Examkin

Wireless LAN Client Connectivity Configuration via WLC GUI

29 questions

All types29Multiple choice14Multiple select6Ordering9
Question 1Question →

A network technician is configuring a new Wireless LAN on a Cisco Wireless LAN Controller (WLC) using the web interface. The technician has created the WLAN profile, assigned the SSID, and selected the interface mapping under the General tab. However, access points are not broadcasting the new network and wireless clients cannot connect. Which checkbox under the WLANs > Edit 'General' tab must be selected to make the WLAN active and operational?

Show answer & explanation

Answer: Status

Answer

The Status checkbox must be selected under the General tab to administratively enable the WLAN.
Newly created WLANs on a Cisco WLC are disabled by default. Under the General tab of the WLANs > Edit configuration page, checking the Status box (Enabled) is required to administratively activate the WLAN so that assigned Access Points can broadcast the SSID and process client association requests.

Step-by-Step Solution

1
Navigate to the WLANs menu in the Cisco WLC GUI and click on the newly created WLAN ID.
The WLANs > Edit configuration screen appears showing the General tab.
This menu contains basic identity and status controls for the specific WLAN.
2
Locate the Status field on the General tab page.
The Status checkbox is unchecked by default upon WLAN creation.
Cisco WLC creates WLANs in an administratively disabled state to prevent broadcasting incomplete network settings.
3
Check the Status box to set it to Enabled and click Apply.
The WLAN state changes to Enabled and Access Points begin broadcasting the SSID.
Enabling Status activates the WLAN operational state across all assigned APs.

Key Concept

WLAN Administrative Enablement via WLC GUI
Question 2Question →

An administrator needs to create a new WPA2-Personal WLAN using the Cisco Wireless LAN Controller (WLC) GUI. Place the steps in the correct chronological order to complete this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by selecting 'Create New' on the WLANs page, defining the Profile Name and SSID, enabling the WLAN and mapping the interface under the General tab, and finally configuring PSK under the Layer 2 Security tab.
The correct order follows standard WLC GUI workflow: first initiating creation via the drop-down menu on the WLANs page, defining the WLAN identity (Profile Name and SSID), enabling the WLAN and selecting its interface under the General tab, and finally defining authentication parameters under the Layer 2 Security tab.

Step-by-Step Solution

1
Initiate WLAN creation
Access the creation interface by choosing 'Create New' on the WLANs menu.
The controller requires starting a new instance from the main WLAN management page.
2
Define WLAN identification
Specify the Profile Name, broadcast SSID, and numerical WLAN ID.
Applying these parameters creates the WLAN entry and opens the WLAN Edit configuration sub-menus.
3
Configure General settings
Map the WLAN to its target interface/VLAN and set the WLAN Status to Enabled.
Clients cannot connect unless the WLAN is bound to an active interface and enabled.
4
Configure Security settings
Set Layer 2 Security to WPA2/WPA3, select PSK under Auth Key Management, and set the password.
This establishes the WPA2-Personal authentication requirements for connecting clients.

Key Concept

WLC GUI WLAN Configuration Sequence
Question 3Question →

An administrator is configuring client connectivity for a new wireless network using the Cisco Wireless LAN Controller (WLC) web interface. The WLAN must use WPA2-Personal (PSK) authentication and be mapped to a dedicated dynamic interface. Arrange the GUI configuration steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of configuration steps is: 1) Select Create New and click Go on the WLANs page; 2) Define the Profile Name and SSID, then click Apply; 3) Map the dynamic interface under the General tab; 4) Configure WPA2-Personal (PSK) under Security > Layer 2; 5) Check the Status Enabled box on the General tab and click Apply.
Configuring a WLAN via the Cisco WLC GUI follows a defined procedural sequence. First, the administrator must navigate to WLANs > WLANs, select 'Create New', and click 'Go'. Second, the Profile Name and SSID are specified, followed by clicking 'Apply' to generate the profile entry. Third, under the General tab, the administrator maps the WLAN to the designated dynamic interface. Fourth, under Security > Layer 2, WPA2 Policy is enabled alongside PSK key management and the pre-shared key value. Fifth, the administrator returns to the General tab to check the Status checkbox to Enabled, clicking Apply to operationalize the WLAN.

Step-by-Step Solution

1
Initiate WLAN Creation
Navigating to WLANs > WLANs, selecting 'Create New' from the drop-down menu, and clicking 'Go' opens the initial setup page.
You must create a new profile instance before configuring parameters.
2
Define Profile Name and SSID
Entering the Profile Name and SSID and clicking 'Apply' instantiates the WLAN entry in the controller configuration.
The WLC requires an established Profile Name and SSID identifier before opening the full edit menu.
3
Bind Dynamic Interface
Selecting the dynamic interface on the General tab binds wireless client traffic to the appropriate VLAN.
Interface mapping determines client IP address assignment and network access.
4
Configure Layer 2 Security
Selecting WPA+WPA2, enabling WPA2 Policy, enabling PSK, and entering the pre-shared key secures client connections.
Layer 2 security options must be configured under Security > Layer 2 rather than Layer 3 or AAA tabs.
5
Enable and Save WLAN
Checking the 'Status: Enabled' box on the General tab and clicking 'Apply' activates the SSID across associated APs.
WLAN profiles are disabled by default during creation and must be explicitly enabled after all configurations are set.

