Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 801Question →

A network engineer is reviewing security standards to upgrade an organization's wireless network infrastructure to WPA3. Which TWO statements accurately describe the security enhancements and requirements introduced in WPA3 compared to WPA2? (Select two.)

Select all that apply

Show answer & explanation

Answer: WPA3-Personal replaces the legacy pre-shared key (PSK) four-way handshake with Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks.; WPA3 mandates the use of Protected Management Frames (PMF) across all connections to defend against wireless management frame spoofing.

Answer

WPA3 introduces Simultaneous Authentication of Equals (SAE) in Personal mode to protect against dictionary attacks, and mandates Protected Management Frames (PMF) on all connections.
WPA3 introduces key cryptographic enhancements over WPA2. First, WPA3-Personal replaces the legacy WPA2 PSK four-way handshake with Simultaneous Authentication of Equals (SAE), which protects against offline dictionary attacks and provides forward secrecy. Second, WPA3 mandates Protected Management Frames (PMF / IEEE 802.11w) across all client connections to protect against management frame injection and deauthentication attacks.

Step-by-Step Solution

1
Analyze WPA3-Personal authentication improvements over WPA2-Personal.
Identified that WPA3-Personal replaces the PSK four-way handshake with Simultaneous Authentication of Equals (SAE), preventing offline password guessing.
SAE uses Dragonfly key exchange so that an attacker capturing the handshake cannot perform offline dictionary attacks.
2
Evaluate management frame protection requirements in WPA3.
Confirmed that Protected Management Frames (PMF / IEEE 802.11w) are mandatory in WPA3.
PMF prevents deauthentication and disassociation spoofing attacks by encrypting/authenticating management frames.
3
Examine distractor statements regarding RADIUS deployment and TKIP ciphers.
Disqualified statements claiming WPA3-Personal requires RADIUS or that WPA3 uses TKIP.
RADIUS is required for 802.1X Enterprise mode, not Personal mode. TKIP is an insecure legacy cipher prohibited in WPA3.

Key Concept

WPA3 Security Improvements: SAE Key Exchange and Mandatory PMF
Estimated Time:1m 30s
Question 802Question →

A network administrator is deploying a high-security wireless LAN on a Cisco Wireless LAN Controller (WLC) configured for WPA3-Enterprise authentication. Which operational feature is mandatory for all client devices connecting to this WLAN?

Show answer & explanation

Answer: Support and active enforcement of Protected Management Frames (PMF)

Answer

Support and active enforcement of Protected Management Frames (PMF)
The WPA3 security specification makes Protected Management Frames (PMF, IEEE 802.11w) mandatory for all device connections in both WPA3-Personal and WPA3-Enterprise deployments. PMF protects unicast and multicast management frames—such as deauthentication and disassociation frames—against eavesdropping and spoofing.

Step-by-Step Solution

1
Identify the key cryptographic and structural enhancements introduced by the WPA3 standard.
Recognize that Protected Management Frames (PMF / IEEE 802.11w) are mandatory across all WPA3 modes (Personal and Enterprise).
PMF prevents attackers from forging management frames, such as deauthentication or disassociation packets, mitigating Wireless DoS attacks.
2
Evaluate client-side compatibility requirements for joining WPA3 WLANs.
Determine that connected clients must explicitly support PMF negotiation during association.
Unlike WPA2 where PMF was optional, WPA3 enforces PMF as a non-negotiable security baseline.

Key Concept

WPA3 Mandatory Protected Management Frames (PMF)
Question 803Question →

Match each wireless security protocol or mode with its primary key exchange mechanism or encryption characteristic.

Click a left item, then click its matching right item

Items

WPA2-Personal
WPA3-Personal
WPA3-Enterprise (192-bit mode)
Opportunistic Wireless Encryption (OWE)

Matches

Show answer & explanation

Answer

WPA2-Personal pairs with CCMP (AES-128) and PSK 4-way handshake; WPA3-Personal pairs with Simultaneous Authentication of Equals (SAE); WPA3-Enterprise (192-bit mode) pairs with GCMP-256, EAP-TLS, and PMF; OWE pairs with unauthenticated encryption on open networks using Diffie-Hellman key exchange.
Each wireless security protocol uses distinct key exchange mechanisms and encryption ciphers: WPA2-Personal relies on PSK with CCMP (AES-128); WPA3-Personal introduces SAE to mitigate dictionary attacks; WPA3-Enterprise 192-bit mode mandates GCMP-256 and EAP-TLS; OWE delivers unauthenticated encryption over open networks using Diffie-Hellman key exchanges.

Step-by-Step Solution

1
Identify the authentication and encryption suite for legacy WPA2-Personal.
WPA2-Personal uses PSK authentication with a 4-way handshake and CCMP (AES-128) encryption.
This is the baseline IEEE 802.11i implementation for pre-shared key deployments.
2
Identify the key exchange enhancement in WPA3-Personal.
WPA3-Personal mandates Simultaneous Authentication of Equals (SAE).
SAE prevents password guessing attacks by validating authentication without exposing pre-shared secrets.
3
Identify the high-security requirements of WPA3-Enterprise 192-bit mode.
It specifies GCMP-256 cipher suite along with EAP-TLS and mandatory PMF.
Enterprise 192-bit mode enforces top-tier cryptographic standards for sensitive deployments.
4
Identify the role of Opportunistic Wireless Encryption (OWE).
OWE encrypts traffic over open wireless networks using Diffie-Hellman key negotiation.
OWE allows open hotspots to encrypt wireless transmission without requiring user passphrases.

Key Concept

Wireless Security Protocols (WPA, WPA2, WPA3, OWE)
Estimated Time:1m 30s
Question 804Question →

A network engineer is configuring a Cisco IOS router (R1) to act as a DHCP relay agent servicing clients across multiple subnets. Central DHCP services reside at IP address 172.16.100.5. The subinterface configuration on R1 is as follows:

text
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 10.1.10.1 255.255.255.0
ip helper-address 172.16.100.5
!
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 10.1.20.1 255.255.255.0
!
interface GigabitEthernet0/1
description Egress link towards DHCP Server
ip address 172.16.100.1 255.255.255.0

Clients connected to VLAN 10 successfully receive IP addresses, while clients on VLAN 20 fail to obtain lease parameters. Which TWO statements accurately explain the operation of the DHCP relay agent or the required configuration changes?

Select all that apply

Show answer & explanation

Answer: The command ip helper-address 172.16.100.5 must be configured under interface GigabitEthernet0/0.20 so that DHCP broadcasts from VLAN 20 clients are relayed to the server.; When forwarding a DHCP Discover packet from VLAN 10, the router inserts its local subinterface IP address (10.1.10.1) into the GIADDR field of the DHCP header.

Answer

The helper address command must be added to subinterface GigabitEthernet0/0.20, and the router populates the GIADDR field with its local client-facing interface IP address when forwarding relay requests.
The correct options accurately reflect DHCP relay principles: first, helper addresses must be enabled on every client-facing gateway interface (such as GigabitEthernet0/0.20) where client broadcasts originate; second, the relay agent populates the GIADDR field with its local gateway IP address so the central DHCP server knows which scope to assign.

Step-by-Step Solution

1
Analyze the subinterface configuration for VLAN 20.
GigabitEthernet0/0.20 is missing the `ip helper-address 172.16.100.5` command, causing client DHCP Discover broadcasts on VLAN 20 to be dropped by default.
DHCP relay helper addresses operate on a per-interface basis and must be configured on every incoming client gateway interface.
2
Examine the DHCP packet transformation performed by the relay agent.
When relaying client broadcast requests to the server, the router inserts its own ingress interface IP address into the GIADDR (Gateway IP Address) field of the DHCP payload.
The central DHCP server uses the GIADDR field to determine the appropriate IP pool and subnet range from which to lease an address.

Key Concept

DHCP Relay Agent Configuration and GIADDR Operation
Question 805Question →

A wireless network engineer is reviewing protocol requirements to transition an enterprise Wi-Fi infrastructure from WPA2 to WPA3 across corporate and guest SSIDs. Which TWO statements correctly describe key structural and operational differences between WPA3 and legacy WPA2 standards?

Select all that apply

Show answer & explanation

Answer: WPA3-Personal mandates the use of Simultaneous Authentication of Equals (SAE) for initial key exchange to mitigate offline password guessing and dictionary attacks.; Protected Management Frames (PMF / IEEE 802.11w) are strictly mandatory for all native WPA3 connections.

Answer

The correct statements are that WPA3-Personal mandates Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks, and Protected Management Frames (PMF) are mandatory across all native WPA3 network connections.
WPA3 introduces key improvements over WPA2: Simultaneous Authentication of Equals (SAE) replaces WPA2-Personal's Pre-Shared Key (PSK) 4-way handshake to protect against offline dictionary attacks and provide forward secrecy. Additionally, Protected Management Frames (PMF / IEEE 802.11w) are mandatory across all native WPA3 network connections to secure control and management traffic against spoofing.

Step-by-Step Solution

1
Analyze WPA3-Personal key exchange mechanisms
Identified that WPA3-Personal uses Dragonfly/SAE (Simultaneous Authentication of Equals) instead of the WPA2 PSK 4-way handshake, preventing offline dictionary attacks.
SAE provides forward secrecy and protects authentication exchanges even when weak passwords are chosen.
2
Evaluate WPA3 Management Frame Protection requirements
Confirmed that IEEE 802.11w Protected Management Frames (PMF) are negotiated as required (mandatory) in WPA3 mode.
PMF shields unicast and multicast management frames against deauthentication and disassociation spoofing.
3
Verify legacy cipher and enterprise framework compatibility
Disproved claims that WPA3 uses TKIP or removes 802.1X.
TKIP is explicitly forbidden in WPA3 due to security vulnerabilities, and WPA3-Enterprise retains 802.1X/EAP.

Key Concept

WPA3 Security Enhancements (SAE and Mandatory PMF)
Question 806Question →

A small business seeks to secure its employee Wi-Fi network against offline brute-force and dictionary attacks if wireless traffic captures occur. The company does not deploy a centralized AAA or RADIUS server. Which wireless security protocol and key exchange mechanism should be configured on the Wireless LAN Controller (WLC) to satisfy these requirements?

Show answer & explanation

Answer: WPA3-Personal using Simultaneous Authentication of Equals (SAE)

Answer

WPA3-Personal using Simultaneous Authentication of Equals (SAE)
WPA3-Personal replaces the traditional WPA2 4-way handshake with Simultaneous Authentication of Equals (SAE), based on the Dragonfly key exchange algorithm. SAE provides forward secrecy and effectively mitigates offline dictionary and brute-force attacks even if passwords are simple, all without requiring an 802.1X RADIUS authentication server.

Step-by-Step Solution

1
Analyze authentication infrastructure constraints
Since the organization has no AAA/RADIUS server, Enterprise modes (802.1X/EAP) cannot be implemented. The solution must use a Personal (Preshared Key) deployment model.
Enterprise security modes rely on 802.1X RADIUS communication to authenticate users against a centralized backend directory.
2
Evaluate key exchange mechanisms for PSK protection
WPA2-Personal uses a 4-way handshake vulnerable to offline dictionary/brute-force attacks if captured. WPA3-Personal replaces this mechanism with Simultaneous Authentication of Equals (SAE).
SAE is based on the Dragonfly handshake algorithm, which provides zero-knowledge proof key establishment, preventing passive offline key-cracking attempts.
3
Select the matching configuration option
WPA3-Personal utilizing SAE delivers pre-shared key simplicity without requiring RADIUS while guaranteeing protection against offline dictionary attacks.
Meets both operational constraints: no RADIUS server required and resistant to handshake capture attacks.

Key Concept

Wireless Security Protocols: WPA3-Personal SAE vs WPA2-Personal PSK
Question 807Question →

A network administrator is upgrading a corporate Wireless LAN Controller (WLC) to meet stringent government cryptographic requirements. The administrator configures a new SSID operating in WPA3-Enterprise 192-bit mode. Which encryption cipher suite is mandated by WPA3-Enterprise 192-bit mode to protect data payload frames?

Show answer & explanation

Answer: GCMP-256 (Galois/Counter Mode Protocol with 256-bit encryption)

Answer

GCMP-256 (Galois/Counter Mode Protocol with 256-bit encryption)
Galois/Counter Mode Protocol with 256-bit encryption (GCMP-256) is mandated by the IEEE 802.11i / WPA3 specifications for WPA3-Enterprise 192-bit mode. This mode provides higher-grade cryptographic protection aligned with Commercial National Security Algorithm (CNSA) suite standards.

Step-by-Step Solution

1
Identify the specific wireless security framework and operational mode requested
The scenario specifies WPA3-Enterprise in 192-bit security mode (CNSA suite compliant).
Different WPA3 operating modes specify distinct cryptographic algorithms and key sizes.
2
Evaluate the cipher suite requirements for WPA3-Enterprise 192-bit mode
WPA3-Enterprise 192-bit mode requires GCMP-256 for authenticated data encryption, BIP-GMAC-256 for management frame protection, and EAP-TLS with SHA-384 for authentication.
Standard WPA2/WPA3 Enterprise 128-bit modes use CCMP-128, whereas 192-bit mode upgrades the cipher suite to 256-bit GCMP.

Key Concept

WPA3-Enterprise 192-bit Security Mode Requirements
Question 808Question →

Match each wireless security protocol or feature to its defining operational characteristic.

Click a left item, then click its matching right item

Items

Protected Management Frames (PMF)
Temporal Key Integrity Protocol (TKIP)
Opportunistic Wireless Encryption (OWE)
Simultaneous Authentication of Equals (SAE)

Matches

Show answer & explanation

Answer

Protected Management Frames (PMF) matches securing unicast/multicast management frames; TKIP matches legacy RC4 encapsulation with key mixing; OWE matches unauthenticated encryption on open networks; SAE matches prevention of offline dictionary attacks via Dragonfly key exchange.
Each protocol or mechanism serves a distinct function within wireless security architectures: PMF protects management action frames from forgery, TKIP relies on RC4 for legacy WPA security, OWE provides unauthenticated encryption for open access, and SAE uses Dragonfly key exchange to secure pre-shared key establishment in WPA3-Personal.

