6.2 Implement BYOD and Guest 300-430 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An administrator is troubleshooting a Local Web Authentication deployment where users are not being redirected to the login page. The WLC is configured with LWA and uses an external RADIUS server. The administrator verifies that the RADIUS server is reachable and that the SSID is enabled. Which additional check is most likely to reveal the issue?

   • ACheck that the RADIUS server's shared secret matches the WLC's configuration.
   • BEnsure that the SSID is broadcasting and that the client is within range.
   • CVerify that the WLC has a valid certificate for HTTPS and that the redirect ACL is configured correctly.
   • DConfirm that the client's browser has JavaScript enabled.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is deploying a new wireless network with two SSIDs: one for employees using 802.1X with certificates and one for guests using Central Web Authentication with ISE. The WLC has a single management interface. The security team requires that the guest portal be accessible over HTTPS without browser warnings. Which certificate strategy should be used?

   • AInstall the ISE certificate on the WLC and use it for both the management interface and the guest portal.
   • BInstall a CA-signed certificate on the WLC for its HTTPS service and use ISE's own CA-signed certificate for the guest portal.
   • CUse a single self-signed certificate on both the WLC and ISE to simplify management.
   • DDisable HTTPS on the WLC and use HTTP for the guest redirect to avoid certificate issues.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is deploying a guest Wi-Fi with ISE Central Web Authentication. The security team requires that guests be redirected to the portal only when they attempt to access the internet, not when they access internal resources. Which configuration is required?

   • AConfigure a pre-authentication ACL on the WLC that permits internal traffic and redirects all other traffic to the portal.
   • BDisable the redirect for internal DNS queries only.
   • CConfigure the WLC to redirect all HTTP traffic regardless of destination.
   • DUse ISE's policy to redirect only traffic to specific destinations.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A small office has a WLC but no external RADIUS server. They want to provide guest Wi-Fi with a simple username/password login. The WLC will host the web authentication page. Which configuration is required on the WLC?

   • AEnable Central Web Authentication and point the redirect URL to an external web server.
   • BUse the WLC's default self-signed certificate and configure a RADIUS proxy to a cloud service.
   • CConfigure the WLC to use RADIUS with ISE and create a guest portal in ISE.
   • DConfigure a local user database with guest credentials and enable Local Web Authentication on the SSID.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A university wants to provision student laptops with 802.1X settings and a trusted certificate. They also want to support guest access via CWA with ISE. The WLC currently uses a self-signed certificate. What is the best way to avoid browser warnings for both services?

   • AUse CWA for both 802.1X and guest access, and install a public CA-signed certificate on ISE.
   • BUse ISE's native supplicant provisioning for the 802.1X profile and install a public CA-signed certificate on the WLC for CWA.
   • CUse LWA on the WLC for both 802.1X and guest access, and keep the self-signed certificate.
   • DUse ISE's self-registration portal for supplicant provisioning and install the ISE certificate on the WLC.
   Reveal Solution Discussion Select an answer first