NetExam Pro

CCNA Wireless Fundamentals

CCNA 200-301 exam notes · Updated 2026-10-06

Wireless is a compact but high-yield slice of the CCNA 200-301 blueprint: architectures, controllers, AP modes and security. These CCNA wireless fundamentals notes cover wireless architectures and the WLC, plus AP modes and wireless security. Cement it afterwards with a free CCNA mock test.

Wireless Architectures and the WLC

Enterprise wireless is controller-based: lightweight APs tunnel all management (and usually client traffic) to a Wireless LAN Controller (WLC) using CAPWAP. This split-MAC architecture puts real-time jobs (beacons, probe responses, frame acknowledgement) on the AP and management, policy and roaming decisions on the controller — so hundreds of APs are configured once, centrally. Contrast with autonomous APs, which are standalone, individually configured, and fine for a small office but unmanageable at scale.

Know the wireless building blocks: the SSID is the network name clients see; a BSS is one AP's coverage cell; an ESS is multiple APs sharing one SSID so clients roam seamlessly. The 2.4 GHz band has only three non-overlapping channels (1, 6, 11); 5 GHz has many more and less interference, which is why modern deployments prefer it. APs get their addresses and controller discovery via DHCP options or DNS.

On a WLC you create WLANs binding an SSID to security settings and a VLAN/interface; verify APs have joined with show ap summary. Common exam gotchas: APs in different regulatory domains, mismatched country codes, and APs stuck in discovery because the WLC's management interface is unreachable. The controller is also where rogue AP detection lives — identifying unauthorised access points on your airspace.

Key exam points

  • Controller-based: lightweight APs + WLC over CAPWAP; split-MAC (real-time on AP, management on WLC).
  • SSID = network name; BSS = one AP cell; ESS = roaming across APs on one SSID.
  • 2.4 GHz: only channels 1, 6, 11 are non-overlapping. Prefer 5 GHz for capacity.
  • WLC workflow: create WLAN → bind SSID, security, VLAN. Check joins with show ap summary.

AP Modes and Wireless Security

APs operate in modes matched to their job. Local mode is the default: the AP serves clients and tunnels everything to the WLC. FlexConnect lets the AP switch client traffic locally at the branch while staying centrally managed — the answer whenever a question mentions a remote site surviving a WAN outage. Monitor mode dedicates the AP to scanning (rogue detection, intrusion detection), rogue detector mode listens on the wired side for rogue APs, and sniffer mode captures raw 802.11 frames for analysis.

For security, the progression is WEP → WPA → WPA2 → WPA3, and only the last two are acceptable. WPA2 uses AES-CCMP encryption with either a pre-shared key (WPA2-Personal) or 802.1X/EAP with a RADIUS server (WPA2-Enterprise). WPA3-Personal replaces the PSK handshake with SAE (Simultaneous Authentication of Equals), which defeats offline dictionary attacks; WPA3-Enterprise offers a 192-bit security mode. The exam's blunt rule: WEP and TKIP are never the answer.

Enterprise authentication follows 802.1X: the client (supplicant) talks EAP to the AP (authenticator), which relays to the RADIUS server (authentication server). Remember the port pair from the tables: RADIUS authentication on UDP 1812, accounting on 1813. A question describing certificate-based or credential-based Wi-Fi login with a central server is describing WPA2/WPA3-Enterprise with 802.1X.

Key exam points

  • AP modes: local (default), FlexConnect (branch survivability), monitor, rogue detector, sniffer.
  • WPA2 = AES-CCMP; Personal uses PSK, Enterprise uses 802.1X + RADIUS.
  • WPA3-Personal uses SAE (kills offline dictionary attacks); WPA3-Enterprise offers 192-bit mode.
  • WEP/TKIP are never correct. 802.1X roles: supplicant → authenticator → authentication server.

Related CCNA study guides

Frequently asked questions

What are the key CCNA exam points for Wireless Architectures and the WLC?

For the CCNA 200-301 exam, remember: Controller-based: lightweight APs + WLC over CAPWAP; split-MAC (real-time on AP, management on WLC). SSID = network name; BSS = one AP cell; ESS = roaming across APs on one SSID. 2.4 GHz: only channels 1, 6, 11 are non-overlapping. Prefer 5 GHz for capacity. WLC workflow: create WLAN → bind SSID, security, VLAN. Check joins with show ap summary.

What are the key CCNA exam points for AP Modes and Wireless Security?

For the CCNA 200-301 exam, remember: AP modes: local (default), FlexConnect (branch survivability), monitor, rogue detector, sniffer. WPA2 = AES-CCMP; Personal uses PSK, Enterprise uses 802.1X + RADIUS. WPA3-Personal uses SAE (kills offline dictionary attacks); WPA3-Enterprise offers 192-bit mode. WEP/TKIP are never correct. 802.1X roles: supplicant → authenticator → authentication server.

Which key detail about Wireless Architectures and the WLC should you memorise for the CCNA 200-301 exam?

SSID = network name; BSS = one AP cell; ESS = roaming across APs on one SSID.

Which key detail about AP Modes and Wireless Security should you memorise for the CCNA 200-301 exam?

WPA2 = AES-CCMP; Personal uses PSK, Enterprise uses 802.1X + RADIUS.

What is a common CCNA exam trap involving Wireless Architectures and the WLC?

2.4 GHz: only channels 1, 6, 11 are non-overlapping. Prefer 5 GHz for capacity.