CCNA Wireless Interview Questions and Answers: 35 Questions for Network Engineer Roles

Key takeaways

• CCNA Wireless no longer exists. Wireless topics are inside CCNA 200-301, so prepare from that blueprint plus hands-on WLC practice.
• Know the architecture well: autonomous APs, lightweight APs with a controller, CAPWAP, and cloud-managed designs.
• Security questions focus on WPA2 versus WPA3, PSK versus 802.1X with RADIUS, and why hiding an SSID is not security.
• Troubleshooting answers should follow a method: coverage, interference, association, authentication, then DHCP and DNS.
• Learn Wi-Fi 6, 6E and 7 at a high level. Interviewers now expect them.

Is CCNA Wireless still a certification?

No. Cisco retired CCNA Wireless, together with CCNA Security, Voice, Routing and Switching and Data Center, in February 2020 and replaced them with a single CCNA 200-301 exam. Wireless knowledge did not disappear. It now appears in CCNA 200-301, which covers wireless principles, Cisco wireless architectures and AP modes, WLAN components, controller management access, creating a WLAN in the controller GUI and WPA, WPA2 and WPA3 security. Deeper wireless work lives in CCNP Enterprise. Check Cisco's current blueprint on its certifications page.

So when an interviewer asks "wireless questions for CCNA", they mean the questions below: the concepts a network engineer is expected to explain and apply.

How should you answer wireless interview questions?

• Give the one-sentence answer first, then the reason or an example.
• Show a method for troubleshooting questions. Interviewers care about order more than the final fix.
• Say "it depends" only if you follow it with what it depends on.
• Admit what you have not done in production. Then say how you would test it in a lab.

RF and Wi-Fi fundamentals

1. What is the difference between the 2.4 GHz and 5 GHz bands?

2.4 GHz travels further and passes through walls better, but it has only three non-overlapping channels and shares the band with Bluetooth, microwaves and neighbours. 5 GHz has many more channels and less interference and supports higher speeds, but its range is shorter. A good design uses both and steers capable clients to 5 GHz.

2. Which 2.4 GHz channels do not overlap?

With 20 MHz channels, 1, 6 and 11 are the standard non-overlapping set. Planning an AP grid so neighbouring APs use different ones reduces co-channel interference.

3. What are SSID, BSSID and ESS?

The SSID is the network name. The BSSID is the MAC address of a specific AP radio serving that network. An ESS is several access points sharing one SSID and joined by a wired network, which lets clients roam.

4. Why does Wi-Fi use CSMA/CA instead of CSMA/CD?

A radio cannot reliably listen while it transmits, so collisions cannot be detected. Wi-Fi tries to avoid them: stations listen first, wait random back-off time and use acknowledgements. Wireless is also half duplex, so everyone on a channel shares airtime.

5. What is the hidden node problem?

Two clients may be in range of the AP but not of each other. They transmit at the same time and collide at the AP. RTS/CTS and good cell design reduce it.

6. Explain dB, dBm and why 3 dB matters.

dBm measures absolute power against 1 mW, so 0 dBm is 1 mW. dB is a ratio. Every +3 dB roughly doubles power and every -3 dB halves it. +10 dB is ten times. This helps when you compare transmit power, antenna gain and path loss.

7. What are RSSI and SNR, and what values are acceptable?

RSSI is received signal strength. SNR is the gap between signal and noise floor. A strong signal in a noisy room still performs badly, so SNR matters more. A common design target for voice is about -67 dBm RSSI with SNR above 25 dB. Treat these as design guidance and check your vendor's recommendations.

8. What does channel width do?

Wider channels (40, 80, 160 MHz) give more throughput but use more spectrum, leaving fewer non-overlapping channels and more interference. In dense enterprise 5 GHz designs, 20 or 40 MHz is often chosen for capacity and stability.

Wi-Fi standards

9. Summarise the 802.11 standards.

See the table below. Interviewers usually want you to link the standard to its band and its headline feature: 802.11n introduced MIMO, 802.11ac is 5 GHz with wider channels and downlink MU-MIMO, 802.11ax (Wi-Fi 6) adds OFDMA and better efficiency in crowded places.

10. What is new in Wi-Fi 6, 6E and Wi-Fi 7?

Wi-Fi 6 (802.11ax) adds OFDMA, BSS colouring, target wake time and MU-MIMO in both directions. Wi-Fi 6E uses the same technology in the 6 GHz band, which has more clean channels. Wi-Fi 7 (802.11be) adds wider 320 MHz channels, higher-order modulation and multi-link operation. Check what 6 GHz spectrum your country has opened.

11. What are MU-MIMO and beamforming?

MIMO uses multiple antennas for multiple spatial streams. MU-MIMO lets an AP send to several clients at once instead of one at a time. Beamforming focuses energy toward a client. Both need client support to give a benefit.

WLAN architecture and Cisco AP modes

12. What is the difference between autonomous, lightweight and cloud-managed access points?

Autonomous APs run their own configuration and are managed individually. Lightweight APs join a wireless LAN controller (WLC) and take configuration from it. Cloud-managed APs, such as Cisco Meraki, are managed from a cloud dashboard. Controller and cloud models give central policy, easier scaling and faster change.

13. What is CAPWAP and which ports does it use?

CAPWAP (Control and Provisioning of Wireless Access Points) is the tunnelling protocol between a lightweight AP and its WLC. Control traffic uses UDP 5246 and data uses UDP 5247. It is described in IETF RFCs.

14. How does an AP find a controller?

Typical methods are a list of previously joined controllers, DHCP option 43, a DNS lookup for a controller name, and a local broadcast. Many enterprise networks use DHCP option 43 or DNS. If an AP cannot join, check IP addressing, firewall rules for CAPWAP and time and certificate settings.

15. What are common Cisco AP modes?

Local mode serves clients and scans channels. FlexConnect lets an AP switch client traffic locally at a branch if the WAN to the controller drops. Monitor mode only scans for rogues and attacks. Sniffer mode captures packets for analysis. Bridge or mesh mode links APs wirelessly. Know local and FlexConnect best.

16. What is split-MAC?

Real-time functions such as beacons, acknowledgements and encryption stay on the AP, while management functions such as authentication, RRM and policy sit on the controller. This is how lightweight designs share the load.

17. What is the role of a wireless LAN controller?

It manages many APs from one place: configuration, firmware, radio resource management, security policy, client roaming and monitoring. Cisco's current controller family is the Catalyst 9800 series, which replaced older AireOS controllers.

18. What is Radio Resource Management (RRM)?

RRM automatically tunes channel assignment and transmit power across APs based on interference and coverage, and can fill coverage holes. It helps, but a poor physical design cannot be fixed by RRM.

Security

19. List the main Wi-Fi security protocols.

WEP is broken and should never be used. WPA with TKIP is also deprecated. WPA2 uses AES-CCMP and is still widely deployed. WPA3 is current and adds SAE, mandatory protected management frames and stronger enterprise options.

20. What is the difference between WPA2-Personal and WPA2-Enterprise?

Personal uses one shared passphrase. Enterprise uses 802.1X with a RADIUS server, so each user or device authenticates individually and keys are unique per session. Enterprise allows revoking one user without changing everyone's password.

21. How does 802.1X work for Wi-Fi?

The client is the supplicant, the AP or WLC is the authenticator and a RADIUS server is the authentication server. EAP carries credentials or certificates between the client and RADIUS. Common methods are PEAP and EAP-TLS. RADIUS normally uses UDP 1812 for authentication and 1813 for accounting.

22. What does WPA3 improve?

SAE replaces the pre-shared key handshake so a captured handshake cannot be attacked offline. Protected management frames are required, and Enhanced Open (OWE) encrypts open networks. WPA3-Enterprise adds a higher-strength 192-bit mode.

23. Is hiding the SSID or MAC filtering a real control?

No. Both are easy to bypass: a hidden SSID is exposed in client frames and MAC addresses can be copied. They add little beyond inconvenience. Use strong encryption and authentication instead.

24. What is a rogue AP, and how is it different from an evil twin?

A rogue AP is any unauthorised AP on your network, often plugged in by an employee. An evil twin imitates a legitimate SSID to lure clients. Both are detected by controllers or monitor-mode APs that scan the air and compare against known APs, and prevented with 802.1X, wired port security and wireless intrusion prevention.

25. How do you secure a guest network?

Give it its own SSID mapped to an isolated VLAN, use a captive portal or sponsored access, enable client isolation, rate-limit bandwidth and block access to internal subnets. Use WPA3 Enhanced Open or a passphrase where possible.

Roaming, QoS and design

26. What is roaming, and what are 802.11k, v and r?

Roaming is a client moving between APs while keeping its session. 802.11k gives clients a neighbour list so they scan less. 802.11v lets the network suggest a better AP. 802.11r speeds up key exchange for fast transitions, which matters for voice. Layer 2 roaming stays in one VLAN. Layer 3 roaming crosses subnets and needs tunnelling or a mobility design.

27. What is a sticky client?

A client that stays on a distant AP and refuses to move even when a closer one is better. Fixes include sensible minimum data rates, 802.11k and v support, band steering and proper transmit power.

28. How do you do a wireless site survey?

A predictive survey uses a floor plan and software model. A passive survey measures signals from existing APs. An active survey tests a connected client's throughput. Always validate a predictive design on site, because walls, glass and people change the result.

29. How do you plan capacity for a high-density room?

Count devices and expected traffic as well as area. Use smaller cells with lower transmit power, 5 GHz or 6 GHz, narrower channels, and enough APs to share airtime. Limit low data rates so slow clients do not consume airtime.

30. Why does QoS matter on Wi-Fi?

Voice and video need low delay and jitter. Wi-Fi marks traffic using WMM access categories, which map from DSCP. Mark and trust voice, give it priority at the AP and the switch, and verify end to end.

31. What do PoE standards give an AP?

PoE (802.3af) provides up to 15.4 W at the switch, PoE+ (802.3at) up to 30 W, and 802.3bt up to 60 or 90 W. Newer, busier APs may need more than 802.3af, so check the datasheet.

Troubleshooting scenarios

32. A user says Wi-Fi is slow. How do you investigate?

Confirm scope first: one user or many, one place or everywhere. Check signal and SNR, channel utilisation, retries and data rate for that client, then the AP's load and the uplink. Then rule out wired-side issues and DNS. Do not change settings before you know where the problem sits.

33. Devices cannot connect. What is your order of checks?

Work through the association process: Is the SSID visible and the AP up? Does the client associate? Does authentication succeed (passphrase or 802.1X and RADIUS logs)? Does it get an IP address from DHCP? Can it reach its gateway and DNS? Each step tells you which layer to inspect.

34. An AP will not join the controller. What do you check?

Check power and link, the AP's IP address and gateway, whether it can locate the WLC (DHCP option 43 or DNS), firewall rules for UDP 5246 and 5247, time sync and certificates, and software compatibility between AP and controller.

35. Connections drop in one corner of a building only. What might be wrong?

Likely causes are a coverage gap, interference from a neighbour or a device such as a microwave, a failed or badly placed AP, or a sticky client. Walk the area with a survey tool, check channel and noise, and look at controller events for that AP.

What should you practise before the interview?

1. Create a WLAN with WPA2-PSK on a controller or simulator and then change it to WPA3 or 802.1X.
2. Capture a connection with Wireshark in monitor mode and identify the probe, authentication and association frames. See the Wireshark documentation. Capture only networks you own or are allowed to test.
3. Draw a controller, three APs and a client roaming between them from memory, and label CAPWAP, VLANs and DHCP.
4. Explain out loud why 1, 6 and 11 are used.
5. Read our guides on Wi-Fi encryption and common wireless problems.

Next steps

Choose five questions you could not answer cleanly and build a small lab for each. If you need the networking foundations first, start with a beginner's guide to computer networking. For a structured path that covers wireless inside the current Cisco certification, see our CCNA 200-301 course.

Related reading

• How to Use Alfa Network Cards for Wi-Fi Hacking, Packet Injection, and Wireless Security Testing | Full Guide for Ethical Hackers