I85PREP
⌘ K
ExtremeCloud IQ Certification study materials
ExtremeCloud IQ Certification study resources

ExtremeCloud IQ Certification: Network Policies, SSIDs and Wireless Configuration

ExtremeCloud IQ Certification · Work through your exam, one topic at a time.

All guide sections

Network Policies, SSIDs and Wireless Configuration

Network Policies, SSIDs and Wireless Configuration is the core wireless design domain. It tests how policies bind SSIDs, authentication, VLANs, and radio behavior to devices, and how to choose the right security mode.

Network Policy structure

  • A Network Policy is the container that ties together SSIDs, authentication servers, VLANs, QoS, schedules, and radio/device settings.
  • The policy must be assigned to the target devices or Cloud Config Group; an unassigned policy changes nothing.
  • SSIDs define the wireless service: name, security mode, encryption, VLAN, client isolation, and availability.

SSID security choices

  • Open networks provide no encryption; use them only with captive portal or guest isolation.
  • WPA2/WPA3 Personal uses a pre-shared key; WPA3-Enterprise uses 802.1X with a RADIUS server.
  • WPA3 transition mode allows WPA2 clients while moving toward WPA3, but it is not the same as pure WPA3.
  • For enterprise SSIDs, map the SSID to the correct RADIUS profile and VLAN; a mismatch produces authentication failures or wrong subnet assignment.

Radio and client behavior

  • Radio profiles set channels, power, and band preferences. Band steering encourages capable clients to 5 GHz or 6 GHz.
  • Fast roaming (802.11r) helps voice and mobile clients, but only when the infrastructure and clients support it.

Worked example

A hospital needs a secure clinical SSID on VLAN 30 with 802.1X, plus a guest SSID on VLAN 99 with client isolation. Reasoning: create a Network Policy, attach the RADIUS profile to the clinical SSID, set WPA3-Enterprise (or WPA2-Enterprise if legacy devices require it), and assign VLAN 30. For guest, use a separate SSID with isolation and VLAN 99, and rate-limit it. Assign the policy to the clinical AP group and verify the uplink carries both VLANs.

Traps that cost marks

  • Configuring an SSID but forgetting to enable it or attach the policy.
  • Using a VLAN that the switch uplink does not carry as tagged traffic.
  • Treating a hidden SSID as a security control.
  • Choosing WPA3-only when legacy clinical devices cannot associate.