Exam 350-101 Topic 1 Question 17 Discussion

To enable WPA2-Enterprise with RADIUS authentication on a Cisco Catalyst 9800 WLC, the WLAN configuration must specify the use of 802.1X as the authentication mechanism. The commandsecurity wpa wpa2 akm dot1xexplicitly instructs the WLAN to use WPA2 encryption with the 802.1X authentication key management (AKM), which leverages the configured RADIUS server group for client authentication. Option B (security dot1x authentication-list) and Option C (security dot1x method-list) are legacy or IOS-style commands that define AAA method lists but do not directly bind the WLAN to WPA2-Enterprise security.
Option A (security wpa enable) only enables WPA but does not define the authentication mode or RADIUS integration, which is insufficient for WPA2-Enterprise deployments. Cisco Wireless design guides emphasize that for staff or enterprise-class WLANs using external RADIUS servers, the WLAN's security profile must use WPA2 with AKM set to 802.1X. This ensures clients perform EAP authentication with the external server, supporting secure credential exchange and proper authorization. Correctly applyingsecurity wpa wpa2 akm dot1xin the WLAN configuration guarantees the WLC enforces encryption and authentication policies in line with enterprise security requirements. Reference topics:Client Connectivity Configuration - WPA2- Enterprise, 802.1X, AKM, RADIUS integration on Cisco WLCs.