A company uses ISE profiling on its wireless network. They want to block IoT devices that are not authorized. The WLAN uses MAB for these devices. ISE has a profiling policy that identifies known IoT devices. What is the best way to enforce the block?

Configure the WLAN to use a blacklist of MAC addresses on the controller.

Use RADIUS attributes to assign the IoT devices to a VLAN with no internet access.

Set the WLAN to open authentication and rely on the firewall to block the devices.

Create an authorization policy that matches the profiled device and returns an Access-Reject.

A user is unable to connect to the WLAN. The WLAN uses 802.1X with PEAP-MSCHAPv2 and ISE. The controller logs show an Access-Accept from ISE, but the client still fails to obtain an IP address. What is the most likely cause?

The client's username or password is incorrect.

The RADIUS-assigned VLAN is not trunked to the access switch, so the client's DHCP request is not reaching the DHCP server.

The RADIUS shared secret is incorrect.

Which RADIUS attribute is commonly used by Cisco wireless controllers to receive a downloadable ACL name from ISE?

Acct-Interim-Interval (Attribute 85)

Framed-IP-Address (Attribute 8)

A company has FlexConnect APs in local switching mode. The WLAN uses 802.1X with ISE. During a WAN outage, the AP falls back to local authentication. After the WAN recovers, clients that authenticated locally are still connected. The security team wants to enforce the central ISE policy for these clients. What should be done?

Manually disconnect the clients from the AP and have them reconnect.

Disable local authentication on the AP and rely on the WAN to recover.

Change the WLAN to central switching to avoid local authentication fallback.

Configure the controller to send a CoA to the AP to reauthenticate the clients after the WAN recovers.

A company is deploying a WLAN with 802.1X and ISE. The security team wants to restrict access to a specific internal server for a group of contractors. ISE is configured to return a downloadable ACL (dACL) for that group. What must be configured on the wireless controller to enforce the dACL?

Enable RADIUS accounting to send the dACL to the controller.

Configure the WLAN to use the dACL as the default ACL for all users.

Enable AAA override and ensure the WLAN is configured to accept downloadable ACLs from RADIUS.

Create a static ACL on the controller with the same name as the dACL and apply it to the WLAN.

CiscoCertified Network Professional Enterprise Wireless (ENWLSI)

Domain 6Objective 3

6.3 Implement Client Security on Different Wireless Architectures and ISE 300-430 Practice Questions (Page 4)

Part of the Security for Wireless Client Connectivity domain, which accounts for 20% of the 300-430 exam. Cisco does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

9concepts

20%of the exam

Questions 16–20

16application · medium
A company uses ISE profiling on its wireless network. They want to block IoT devices that are not authorized. The WLAN uses MAB for these devices. ISE has a profiling policy that identifies known IoT devices. What is the best way to enforce the block?
Select an answer first
17expert · hard
A user is unable to connect to the WLAN. The WLAN uses 802.1X with PEAP-MSCHAPv2 and ISE. The controller logs show an Access-Accept from ISE, but the client still fails to obtain an IP address. What is the most likely cause?
Select an answer first
18foundation · easy
Which RADIUS attribute is commonly used by Cisco wireless controllers to receive a downloadable ACL name from ISE?
Select an answer first
19expert · hard
A company has FlexConnect APs in local switching mode. The WLAN uses 802.1X with ISE. During a WAN outage, the AP falls back to local authentication. After the WAN recovers, clients that authenticated locally are still connected. The security team wants to enforce the central ISE policy for these clients. What should be done?
Select an answer first
20application · medium
A company is deploying a WLAN with 802.1X and ISE. The security team wants to restrict access to a specific internal server for a group of contractors. ISE is configured to return a downloadable ACL (dACL) for that group. What must be configured on the wireless controller to enforce the dACL?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 300-430

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “300-430” is a trademark of its owner, used for identification only.