Configuring a WLAN for WPA2 PSK with MAC-Filter Restrictions

200-301 By islever Editorial Last updated

Configure and verify WLAN within the GUI using WPA2 PSK Interpret the wireless LAN GUI configuration for client connectivity, such as WLAN creation, security settings, QoS profiles, and advanced settings

Short answer

CD Enable the WPA2 Policy (C) to use PSK authentication and enable MAC Filtering (D) to permit only specific client MAC addresses onto the WLAN.

Question

Refer to the exhibit. A network engineer is configuring a WLAN to use a WPA2 PSK and allow only specific clients to join. Which two actions must be taken to complete the process? (Choose two.) - Exhibit: Configuring a WLAN for WPA2 PSK with MAC-Filter Restrictions
  1. Enable the OSEN Policy option.
  2. Enable the 802.1X option for Authentication Key Management.
  3. Enable the WPA2 Policy option. Correct Answer
  4. Enable the MAC Filtering option. Correct Answer
  5. Enable the CCKM option for Authentication Key Management.

Key Takeaways

PSK and 802.1X are the two mutually exclusive WLAN authentication modes — choosing PSK rules out 802.1X/CCKM, leaving WPA2 Policy plus MAC Filtering as the required pair.

To build a WLAN that authenticates users with a pre-shared key, the WLAN must use the WPA2 security policy with PSK. To restrict joining to specific clients, MAC Filtering maintains an allowlist of permitted MAC addresses; all others are rejected. 802.1X and CCKM are certificate/EAP-based and incompatible with PSK.

Common mistake: Picking 802.1X (B) or CCKM (E): those are enterprise/EAP auth, not PSK. The question explicitly says WPA2 PSK, so only the WPA2 Policy and MAC Filtering apply.

Expert Analysis

Why the Answer Is Correct

C (WPA2 Policy) is required so the WLAN uses PSK authentication, and D (MAC Filtering) creates an allowlist that permits only specific client MAC addresses to join. Together they satisfy "WPA2 PSK" and "allow only specific clients."

Why the Other Options Are Wrong

A (OSEN) is for Hotspot 2.0, not PSK. B (802.1X) and E (CCKM) are certificate/EAP-based authentication, which conflict with the PSK requirement stated in the question. With PSK selected, 802.1X is explicitly ruled out.

Community Comment Notes

The leading vote is CD (80) versus BC (20). Top commenters explain that PSK uses a password, not a certificate, so 802.1X cannot be chosen, and that MAC Filtering is what restricts which clients may join.

Official Reference

https://learningnetwork.cisco.com/s/ccna-exam-topics

This link opens the official vendor documentation in a new tab.

Community Votes

CD
80%
BC
20%

80% of anonymous learners picked answer CD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. sy0_061 👍 3
    When we select PSK, we give the users a password they can enter to authenticate. This password is Pre Shared Key (PSK). So we can't choose an 802.1x since that uses a cert authentication instead of password. Mac filtering will allow us to choose who can join and who can't. Choosing the WPA2 policy is straight forward.
  2. exiledwl 👍 2
    Given answer is correct Can't be B as there are 2 main authentication modes, PSK and 802.1x, questions is asking for PSK, check jeremys it lab day 57 @24:30
  3. [Removed] 👍 1
    Answer C is straightforward. Answer B is correct because, while 802.1X is an IEEE standard, CCKM is a proprietary Cisco technology which requires specific, compatible hardware.
  4. JSMM 👍 1
    MAC Filtering lets you manage an allowlist of MAC addresses that can access the LAN. All others are blocked.
  5. MinSun600 👍 1
    correct answer is BC

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Rapid PVST+ Port State That Neither Receives BPDUs nor Learns MAC

S-grade

Computing the EUI-64 Interface ID for a Given MAC Address

S-grade

Electing the Root Bridge in PVST+ by Priority and MAC

S-grade

How a Switch Handles an ARP Request for an Unknown Destination

S-grade

Practice All 200-301 Questions

Access 220 questions with complete answers and detailed explanations.

View Full 200-301 Practice Test →

← Back to 200-301 Study Guide