8.3 Implement Control Plane ACLs on the Controller 300-430 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   On a Cisco Catalyst 9800 wireless controller, where is a Control Plane ACL configured in the GUI?

   • AConfiguration > Security > Control Plane ACL
   • BAdministration > Management > ACL
   • CMonitoring > Security > ACL
   • DConfiguration > Wireless > Access Policies
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which CLI command is used to apply a named Control Plane ACL on a Cisco wireless LAN controller running AireOS?

   • Aconfig acl policy <acl-name>
   • Bcontrol-plane security ip access-group <acl-name> in
   • Cip access-group <acl-name> in
   • Dwireless client acl <acl-name>
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network engineer is hardening a Cisco wireless controller that is reachable from the corporate network. The controller's management interface is on VLAN 10, and the engineer wants to ensure that only the network management station (NMS) at 10.10.10.50 can reach the controller's HTTPS and SSH services. Other traffic to the controller's control plane should be dropped. Which approach should the engineer take?

   • AConfigure an ACL on the controller's management interface that permits only ICMP from 10.10.10.50.
   • BConfigure a CPU ACL on the switch that blocks all traffic to the controller's IP address except from 10.10.10.50.
   • CConfigure a Control Plane ACL that permits TCP 443 and TCP 22 from 10.10.10.50 and denies all other traffic to the controller.
   • DEnable the controller's built-in firewall and create a rule to allow only the NMS IP.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A Cisco 9800 controller is being hardened. The security team wants to ensure that only the NMS server can access the controller's management interfaces, but they also want to allow all access points in the 10.0.0.0/8 range to join. The engineer must implement a Control Plane ACL that meets these requirements while minimizing the risk of blocking legitimate traffic. What is the best approach?

   • ACreate an ACL with specific permit entries for management protocols from the NMS and CAPWAP from the AP subnet, then deny all other traffic.
   • BCreate an ACL that permits all management protocols from any source, and CAPWAP from the AP subnet.
   • CCreate an ACL that permits all traffic from the NMS and the AP subnet, then deny all other traffic.
   • DCreate an ACL that denies all traffic and then adds permit entries as needed.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A network engineer has implemented a Control Plane ACL on a Cisco 9800 controller. The ACL is intended to allow only HTTPS from the NMS and CAPWAP from APs. After implementation, the engineer notices that the controller's CPU utilization is still high. What should the engineer investigate?

   • ACheck if the ACL is actually applied to the control plane and if the hit counts show that unwanted traffic is being dropped.
   • BIncrease the controller's CPU priority to handle more traffic.
   • CReboot the controller to clear the CPU.
   • DDisable the ACL to reduce CPU load.
   Reveal Solution Discussion Select an answer first