Key Concept

Cisco WLC GUI WLAN Configuration Sequence
Estimated Time:1m 15s
Question 4Question →

An engineer is configuring a wireless network for enterprise laptops using the Cisco Wireless LAN Controller (WLC) web interface. Under the Security tab, Layer 2 security is configured to use WPA2-Enterprise with 802.1X key management. Which sub-tab within the WLAN configuration page must be used to specify the external RADIUS authentication server for client authorization?

Show answer & explanation

Answer: AAA Servers sub-tab under Security

Answer

The RADIUS authentication server is assigned on the AAA Servers sub-tab under the Security tab of the WLAN configuration page.
On a Cisco WLC, after configuring Layer 2 Security for 802.1X (WPA2/WPA3 Enterprise), external RADIUS authentication servers are selected under the AAA Servers sub-tab located within the Security tab of the WLAN edit page.

Step-by-Step Solution

1
Identify the WLAN configuration requirement
The scenario requires associating an 802.1X RADIUS authentication server with a newly defined WPA2-Enterprise WLAN.
When 802.1X is selected under Layer 2 Security, the WLC must know which external AAA server to forward EAP authentication requests to.
2
Locate the appropriate WLC GUI menu section
Navigate to WLANs > Edit > Security > AAA Servers.
Cisco WLC GUI categorizes external authentication server selection under the AAA Servers sub-tab within the Security tab.

Key Concept

WLC GUI WLAN RADIUS Authentication Server Configuration
Estimated Time:1m 0s
Question 5Question →

An administrator is configuring a corporate WLAN on a Cisco Wireless LAN Controller (WLC) GUI for enterprise clients requiring 802.1X authentication and centralized CAPWAP traffic forwarding. During initial client association tests, clients fail to complete 802.1X authentication and fail to receive an IP address via DHCP. Inspection of the WLC GUI shows that the WLAN status is enabled, but client traffic is mapped to the default management interface, and no authentication server is processing client login requests for this WLAN. Which TWO configurations within the WLC GUI WLAN edit menu must be applied to resolve these client connectivity issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Navigate to WLANs > Edit > Security > AAA Servers tab and select the active RADIUS server under Server 1 in the Authentication Servers section.; Navigate to WLANs > Edit > General tab and change the Interface/Interface Group dropdown from management to the mapped dynamic client VLAN interface.

Answer

To resolve 802.1X client authentication failure and improper DHCP address assignment, the administrator must select an active RADIUS server under the Security > AAA Servers tab and reassign the WLAN interface mapping from management to the client dynamic VLAN interface under the General tab.
In the Cisco WLC GUI, establishing functional client connectivity for an 802.1X enterprise WLAN requires configuring AAA authentication server bindings under WLANs > Edit > Security > AAA Servers. Additionally, assigning client traffic to the correct dynamic interface corresponding to the client VLAN must be performed under the WLANs > Edit > General tab.

Step-by-Step Solution

1
Diagnose 802.1X RADIUS server assignment failure
Identify that 802.1X authentication requests are dropped because no RADIUS server is bound to the WLAN under WLANs > Edit > Security > AAA Servers.
WLC WLANs configured for WPA2/WPA3-Enterprise (802.1X) require an explicit AAA server mapping in the WLAN settings to pass EAP messages to RADIUS.
2
Diagnose client VLAN and DHCP failure
Identify that mapping client traffic to the management interface prevents clients from obtaining lease addresses on the designated client subnet.
Cisco WLC GUI requires mapping each WLAN to its corresponding dynamic interface on the General tab to ensure proper VLAN tagging and DHCP relay forwarding.

Key Concept

WLAN Interface Mapping and AAA Server Association in Cisco WLC GUI
Question 6Question →

A network administrator needs to configure a new WPA2-Enterprise Wireless LAN (WLAN) for client connectivity using the Cisco Wireless LAN Controller (WLC) GUI. Arrange the steps in the correct chronological order required to successfully create, configure security settings for, enable, and apply this WLAN.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order is: 1) Navigate to WLANs > WLANs and select Create New, 2) Define Profile Name, SSID, and WLAN ID then click Apply, 3) Select the dynamic interface and enable Status under the General tab, 4) Configure WPA2 Policy with 802.1X under the Security > Layer 2 tab, and 5) Select the RADIUS authentication server under the AAA Servers tab and click Apply.
Creating a WLAN via the Cisco WLC web GUI follows a strict sequential process. First, navigating to WLANs > WLANs and executing 'Create New' allows entry of the basic identifying information (Profile Name, SSID, and WLAN ID). Clicking Apply creates the WLAN instance and presents the edit menu. On the General tab, the administrator maps the WLAN to a dynamic interface for VLAN access and enables the WLAN status. Next, under Security > Layer 2, WPA2 Policy and 802.1X Key Management are specified. Finally, under the AAA Servers tab, the specific RADIUS server is attached to handle 802.1X authentication, and clicking Apply saves the full configuration.

