8.3 Implement Control Plane ACLs on the Controller 300-430 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After applying a Control Plane ACL on a Cisco 9800 controller, an engineer wants to confirm that the ACL is actually protecting the control plane. Which command provides information about the control-plane policy and its associated ACL?

   • Ashow access-lists
   • Bshow running-config
   • Cshow control-plane
   • Dshow ip interface
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which show command on a Catalyst 9800 controller verifies the applied Control Plane ACL and its packet counters?

   • Ashow running-config | section control-plane
   • Bshow control-plane
   • Cshow access-lists
   • Dshow platform acl
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An engineer is implementing a Control Plane ACL on a Cisco 9800 controller. The ACL must allow CAPWAP from APs in the 192.168.0.0/16 subnet, but the APs are also using DHCP to obtain their IP addresses. The engineer must ensure that DHCP traffic from the APs is not blocked by the ACL. What should the engineer include in the ACL?

   • APermit ICMP from the AP subnet.
   • BPermit TCP port 67 and 68 from the AP subnet.
   • CPermit UDP port 67 (DHCP server) and UDP port 68 (DHCP client) from the AP subnet.
   • DPermit all UDP traffic from the AP subnet.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is deploying a Cisco 9800 controller in a DMZ. The security policy requires that only the network operations center (NOC) subnet (172.16.10.0/24) can access the controller's management interfaces (HTTPS, SSH, SNMP). All other traffic to the control plane should be dropped. The engineer needs to implement this using a Control Plane ACL. What is the most efficient way to achieve this?

   • ACreate an ACL with permit statements for the NOC subnet for TCP 443, TCP 22, and UDP 161, and a final deny all.
   • BCreate an ACL that denies all traffic from the NOC subnet and permits all other traffic.
   • CCreate an ACL that permits all TCP traffic from the NOC subnet and denies all UDP traffic.
   • DCreate an ACL that permits all traffic from the NOC subnet and denies all other traffic.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   After implementing a Control Plane ACL on a Cisco 9800 controller, an engineer notices that the ACL hit counts show a large number of packets being denied. The engineer suspects that the ACL is dropping legitimate CAPWAP traffic from access points. What is the most effective way to determine if the ACL is causing the issue?

   • ARemove the ACL and see if APs join successfully.
   • BCheck the AP join logs for errors.
   • CCompare the hit counts on the CAPWAP permit entry with the number of APs expected to join.
   • DReboot the controller to reset the ACL counters.
   Reveal Solution Discussion Select an answer first