6.4 Implement Identity-Based Networking on Different Wireless Architectures (VLANs, QoS, ACLs) 300-430 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company uses a Catalyst 9800 controller and ISE. Voice clients must receive higher QoS priority than regular data clients on the same SSID. ISE has been configured to return the appropriate QoS attributes. Which configuration on the Catalyst 9800 is required to apply the per-user QoS policy?

   • AConfigure the switch port to trust the DSCP value from the client.
   • BEnable AAA Override on the WLAN and configure the RADIUS server to return the QoS attributes.
   • CUse the WLAN's per-SSID QoS setting and assign it to the voice VLAN.
   • DConfigure the WLAN with a static QoS profile and apply it to all clients.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How does a wireless controller apply an ACL that is returned by a RADIUS server during authentication?

   • AThe controller downloads the ACL from the RADIUS server and applies it to the client's traffic
   • BThe client installs the ACL locally on its operating system
   • CThe ACL is applied only to the RADIUS server's traffic
   • DThe access point applies the ACL to the wireless medium
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is a characteristic of cloud-managed wireless architectures (e.g., Cisco Meraki) regarding identity-based networking?

   • AThe architecture requires an on-premises wireless controller
   • BIdentity-based policies are not supported
   • CAll authentication is done locally on the access point without any external server
   • DPolicies are configured and managed from a cloud dashboard and pushed to the access points
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company uses a Catalyst 9800 embedded wireless controller and ISE. Employees authenticate with 802.1X and must be placed in VLAN 10, while contractors authenticate with MAB and must be placed in VLAN 20. Both groups connect to the same SSID. What must be configured on the Catalyst 9800 to achieve this?

   • ACreate two WLANs with different SSIDs and map each to the desired VLAN.
   • BUse the Catalyst 9800's local user database to assign VLANs based on the MAC address.
   • CConfigure the WLAN with a static VLAN and use ISE to send a VLAN name in the Access-Accept.
   • DEnable AAA Override on the WLAN and configure ISE to return the appropriate VLAN for each identity.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A manufacturing plant uses a Catalyst 9800 WLC and ISE. They have IoT devices (e.g., sensors) that do not support 802.1X. These devices must be placed in a separate 'IoT' VLAN and be denied access to the corporate network. Which authentication method and ISE policy should be used?

   • AUse MAC Authentication Bypass (MAB) and create an ISE authorization profile that returns the 'IoT' VLAN and a dACL that denies access to corporate subnets.
   • BCreate a static DHCP reservation for each device and assign the 'IoT' VLAN based on IP address.
   • CUse Web Authentication (WebAuth) and have the devices authenticate via a captive portal.
   • DUse 802.1X with a machine certificate and place the devices in the 'IoT' VLAN.
   Reveal Solution Discussion Select an answer first