8.2 Implement Access Point Authentication (including 802.1X) 300-430 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network engineer is troubleshooting why a Cisco AP fails 802.1X authentication. The AP is configured with the correct RADIUS server IP and shared secret. The switch port shows the AP in an unauthorized state. Which next step is most likely to reveal the cause?

   • ACheck the RADIUS server logs for an Access-Reject message and verify the AP's supplicant credentials.
   • BChange the switch port to dynamic VLAN assignment.
   • CDisable 802.1X on the switch port and enable MAC authentication bypass.
   • DReboot the AP to force it to re-initiate authentication.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An engineer is configuring 802.1X on a Cisco AP. The RADIUS server is at 192.168.10.5, and the shared secret is 'Cisco123'. The AP is connected to a switch port that is set to 'auto' authentication. The engineer enables 802.1X on the AP's Ethernet interface but authentication still fails. What is the most likely missing configuration?

   • AThe switch port is not in the same VLAN as the AP.
   • BThe AP's wireless interface is not enabled.
   • CThe RADIUS server's authentication port is not set to 1812.
   • DThe AP's hostname is not configured.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A retail chain is deploying new Cisco APs that will connect to a switch port configured for 802.1X. The APs are managed by a controller, and the security policy requires the APs to authenticate using 802.1X with EAP-FAST. Which configuration is required on the AP to support this?

   • AEnable 802.1X on the AP's Ethernet interface and configure the RADIUS server and EAP-FAST parameters.
   • BDisable the AP's Ethernet interface and use a wireless uplink to the controller.
   • CConfigure the AP to use a static IP address and rely on the controller to authenticate it.
   • DSet the AP's management VLAN to the same VLAN as the RADIUS server.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is deploying 802.1X for APs in a new office. The APs are managed by a WLC, and the WLC is configured to act as a RADIUS proxy to an external RADIUS server. The engineer wants to ensure that APs authenticate even if the external RADIUS server is temporarily unreachable. What should the engineer configure?

   • AConfigure the APs to use a different RADIUS server directly.
   • BConfigure a local RADIUS server on the WLC as a fallback.
   • CIncrease the RADIUS timeout on the WLC.
   • DConfigure the APs to use local EAP authentication.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is deploying EAP-TLS for AP authentication. The APs are configured to validate the RADIUS server certificate. The RADIUS server certificate is signed by an external public CA. During a pilot, all APs fail with a certificate validation error. What is the most likely cause?

   • AThe APs are configured with the wrong EAP type.
   • BThe APs do not have the external CA's root certificate in their trust store.
   • CThe RADIUS server's shared secret is incorrect.
   • DThe RADIUS server certificate has expired.
   Reveal Solution Discussion Select an answer first