Step-by-Step Solution

1
Initiate WLAN Creation
Access the WLAN creation workflow by selecting 'Create New' from the drop-down menu on the WLANs page and clicking 'Go'.
The controller requires creating a new WLAN object before configurable tabs become available.
2
Configure Basic Identifiers
Assign the Profile Name, wireless network SSID, and unique WLAN ID, then click 'Apply'.
Applying these parameters registers the WLAN and automatically opens the WLANs > Edit page with specific configuration tabs.
3
Configure Interface Mapping & Administrative Status
On the General tab, select the mapped dynamic VLAN interface and check the Enabled box for Status.
Clients will fail to receive IP addressing or transmit traffic if the WLAN is not mapped to an operational interface and enabled.
4
Configure Layer 2 Security Mechanisms
Navigate to Security > Layer 2, select WPA+WPA2 parameters, enable WPA2 Policy, and choose 802.1X under Auth Key Management.
WPA2-Enterprise relies on 802.1X Key Management rather than PSK.
5
Bind AAA RADIUS Server & Save Settings
Navigate to the AAA Servers tab, choose the configured RADIUS server under Server 1, and click 'Apply' in the top-right corner.
802.1X authentication requests must be forwarded to a external RADIUS server for identity validation.

Key Concept

WLC GUI WLAN Creation and 802.1X Security Configuration Order
Estimated Time:2m 0s
Question 7Question →

A network administrator is setting up a new wireless network using the Cisco Wireless LAN Controller (WLC) web GUI. After defining the WLAN profile name and SSID on the General tab, the administrator needs to configure WPA2 Pre-Shared Key (PSK) authentication for client connectivity. Under which tab and sub-tab within the WLANs > Edit menu is the PSK passphrase field configured?

Show answer & explanation

Answer: Security tab, under the Layer 2 sub-tab

Answer

The PSK passphrase is configured under the Security tab on the Layer 2 sub-tab.
In the Cisco WLC web GUI, Layer 2 wireless security protocols (WPA2/WPA3) and key management methods (PSK vs 802.1X) are located under WLANs > Edit > Security > Layer 2. Enabling PSK under Auth Key Management displays the Pre-Shared Key entry box directly on the Layer 2 sub-tab.

Step-by-Step Solution

1
Navigate to WLANs > Edit for the target WLAN in the WLC GUI.
Access the configuration tabs for the specific WLAN.
WLAN-specific parameters are modified in this section.
2
Click on the Security tab, then select the Layer 2 sub-tab.
Layer 2 security options (such as WPA+WPA2) are displayed.
Wi-Fi authentication mechanisms (PSK and 802.1X) operate at Layer 2.
3
Select PSK under Auth Key Management and enter the passphrase in the Pre-Shared Key box.
The PSK passphrase is applied directly within the Layer 2 sub-tab.
Cisco AireOS WLC GUI integrates PSK key entry directly into the Layer 2 security policy page.

Key Concept

WLC GUI WLAN Security Configuration & Navigation
Estimated Time:1m 15s
Question 8Question →

A network administrator needs to create a new Wireless LAN (WLAN) on a Cisco Wireless LAN Controller (WLC) using the GUI to allow client connectivity. Arrange the steps required to configure and activate the new WLAN in the correct sequential order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order to create and activate a WLAN via the Cisco WLC GUI is: 1) Navigate to the WLANs tab and select 'Create New', 2) Define the Profile Name, SSID, and mapped Interface under the General tab, 3) Select Layer 2 security settings under the Security tab, and 4) Select the Status checkbox under the General tab and click Apply to enable client connections.
When configuring a WLAN via the Cisco WLC GUI, the administrator must first create the new WLAN entry from the WLANs menu. Next, the Profile Name, SSID, and Interface mapping are set under the General tab. After that, authentication methods (such as PSK or 802.1X) are selected under the Security tab. Finally, the Status checkbox under the General tab is enabled and applied to begin broadcasting the network to client devices.

Step-by-Step Solution

1
Initiate WLAN creation in WLC GUI
WLAN creation page is displayed
Selecting 'Create New' under the WLANs menu starts the creation process.
2
Configure basic parameters and interface mapping
WLAN identity and network binding are defined
Setting the Profile Name, SSID, and Interface/Interface Group binds the WLAN to the correct network segment.
3
Configure security options
WLAN security and authentication parameters are set
Security parameters under the Security tab define how clients authenticate and encrypt traffic.
4
Enable WLAN Status and apply changes
WLAN becomes active and broadcasts the SSID to clients
Checking the Status box enables the WLAN profile on the controller.

