6.4 Implement Identity-Based Networking on Different Wireless Architectures (VLANs, QoS, ACLs) 300-430 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which RADIUS attribute is commonly used to convey QoS information to a wireless controller for identity-based QoS policies?

   • ATunnel-Type
   • BCisco-AVPair (e.g., qos-level)
   • CFilter-Id
   • DFramed-IP-Address
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company uses Cisco Catalyst 9800 WLCs and ISE. The executive team's VoIP calls must receive higher priority than other traffic on the same SSID. The executives are in a specific AD group. Which configuration is required to ensure their traffic is marked with the appropriate QoS level?

   • AConfigure a static ACL on the WLC that matches the executives' IP addresses and sets the DSCP value to EF.
   • BOn the WLC, create a new SSID for executives and enable WMM with Platinum QoS on that SSID.
   • CIn ISE, create a policy that assigns the executives to a different VLAN and configure that VLAN's switchport with a higher QoS trust setting.
   • DIn ISE, create an authorization profile for the executive group that includes the 'WMM U-APSD' and 'QoS Level' attributes, setting the QoS level to 'Platinum'.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company uses a centralized WLC (Cisco 9800) with CAPWAP and ISE. They want to provide different QoS levels to different user groups on the same SSID. The executives should get 'Platinum' QoS, and regular employees should get 'Gold' QoS. The ISE authorization policies are correctly configured. However, all users are receiving 'Gold' QoS. What is the most likely cause?

   • AThe executives' supplicants are not configured to request the correct QoS level.
   • BThe WLC is not configured with 'AAA Override' enabled.
   • CThe authorization profile for the executives does not include the 'QoS Level' attribute, or it is set to 'Gold' instead of 'Platinum'.
   • DThe WLC has a static QoS profile configured for the SSID that overrides the RADIUS-returned QoS.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company uses a centralized WLC with CAPWAP and ISE. Employees authenticate via 802.1X and must be placed in VLAN 10. Guests authenticate via the guest portal and must be placed in VLAN 20. Both groups use the same SSID. What must be configured on the WLC to support this?

   • ACreate two WLANs with different SSIDs and map each to the desired VLAN.
   • BUse the WLC's local user database to assign VLANs based on the username.
   • CConfigure the WLAN with a static VLAN and use ISE to send a VLAN name in the Access-Accept.
   • DEnable AAA Override on the WLAN and configure ISE to return the appropriate VLAN for each identity.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hospital uses a centralized WLC with CAPWAP and Cisco ISE. Contractors authenticate via MAB (MAC Authentication Bypass) and are placed in a 'Contractor' VLAN. The hospital's security policy requires that contractors can only reach the internet and the guest registration portal, not internal hospital resources. Which ISE authorization profile configuration should be used to enforce this?

   • ASet the 'per-user ACL' attribute in the authorization profile to 'none' and configure the firewall to block internal traffic.
   • BAssign the contractor VLAN and rely on the VLAN's access control list (VACL) configured on the upstream switch.
   • CConfigure a static ACL on the WLC and apply it to the contractor SSID.
   • DReturn a downloadable ACL (dACL) that permits only HTTP/HTTPS to the internet and the portal, and denies all other traffic.
   Reveal Solution Discussion Select an answer first