6.3 Implement Client Security on Different Wireless Architectures and ISE 300-430 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In Central Web Authentication (CWA) with ISE, what is the purpose of the redirect ACL on the wireless controller?

   • ATo block all traffic from unauthenticated clients
   • BTo encrypt all client traffic
   • CTo allow only traffic to the ISE portal and necessary services like DNS/DHCP
   • DTo assign a VLAN to the client
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company uses ISE profiling to identify devices on their WLAN. They have a policy that assigns a 'guest' VLAN to unknown devices. Recently, some known Windows laptops are being placed in the guest VLAN. ISE logs show that the profiler is not updating the endpoint's profile. What is the most likely cause?

   • AThe profiler probe is not receiving HTTP or DHCP traffic from the clients.
   • BThe RADIUS server is not sending accounting to ISE.
   • CThe WLAN is configured for 802.1X, which prevents profiling.
   • DThe authorization policy is matching on the wrong attribute.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A small business has a single autonomous AP and wants to use 802.1X with ISE for client authentication. The AP does not support RADIUS. What is the most practical way to integrate ISE with this autonomous AP?

   • AReplace the autonomous AP with a lightweight AP and a wireless controller that supports RADIUS.
   • BUse MAC authentication bypass on the autonomous AP and forward MACs to ISE via RADIUS.
   • CPlace the autonomous AP in bridge mode and use an external RADIUS server for authentication.
   • DConfigure the autonomous AP to use RADIUS via a proxy on the local network.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A retail chain uses FlexConnect APs with local switching. They have legacy barcode scanners that do not support 802.1X. They want these devices to authenticate via MAB and be placed in the 'IoT' VLAN. The WLAN is configured for MAB with AAA Override. However, the scanners are failing authentication. What should you verify first?

   • AThat the WLAN is set to 'WPA2-PSK' because MAB requires a pre-shared key.
   • BThat the scanner's MAC address is not randomized, because MAB uses the client's IP address for authentication.
   • CThat the FlexConnect APs are in connected mode, because MAB does not work in standalone mode.
   • DThat the scanner MAC addresses are in the ISE endpoint identity store and the MAB policy is set to 'Process Host Lookup'.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A manufacturing plant has a WLAN for IoT sensors that do not support 802.1X. The network team wants these devices to authenticate via MAC address and have ISE assign them to a restricted VLAN. The sensors are already in the ISE endpoint database. The WLAN is configured for MAC filtering. What else must be configured to complete the MAB flow?

   • ACreate a local MAC address list on the controller and assign the VLAN directly.
   • BConfigure the WLAN to use the same RADIUS server as the 802.1X WLAN and ensure ISE has a policy that returns the restricted VLAN.
   • CEnable 802.1X on the WLAN and configure the sensors with a certificate for authentication.
   • DConfigure the WLAN for open authentication and rely on the controller to forward the MAC address to ISE.
   Reveal Solution Discussion Select an answer first