Step-by-Step Solution

1
Identify the primary role of Protected Management Frames (PMF)
PMF (IEEE 802.11w) protects management frames (such as deauth packets) against spoofing and eavesdropping; it is mandatory in WPA3.
Security standards mandate PMF to prevent common Wireless Denial of Service (DoS) attacks.
2
Identify the encryption characteristics of Temporal Key Integrity Protocol (TKIP)
TKIP uses RC4 stream cipher with dynamic temporal key mixing as an upgrade path from WEP.
TKIP was designed to run on legacy WEP hardware while fixing key reuse flaws.
3
Identify the operation of Opportunistic Wireless Encryption (OWE)
OWE uses Diffie-Hellman key exchange to encrypt open Wi-Fi networks without requiring client authentication.
Enhanced Open (OWE) provides opportunistic privacy for guest networks without passphrase configuration.
4
Identify the authentication protocol used in Simultaneous Authentication of Equals (SAE)
SAE utilizes the Dragonfly handshake algorithm to negotiate shared keys securely and neutralize offline dictionary attacks.
SAE replaces the traditional 4-way handshake PSK model in WPA3-Personal.

Key Concept

Wireless Security Protocols and Cipher Mechanics
Question 809Question →

A network administrator is transitioning a retail store Wi-Fi network from WPA2-Personal to WPA3-Personal. During testing, the administrator confirms that pre-shared key (PSK) authentication has been replaced by Simultaneous Authentication of Equals (SAE) based on the Dragonfly key exchange algorithm. Which security enhancement does SAE deliver when compared to the traditional WPA2 4-way handshake?

Show answer & explanation

Answer: It provides forward secrecy and built-in resistance to offline dictionary attacks even when password complexity is low.

Answer

SAE provides forward secrecy and prevents offline dictionary attacks by eliminating the predictable 4-way handshake password exchange used in WPA2-Personal.
WPA3-Personal mandates Simultaneous Authentication of Equals (SAE), replacing the vulnerable 4-way WPA2 PSK exchange. SAE leverages the Dragonfly key exchange protocol, which prevents passive eavesdroppers from capturing traffic and cracking passwords via offline dictionary attacks, while also guaranteeing forward secrecy.

Step-by-Step Solution

1
Analyze WPA2-Personal vulnerability
WPA2-Personal uses a 4-way handshake based on a static PSK. An attacker capturing the handshake can perform offline brute-force or dictionary attacks to reveal the PSK.
The WPA2 pairwise master key (PMK) derivation allows passive offline analysis.
2
Evaluate WPA3-Personal SAE operation
WPA3-Personal replaces the standard PSK 4-way handshake with Simultaneous Authentication of Equals (SAE), based on the Diffie-Hellman Dragonfly key exchange.
SAE executes a peer-to-peer authentication exchange before key establishment.
3
Identify key cryptographic advantages
SAE ensures forward secrecy (session keys cannot be compromised even if the password is discovered later) and renders offline dictionary attacks useless because each attempt requires an active network exchange.
Invalid authentication attempts require live interactions with the AP, frustrating passive capture analysis.

Key Concept

WPA3-Personal Simultaneous Authentication of Equals (SAE)
Question 810Question →

Match each wireless security framework or protocol with its primary key exchange or encryption mechanism.

Click a left item, then click its matching right item

Items

WPA3-Personal
WPA2-Enterprise
Enhanced Open (OWE)
WPA-Personal (Legacy)

Matches

Show answer & explanation

Answer

WPA3-Personal matches with SAE key exchange. WPA2-Enterprise matches with 802.1X/RADIUS authentication. Enhanced Open (OWE) matches with unauthenticated Diffie-Hellman encryption. WPA-Personal matches with deprecated TKIP/RC4 encryption.
Each wireless protocol maps to its distinct standard implementation: WPA3-Personal uses SAE for Dragonfly key exchange, WPA2-Enterprise mandates 802.1X/EAP with RADIUS, Enhanced Open provides OWE encryption for unauthenticated networks, and legacy WPA uses TKIP.

Step-by-Step Solution

1
Identify key characteristics of WPA3-Personal.
WPA3-Personal introduces SAE (Simultaneous Authentication of Equals) to eliminate offline brute-force attacks.
SAE is the hallmark replacement for PSK in WPA3.
2
Identify key characteristics of WPA2-Enterprise.
Enterprise modes specifically demand 802.1X with EAP and RADIUS servers.
Personal modes use pre-shared keys, whereas Enterprise modes use centralized AAA architecture.
3
Identify key characteristics of Enhanced Open (OWE).
Enhanced Open uses OWE (Diffie-Hellman key exchange) to encrypt traffic on open networks without password entry.
OWE protects public Wi-Fi eavesdropping without authentication.
4
Identify key characteristics of WPA-Personal (Legacy).
Legacy WPA relied on TKIP/RC4 prior to the introduction of CCMP/AES in WPA2.
TKIP was designed as an interim migration path from WEP.

Key Concept

Wireless Security Protocols and Authentication/Encryption Mechanisms
Question 811Question →

A network engineer is configuring a new Wireless LAN Controller (WLC) deployment to support WPA3-Enterprise across an enterprise infrastructure. Which two operational characteristics or requirements strictly apply to WPA3-Enterprise deployments? (Select two.)

Select all that apply

Show answer & explanation

Answer: Protected Management Frames (PMF) must be set to required and enforced on the WLAN.; Client authentication relies on IEEE 802.1X and EAP protocols rather than Simultaneous Authentication of Equals (SAE).

