6.3 Implement Client Security on Different Wireless Architectures and ISE 300-430 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A university uses ISE profiling on its wireless network. The security team wants to automatically place Apple iPads into a 'tablets' VLAN and Windows laptops into a 'computers' VLAN. The WLAN is configured for 802.1X with ISE. What is the most efficient way to achieve this?

   • AConfigure the controller to assign VLANs based on the DHCP vendor class of the client.
   • BCreate ISE authorization policies that match on profiler attributes such as Device Type and return the appropriate VLAN.
   • CUse MAC authentication bypass and manually add each device's MAC to the correct VLAN group.
   • DCreate separate WLANs for each device type and use RADIUS attributes to assign the VLAN.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A hotel uses CWA with ISE for guest Wi-Fi. Guests are redirected to a portal, but after entering the access code, they are not granted internet access. ISE logs show that the guest was authenticated and authorized. The controller logs show that the client is in the RUN state. What is the most likely cause?

   • AThe client's browser is caching the redirect page.
   • BThe WLAN's AAA override is disabled, so the VLAN is not applied.
   • CThe post-authentication ACL returned by ISE is blocking all traffic except DNS.
   • DThe RADIUS accounting is not enabled, so ISE does not know the session is active.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A hospital has a WLAN for medical devices that use MAB. The devices are in the ISE endpoint database. Recently, some devices fail authentication. ISE logs show 'Authentication failed' for these MAC addresses. The devices are known to be on the network. What is the most likely cause?

   • AThe RADIUS shared secret between the controller and ISE has changed.
   • BThe WLAN is configured for 802.1X instead of MAB.
   • CThe devices are not sending a DHCP request, so ISE cannot profile them.
   • DThe MAC addresses are in the endpoint database but the authorization policy does not match them.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A library offers guest Wi-Fi using CWA with ISE. Guests are redirected to a portal where they must enter a code printed on a receipt. After entering the code, they should be allowed internet access. The WLAN is configured for CWA. What must be configured on ISE to validate the codes and grant access?

   • ASet up a RADIUS server on the AP to validate the codes.
   • BCreate a local user database on the controller with the codes and use RADIUS to authenticate.
   • CCreate a guest portal with a sponsor approval flow and configure the WLAN to use the portal.
   • DConfigure the WLAN for MAC authentication bypass and use ISE to validate the codes.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company uses ISE profiling to identify devices on the wireless network. They want to automatically place iPads in the 'Tablet' VLAN and Windows laptops in the 'PC' VLAN. The WLAN uses 802.1X with PEAP. What must be configured in ISE to achieve this?

   • AEnable 'RADIUS Change of Authorization' (CoA) on the WLC to push the VLAN after profiling.
   • BCreate authorization profiles that return the appropriate VLAN based on the profiled device type.
   • CConfigure the WLC to send RADIUS accounting with the device's MAC address to ISE.
   • DUse a different EAP method for iPads and Windows laptops to differentiate them.
   Reveal Solution Discussion Select an answer first