300-430 practice questions 41–50

1. Question 41 · 294 in bank

   An engineer configures the wireless LAN controller to perform 802.1x user authentication. Which configuration must be enabled to ensure that client devices can connect to the wireless, even when WLC cannot communicate with the RADIUS?

   • Apre-authentication
   • Blocal EAP
   • Cauthentication caching
   • DCisco Centralized Key Management

   Show answer

   Answer: B

   Explanation

   Local EAP is an authentication method that allows users and wireless clients to be authenticated locally on the controller. It is designed for use in remote offices that want to maintain connectivity to wireless clients when the backend system becomes disrupted or the external authentication server goes down. When you enable local EAP, the controller serves as the authentication server and the local user database, so it removes dependence on an external authentication server. Reference: http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100590-ldap-eapfast-config.html

   Source: Adapted from community discussion — skh

   References

   • Cisco documentation

   Next question

2. Question 42 · 294 in bank

   An IT team is growing quickly and needs a solution for management device access. The solution must authenticate users from an external repository instead of the current local on the WLC, and it must also identify the user and determine what level of access users should have. Which protocol do you recommend to achieve these goals?

   • Anetwork policy server
   • BRADIUS
   • CTACACS+
   • DLDAP

   Show answer

   Answer: C

   Next question

3. Question 43 · 294 in bank

   Select 3

   Refer to the exhibit. An engineer must connect a fork lift via a WGB to a wireless network and must authenticate the WGB certificate against the RADIUS server. Which three steps are required for this configuration? (Choose three.)

   

   • AConfigure the certificate, WLAN, and radio interface on WGB.
   • BConfigure the certificate on the WLC.
   • CConfigure WLAN to authenticate using ISE.
   • DConfigure the access point with the root certificate from ISE.
   • EConfigure WGB as a network device in ISE.
   • FConfigure a policy on ISE to allow devices to connect that validate the certificate.

   Show answer

   Answer: ACF

   Explanation

   Worst question I saw on this exam.... I agree with daeman. Explanations : A. Configure the certificate, WLAN, and radio interface on WGB. --> That's true B. Configure the certificate on the WLC. --> Nope, the WLC is the authenticator, it is neither authenticated or needs to authenticate anything C. Configure WLAN to authenticate using ISE. --> True, on the controller the SSID to which the WGB will connect must be configured, and broadcasted by the LAP D. Configure the access point with the root certificate from ISE. --> If they are talking about the WGB access point, then that's true, the root certificate that signed ISE certificate needs to be installed in the WGB AP E. Configure WGB as a network device in ISE. --> That's surely wrong. The WGB is not the authenticator in the dot1x process. It is the client. The controller is the authenticator. F. Configure a policy on ISE to allow devices to connect that validate the certificate. --> As I understand it, in some ways, that's true. We need to create an authentication/authorization policy on ISE so that the WGB AP will be authenticated by ISE based on the its certificate.

   Source: Adapted from community discussion — segr4523

   Next question

4. Question 44 · 294 in bank

   During the EAP process and specifically related to the client authentication session, which encrypted key is sent from the RADIUS server to the access point?

   • AWPA key
   • Bsession key
   • Cencryption key
   • Dshared-secret key

   Show answer

   Answer: B

   Explanation

   Once a client is associated with the AP, it must be authenticated and cryptographic keys generated for its session. An entire hierarchy of keys must be generated, beginning with the Master Session Key (MSK).

   Source: Adapted from community discussion — Vlad_Is_Love_ua

   Next question

5. Question 45 · 294 in bank

   Select 2

   A network is set up to support wired and wireless clients. Both types must authenticate using 802.1X before connecting to the network. Different types of client authentication must be separated on a Cisco ISE deployment. Which two configuration items achieve this task? (Choose two.)

   • Adevice profiles
   • Bpolicy sets
   • Cseparate networks
   • Dpolicy groups
   • Epolicy results

   Show answer

   Answer: BE

   Explanation

   B and E would be a better answer as the overall policy for wired and wireless will be different, as will the authorization result within each policy.

   Source: Adapted from community discussion — daeman

   Next question

6. Question 46 · 294 in bank

   An engineer must configure Cisco OEAPs for three executives. As soon as the NAT address is configured on the management interface, it is noticed that the WLC is not responding for APs that are trying to associate to the internal IP management address. Which command should be used to reconcile this?