Answer

WPA3-Enterprise requires Protected Management Frames (PMF) to be enforced and uses IEEE 802.1X/EAP frameworks for client authentication.
WPA3 mandates the use of Protected Management Frames (PMF / IEEE 802.11w) across all implementations to guard against eavesdropping and frame forging. Additionally, WPA3-Enterprise relies on IEEE 802.1X authentication with EAP methods for centralized user access control, contrasting with WPA3-Personal which employs SAE.

Step-by-Step Solution

1
Analyze key security requirements for the WPA3 standard.
PMF (IEEE 802.11w) is mandatory across all WPA3 modes (Personal and Enterprise) to protect against management frame attacks.
WPA3 eliminates optional PMF negotiated states found in WPA2 and makes management protection compulsory.
2
Differentiate between Personal and Enterprise operational modes in WPA3.
WPA3-Personal replaces PSK with SAE (Simultaneous Authentication of Equals), whereas WPA3-Enterprise mandates IEEE 802.1X and EAP authentication.
Enterprise wireless networks require individual user identity verification backed by a centralized AAA infrastructure.

Key Concept

WPA3-Enterprise mandatory security requirements (PMF enforcement and 802.1X/EAP authentication architecture)
Question 812Question →

A network administrator is migrating an enterprise wireless network from WPA2-Enterprise to WPA3-Enterprise by enabling a transition mode on a Cisco Wireless LAN Controller (WLC). Which two statements accurately describe the protocol mechanisms and operational requirements for this transition deployment? (Select two.)

Select all that apply

Show answer & explanation

Answer: Protected Management Frames (PMF) must be set to optional (capable) on the WLAN to allow legacy WPA2 clients to connect alongside WPA3 clients.; Both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X framework and Extensible Authentication Protocol (EAP) for user authentication.

Answer

Protected Management Frames (PMF) must be set to optional (capable) on the WLAN to allow legacy WPA2 clients to connect alongside WPA3 clients, and both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X framework and Extensible Authentication Protocol (EAP) for user authentication.
Both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X port-based authentication architecture paired with EAP for centralized client credential verification via RADIUS. Furthermore, because WPA3 mandates Protected Management Frames (802.11w) while WPA2 does not, enabling transition mode on a Wireless LAN Controller requires setting PMF to optional (capable) so both modern WPA3 and legacy WPA2 clients can successfully associate.

Step-by-Step Solution

1
Analyze authentication requirements across WPA2-Enterprise and WPA3-Enterprise.
Identify that both enterprise standards use IEEE 802.1X/EAP with a backend RADIUS server for identity management.
Enterprise wireless security relies on 802.1X port-based access control regardless of whether WPA2 or WPA3 framing is in use.
2
Evaluate Protected Management Frame (PMF / 802.11w) configuration requirements for WLAN transition mode.
Determine that setting PMF to optional (capable) allows WPA3 devices to negotiate management frame protection while permitting WPA2 devices without PMF support to join.
WPA3 mandates PMF, whereas WPA2 does not require it; setting PMF to optional on the WLC resolves client compatibility gaps.

Key Concept

WPA2/WPA3 Enterprise authentication frameworks and Protected Management Frame (PMF) transition mode settings
Question 813Question →

A network administrator needs to deploy a secure wireless LAN for a small branch office. The security policy dictates that wireless client authentication must prevent offline dictionary attacks against pre-shared credentials and enforce Protected Management Frames (PMF), while avoiding the deployment cost and complexity of an external RADIUS or AAA server. Which wireless security deployment mode meets all of these requirements?

Show answer & explanation

Answer: WPA3-Personal using Simultaneous Authentication of Equals (SAE)

Answer

WPA3-Personal using Simultaneous Authentication of Equals (SAE)
WPA3-Personal uses Simultaneous Authentication of Equals (SAE), a peer-to-peer key exchange protocol based on the Dragonfly handshake. SAE prevents offline dictionary attacks even if weak passphrases are selected, provides forward secrecy, and mandates Protected Management Frames (PMF), fulfilling all requirements without requiring a RADIUS server.

Step-by-Step Solution

1
Analyze deployment constraints
Requirements are offline dictionary attack protection, mandatory Protected Management Frames (PMF), and operating without an external RADIUS/AAA server.
Branch offices without dedicated AAA infrastructure require a personal/passphrase mode rather than an enterprise mode.
2
Evaluate key exchange mechanisms
WPA3-Personal introduces Simultaneous Authentication of Equals (SAE), based on the Dragonfly key exchange algorithm.
SAE provides forward secrecy and renders captured handshakes immune to offline dictionary attacks.
3
Verify compliance with PMF standards
PMF (IEEE 802.11w) is optional in WPA2 but strictly mandatory in all WPA3 modes.
Selecting WPA3-Personal SAE ensures both PMF compliance and non-RADIUS operation.