Key Concept

WLC GUI WLAN Configuration Sequence
Estimated Time:1m 0s
Question 9Question →

When creating a new Wireless LAN (WLAN) on a Cisco Wireless LAN Controller (WLC) using the web GUI, under which tab within the WLANs Edit menu is Pre-Shared Key (PSK) authentication configured for WPA2-Personal wireless clients?

Show answer & explanation

Answer: Security tab

Answer

The Security tab is used to configure WPA2-Personal Pre-Shared Key (PSK) authentication on a Cisco Wireless LAN Controller GUI.
In the Cisco WLC web GUI, all Layer 2 and Layer 3 security protocols—including WPA2-Personal Pre-Shared Key (PSK) and WPA2-Enterprise (802.1X)—are configured under the Security tab of the WLANs > Edit page.

Step-by-Step Solution

1
Navigate to the WLANs menu in the Cisco WLC GUI and select the target WLAN ID.
The WLANs > Edit page opens with several configuration tabs (General, Security, AAA Servers, QoS, Advanced).
Different WLAN parameters are segregated into functional tabs.
2
Select the Security tab and sub-tab Layer 2.
Layer 2 security mechanisms such as WPA+WPA2 are displayed.
Pre-Shared Key (PSK) is a Layer 2 security mechanism under the WPA/WPA2 policy.
3
Enable WPA2 Policy and set Auth Key Management to PSK, then enter the pre-shared key format and key value.
Client connectivity is configured to require the specified PSK for WPA2-Personal association.
This establishes client authentication criteria for the wireless network.

Key Concept

Cisco WLC GUI WLAN Security Configuration
Estimated Time:45s
Question 10Question →

An administrator is configuring a new Wireless LAN (WLAN) using the Cisco Wireless LAN Controller (WLC) web GUI. Which two settings must be configured on the WLANs > Edit 'General' tab to enable basic client connectivity and map wireless traffic to the wired network? (Select two.)

Select all that apply

Show answer & explanation

Answer: Check the Enabled box under Status to activate the WLAN.; Select the appropriate Interface or Interface Group name from the drop-down menu.

Answer

The two required configurations on the General tab are enabling the WLAN Status checkbox and selecting the target Interface/Interface Group.
On a Cisco WLC GUI, the WLANs > Edit 'General' tab is used to establish core settings: enabling the WLAN Status checkbox makes the network active, and selecting the Interface/Interface Group ties wireless clients to the appropriate wired network interface.

Step-by-Step Solution

1
Navigate to the WLANs menu in the Cisco WLC GUI and open the General tab for the specific WLAN.
The General tab displays primary parameters including Profile Name, SSID, Status, and Interface/Interface Group.
This tab establishes fundamental WLAN administrative identity and traffic mapping.
2
Select the Enabled checkbox under Status.
The WLAN transitions to an active state across joining access points.
By default, new WLANs are created in a disabled state to prevent unexpected broadcasts before full setup.
3
Select the designated dynamic interface or interface group from the Interface/Interface Group menu.
Wireless client data frames are bridged onto the corresponding wired VLAN.
A WLAN must be tied to a controller interface to map client traffic into the underlying local network infrastructure.

Key Concept

WLC GUI WLAN General Tab Configuration
Question 11Question →

A network administrator configures a WPA2-Enterprise wireless network on a Cisco Wireless LAN Controller (WLC) GUI. On the WLANs > Edit page, the administrator sets the Interface/Interface Group on the General tab to a default VLAN dynamic interface, configures RADIUS authentication under the Security > AAA Servers tab, and confirms 802.1X Key Management under the Security > Layer 2 tab. During testing, wireless clients successfully authenticate against the external RADIUS server, but all clients are assigned to the default dynamic interface specified on the General tab rather than the individual per-user VLAN IDs returned in the RADIUS server IETF attributes (Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID). Which GUI configuration change on the WLC is required to enforce the dynamic VLAN assignments supplied by the RADIUS server?

Show answer & explanation

Answer: Navigate to the Advanced tab of the WLAN edit page and enable the Allow AAA Override option.

Answer

Enable the Allow AAA Override option under the Advanced tab of the WLAN configuration page on the WLC GUI.
On a Cisco WLC, the 'Allow AAA Override' setting on the WLAN's Advanced tab must be enabled for the controller to accept client-specific attributes returned by a RADIUS server during 802.1X authentication. Without this setting checked, the WLC ignores RADIUS IETF attributes (such as Tunnel-Private-Group-ID for dynamic VLAN placement) and forces all authenticated clients onto the static interface configured on the WLAN's General tab.