   • Aconfig flexconnect office-extend nat-ip-only disable
   • Bconfig network ap-discovery nap-ip-only enable
   • Cconfig flexconnect office-extend nat-ip-only enable
   • Dconfig network ap-discovery nat-ip-only disable

   Show answer

   Answer: D

   Explanation

   config network ap-discovery nat-ip-only {enable | disable} where enable—Enables use of NAT IP only in Discovery response. This is the default. Use this command if all APs are outside of the NAT gateway. disable—Enables use of both NAT IP and non-NAT IP in discovery response. Use this command if APs are on the inside and outside of the NAT gateway; for example, Local Mode and OfficeExtend APs on the same controller. https://community.cisco.com/t5/wireless/office-extend-ap-and-external-addresses/td-p/3742395

   Source: Adapted from community discussion — Vlad_Is_Love_ua

   References

   • cisco.com documentation

   Next question

7. Question 47 · 294 in bank

   An engineer is troubleshooting a Cisco CMX high-availability deployment and notices that the primary and backup Cisco CMX servers are both considered primary. Which command must the engineer run on the backup server?

   • Acmxha convert backup
   • Bcmxha backup convert
   • Ccmxha secondary convert
   • Dcmxha convert secondary

   Show answer

   Answer: C

   Explanation

   C. To convert the system to a secondary server and display Cisco CMX high availability (HA) information, use the cmxha secondary command. cmxha secondary{ convert | info }

   Source: Adapted from community discussion — Zanjit500

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 48 · 294 in bank

   Select 2

   A network administrator managing a Cisco Catalyst 9800-80 WLC must place all iOS connected devices to the guest SSID on VLAN 101. The rest of the clients must connect on VLAN 102 distribute load across subnets. To achieve this configuration, the administrator configures a local policy on the WLC. Which two configurations are required? (Choose two.)

   • AAssign a policy map under global security policy settings.
   • BAdd local profiling policy under global security policy settings.
   • CCreate a service template.
   • DAllow HTTP and DHCP profiling under policy map.
   • EEnable device classification on global wireless settings.

   Show answer

   Answer: CE

   Explanation

   C: Create a service template: A service template is used to configure the parameters of the client's network connection, including the VLAN ID. The service template should specify VLAN 102 for non-iOS devices. E: Enable device classification on global wireless settings: This option is used to classify clients based on their device type (such as iOS, Android, or Windows) and assign a specific VLAN ID to the device type. The device classification rule should specify VLAN 101 for iOS devices and VLAN 102 for non-iOS devices.

   Source: Adapted from community discussion — PauBau

   Next question

9. Question 49 · 294 in bank

   An engineer is assembling a PCI report for compliance purposes and must include missed best practices that are related to WLAN controllers. The engineer has access to all WLCs, Cisco MSE, and Cisco Prime Infrastructure. Which method most efficiently displays a summary of inconsistencies?

   • AWLC running-config
   • BCisco Prime Infrastructure monitoring
   • CCisco Prime Infrastructure reporting
   • DWLC logs

   Show answer

   Answer: C

   Explanation

   Incorrect. C should be a correct answer. OCG, p.408 (Figure 16-2 Cisco Prime Infrastructure Report Launch Pad (Lower Part)) Compliance: Compliance is critical if your network includes a publicly accessible area where payment is being processed. You may need to comply with the Payment Card Industry (PCI) Data Security Standard (DSS), which includes several requirements for wireless networks. From the compliance menu, you can run a compliance audit. Beyond PCI, this family of reports allows you to check your wireless network configuration for security weaknesses (insecure protocols and such) and also verify what configuration changes have been made on your network and whether these changes result in inconsistent configurations between network elements.

   Source: Adapted from community discussion — Yod_Jjot

   References

   • Cisco documentation

   Next question

10. Question 50 · 294 in bank

    Select 2

    An engineer is ensuring that, on the IEEE 802.1X wireless network, clients authenticate using a central repository and local credentials on the Cisco WLC. Which two configuration elements must be completed on the WLAN? (Choose two.)

    • ATACACS+
    • BMAC authentication
    • Clocal EAP enabled
    • Dweb authentication
    • ELDAP server

    Show answer

    Answer: CE

    Explanation

    C and E make more sense here where the WLC performs EAP locally but then validates clients against a central LDAP directory.

    Source: Adapted from community discussion — daeman

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-430 practice, question 41. 294 questions available.