300-430 practice questions 251–260

1. Question 251 · 294 in bank

   An engineer needs to provision certificates on a Cisco Catalyst 9800 Series Wireless Controller. The customer uses a third-party CA server. Which protocol must be used between the controller and CA server to request and install certificates?

   • ASCEP
   • BTLS
   • CLDAP
   • DSSL

   Show answer

   Answer: A

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/trustpoints/b-configuring-trustpoints-on-cisco-catalyst-9800-series- controllers/c-workflow-to-configure-a-trustpoint-for-a-third-party-certificate-on-catalyst-9800.html

   Source: Adapted from community discussion — Yod_Jjot

   Next question

2. Question 252 · 294 in bank

   Select 2

   A corporation has recently implemented a BYOD policy at their HQ. Which two risks should the security director be concerned about? (Choose two.)

   • Anetwork analyzers
   • Bmalware
   • Clost and stolen devices
   • Dkeyloggers
   • Eunauthorized users

   Show answer

   Answer: BE

   Next question

3. Question 253 · 294 in bank

   When implementing self-registration for guest/BYOD devices, what happens when an employee tries to connect four devices to the network at the same time?

   • AThe last device is removed and the newly added device is updated as active device.
   • BThe registration is allowed, but only one device is connected at any given time.
   • CAll devices are allowed on the network simultaneously.
   • DPurge time dictates how long a device is registered to the portal.

   Show answer

   Answer: C

   Explanation

   A is correct, just poorly phrased. As no specific configurations are specified, default is applied, agreed? By default: - 5 devices can be registered - 3 simultaneous logins - Oldest connection is disconnected (so the newly added is updated as active and last could be read as oldest.)

   Source: Adapted from community discussion — Mimimimimi

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

4. Question 254 · 294 in bank

   What is an important consideration when implementing a dual SSID design for BYOD?

   • AAfter using the provisioning SSID, an ACL that used to make the client switch SSIDs forces the user to associate and traverse the network by MAC filtering.
   • BIf multiple WLCs are used, the WLAN IDs must be exact for the clients to be provisioned and traverse the network correctly.
   • CSSIDs for this setup must be configured with NAC State-RADIUS NAC for the clients to authenticate with Cisco ISE, or with NAC State-ISE NAC for Cisco ISE to associate the client.
   • DOne SSID is for provisioning and the other SSID is for gaining access to the network. The use of an ACL should not be enforced to make the client connect to the REAL SSID after provisioning.

   Show answer

   Answer: D

   Explanation

   B is correct: "When implementing BYOD solutions using more than one Wireless LAN Controller, WLAN IDs must be kept consistent. WLAN ID is used by ISE in determining which WLAN (SSID) clients are using to connect to the network. Ensuring each WLAN has the same WLAN ID on each WLC is essential for proper operation and security." https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Design_Guide/BYOD_Wireless.html

   Source: Adapted from community discussion — Skliffi

   References

   • Cisco documentation

   Next question

5. Question 255 · 294 in bank

   Refer to the exhibit. A network administrator deploys the DHCP profiler service in two ISE servers: 10.3.10.101 and 10.3.10.102. All BYOD devices connecting to WLAN on VLAN63 have been incorrectly profiled and are assigned as unknown profiled endpoints. Which action efficiently rectifies the issue according to Cisco recommendations?

   

   • ANothing needed to be added on the Cisco WLC or VLAN interface. The ISE configuration must be fixed.
   • BDisable DHCP proxy on the Cisco WLC.
   • CDisable DHCP proxy on the Cisco WLC and run the ip helper-address command under the VLAN interface to point to DHCP and the two ISE servers.
   • DKeep DHCP proxy enabled on the Cisco WLC and define helper-address under the VLAN interface to point to the two ISE servers.

   Show answer

   Answer: C

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

6. Question 256 · 294 in bank

   An engineer must implement a BYOD policy with these requirements: ✑ Onboarding unknown machines ✑ Easily scalable ✑ Low overhead on the wireless network Which method satisfies these requirements?

   • Atriple SSID
   • Bsingle SSID
   • Copen SSID
   • Ddual SSID

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

7. Question 257 · 294 in bank

   A company has a single WLAN configured for 802.1x authentication with the QoS set to Silver. This WLAN supports all corporate and BYOD access. A decision has been made to allow users to install Cisco Jabber on their personal mobile devices. Users report poor voice quality when using Jabber. QoS is being applied only as best effort. What must be configured to ensure that the WLAN remains on the Silver class and to ensure Platinum class for Jabber?

   • AConfigure QoS on the mobile devices that have Jabber installed.
   • BEnable Cisco Centralized Key Management on the WLAN so that the Jabber-enabled devices will connect.
   • CConfigure the WLAN to broadcast on 5 GHz radios only and allow Jabber users to connect.
   • DConfigure an AVC profile for the Jabber traffic and apply it to the WLAN.

   Show answer

   Answer: D

   Next question

8. Question 258 · 294 in bank

   An engineer is implementing profiling for BYOD devices using Cisco ISE. When using a distributed model, which persona must the engineer configure with the profiling service?

   • ADevice Admin Node
   • BPrimary Admin Node
   • CMonitor Node
   • DPolicy Services Node

   Show answer

   Answer: D

   Explanation

   I re-read the question (tricky-not clear to me)...It is actually D as written. You do the changes on the PAN, but on the PSN Persona, you click the tick box for policy service>enable profiling service. Here is an article to help. https://community.cisco.com/t5/security-knowledge-base/ise-profiling-design-guide/ta-p/3739456#toc-hId-55974052

   Source: Adapted from community discussion — Gumpy1

   References

   • cisco.com documentation

   Next question

9. Question 259 · 294 in bank

   A corporation is spread across different countries and uses MPLS to connect the offices. The senior management wants to utilize the wireless network for all the employees. To ensure strong connectivity and minimize delays, an engineer needs to control the amount of traffic that is traversing between the APs and the central WLC. Which configuration should be used to accomplish this goal?

   • AFlexConnect mode with central switching enabled
   • BFlexConnect mode with central authentication
   • CFlexConnect mode with OfficeExtend enabled
   • DFlexConnect mode with local authentication

   Show answer

   Answer: D

   Explanation

   I think the answer here should be C A Cisco OfficeExtend access point (Cisco OEAP) provides secure communications from a Cisco WLC to a Cisco AP at a remote location, seamlessly extending the corporate WLAN over the Internet to an employee’s residence. The user’s experience at the home office is exactly the same as it would be at the corporate office. Datagram Transport Layer Security (DTLS) encryption between the access point and the controller ensures that all communications have the highest level of security.Cisco OEAPs are designed to work behind a router or other gateway device that is using network address translation (NAT). NAT allows a device, such as a router, to act as an agent between the Internet (public) and a personal network (private), enabling an entire group of computers to be represented by a single IP address. There is no limit to the number of Cisco OEAPs that you can deploy behind a NAT device.

   Source: Adapted from community discussion — NightmareCreature

   References

   • Cisco documentation

   Next question

10. Question 260 · 294 in bank

    DRAG DROP - The network management team in a large shopping center has detected numerous rogue APs from local coffee shops that are broadcasting SSIDs. All of these SSIDs have names starting with ATC (for example, ATC302, ATC011, and ATC566). A wireless network engineer must appropriately classify these SSIDs using the Rogue Rules feature. Drag and drop the options from the left onto the categories in which they must be used on the right. Not all options are used. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    References

    • cisco.com documentation

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-430 practice, question 251. 294 questions available.