Step-by-Step Solution

1
Analyze the client connectivity issue.
802.1X authentication succeeds, but RADIUS-supplied attributes (VLAN IDs) are ignored, defaulting clients to the WLAN's mapped interface.
By default, Cisco WLC ignores user-specific AAA parameters returned in RADIUS Access-Accept messages unless explicitly configured to apply them.
2
Locate the required configuration feature in the WLC GUI.
Identify that feature overrides (AAA Override) reside under WLANs > Edit > Advanced tab.
The Advanced tab controls policy override capabilities, including Allow AAA Override, Coverage Hole Detection, and Client Band Select.
3
Enable 'Allow AAA Override'.
The WLC overrides the default dynamic interface on the General tab with the RADIUS IETF attributes 64 (Tunnel-Type), 65 (Tunnel-Medium-Type), and 81 (Tunnel-Private-Group-ID).
This setting instructs the controller to dynamically place authenticated clients into their assigned VLANs based on RADIUS authorization profiles.

Key Concept

WLAN AAA Override Configuration for Dynamic RADIUS VLAN Assignment via WLC GUI
Question 12Question →

A network engineer is configuring a newly created WLAN on a Cisco Wireless LAN Controller (WLC) using the web GUI. The engineer needs to bind this WLAN to a specific dynamic interface so that connecting wireless clients are assigned to the correct IP subnet VLAN. On which tab within the WLANs > Edit menu is the Interface/Interface Group drop-down list located?

Show answer & explanation

Answer: General

Answer

The Interface/Interface Group drop-down list is located under the General tab of the WLAN edit menu.
On a Cisco Wireless LAN Controller (WLC) GUI, the General tab under WLANs > Edit is where core operational attributes are defined. This includes the Profile Name, SSID, Status enablement, Radio Policy, and the Interface/Interface Group mapping that links the WLAN to a specific dynamic interface/VLAN.

Step-by-Step Solution

1
Navigate to WLANs menu in the Cisco WLC web GUI
Displays the list of configured WLAN IDs and Profile Names.
Allows selection of the specific WLAN requiring modification.
2
Click the target WLAN ID to access the Edit menu
Opens the WLAN Edit window displaying multiple configuration tabs (General, Security, QoS, Policy-Mapping, Advanced).
Provides access to the settings of the selected WLAN.
3
Locate the Interface/Interface Group (GNS) drop-down menu on the General tab
Maps the wireless traffic of clients connecting to this SSID to the corresponding controller dynamic interface and backend VLAN.
The General tab houses essential WLAN parameters including Profile Name, SSID, Status checkbox, and Interface association.

Key Concept

WLAN Interface Association in Cisco WLC GUI
Estimated Time:45s
Question 13Question →

An engineer has globally defined an external RADIUS server under Controller > AAA > RADIUS > Authentication on a Cisco Wireless LAN Controller (WLC). The engineer then creates a new enterprise WLAN with Layer 2 Security set to WPA2 using 802.1X authentication. However, wireless clients attempting to connect are unable to authenticate, and debug logs indicate that no authentication requests are being transmitted to the RADIUS server. Which configuration action within the WLANs > Edit menu must be performed to resolve this client authentication failure?

Show answer & explanation

Answer: Select the active RADIUS server under the AAA Servers tab of the specific WLAN configuration.

Answer

Selecting the active RADIUS server under the AAA Servers tab of the specific WLAN configuration enables the WLC to route 802.1X client authentication requests to the RADIUS server.
Global RADIUS server configuration under the Controller menu merely registers the server with the WLC. To enable client authentication for a specific WLAN using 802.1X, an administrator must navigate to WLANs > Edit > AAA Servers tab and select the desired RADIUS server from the Authentication Servers drop-down menu.

Step-by-Step Solution

1
Analyze the prerequisite global configuration versus WLAN-specific mapping on Cisco WLC GUI.
Global configuration makes the RADIUS server available, but individual WLANs must be explicitly bound to the server.
Different WLANs may require different RADIUS servers or authentication server groups.
2
Identify the specific GUI tab in the WLANs > Edit menu responsible for authentication server assignment.
The AAA Servers tab contains drop-down menus for Authentication and Accounting servers.
This tab connects the WLAN's 802.1X security configuration to the desired RADIUS server index.
3
Select the primary RADIUS server from the Authentication Servers drop-down list.
The controller now forwards EAP-Request/Response packets between wireless clients and the designated RADIUS server.
Without this mapping, the WLC has no target server configured for client 802.1X requests on that WLAN.

Key Concept

WLAN AAA Server Mapping in Cisco WLC GUI
Estimated Time:1m 30s
Question 14Question →

A network administrator is creating a new WLAN on a Cisco Wireless LAN Controller (WLC) via the web GUI to support corporate users. The WLAN must map client traffic to the dynamic interface associated with VLAN 20 and authenticate clients using WPA2-Enterprise (802.1X) against a central external RADIUS server that has already been globally configured on the controller. Which two configuration actions must the administrator perform within the WLAN configuration tabs in the WLC GUI to successfully complete this setup? (Select two.)

