Which Layer 2 Security Mode Supports Web-Based Authentication?
Refer to the exhibit. A client requests a new SSID that will use web-based authentication and external RADIUS servers. Which Layer 2 security mode must be selected? - 
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Candidates frequently confuse Layer 2 encryption requirements with Layer 3 captive portal flows, mistakenly selecting WPA2 because they associate wireless security with mandatory password protection.
This question tests the mandatory Layer 2 setting for deploying web-based authentication with external RADIUS servers. The community consensus confirms that 'None' must be selected, as web authentication operates at Layer 3 and requires an unencrypted initial association.
Option A (WPA2 + WPAS) or D (WPA+WPA2) is commonly chosen due to the assumption that all enterprise SSIDs must enforce encryption. However, enabling these modes blocks the initial DHCP and HTTP redirect process required for the web login splash page, rendering web authentication impossible.
Community Discussion (10 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Core Concept: Layer 2 vs. Layer 3 Authentication
In Cisco wireless architecture, security is strictly segmented into Layer 2 (association and encryption) and Layer 3 (user/group authentication and authorization). Web-based authentication, also referred to as Captive Portal or Central Web Authentication (CWA), is fundamentally a Layer 3 mechanism. Because clients must obtain an IP address via DHCP and reach a transparent HTTP proxy for the splash page redirect before any credentials are entered, the radio interface cannot enforce Layer 2 encryption or pre-authentication checks.Why "None" is Correct
The Layer 2 security mode must be configured to None. This creates an open association state, allowing the client to complete DHCP, receive an IP, and trigger the captive portal redirect. Once authenticated via the external RADIUS server, the WLC can apply post-authentication policies such as dynamic VLAN assignments or optional data encryption through group policies. Community contributors consistently highlight that Cisco’s official configuration guides explicitly mandate setting the L2 tab to "None" when enabling web authentication features.Why Other Options Fail
Options A and D enforce CCMP/AES encryption and require either Pre-Shared Keys or 802.1X/EAP exchanges. These methods demand successful cryptographic handshakes before granting Layer 3 access, which directly contradicts the "connect first, authenticate later" workflow of web portals. Option C (Static WEP) is obsolete, cryptographically broken, and functionally incompatible with modern web redirect architectures. Selecting any encryption mode will drop the initial unauthenticated traffic destined for the authentication server.Official Reference
Exam Strategy
When troubleshooting or designing WLAN security on certification exams, always map the authentication feature to its corresponding OSI layer. If a solution relies on HTTP redirects, splash pages, or DHCP discovery (like Web Auth, BYOD, or NAC), assume Layer 2 security must be set to "None" unless the scenario explicitly describes post-authentication encryption. Memorize the L2/L3 compatibility matrix to quickly eliminate trap answers that incorrectly pair modern encryption with web-based access controls.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →