6.3 Implement Client Security on Different Wireless Architectures and ISE 300-430 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a centralized WLC and ISE. They recently changed their 802.1X EAP method from PEAP to EAP-TLS. After the change, some users cannot authenticate. The ISE logs show that the users are failing certificate validation. What is the most likely cause?

   • AThe ISE policy is set to require a specific certificate template that the users do not have.
   • BThe users' supplicants are still configured for PEAP, so they are not sending certificates.
   • CThe users' client certificates are not trusted by the ISE certificate authority (CA).
   • DThe WLC is not configured with the correct RADIUS shared secret.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A hospital uses ISE profiling to identify medical devices. They have infusion pumps that do not support 802.1X. They want to use MAB for these devices and then profile them to assign the correct VLAN. What is the correct configuration order?

   • AUse a static VLAN on the WLAN and rely on profiling to change it via CoA.
   • BConfigure 802.1X with a machine certificate for the pumps, then use profiling to assign the VLAN.
   • CCreate a separate WLAN for the pumps with open authentication and use profiling to assign the VLAN.
   • DConfigure MAB on the WLAN, then in ISE create a profiling policy that matches the device's attributes and an authorization profile that returns the VLAN.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hotel offers guest Wi-Fi. They use a centralized WLC and ISE for Central Web Authentication (CWA). Guests must accept an acceptable use policy (AUP) before accessing the internet. After a guest accepts the AUP, they still cannot browse. The ISE policy returns a VLAN and an ACL. What is the most likely missing configuration?

   • AThe WLAN has 'AAA Override' disabled, so the post-authentication VLAN and ACL are not applied.
   • BThe guest's browser is not configured to use a proxy, which is required for CWA redirect.
   • CThe WLC is not configured with a DNS server, so the guest cannot resolve the redirect URL.
   • DThe ISE policy is set to 'Permit Access' but the guest is not assigned to the correct identity group.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In a wireless network using ISE for authentication, which RADIUS attribute is used to assign a client to a specific VLAN?

   • AUser-Name (Attribute 1)
   • BTunnel-Private-Group-ID (Attribute 81)
   • CNAS-IP-Address (Attribute 4)
   • DCalled-Station-Id (Attribute 30)
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail chain uses FlexConnect APs in local switching mode at remote stores. The WLAN is configured for 802.1X with ISE as the RADIUS server. The WAN link to the central site goes down, and clients can no longer authenticate. The store manager wants to keep the Wi-Fi available for employees during the outage. What should the network team configure to achieve this?

   • AEnable AAA fallback on the controller to use a backup RADIUS server at the store.
   • BConfigure the WLAN for MAC filtering and use the AP's local MAC list as a fallback.
   • CConfigure a local RADIUS server on the FlexConnect AP with a fallback policy that allows authentication when the WAN is down.
   • DChange the WLAN to open authentication and rely on the AP's local switching to provide connectivity.
   Reveal Solution Discussion Select an answer first