Select all that apply

Show answer & explanation

Answer: Under the General tab, select the dynamic interface mapped to VLAN 20 from the Interface/Interface Group dropdown menu and check the Enabled box for Status.; Under the Security > AAA Servers tab, select the pre-configured RADIUS server from the Server 1 dropdown list in the Authentication Servers section.

Answer

The administrator must map the WLAN to the dynamic interface for VLAN 20 and enable the WLAN status under the General tab, as well as select the pre-configured RADIUS server under the Security > AAA Servers tab.
To complete WLAN client connectivity configuration for WPA2-Enterprise with VLAN tagging: 1) Under the General tab, the WLAN must be associated with the appropriate dynamic interface (VLAN 20) and the Status box must be checked to enable SSID broadcasting and association. 2) Under the Security > AAA Servers tab, the specific external RADIUS server must be bound to the WLAN so authentication traffic is forwarded correctly.

Step-by-Step Solution

1
Navigate to the WLANs tab in the WLC GUI and edit the target WLAN.
Access the multi-tab configuration interface for the specific WLAN.
WLAN settings are organized into General, Security, AAA Servers, QoS, and Advanced tabs.
2
Select the dynamic interface for VLAN 20 and check the Enabled checkbox under the General tab.
Traffic from clients associating to this WLAN is mapped to VLAN 20, and the WLAN is brought administratively online.
Without enabling Status, the WLAN remains inactive; without binding the dynamic interface, client traffic cannot reach VLAN 20.
3
Navigate to Security > AAA Servers tab and select the globally configured RADIUS server under Authentication Servers.
The WLAN is instructed to send 802.1X authentication requests to the designated external RADIUS server.
Global RADIUS definitions must be explicitly assigned to individual WLANs under the WLAN AAA Servers tab for 802.1X Enterprise security.

Key Concept

WLC GUI WLAN Client Connectivity and Security Configuration Parameters
Estimated Time:2m 0s
Question 15Question →

A network engineer is configuring a high-security WLAN on a Cisco Wireless LAN Controller (WLC) via the web GUI to support modern client devices using WPA3-Personal (SAE) key management. Under the WLANs > Edit > Security > Layer 2 tab, the engineer selects WPA3 Policy but leaves the Protected Management Frames (PMF) setting at 'Disabled'. When attempting to save and enable the WLAN, the WLC displays a configuration error and refuses to save the profile. Which setting change in the WLC GUI is mandatory to resolve this error?

Show answer & explanation

Answer: Set Protected Management Frames (PMF) to Required under the Security > Layer 2 tab

Answer

Set Protected Management Frames (PMF) to Required under the Security > Layer 2 tab
Under the Wi-Fi Alliance WPA3 specification, Protected Management Frames (PMF / IEEE 802.11w) are strictly mandatory. When configuring a WLAN on a Cisco Wireless LAN Controller via the web GUI (WLANs > Edit > Security > Layer 2), selecting WPA3 Policy forces the administrator to set Protected Management Frames to 'Required'. Leaving PMF set to 'Disabled' results in an immediate GUI validation failure because the controller enforces WPA3 security standard compliance.

Step-by-Step Solution

1
Identify the mandatory prerequisite for WPA3 operation on Cisco WLCs
Recognize that the Wi-Fi Alliance WPA3 specification mandates IEEE 802.11w Protected Management Frames (PMF).
PMF prevents management frame spoofing attacks such as deauthentication and disassociation attacks.
2
Locate the PMF configuration field in the WLC GUI
Navigate to WLANs > Edit > Security > Layer 2 tab where WPA+WPA2/WPA3 parameters reside.
PMF is a Layer 2 security mechanism configured on the same sub-tab as WPA3 Policy.
3
Adjust the PMF parameter to satisfy WPA3 policy validation
Change Protected Management Frames dropdown from Disabled to Required.
Selecting WPA3 Policy without enabling PMF as Required generates a WLC GUI validation error when applying changes.

Key Concept

WLC GUI Layer 2 Security and WPA3 PMF Prerequisite Configuration
Estimated Time:2m 0s
Question 16Question →

A network engineer is tasked with deploying a new WPA2-Enterprise wireless network on a Cisco Wireless LAN Controller (WLC) using the web GUI. The WLAN must enforce 802.1X authentication via an external RADIUS server and support dynamic VLAN assignment using AAA override. What is the correct chronological sequence of steps to configure this WLAN on the WLC GUI from initial creation to feature enablement?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for configuring a WPA2-Enterprise WLAN with AAA Override on a Cisco WLC GUI is: 1) Create New WLAN (define Profile Name/SSID), 2) Set Interface and Enable Status under General tab, 3) Set WPA2-AES and 802.1X under Security > Layer 2 tab, 4) Select RADIUS Server under Security > AAA Servers tab, and 5) Enable Allow AAA Override under Advanced tab.
The correct procedural order follows standard Cisco WLC administration logic: First, create the WLAN instance with its Profile Name and SSID. Next, configure fundamental interface mapping and admin status on the General tab. Then, configure Layer 2 security for WPA2-Enterprise (802.1X AKM) on the Security > Layer 2 tab. Fourth, link the global RADIUS server under the Security > AAA Servers tab. Finally, navigate to the Advanced tab to enable 'Allow AAA Override' for dynamic VLAN steering.

