Wireless and Automation Interview Questions for CCNA
25 Wireless and Automation questions with answers for ccna roles — 7 easy, 12 medium, 6 hard.
About Wireless and Automation
This topic covers 802.11 standards, 2.4 and 5 GHz channel planning, SSID and BSSID, controller-based and cloud-managed APs, CAPWAP and WPA2 versus WPA3. It also covers network programmability: control and data planes, controller-based networking, overlays, REST APIs, JSON and YAML, and automation with Python and Ansible, which employers increasingly expect even from junior engineers.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
802.11n (Wi-Fi 4) works on 2.4 and 5 GHz with MIMO. 802.11ac (Wi-Fi 5) is 5 GHz only with wider channels and MU-MIMO downlink. 802.11ax (Wi-Fi 6 and 6E) adds OFDMA, BSS colouring and target wake time, and 6E adds the 6 GHz band. 802.11be (Wi-Fi 7) adds 320 MHz channels and multi-link operation. India opened part of the 6 GHz band for indoor use.
In 2.4 GHz each channel is about 22 MHz wide but channels are only 5 MHz apart, so most adjacent channels overlap and interfere. Channels 1, 6 and 11 are the only three non-overlapping channels, so neighbouring access points should alternate between them. The 5 GHz band has many more non-overlapping 20 MHz channels, which is why it is preferred for capacity.
The SSID is the network name users see. The BSSID is the MAC address of the access point radio serving a BSS, the basic service set of one AP and its clients. An ESS is multiple BSSs sharing the same SSID connected by a wired distribution system, so clients can roam between APs. Each AP can broadcast several SSIDs, each with its own BSSID.
04
What are the data plane, control plane and management plane?
The data plane forwards packets, using tables such as the FIB and MAC table, ideally in hardware. The control plane builds those tables using protocols like OSPF, STP and ARP. The management plane is how admins and tools interact with the device, through SSH, SNMP, syslog and APIs. Separating them helps understanding of SDN, where the control plane can be centralised.
05
What is a REST API and which HTTP methods map to CRUD?
A REST API exposes resources at URLs and is stateless, usually with JSON payloads over HTTPS. CRUD maps to HTTP verbs: POST creates, GET reads, PUT replaces or PATCH partly updates, and DELETE removes. Responses use status codes such as 200 OK, 201 Created, 401 Unauthorized, 404 Not Found and 500 Server Error. Controllers expose northbound REST APIs for automation.
06
How would you represent an interface configuration in JSON and YAML?
The same data in both formats.
JSON:
{
"interface": "GigabitEthernet0/1",
"enabled": true,
"ipv4": ["192.168.1.1/24"]
}
YAML:
interface: GigabitEthernet0/1
enabled: true
ipv4:
- 192.168.1.1/24
07
Where do you see yourself in five years in networking?
Situation: I started with CCNA and a support role. Task: build a clear path. Action: I plan to master routing, switching and wireless in the next two years, pass CCNP Enterprise, and build automation skills in Python and Ansible alongside cloud networking. Result I aim for: a network engineer or architect role leading campus and SD-WAN projects, mentoring juniors and owning designs end to end.
08
What is the difference between autonomous APs, controller-based APs and cloud-managed APs?
Autonomous APs are configured one by one and suit very small sites. Lightweight APs are managed by a Wireless LAN Controller using CAPWAP tunnels, which centralises configuration, RF management and roaming, and suits campuses. Cloud-managed APs are configured from a cloud dashboard, ideal for many branches. Split-MAC means real-time functions stay on the AP while management sits on the controller.
Control and Provisioning of Wireless Access Points is the protocol between lightweight APs and the WLC. It builds two tunnels: a control tunnel on UDP 5246, encrypted with DTLS, and a data tunnel on UDP 5247 that carries client traffic in central switching mode. In FlexConnect or local switching mode, client data is switched locally at the AP instead of being tunnelled.
WPA2 uses AES-CCMP; WPA2-Personal uses a pre-shared key that is vulnerable to offline dictionary attacks, and WPA2-Enterprise uses 802.1X with RADIUS. WPA3-Personal replaces PSK with SAE, which resists offline guessing and gives forward secrecy. WPA3-Enterprise offers a 192-bit mode. WPA3 requires protected management frames. Open networks can use OWE for encryption without passwords.
11
How does controller-based networking differ from traditional networking?
Traditionally each device has its own control plane and is configured box by box. In controller-based or software-defined networking, a central controller holds the policy and pushes it to devices through southbound APIs such as NETCONF or OpenFlow, while applications talk to the controller through northbound REST APIs. This gives consistent configuration, automation and network-wide visibility.
12
Compare Ansible, Puppet and Chef for network automation.
Ansible is agentless, uses SSH or APIs, writes playbooks in YAML and uses a push model, so it is the most popular for network devices. Puppet uses an agent, a declarative manifest language and a pull model. Chef uses Ruby-based recipes with an agent and pull model. Puppet and Chef are more common for servers. All support idempotent configuration management.
13
Users complain Wi-Fi is slow in a conference room with 60 people. What do you check and fix?