Key Concept

WPA3-Personal key exchange via SAE and mandatory Protected Management Frames
Question 814Question →

An engineer audits an enterprise wireless deployment configured strictly for WPA3-Enterprise mode. During client connectivity testing, older legacy wireless client devices fail to associate with the SSID, even though their security profiles are configured with valid 802.1X EAP credentials. What mandatory feature of WPA3 security causes these legacy clients to fail association?

Show answer & explanation

Answer: Protected Management Frames (PMF) are strictly required for all associations.

Answer

Protected Management Frames (PMF) are strictly required for all associations.
Under the Wi-Fi Alliance WPA3 standard specification, Protected Management Frames (PMF / IEEE 802.11w) transition from being optional (as in WPA2) to strictly mandatory. Any legacy wireless client device that lacks support for PMF capability negotiation is rejected at association time by a WPA3-configured access point.

Step-by-Step Solution

1
Identify the protocol requirements introduced in the WPA3 wireless security standard.
WPA3 introduces mandatory Protected Management Frames (PMF / IEEE 802.11w) for both Personal and Enterprise operating modes.
PMF protects management frames such as deauthentication and disassociation from spoofing and eavesdropping attacks.
2
Evaluate the impact of mandatory PMF on legacy client devices.
Clients that do not support 802.11w PMF or only support optional PMF negotiation cannot complete the association handshake with an SSID running pure WPA3.
When an access point operates in WPA3 mode, PMF requirement is set to Required (Required/Mandatory), rejecting legacy clients lacking PMF support.

Key Concept

WPA3 Mandatory Protected Management Frames (PMF / IEEE 802.11w)
Question 815Question →

An enterprise network requires redundant, high-bandwidth connectivity between a Cisco AireOS Wireless LAN Controller (WLC) distribution port bundle and a Cisco Catalyst distribution switch. The network team decides to enable Link Aggregation (LAG) on the controller. Which TWO switch-side configurations and behaviors are mandatory for this infrastructure connection to operate correctly? (Select two.)

Select all that apply

Show answer & explanation

Answer: The switch member ports must be statically bundled using channel-group mode on because AireOS LAG does not negotiate using dynamic protocols like LACP or PAgP.; The switch port-channel interface must be configured as an 802.1Q trunk carrying all necessary wireless client and management VLANs with matching native VLAN settings.

Answer

The mandatory switch-side configurations are configuring member ports in static EtherChannel mode (channel-group mode on) and setting the port-channel interface as an 802.1Q trunk carrying the required VLANs with matching native VLAN configurations.
On Cisco AireOS controllers, enabling LAG aggregates all physical distribution ports into a single logical channel. Because AireOS does not support dynamic negotiation protocols (LACP or PAgP), the upstream switch member ports must be statically bound using mode on. Additionally, because multiple VLANs (management, dynamic client WLANs, AP manager) travel across this aggregate link, the port-channel interface on the Catalyst switch must be configured as an 802.1Q trunk with properly aligned native and allowed VLANs.

Step-by-Step Solution

1
Identify the link aggregation capabilities and requirements of Cisco AireOS Wireless LAN Controllers.
AireOS controllers support a single LAG interface bundle that aggregates all distribution ports into one logical connection without supporting dynamic negotiation protocols (LACP/PAgP).
Since AireOS cannot participate in LACP or PAgP handshake negotiation, the upstream Catalyst switch must be configured manually for static EtherChannel using mode on.
2
Determine the trunking and VLAN requirements for WLC distribution port bundles.
All WLC logical interfaces (management, dynamic client VLANs, manager ports) pass over this unified LAG bundle requiring 802.1Q VLAN encapsulation.
The upstream switch port-channel and physical member ports must be configured as 802.1Q trunks with consistent native VLANs and allowed VLAN lists to prevent frame drops or VLAN leakage.
3
Evaluate and eliminate incorrect statements regarding LAP mode traffic routing and dynamic negotiation.
Dynamic negotiation modes like LACP passive or PAgP fail, and Local mode LAPs do not require switch trunk ports since CAPWAP tunnels all client data to the controller.
Local mode APs tunnel data to the WLC rather than switching locally, so AP switch ports remain in access mode, whereas FlexConnect mode APs would utilize switch trunking.

Key Concept

Cisco AireOS WLC Link Aggregation (LAG) and Upstream Switch Trunking
Estimated Time:1m 30s
Question 816Question →

A network administrator has configured HSRPv2 between two routers, R1 and R2. Router R1 is currently the Active router with a configured priority of 120, preemption enabled, and tracking on its primary WAN interface configured to decrement priority by 30 upon link failure. Router R2 is currently the Standby router with a configured priority of 105 and preemption enabled. When R1's tracked WAN interface fails, a precise sequence of operational events occurs across the routers and local LAN switches to complete the failover. What is the correct chronological sequence of these events from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of events is: (1) R1's tracked WAN interface fails and internal priority decrements to 90, (2) R1 advertises priority 90 in an HSRP Hello packet, (3) R2 observes R1's lower priority and transmits an HSRP Coup message due to preemption, (4) R2 assumes Active status and transmits a Gratuitous ARP (GARP) frame to update switch CAM tables, and (5) R1 processes R2's higher-priority election and transitions to Standby status.
The failover process begins when R1's tracked interface fails, immediately decreasing its local priority from 120 to 90. R1 advertises this new priority of 90 in its subsequent HSRP Hello multicast packet. R2 reads R1's Hello packet, notices its own priority of 105 is higher than R1's 90, and generates an HSRP Coup message because preemption is enabled. R2 then transitions to Active status and broadcasts a Gratuitous ARP (GARP) frame so adjacent switches update their MAC address tables for the virtual MAC address. Finally, R1 receives R2's Active message and transitions to Standby status.

