6.3 Implement Client Security on Different Wireless Architectures and ISE 300-430 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A user reports that they cannot connect to the corporate WLAN. The WLAN uses 802.1X with ISE. The controller logs show an Access-Reject from ISE. The user's laptop shows an authentication error. Which two checks should the administrator perform first to isolate the issue?

   • AVerify the user's credentials in Active Directory and check the ISE authentication logs for the specific failure reason.
   • BCheck the RADIUS shared secret between the controller and ISE and verify the controller's IP address is in the ISE NAS list.
   • CCheck the client's certificate validity and ensure the root CA is trusted on the device.
   • DVerify the WLAN's SSID is broadcast and the client's wireless driver is up to date.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is evaluating wireless architectures. They have a requirement to support 802.1X with ISE, but they also need to support a remote site with no local IT staff and an unreliable WAN link. Which architecture best meets both requirements?

   • ACentralized architecture with FlexConnect APs in local switching mode and local RADIUS fallback.
   • BCloud-based architecture with a RADIUS proxy at the remote site.
   • CCentralized architecture with central switching and no local fallback.
   • DAutonomous APs with local RADIUS server on each AP.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which RADIUS attribute is commonly used by ISE to return authorization results to a wireless controller, such as VLAN assignment or downloadable ACL?

   • ARADIUS Attribute 81 (Tunnel-Private-Group-ID)
   • BRADIUS Attribute 8 (Framed-IP-Address)
   • CRADIUS Attribute 1 (User-Name)
   • DRADIUS Attribute 64 (Tunnel-Type)
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a centralized WLC and ISE. Employees authenticate with 802.1X using EAP-TLS. Recently, some users report that they cannot connect, while others can. The ISE logs show that the failing users have certificate errors. What is the most likely cause?

   • AThe failing users' client certificates are not trusted by the ISE certificate authority (CA).
   • BThe failing users are on a different VLAN that does not have access to the RADIUS server.
   • CThe ISE policy is set to require a specific EAP method that the failing users do not support.
   • DThe WLC is not configured with the correct RADIUS shared secret.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   After a guest user successfully authenticates via Central Web Authentication (CWA), what does ISE typically send to the wireless controller to enforce the post-authentication policy?

   • AA new SSID configuration
   • BA CoA (Change of Authorization) to disconnect the client
   • CA RADIUS Access-Challenge to request more credentials
   • DA RADIUS Access-Accept with authorization attributes such as VLAN or ACL
   Reveal Solution Discussion Select an answer first