300-430 practice questions 81–90

1. Question 81 · 294 in bank

   Select 2

   A network administrator just completed the basic implementation of Cisco CMX and tries to implement location tracking. The administrator is having trouble establishing connectivity between one of the WLCs through NMSP. What must be configured to establish this connectivity? (Choose two.)

   • AAdd permanent licenses on the Cisco CMX server.
   • BAllow on the firewall port 16113 between Cisco CMX and the WLC.
   • CEnable NMSP on the WLC.
   • DReboot Cisco CMX after adding the WLC for the first time.
   • EAdd to the WLC the MAC address and SSC key for the Cisco CMX server.

   Show answer

   Answer: BC

   Explanation

   I tested this on my 9800 controller wlc-lab-1#sh run | inc nmsp wlc-lab-1#conf t Enter configuration commands, one per line. End with CNTL/Z. wlc-lab-1(config)#nmsp enable wlc-lab-1(config)#^Z wlc-lab-1#sh run | inc nmsp nmsp enable wlc-lab-1# ---> on IOS XE WLC NMSP needs to bet set to "enable". NO NMSP is the system default ! Port TCP 16113 needs to be routable between WLC and CMX. The link below presented by USer NoWiresIncludes is interesting, but from my point of view only at prio 3. NMSP and TCP port 16113 are the 1st steps to verify.

   Source: Adapted from community discussion — peer1024

   Next question

2. Question 82 · 294 in bank

   

   Refer to the exhibit. An engineer must provide a position of rogue APs on a floor map using Cisco PI 3.0, but no rogue AP options are showing on the left-hand navigation menu under Maps. What is the reason for this omission?

   • AAn assurance license is not installed.
   • BThe controller operational status background task is disabled.
   • CThe Show Detected Interferers feature under the AP option is disabled.
   • DCisco MSE has not been added to Cisco PI.

   Show answer

   Answer: D

   Explanation

   Note Depending on whether or not a mobility services engine is present in NCS, some of the floor settings may not display. Clients, 802.11 Tags, Rogue APs, Adhoc Rogues, Rouge Clients and Interferers are visible only if a MSE is present in NCS.

   Source: Adapted from community discussion — qqqqqqqqqqq123

   Next question

3. Question 83 · 294 in bank

   WPA2 Enterprise with 802.1X is being used for clients to authenticate to a wireless network through a Cisco ISE server. For security reasons, the network engineer wants to ensure that only PEAP authentication is used. The engineer sent instructions to clients on how to configure the supplicants, but the ISE logs still show users authenticating using EAP-FAST. Which action ensures that access to the network is restricted for these users unless the correct authentication mechanism is configured?

   • AEnable AAA override on the SSID, gather the usernames of these users, and disable the RADIUS accounts until the devices are correctly configured.
   • BEnable AAA override on the SSID and configure an ACL on the WLC that allows access to users with IP addresses from a specific subnet.
   • CEnable AAA override on the SSID and configure an access policy in Cisco ISE that denies access to the list of MACs that have used EAP-FAST.
   • DEnable AAA override on the SSID and configure an access policy in Cisco ISE that allows access only when the EAP authentication method is PEAP.

   Show answer

   Answer: D

   Explanation

   Enabling AAA override on the SSID ensures that the access policies enforced by the Cisco ISE server are applied to the wireless clients attempting to connect to the network. Configuring an access policy in Cisco ISE that specifies PEAP as the required EAP authentication method will ensure that only clients using the correct authentication method (PEAP) are allowed access to the network. This way, any clients attempting to authenticate using EAP-FAST will be denied access, as they do not meet the specified authentication requirements.

   Source: Adapted from community discussion — robi1020

   Next question

4. Question 84 · 294 in bank

   

   Refer to the exhibit. What is the reason that the wireless client cannot get the RUN state?

   • AIt has no communication with Cisco ISE.
   • BAn authentication error has occurred.
   • CIt is not getting the IP address.
   • DBecause of central switching, the AP must reach the Cisco ISE directly.

   Show answer

   Answer: C

   Next question

5. Question 85 · 294 in bank

   A wireless engineer deployed all remote sites as FlexConnect. The client VLAN assignment on these sites is configured manually mapped by WLAN and using local switching. Dynamic VLAN assignment is provided by the newly deployed Cisco ISE. Which IETF attribute must be configured on the AAA server to send that VLAN ID?

   • ATunnel-Medium-Type
   • BTunnel-Client-Endpoint
   • CTunnel-Assignment-ID
   • DTunnel-Private-Group-ID

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

6. Question 86 · 294 in bank

   

   Refer to the exhibit. An engineer has deployed the Cisco CMX solution to track and detect the number of users who visit the office each day. The CMX dashboard is not showing any data. Which action resolves this issue?

   • AConfigure Single Sign-On authentication.
   • BAdd the WLCs to CMX.
   • CCopy the exported Maps from CMX server to PI using SCP.
   • DInstall an evaluation license to CMX server.

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

7. Question 87 · 294 in bank

   

   Refer to the exhibit. A network architect configured the Cisco Catalyst 9800 Series Controller to find out information on client types in the wireless network. RADIUS profiling is enabled so that the controller forwards the information about clients to a Cisco ISE server through vendor-specific RADIUS attributes. The ISE server is not profiling any data from the controller. Which configuration must be added in the blank in the code to accomplish the profiling on the Cisco 9800 Series controller?

   • Aaaa accounting identity acct_method start-stop group rad-group
   • Baaa accounting network acct_method start-stop group rad-group
   • Caaa accounting exec acct_method start-stop group rad-group
   • Daaa accounting commands acct_method start-stop group rad-group

   Show answer

   Answer: A

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 88 · 294 in bank

   Company XYZ recently migrated from AireOS to IOS XE 9800 WLCs. The Internet bandwidth must be limited to 5 Mbps for each guest client as per the global standard. In which configuration on the Cisco Catalyst 9800 WLC must the QoS requirement be added?

   • Atable map
   • Bpolicy map
   • Cservice policy
   • Dclass map

   Show answer

   Answer: B

   Next question

9. Question 89 · 294 in bank

   An engineer wants the wireless voice traffic class of service to be used to determine the queue order for packets received, and then have the differentiated services code point set to match when it is resent to another port on the switch. Which configuration is required in the network?

   • APlatinum QoS configured on the WLAN
   • BWMM set to required on the WLAN
   • Cmsl qos trust dscp configured on the controller switch port
   • Dmsl qos trust cos configured on the controller switch port

   Show answer

   Answer: D

   Explanation

   The Correct Answer is D. "When you enter the mls qos trust cos command on a port, the switch uses the CoS marking on incoming packets in order to put the packet in the right queue. When the packet is resent, the switch makes the DSCP value correspond to the CoS." See: https://www.cisco.com/c/en/us/support/docs/wireless-mobility/voice-over-wireless-lan-vowlan/116056-technote-qos-00.html#anc3

   Source: Adapted from community discussion — andit

   References

   • Cisco documentation

   Next question

10. Question 90 · 294 in bank

    An engineer needs read/write access to rename access points and add them to the correct AP groups on a wireless controller. Using Cisco ISE TACACS, which custom attributes is the minimum required?

    • Arole1=WLAN
    • Brole1=WLAN role2=SECURITY
    • Crole1=WLAN role2=WIRELESS
    • Drole1=WIRELESS

    Show answer

    Answer: C

    Explanation

    You forgot that the other requirement was to rename Access Points, which can be found in the Wireless tab, so WLAN and Wireless are both required

    Source: Adapted from community discussion — NoWiresIncluded

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-430 practice, question 81. 294 questions available.