Step-by-Step Solution

1
Initiate WLAN creation in WLC GUI
WLAN ID is allocated and initial Profile Name and SSID parameters are bound to the controller database.
You cannot configure specific WLAN sub-tabs until the WLAN instance is created via WLANs > Create New.
2
Configure General tab settings
The WLAN is associated with a distribution interface/interface group and marked administratively enabled.
Binding to an interface provides network pathing for client traffic.
3
Configure Layer 2 Security parameters
Layer 2 security policy is set to WPA2 with AES cipher and 802.1X key management.
Specifying 802.1X key management is a prerequisite for utilizing RADIUS EAP-based client authentication.
4
Bind RADIUS Server under AAA Servers tab
The WLAN targets the specific external RADIUS server for client EAP authentication transactions.
Without selecting an active RADIUS server under AAA Servers, 802.1X authentication requests will fail.
5
Enable AAA Override on Advanced tab
The controller honors RADIUS-returned VLAN attributes (IETF 64, 65, 81) to override the default WLAN interface assignment per user.
AAA Override functionality is disabled by default and resides specifically under the WLAN Advanced settings tab.

Key Concept

WLC GUI WLAN Configuration Workflow and Feature Navigation
Estimated Time:2m 30s
Question 17Question →

A network administrator needs to deploy a new corporate WLAN using WPA2/WPA3 Enterprise authentication on a Cisco AireOS Wireless LAN Controller (WLC) via the web GUI. Arrange the following administrative tasks in the correct sequential order required to successfully configure and activate the WLAN for wireless client connectivity.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural sequence is: 1) Navigate to WLANs > WLANs, select 'Create New' and enter the Profile Name and SSID; 2) On the General tab, map the dynamic interface; 3) Under Security > Layer 2, configure WPA2/WPA3 and 802.1X key management; 4) On the AAA Servers tab, bind the RADIUS authentication server; 5) Return to the General tab to check the Status (Enabled) box and click Apply.
Configuring a WLC WLAN requires a strict logical workflow: basic WLAN instantiation (SSID/Profile Name), interface assignment for VLAN traffic routing, Layer 2 security protocol selection (802.1X), external AAA RADIUS binding, and finally enabling the administrative Status to begin broadcasting the SSID.

Step-by-Step Solution

1
Initialize WLAN creation in WLC GUI
Defines the WLAN container with unique SSID and Profile Name.
Creating the basic WLAN structure is the mandatory starting point before detailed parameters can be edited.
2
Assign dynamic interface mapping
Associates wireless client traffic to the appropriate VLAN interface.
Setting the interface on the General tab ensures client packets are tagged with the correct VLAN ID upon join.
3
Define Layer 2 security mechanism
Sets authentication mode to 802.1X (WPA2/WPA3 Enterprise).
Configuring 802.1X key management under Security > Layer 2 specifies that external AAA authentication is required.
4
Map external RADIUS authentication server
Binds the globally defined RADIUS server to this specific WLAN under AAA Servers.
The WLC cannot authenticate 802.1X clients without associating a RADIUS server to the WLAN.
5
Enable WLAN status and apply changes
Activates the WLAN on member Access Points for client probing and association.
By default, new WLANs are disabled; enabling status must occur after all dependencies (interface, security, AAA) are configured.

Key Concept

WLC GUI WLAN Configuration Sequence
Question 18Question →

A network engineer is configuring a dedicated voice wireless network for wireless IP phones using the Cisco Wireless LAN Controller (WLC) web GUI. To ensure optimal performance and security, the engineer must set the Quality of Service (QoS) profile to Platinum (Voice) and restrict direct traffic between wireless clients on the same WLAN by enabling Peer-to-Peer Blocking. Which combination of GUI tabs under WLANs > Edit must the engineer access to configure these two settings?

Show answer & explanation

Answer: Configure the QoS profile under the QoS tab, and configure Peer-to-Peer Blocking under the Advanced tab.

Answer

Configure the QoS profile under the QoS tab, and configure Peer-to-Peer Blocking under the Advanced tab.
In the Cisco AireOS WLC web interface, editing a WLAN presents several dedicated tabs: General, Security, QoS, Policy-Mapping, AAA Servers, DNS, Device Analytics, IPv6, Advanced, and FlexConnect. The QoS tab specifies the Quality of Service profile (Platinum, Gold, Silver, Bronze) applied to client traffic. The Advanced tab controls operational client behavior and features, including Peer-to-Peer Blocking (Disabled, Drop, or Upstream-Forward), AAA Override, Mandatory DHCP, and Client Exclusion.

