8.2 Implement Access Point Authentication (including 802.1X) 300-430 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When troubleshooting a certificate issue on a client that is failing 802.1X authentication, which of the following is a common cause?

   • AThe client's wireless adapter is not configured with the correct SSID
   • BThe client's operating system is not licensed for 802.1X
   • CThe client's IP address is not in the same subnet as the RADIUS server
   • DThe client's certificate has expired or is not trusted by the RADIUS server
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When troubleshooting an 802.1X authentication failure, which of the following is a valid first step to verify connectivity between the access point and the RADIUS server?

   • ACheck the client's wireless signal strength
   • BReboot the access point
   • CVerify the client's IP address configuration
   • DPing the RADIUS server from the access point
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is deploying 802.1X for APs. The security team requires mutual authentication and the use of certificates. However, the current RADIUS server does not support EAP-TLS. Which approach would meet the requirement with the least disruption?

   • AUpgrade the RADIUS server to support EAP-TLS and issue certificates to all APs.
   • BUse EAP-FAST with PACs and no certificates.
   • CUse PEAP-MSCHAPv2 with server certificates and user credentials.
   • DUse LEAP with a shared secret.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An AP fails 802.1X authentication. The RADIUS server logs show an Access-Reject. The AP is configured with EAP-TLS. The AP's certificate is valid and trusted by the RADIUS server. What is the most likely cause of the Access-Reject?

   • AThe AP's certificate is not mapped to a valid user or device account in the RADIUS server's identity store.
   • BThe AP's shared secret is incorrect.
   • CThe switch port is in the wrong authentication mode.
   • DThe RADIUS server's certificate is expired.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital is deploying new Cisco 9105AX access points. The security team requires that each AP authenticate to the network before it can join the controller. The existing RADIUS server uses a shared secret and supports EAP-FAST. The APs will be connected to a switch port that is configured for 802.1X. What must be configured on the AP to complete the authentication process?

   • AEnable 802.1X on the AP's Ethernet interface and configure the RADIUS server IP, shared secret, and EAP-FAST as the authentication method.
   • BEnable 802.1X globally on the controller and configure the AP to use the controller's IP address as the RADIUS server.
   • CSet the AP's management interface to use DHCP and rely on the switch's default port VLAN to authenticate automatically.
   • DConfigure the AP to use MAC authentication bypass (MAB) on the switch port so the AP does not need to run 802.1X.
   Reveal Solution Discussion Select an answer first