy, so a leaked passphrase does not expose old captures.
   • D. Hiding the SSID is not a security control; the name still appears in probe and association frames, and the handshake remains the WPA2 handshake with the same weaknesses.

9. Question 9 of 10Scenario

   A company runs two autonomous access points on one floor. AP-A advertises SSID ravena-corp on channel 1 with WPA2-PSK in VLAN 20. AP-B advertises SSID Ravena-Corp on channel 11 with the same passphrase in VLAN 20. A laptop associated to AP-A keeps that connection as the user walks toward AP-B until the signal fades completely, and then the user has to pick a network by hand. What is the cause?

   1. AP-B uses channel 11 while AP-A uses channel 1, and roaming only works between access points on the same channel
   2. The two access points have different BSSIDs, so the laptop treats them as two separate networks
   3. WPA2-PSK does not support roaming between autonomous access points, only a controller does
   4. The SSID on AP-B is spelled with different capitalisation, so the laptop sees it as a different network
   Show the answer

   Answer: D

   An ESS is formed by access points that advertise exactly the same SSID with compatible security, each with its own BSSID. The client decides when to roam, based on signal quality, and will only move to a BSSID that belongs to the SSID it is connected to. A capitalisation difference, a different passphrase or a different security type all break the ESS.

   • A. Neighbouring access points in an ESS should be on different non-overlapping channels; a client scans the other channels and roams to a better BSSID regardless of the channel number.
   • B. Every access point radio has its own BSSID by design; what makes them one network for the client is the identical SSID, not a shared BSSID.
   • C. Clients roam between autonomous access points as long as the SSID and security match; a controller makes roaming faster and smoother but is not required for it.
   • D. SSIDs are case-sensitive, so ravena-corp and Ravena-Corp are two different networks; the laptop is configured for the first one and will not roam to the second until the user connects to it manually.

10. Question 10 of 10Concept

    A retailer with 15 small shops wants every access point configured and monitored from a single web dashboard hosted by the vendor, with no controller hardware at any shop or in a data centre, and with client traffic switched locally at each shop. Which Cisco wireless architecture fits these requirements?

    1. Centralized architecture with a hardware WLC in the data centre
    2. Cloud-based architecture with Meraki access points
    3. Mobility Express with one access point acting as the controller
    4. Embedded wireless controller running on a Catalyst 9000 switch
    Show the answer

    Answer: B

    Cisco wireless architectures differ in where the control plane lives: centralized means a WLC appliance (or virtual WLC) with CAPWAP tunnels, cloud-based means Meraki access points configured from the Meraki dashboard with data switched locally, and embedded or Mobility Express mean the controller function runs on a switch or on an access point at the site. Match the architecture to who hosts the control plane and where the client traffic should flow.

    • A. A centralized WLC is the controller hardware the retailer wants to avoid, and in local mode it would also pull the shop traffic across the WAN through CAPWAP tunnels.
    • B. Meraki access points are managed through the vendor's cloud dashboard, so there is no controller appliance anywhere, while client data stays on the local shop network; only management traffic goes to the cloud.
    • C. Mobility Express runs the controller function on an access point at the site, so each shop would be its own management island rather than one hosted dashboard.
    • D. An embedded wireless controller still needs a Catalyst switch at each site to host it and is managed per deployment, not from a vendor-hosted dashboard.

Common mistakes

• Treating 2.4 GHz channels as independent: channels 1, 4, 8 and 11 overlap each other, so adding channels between 1, 6 and 11 adds interference instead of capacity.
• Mixing up which standards use which band, especially assuming 802.11ac works in 2.4 GHz (it does not) or that 802.11ax is 5 GHz only (it runs in both, and 6E adds 6 GHz).
• Mapping a client WLAN to the WLC management interface, which puts wireless clients in the same subnet as the controller instead of a dedicated dynamic interface and VLAN.
• Confusing the CAPWAP ports with other protocols: CAPWAP is UDP 5246 for control and UDP 5247 for data; RADIUS is UDP 1812 and 1813 and has nothing to do with AP join.
• Reading SNR as a negative number or in dBm: SNR is signal strength minus noise floor, both in dBm, and the result is a positive number of dB.

Questions people ask

More CCNA topics

• CCNA Subnetting Practice Questions
• CCNA OSPF Practice Questions: Single-Area OSPFv2
• CCNA VLANs and Trunking: Practice Questions
• CCNA ACL Practice Questions
• CCNA NAT, PAT and Port Forwarding Practice Questions
• CCNA Spanning Tree Protocol: Practice Questions
• CCNA IPv6 Practice Questions: Addressing, EUI-64, SLAAC and NDP
• CCNA EtherChannel: Practice Questions
• CCNA First-Hop Redundancy Practice Questions: HSRP, VRRP and GLBP
• CCNA Static Routing Practice Questions: ip route and the Routing Table
• CCNA IP Services Practice Questions
• CCNA Layer 2 Security Practice Questions
• CCNA Security Fundamentals Practice Questions (200-301)
• CCNA QoS Practice Questions (200-301)
• CCNA Automation and Programmability Practice Questions
• CCNA practice test: all domains