This is usually a capacity, not a coverage, issue. I check client count per AP and channel utilisation on the controller. Fixes include adding APs with lower transmit power, steering clients to 5 or 6 GHz with band steering, disabling low data rates such as 1, 2 and 5.5 Mbps, using 20 or 40 MHz channels in dense areas, and limiting per-client bandwidth on the SSID.
14
Users can connect to the corporate SSID but get no IP address. What do you check?
Association works, so the issue is between the AP or WLC and DHCP. I check the WLAN is mapped to the right dynamic interface and VLAN, that the VLAN is allowed on the WLC and AP trunks, and that DHCP relay or helper is set on the VLAN gateway. In FlexConnect local switching, I check the AP switchport trunk and VLAN mapping. Finally I check the DHCP scope.
15
A Python script gets 401 errors when calling a controller REST API. What do you check?
401 Unauthorized means authentication failed. I check the username and password or API key, whether a token must first be requested from an auth endpoint and sent in a header like X-Auth-Token, whether the token expired, and the exact header name and format. I test the same call with curl or an API client to separate script bugs from credential issues.
16
How do you write a simple Python script to fetch interface data from a device?
Netmiko handles SSH sessions; keep credentials in a file or vault, not the script.
import yaml
from netmiko import ConnectHandler
# r1.yml holds device_type, host, username, password
with open('r1.yml') as f:
device = yaml.safe_load(f)
with ConnectHandler(**device) as conn:
output = conn.send_command('show ip interface brief')
print(output)
17
Write a simple Ansible playbook that configures NTP on IOS devices.
Steps on a typical WLC GUI: create a dynamic interface with VLAN, IP and DHCP server; go to WLANs and create a new WLAN with profile name and SSID; map it to the dynamic interface; under Security choose WPA2 or WPA3 with PSK or 802.1X and add the RADIUS server for enterprise; set QoS profile; enable the WLAN and apply it to AP groups.
19
Tell me about a time you took initiative beyond your assigned work.
Situation: our team got many Wi-Fi complaints but had no data. Task: nobody had asked, but I wanted to find the cause. Action: I did a walk-through survey with a free tool, mapped channels and signal, and found three APs on the same 2.4 GHz channel and one dead AP. I shared a short report with fixes. Result: after the changes, Wi-Fi tickets dropped by about 60 percent in a month.
Physical ports include service ports for out-of-band management, distribution system ports that connect to the switch as trunks, and redundancy ports for HA. Logical interfaces include the management interface used for CAPWAP and admin access, dynamic interfaces that map WLANs to VLANs, and a virtual interface used for web auth and DHCP relay. A LAG bundles distribution ports.
The underlay is the physical IP network of switches and routers that provides basic reachability, for example OSPF or IS-IS on routed links. The overlay is a virtual network built on top using tunnels such as VXLAN, so logical segments can stretch across the fabric independent of physical topology. SD-Access and SD-WAN use this model, with a fabric controlling the overlay.
22
A new lightweight AP does not join the controller. How do you troubleshoot?
I check the AP gets a DHCP address and can reach the WLC management IP. It discovers the controller through DHCP option 43, the standard CAPWAP controller DNS name, broadcast or a primed controller IP, so I verify one of these. Then I check UDP 5246 and 5247 are not blocked, the AP's clock and certificate are valid, the country code matches, and the WLC has AP licences available.
23
Your manager wants to stop configuring 200 switches manually. What would you propose?
I would start with a source of truth for devices and variables, then use Ansible playbooks with Jinja2 templates to generate and push standard configs over SSH, keeping them in Git with peer review. A controller such as Catalyst Center could handle day-0 provisioning and compliance. I would start with read-only tasks like backups and audits, then move to small, tested change automation.
24
How do you call a REST API from Python and parse the JSON?
Use the requests library and convert the reply to a dictionary.
import requests
url = 'https://controller.example.local/api/v1/network-device'
headers = {'X-Auth-Token': token, 'Accept': 'application/json'}
r = requests.get(url, headers=headers, timeout=10)
r.raise_for_status()
for dev in r.json()['response']:
print(dev['hostname'], dev['managementIpAddress'])
25
An automation job pushed a wrong configuration to 50 switches and broke their uplinks. How do you recover and stop it happening again?
First stop the job, then recover through out-of-band console or a management network, using configuration archive rollback or a saved backup. In future, run changes with commit confirmed or reload in as a safety timer, test in a lab, use a dry run or check mode, deploy to one canary switch, then in small batches with automatic post-checks. Store templates in Git with peer review so every change is visible and reversible.
Frequently asked questions
How important is Wireless and Automation in CCNA interviews?
This topic covers 802.11 standards, 2.4 and 5 GHz channel planning, SSID and BSSID, controller-based and cloud-managed APs, CAPWAP and WPA2 versus WPA3. It also covers network programmability: control and data planes, controller-based networking, overlays, REST APIs, JSON and YAML, and automation with Python and Ansible, which employers increasingly expect even from junior engineers.
How should I use the Wireless and Automation sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.