Objective 5.9
200-301Describe wireless security protocols (WPA, WPA2, and WPA3).
Objective 5.9 sits in Security Fundamentals, which carries 15% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.
Objective title verbatim from the official objectives. Cisco exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An SSID on a Catalyst 9800 controller is set to WPA2 with default settings. Which data protection does that WLAN use?
Correct.
Checked against cisco.com, August 2026Concept
Wi-Fi Protected Access shipped in two generations. The later one dropped the stream cipher patch that had rescued legacy hardware in favor of a block cipher from a ratified standard, and the default on a WLAN follows the generation selected.
Why A
The earlier generation was written ahead of ratification and guards frames with a temporal key protocol plus an integrity check. The later one implements the ratified standard and uses AES in counter mode with CBC-MAC, which is what an untouched WPA2 WLAN negotiates.
Source
Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide 17.9.x: WPA1 and WPA2 security protocols, checked August 2026By default, WPA1 uses Temporal Key Integrity Protocol (TKIP) and Message Integrity Check (MIC) for data protection while WPA2 uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP).
Now you: objective 5.9 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A staff WLAN must keep a shared passphrase, and the security team wants an attacker who captures the handshake to gain nothing offline. Which WLAN security does that?
Sample question 2 of 3
An access point offers several security modes and every client is recent. Which mode is the most secure for personal Wi-Fi?
Sample question 3 of 3
A network must serve WPA3-capable laptops and older WPA2-only printers on one SSID. Which mode keeps both working?
That’s 3 of the full CCNA bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Fundamentals
- 5.1 Define key security concepts (threats, vulnerabilities, exploits, and mitigation techniques).
- 5.2 Describe security program elements (user awareness, training, and physical access control).
- 5.4 Describe security password policy elements, such as management, complexity, and password alternatives (multifactor authentication, certificates, and biometrics).
- 5.5 Describe IPsec remote access and site-to-site VPNs.
- 5.6 Configure and verify access control lists.
- 5.7 Configure and verify Layer 2 security features (DHCP snooping, dynamic ARP inspection, and port security).
- 5.8 Compare authentication, authorization, and accounting concepts.
- 5.10 Configure and verify WLAN within the GUI using WPA2 PSK.