Step-by-Step Solution

1
Identify the WLC GUI navigation path for Quality of Service (QoS) profile settings.
In the Cisco WLC web GUI, navigate to WLANs > WLANs > Edit '[WLAN Name]' and select the QoS tab to choose the Quality of Service profile (Platinum/Voice).
QoS profiles determine packet marking and prioritization policies for wireless traffic and are located on the dedicated QoS tab.
2
Identify the WLC GUI navigation path for Peer-to-Peer (P2P) Blocking configuration.
Under WLANs > WLANs > Edit '[WLAN Name]', select the Advanced tab and locate the Peer-to-Peer Blocking Action drop-down menu.
Peer-to-Peer Blocking prevents client-to-client communication within the same WLAN and is categorized under operational WLAN behavior on the Advanced tab.

Key Concept

Cisco WLC GUI WLAN Configuration Tabs and Parameter Mapping
Question 19Question →

A network administrator is tasked with configuring a new WPA2-Personal (PSK) wireless network for client connectivity using the Cisco Wireless LAN Controller (WLC) web GUI. Place the steps in the correct order to complete the WLAN deployment from initial creation to saving the final configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order is: 1) Navigate to WLANs and select Create New, 2) Define Profile Name, SSID, and WLAN ID, 3) Select the Interface/Interface Group and enable Status on the General tab, 4) Configure WPA2-PSK parameters under Security > Layer 2, 5) Enter the PSK passphrase, click Apply, and click Save Configuration.
Configuring a client-facing WLAN on a Cisco AireOS WLC follows a strict sequential process: First, initiate creation under the WLANs menu using Create New. Second, define basic network parameters (Profile Name, SSID, ID) and click Apply to launch the edit view. Third, select the client traffic Interface and check Enabled on the General tab. Fourth, navigate to Security > Layer 2 to specify WPA2 Policy and PSK authentication. Finally, enter the pre-shared key passphrase, click Apply to update running memory, and save the WLC configuration.

Step-by-Step Solution

1
Initiate WLAN creation
Accesses the preliminary WLAN creation setup window.
You must navigate to WLANs > Create New to start defining a new wireless network.
2
Set WLAN identifiers
Generates the new WLAN instance and opens the full configuration tabs.
The WLC requires a Profile Name, broadcast SSID, and numerical ID before generating the specific WLAN configuration page.
3
Map network interface and enable WLAN
Binds client traffic to the appropriate VLAN interface and sets the administrative state.
Under the General tab, mapping the interface connects clients to the intended subnet, and checking Enabled activates the SSID.
4
Configure Layer 2 WPA2-PSK security parameters
Sets the authentication method to pre-shared key under Layer 2 settings.
WPA2-Personal settings are located specifically under Security > Layer 2 tab > WPA+WPA2 > Auth Key Management > PSK.
5
Enter passphrase, apply configuration, and save state
Commits changes to active memory and saves NVRAM configuration.
Entering the PSK passphrase completes security settings; clicking Apply commits settings to the running configuration, and Save Configuration persists it across reboots.

Key Concept

WLC GUI WLAN Creation and Client Connectivity Workflow
Estimated Time:1m 30s
Question 20Question →

An administrator is configuring a wireless network using the Cisco Wireless LAN Controller (WLC) web interface. The WLAN profile has been created and mapped to the proper client interface, but wireless clients are unable to automatically detect the network name during passive scanning. However, clients can connect successfully when the network name is entered manually. Which configuration setting under the WLANs > Edit 'General' tab must be selected to resolve this issue?

Show answer & explanation

Answer: Broadcast SSID

Answer

Broadcast SSID
Enabling the Broadcast SSID check box under the WLAN General tab causes the WLC to instruct APs to include the network name (SSID) in 802.11 beacon management frames. This allows client devices performing passive scans to discover and display the wireless network in their list of available networks.

Step-by-Step Solution

1
Identify the symptom described in the scenario.
Clients cannot detect the wireless network via passive scanning, but can connect if the SSID is configured manually.
This indicates that beacon frames sent by the Access Point are hiding the SSID parameter.
2
Locate the appropriate setting in the WLC GUI.
Navigate to WLANs > Edit for the specified WLAN profile, under the General tab.
Basic WLAN parameters like SSID name, profile name, global status, and broadcast settings are located on the General tab.
3
Select the setting that enables SSID advertisement in beacon frames.
Check the Broadcast SSID check box.
Enabling Broadcast SSID ensures the network name is transmitted in beacon frames for client discovery.

Key Concept

WLC GUI WLAN General Tab Configuration
Page 1 / 2Next