How to Configure WLAN for WPA2-AES with PSK and 802.11r Clients?

350-401 By islever Editorial Last updated

Short answer

A Enable Fast Transition and FT + PSK.

Question

Refer to the exhibit. Which action must be taken to configure a WLAN for WPA2-AES with PSK and allow only 802.11r-capable clients to connect? - Exhibit: How to Configure WLAN for WPA2-AES with PSK and 802.11r Clients?
  1. Enable Fast Transition and FT + PSK. Correct Answer
  2. Enable Fast Transition and PSK.
  3. Change Fast Transition to Adaptive Enabled and enable FT + PSK.
  4. Enable PSK and FT + PSK

Key Takeaways

The question tests your understanding of 802.11r Fast Transition and Authentication Key Management (AKM); the trap is confusing the 'FT + PSK' AKM option with merely enabling PSK or Adaptive Fast Transition.

This 350-401 exam question covers configuring a WLAN for WPA2-AES with PSK while restricting access to 802.11r-capable clients. The community agrees that enabling Fast Transition and selecting FT + PSK is the correct approach.

Common mistake: Choosing D 'Enable PSK and FT + PSK' is a common mistake because it seems to include both PSK and fast transition, but in the Cisco WLAN configuration, 'FT + PSK' is the specific AKM option that combines PSK with 802.11r; adding a separate 'Enable PSK' is redundant and not how the GUI checkbox works.

Expert Analysis

Why the Answer Is Correct

802.11r is implemented as Fast Transition (FT) in Cisco WLANs. For WPA2-AES with PSK and FT, the GUI requires two things: enable Fast Transition and choose FT + PSK as the AKM. This enforces that only 802.11r-capable clients can associate using FT; non-FT clients will not complete the FT association.

Why the Other Options Are Wrong

B omits FT + PSK; selecting only PSK does not enable 802.11r. C refers to Adaptive Fast Transition, a different feature for dynamically adapting roaming; it is not needed to restrict to 802.11r clients and is not the standard FT mechanism. D incorrectly enables PSK separately and uses FT + PSK; in the GUI, enabling PSK and FT + PSK is not a valid combination and community comments clarify that the correct option is simply FT + PSK with Fast Transition enabled.

Community Comment Notes

Comment [1] (9 likes) confirms the correct answer and explains that FT is the mechanism for 802.11r and FT + PSK provides the required authentication/encryption. Comment [3] cites Cisco's 802.11r deployment guide to show that FT PSK is the correct AKM selection. Comment [2] also discusses why 'Adaptive Enabled' is not the right choice because adaptive mode is about dynamically adjusting roaming behavior, not a hard requirement for 802.11r-only clients.

Official Reference

https://www.cisco.com/c/dam/en/us/td/docs/wireless/controller/technotes/80211r-ft/b-80211r-dg.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

On 350-401 WLAN questions, look for the exact AKM selection wording. 'FT + PSK' is the option that combines 802.11r fast roaming with WPA2-PSK; if the question mentions 'only 802.11r clients' you must enable Fast Transition and choose this specific AKM.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Mizuchan 👍 9 Answered A
    Fast Transition (FT) is the mechanism used for 802.11r, which is the IEEE standard for fast roaming. By enabling Fast Transition and configuring FT + PSK, the WLAN will use WPA2-AES with a Pre-Shared Key (PSK) for authentication and encryption, and only clients capable of 802.11r will be allowed to connect using this configuration.
  2. supershysherlock 👍 2 Answered A
    Answer: Fast Transition (FT) Why not D 'Adaptive Enabled and enable FT + PSK' ? In the context of 802.11r (Fast Transition), "adaptive enabled" refers to a mode where the network dynamically adjusts the roaming behavior based on the capabilities of the wireless clients. If a client supports 802.11r, the network can utilize Fast Transition features to facilitate faster roaming. If the client does not support 802.11r, the network can fall back to traditional roaming mechanisms to ensure compatibility and connectivity for all clients. In this case we want to restrict access to 802.11r clients, so adaptive enabled is incorrect in this scenario.
  3. zbeugene7 👍 1
    Please corect me if I am wrong , but "A" is not what CISCO says should be done. From CISCO FT configuration manual it clearly states .1X OR FT PSK: Under Authentication Key Management, choose FT 802.1X or FT PSK https://www.cisco.com/c/dam/en/us/td/docs/wireless/controller/technotes/80211r-ft/b-80211r-dg.html AES128 is already enabled as checkbox option for WPA2 policy , so all you have to do is check FT ( enable FT check-box) and select PSK because PSK is required.
  4. felix_simon 👍 1
    A https://www.cisco.com/c/dam/en/us/td/docs/wireless/controller/technotes/80211r-ft/b-80211r-dg.html
  5. slacker_at_work 👍 1 Answered A
    Also see Q823

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide