Implementing Cisco Enterprise Wireless Networks (ENWLSI)294 questions across 30 pages are complete and free, with no account or card.
294 questions in this bank
Free access · progress saved on this device
Branch wireless users report that they can no longer access services from head office but can access services locally at the site. New wireless users can associate to the wireless while the WAN is down. Which three elements (Cisco FlexConnect state, operation mode, and authentication method) are seen in this scenario? (Choose three.)
Answer: ADF
Refer to the exhibit. An engineer deployed a Cisco WLC using local EAP. Users who are configured for EAP-PEAP cannot connect to the network. Based on the local EAP debug on the controller provided, why is the client unable to connect?
Answer: C
User is configured for PEAP authentication. WLC starts EAP-FAST context (Line 3). -> EAP Profile on the WLC needs to be corrected to use PEAP. So C should be correct.
Source: Adapted from community discussion — Caradum
An engineer set up identity-based networking with ISE and configured AAA override on the WLAN. Which two attributes must be used to change the client behavior from the default settings? (Choose two.)
Answer: CD
Correct: The AAA Override option of a WLAN enables you to configure the WLAN for identity networking. It enables you to apply VLAN tagging, Quality of Service (QoS), and Access Control Lists (ACLs) to individual clients based on the returned RADIUS attributes from the AAA server. AAA Override for IPv6 ACLs In order to support centralized access control through a centralized AAA server such as the Cisco Identity Services Engine (ISE) or ACS, the IPv6 ACL can be provisioned on a per-client basis using AAA Override attributes. In order to use this feature, the IPv6 ACL must be configured on the controller and the WLAN must be configured with the AAA Override feature enabled. The actual named AAA attribute for an IPv6 ACL is Airespace-IPv6-ACL-Name, which is similar to the Airespace-ACL-Name attribute that is used for provisioning an IPv4-based ACL. The AAA attribute returned contents should be a string equal to the name of the IPv6 ACL as configured on the controller.
Source: Adapted from community discussion — cskshiet
Refer to the exhibit. The security team has implemented ISE as an AAA solution for the wireless network. The wireless engineer notices that though clients are able to authenticate successfully, the ISE policies that are designed to place them on different interfaces are not working. Which configuration must be applied in the RADIUS Authentication Settings section from the ISE Network Device page?
Answer: C
An engineer is setting up a WLAN to work with a Cisco ISE as the AAA server. The company policy requires that all users be denied access to any resources until they pass the validation. Which component must be configured to achieve this stipulation?
Answer: D
I think only web auth supports preauth acls. So if its corp then i think AAA overide as 802.1x/eap only allows EAP/auth traffic prio to being authenticated.
Source: Adapted from community discussion — Ace_Pee
A Cisco WLC has been added to the network and Cisco ISE as a network device, but authentication is failing. Which configuration within the network device configuration should be verified?
Answer: D
A user is trying to connect to a wireless network that is configured for WPA2-Enterprise security using a corporate laptop. The CA certificate for the authentication server has been installed on the Trusted Root Certification Authorities store on the laptop. The user has been prompted to enter the credentials multiple times, but the authentication has not succeeded. What is causing the issue?
Answer: B
This is a classic Cisco putting ambiguous questions that will have multiple right answers. The IP address response is incorrect and can be ruled out because DHCP occurs after a 802.1x authentication when the client is in the run state (assuming no WebAuth). That leaves an invalid authentication policy on the authenticator which it could be if they didn't define the AAA settings properly. It could be an account lockout as the user will not be notified if it's locked. The final option is an invalid authentication policy on the authentication server. All three of these could be right but I would choose the user account is locked because it says you are troubleshooting a user specific issue. The misconfigured authenticator or authentication server would have widespread problems affecting multiple users wheras the individual user account being locked would explain a user specific problem.
Source: Adapted from community discussion — cisco_spo
A wireless engineer is configuring LWA using ISE. The customer is a startup company and requested the wireless users to authenticate against a directory, but LDAP is unavailable. Which solution should be proposed in order to have the same security and user experience?
Answer: B
Answer should be B because if LDAP is unavaible, then cannot use Novell neither. The following are valid with LDAP working: You can choose any one of the following built-in schema types or create a custom schema: Active Directory Sun Directory Server Novell eDirectory You can click the arrow next to Schema to view the schema details. If you edit the attributes of the predefined schema, Cisco ISE automatically creates a Custom schema.
Source: Adapted from community discussion — alexblue
An engineer has implemented 802.1x authentication on the wireless network utilizing the internal database of a RADIUS server. Some clients reported that they are unable to connect. After troubleshooting, it is found that PEAP authentication is failing. A debug showed the server is sending an Access-Reject message. Which action must be taken to resolve authentication?
Answer: D
Disabling the Server Certificate check will work (B), but then you are not using PEAP, you are back to LEAP, and you have removed all the security benefits of that cert. You need to reload the server certifcate onto the clients that are failing. Choice D.
Source: Adapted from community discussion — NoWiresIncluded
An engineer has configured Cisco Centralized Key Management for an enterprise that has remote branches. The remote offices are connected back to the data center using a VPN connection with low-bandwidth connections. The goal is to improve roaming. Which type of group must be configured?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-430 practice, question 271. 294 questions available.
Version 1.0.0. How we source questions