Step-by-Step Solution

1
Identify the initial interface failure and local priority recalculation.
R1's priority is decremented by 30 (120 - 30 = 90).
HSRP interface tracking continuously monitors the specified interface status and modifies the router priority locally upon state change.
2
Determine how priority changes are communicated across the subnet.
R1 sends an HSRP Hello packet advertising priority 90.
HSRP state updates and priority shifts must be transmitted via multicast Hello messages to peer routers.
3
Evaluate peer router reaction and preemption mechanism.
R2 compares priorities (105 vs 90) and sends a Coup message.
Because preemption is enabled on R2, R2 immediately attempts to claim the Active role when it sees an Active router with lower priority.
4
Analyze Layer 2 forwarding convergence.
R2 shifts to Active state and sends a Gratuitous ARP (GARP).
Layer 2 switches must learn that the virtual MAC address is now reachable via R2's switch port, which is accomplished via GARP frame broadcast.
5
Verify final state transition of the original Active router.
R1 transitions to Standby state.
R1 recognizes R2 as a valid Active router with higher priority (105 > 90) and completes demotion.

Key Concept

HSRP Interface Tracking, Preemption Coup Mechanics, and GARP Convergence
Question 817Question →

A network engineer applies the following logging configuration to a Cisco IOS router:

text
logging buffered 8192 notifications
logging trap 4
logging host 172.16.10.50

Shortly after applying this configuration, the router experiences several events and generates the following syslog messages:

1. `%SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.1.10)`
2. `%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down`
3. `%SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 172.16.10.50 started`
4. `%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down`

Which syslog message will be successfully transmitted to the remote syslog server at 172.16.10.50?

Show answer & explanation

Answer: Only the %LINK-3-UPDOWN message

Answer

Only the %LINK-3-UPDOWN message will be transmitted to the syslog server.
The option specifying that only the link state message (%LINK-3-UPDOWN) will be sent is correct. Cisco IOS syslog trap logging forwards messages whose numeric severity level is less than or equal to the configured trap level. With 'logging trap 4' configured, messages with severity levels 0, 1, 2, 3, and 4 are forwarded. %LINK-3-UPDOWN has a severity code of 3 (Error), which is within this threshold.

Step-by-Step Solution

1
Analyze the syslog trap destination command and identify its severity threshold.
The command 'logging trap 4' sets the trap severity threshold to level 4 (warnings).
The 'logging trap' command controls which log severity levels are forwarded to configured remote syslog hosts.
2
Determine the range of numeric severity levels sent under threshold level 4.
Messages with severity levels 0 (Emergency), 1 (Alert), 2 (Critical), 3 (Error), and 4 (Warning) are forwarded to the remote host. Messages with severity levels 5, 6, and 7 are dropped.
Syslog numeric codes run inversely to priority: 0 is the most urgent and 7 is the least urgent (debugging). A threshold permits all logs with a numeric code less than or equal to the specified value.
3
Evaluate each generated message against the threshold (severity <= 4).
Message 1 (%SYS-5-CONFIG_I) is level 5 (Notification) -> Excluded. Message 2 (%LINK-3-UPDOWN) is level 3 (Error) -> Included. Message 3 (%SYS-6-LOGGINGHOST_STARTSTOP) is level 6 (Informational) -> Excluded. Message 4 (%LINEPROTO-5-UPDOWN) is level 5 (Notification) -> Excluded.
Only message 2 has a numeric severity code (3) that is less than or equal to the configured trap threshold of 4.

Key Concept

Cisco IOS Syslog Severity Levels and Trap Destinations
Estimated Time:2m 0s
Question 818Question →

An engineer executes the command shown below to inspect the OSPFv2 operational status of interface GigabitEthernet0/1 on router R3:

text
R3# show ip ospf interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
Internet Address 10.1.1.3/24, Area 0
Process ID 1, Router ID 3.3.3.3, Network Type BROADCAST, Cost: 1
Transmit Delay is 1 sec, State DROTHER, Priority 0
Designated Router (ID) 2.2.2.2, Interface address 10.1.1.2
Backup Designated Router (ID) 1.1.1.1, Interface address 10.1.1.1
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

Why does router R3 operate in the DROTHER state despite having a higher Router ID than both Designated Router R2 (2.2.2.2) and Backup Designated Router R1 (1.1.1.1)?

Show answer & explanation

Answer: The interface priority on R3 is set to 0, which completely excludes the router from participating in DR and BDR elections.

