An administrator is configuring a Control Plane ACL on a Cisco 9800 WLC. The ACL must permit CAPWAP control (UDP 5246) and data (UDP 5247) from APs in the 172.16.0.0/16 subnet, and permit SSH from the management subnet 192.168.10.0/24. All other traffic should be denied. The administrator creates the ACL and applies it to the control plane. Which additional step is necessary to ensure the ACL is enforced?

Enable the ACL on the management interface using the 'ip access-group' command

Reboot the controller to activate the ACL

Ensure the ACL is named 'CP-ACL' to be recognized by the controller

Apply the ACL to the control plane using the 'control-plane' configuration mode

An engineer is configuring a Control Plane ACL on a Cisco 9800 controller. The ACL must allow CAPWAP control traffic from APs in the 192.168.2.0/24 subnet and deny all other CAPWAP control traffic. The engineer has created the ACL and applied it to the control plane. How can the engineer verify that the ACL is correctly filtering CAPWAP traffic?

Use the 'show access-lists' command to check hit counts on the CAPWAP permit and deny entries.

Use the 'show ap summary' command to see if APs are joining.

Use the 'show control-plane' command to see the ACL configuration.

Use the 'show logging' command to see if CAPWAP packets are being dropped.

Which command on a Cisco AireOS wireless LAN controller shows the currently applied Control Plane ACL and its hit counts?

show running-config | include acl

A network administrator has implemented a Control Plane ACL on a Cisco 9800 controller. The ACL is intended to allow only SNMP from the NMS server and deny all other SNMP traffic. After implementation, the NMS can no longer poll the controller. What should the administrator check first?

Check the NMS server's IP address and ensure it is in the ACL's permit statement.

Disable the ACL to restore SNMP access immediately.

Verify the ACL hit counts to see if SNMP packets from the NMS are being matched and permitted.

Reboot the controller to reset the ACL counters.

A Cisco 9800 controller is deployed in a network with multiple APs. The engineer needs to implement a Control Plane ACL that allows CAPWAP from all APs, but the APs are spread across multiple subnets. The engineer wants to minimize the number of ACL entries. What is the most efficient way to configure the ACL?

Create a separate permit statement for each AP subnet.

Permit all UDP traffic from any source.

Use a single permit statement for UDP port 5246 from a supernet that covers all AP subnets.

Permit CAPWAP from the management subnet only.

CiscoCertified Network Professional Enterprise Wireless (ENWLSI)

Domain 8Objective 3

8.3 Implement Control Plane ACLs on the Controller 300-430 Practice Questions (Page 2)

Part of the Device Hardening domain, which accounts for 10% of the 300-430 exam. Cisco does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

3concepts

10%of the exam

Questions 6–10

6application · medium
An administrator is configuring a Control Plane ACL on a Cisco 9800 WLC. The ACL must permit CAPWAP control (UDP 5246) and data (UDP 5247) from APs in the 172.16.0.0/16 subnet, and permit SSH from the management subnet 192.168.10.0/24. All other traffic should be denied. The administrator creates the ACL and applies it to the control plane. Which additional step is necessary to ensure the ACL is enforced?
Select an answer first
7application · medium
An engineer is configuring a Control Plane ACL on a Cisco 9800 controller. The ACL must allow CAPWAP control traffic from APs in the 192.168.2.0/24 subnet and deny all other CAPWAP control traffic. The engineer has created the ACL and applied it to the control plane. How can the engineer verify that the ACL is correctly filtering CAPWAP traffic?
Select an answer first
8foundation · easy
Which command on a Cisco AireOS wireless LAN controller shows the currently applied Control Plane ACL and its hit counts?
Select an answer first
9application · medium
A network administrator has implemented a Control Plane ACL on a Cisco 9800 controller. The ACL is intended to allow only SNMP from the NMS server and deny all other SNMP traffic. After implementation, the NMS can no longer poll the controller. What should the administrator check first?
Select an answer first
10expert · hard
A Cisco 9800 controller is deployed in a network with multiple APs. The engineer needs to implement a Control Plane ACL that allows CAPWAP from all APs, but the APs are spread across multiple subnets. The engineer wants to minimize the number of ACL entries. What is the most efficient way to configure the ACL?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 300-430

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “300-430” is a trademark of its owner, used for identification only.

8.3 Implement Control Plane ACLs on the Controller 300-430 Practice Questions (Page 2)

Questions 6–10

Which command on a Cisco AireOS wireless LAN controller shows the currently applied Control Plane ACL and its hit counts?

A network administrator has implemented a Control Plane ACL on a Cisco 9800 controller. The ACL is intended to allow only SNMP from the NMS server and deny all other SNMP traffic. After implementation, the NMS can no longer poll the controller. What should the administrator check first?

Keep studying — Device Hardening