6.4 Implement Identity-Based Networking on Different Wireless Architectures (VLANs, QoS, ACLs) 300-430 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does a wireless controller determine which VLAN to assign to a client after successful 802.1X authentication?

   • AFrom the client's DHCP request
   • BFrom the RADIUS Access-Accept message's tunnel attributes (e.g., Tunnel-Private-Group-ID)
   • CFrom the VLAN ID configured in the SSID's static VLAN setting
   • DFrom the access point's local configuration
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization uses Catalyst 9800 embedded wireless controllers in a converged access architecture. They want to implement identity-based networking where users are dynamically assigned to VLANs based on their AD group. The wireless clients authenticate via 802.1X. What is the primary difference in how VLAN assignment is handled compared to a centralized CAPWAP architecture?

   • AThe Catalyst 9800 uses the RADIUS-returned VLAN to program the local switching decision, and the VLAN is applied directly to the client's session on the embedded controller.
   • BThe VLAN is assigned via a downloadable ACL (dACL) instead of a VLAN ID.
   • CThe 9800 does not support dynamic VLAN assignment; it requires a static VLAN per SSID.
   • DThe VLAN assignment is performed by the upstream switch, and the 9800 only forwards the RADIUS attributes to it.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company uses a centralized WLC with CAPWAP and ISE. Employees authenticate via 802.1X and must be placed in VLAN 10, while guests authenticate via the guest portal and must be placed in VLAN 20. Both groups use the same SSID. The administrator has enabled AAA Override on the WLAN. What else must be configured to ensure the VLAN assignment works?

   • ACreate two WLANs with different SSIDs and map each to the desired VLAN.
   • BConfigure the WLAN with a static VLAN and use ISE to send a VLAN name in the Access-Accept.
   • CEnsure ISE returns the correct VLAN attribute for each identity in the Access-Accept.
   • DUse the WLC's local user database to assign VLANs based on the username.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company uses Catalyst 9800 embedded wireless controllers in a converged access architecture. They need to apply different ACLs to different user groups on the same SSID. The ACLs are defined on the 9800. How should the ACL be applied to the user's session?

   • AISE returns the ACL name in the RADIUS Access-Accept, and the 9800 applies the ACL to the client's session.
   • BThe upstream switch applies the ACL based on the VLAN assigned by the 9800.
   • CThe client's supplicant applies the ACL locally on the device.
   • DThe 9800 applies a static ACL to the SSID, and all users on that SSID receive the same ACL.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A university uses a centralized WLC and ISE. Students and faculty connect to the same SSID. Faculty must be able to reach administrative servers, while students must be blocked from those servers. ISE has already been configured to return the appropriate authorization profile. What must be configured on the WLC to enforce the per-user ACL?

   • AConfigure the WLAN to use the same VLAN for all users and rely on the firewall to filter traffic.
   • BCreate two WLANs with different SSIDs and apply different ACLs.
   • CApply a static ACL to the WLAN and map it to the SSID.
   • DEnable AAA Override and configure the WLAN to accept the downloadable ACL from RADIUS.
   Reveal Solution Discussion Select an answer first