Answer

The interface priority on R3 is set to 0, which completely excludes the router from participating in DR and BDR elections.
In OSPFv2 multiaccess networks, DR and BDR elections evaluate interface priority first (highest priority wins, default is 1). Configuring an interface priority of 0 explicitly prevents that router interface from taking on either the DR or BDR role, keeping it permanently as a DROTHER regardless of how high its Router ID is.

Step-by-Step Solution

1
Examine the output of the 'show ip ospf interface GigabitEthernet0/1' command on router R3.
The command output confirms 'State DROTHER, Priority 0' alongside Router ID 3.3.3.3, DR ID 2.2.2.2, and BDR ID 1.1.1.1.
This reveals R3's current operational state, its configured priority, and the current election roles on the segment.
2
Evaluate the impact of interface priority on OSPF DR/BDR election eligibility.
An OSPF interface priority of 0 explicitly disqualifies a router from participating in DR and BDR elections.
By rule, any router with a priority of 0 is immediately excluded from election candidacy regardless of its Router ID value.
3
Determine why R3 remains in the DROTHER state.
Because R3's priority is set to 0, its higher Router ID (3.3.3.3) is ignored during elections, placing R3 in the DROTHER state.
Router ID serves as a tie-breaker only among routers that have non-zero priority values.

Key Concept

OSPFv2 DR/BDR Election Rules and Priority 0 Exclusion
Question 819Question →

A network engineer is troubleshooting an IPsec site-to-site VPN tunnel established between a main office router and a remote branch router situated behind an intermediate Port Address Translation (PAT) gateway. During tunnel negotiation, Phase 1 completes successfully, but encrypted data packets fail to pass between the sites when NAT-Traversal (NAT-T) is disabled on both gateways. Which operational characteristic of IPsec explains why the PAT gateway drops the data phase traffic?

Show answer & explanation

Answer: Native Encapsulating Security Payload (ESP) operates directly over IP protocol 50 without Layer 4 TCP/UDP port headers, preventing PAT gateways from mapping multiple translated sessions.

Answer

Native Encapsulating Security Payload (ESP) operates directly over IP protocol 50 without Layer 4 TCP/UDP port headers, preventing PAT gateways from mapping multiple translated sessions.
The correct answer identifies that native Encapsulating Security Payload (ESP) uses IP protocol 50 without Layer 4 TCP or UDP port headers. Because Port Address Translation (PAT) relies on modifying Layer 4 port numbers to multiplex multiple private IP streams across a single public IP address, it cannot translate native ESP packets. Enabling NAT-Traversal (NAT-T) solves this issue by encapsulating ESP packets within UDP port 4500 headers, allowing PAT gateways to translate the traffic successfully.

Step-by-Step Solution

1
Analyze IPsec protocol headers for Phase 2 data plane traffic.
IPsec Encapsulating Security Payload (ESP) resides directly above the IP layer using IP protocol 50.
ESP does not contain Layer 4 source or destination port fields such as TCP or UDP.
2
Evaluate the operational mechanics of Port Address Translation (PAT).
PAT requires Layer 4 TCP or UDP port numbers to translate multiple internal IP addresses onto a single public IP address.
Without Layer 4 port identifiers, a PAT device cannot create unique translation entries in its translation table.
3
Determine the impact of disabling NAT-Traversal (NAT-T).
Without NAT-T, ESP packets are sent in their native format (IP protocol 50) rather than being encapsulated inside UDP port 4500 wrappers.
The intermediate PAT device cannot translate native ESP packets, causing Phase 2 data traffic to be dropped.

Key Concept

IPsec NAT-Traversal (NAT-T) and ESP Encapsulation Mechanics
Question 820Question →

A network administrator needs to segment a local network into distinct broadcast domains to prevent excessive broadcast traffic from degrading performance. Which network device natively creates a separate broadcast domain on each of its physical interfaces?

Show answer & explanation

Answer: Router

Answer

The router is the network component that natively creates separate broadcast domains on each of its physical interfaces.
Routers operate at Layer 3 of the OSI model and separate networks into distinct IP subnets. Because routers do not forward Layer 2 broadcast packets by default, each physical interface on a router forms a separate broadcast domain.

Step-by-Step Solution

1
Identify the OSI layer boundary required to block Layer 2 broadcast traffic.
Layer 3 (Network Layer) boundaries prevent Layer 2 broadcast frames (such as MAC address FF:FF:FF:FF:FF:FF) from passing between connected networks.
Broadcast traffic is confined to its local subnet unless specifically routed or relayed by design.
2
Determine which component performs default Layer 3 boundary isolation.
Routers connect independent Layer 3 networks and terminate Layer 2 broadcast domains on each interface.
Each physical interface of a router is assigned to a distinct IP subnet and acts as an independent broadcast domain boundary.

Key Concept

Broadcast Domain Isolation at Layer 3
Estimated Time:45s
PreviousPage 41 / 100Next
All practice questions — Cisco CCNA | Examkin