A company is deploying wireless in a cloud-managed architecture (e.g., Meraki). They want to implement identity-based networking where users are assigned to different VLANs based on their AD group. The wireless clients authenticate via 802.1X with ISE. What is the primary mechanism to achieve this?

The client's supplicant sends the VLAN ID to the AP during authentication.

The upstream switch assigns the VLAN based on the MAC address of the client.

The cloud controller assigns the VLAN based on the user's IP address after authentication.

ISE returns the VLAN ID in the RADIUS Access-Accept, and the cloud-managed AP applies it to the client's session.

A hospital uses a centralized WLC with CAPWAP and Cisco ISE. Doctors authenticate with 802.1X and must be placed in VLAN 50, while guest users authenticate via the guest portal and must be placed in VLAN 60. The SSID is shared by both groups. Which configuration is required on the WLC to achieve the VLAN assignment?

Enable AAA Override on the WLAN and configure the RADIUS server to return a VLAN attribute in the Access-Accept.

Create two separate WLANs with different SSIDs and map each to the desired VLAN.

Configure the SSID with a static VLAN and rely on the RADIUS server to send a VLAN name in the Access-Accept.

Use the WLC's local user database to assign VLANs based on the username.

A company is deploying wireless in a Software-Defined Access (SD-Access) fabric. They want to implement identity-based networking where users are assigned to a specific virtual network (VN) and scalable group (SGT) based on their identity. Which component is responsible for translating the user's identity into the VN and SGT assignment?

The DNA Center, which directly configures the VLAN on the access switch after authentication.

The wireless LAN controller, which maps the user's IP address to a VN based on a static table.

The fabric border node, which assigns the SGT based on the user's source IP address.

Cisco ISE, which returns the SGT and VN information in the RADIUS Access-Accept to the fabric edge node.

A university uses Cisco Catalyst 9800 WLCs with Cisco ISE for 802.1X authentication. The registrar's office staff must be placed in VLAN 20, while all other authenticated staff must be in VLAN 10. Both groups authenticate against the same Active Directory domain. The wireless LAN is configured with a single SSID. Which ISE configuration change is required to achieve this VLAN separation?

Modify the WLC's AAA server configuration to use a different shared secret for the registrar's office group.

Create a new RADIUS server entry on the WLC pointing to a different ISE node for the registrar's office.

Create two separate authorization profiles, each returning a different VLAN ID, and map them to the appropriate AD groups in authorization policies.

Configure two different SSIDs, one for the registrar's office and one for all other staff, each with a static VLAN assigned.

A company uses a centralized WLC (Cisco 9800) with CAPWAP. They want to apply a per-user QoS policy based on the user's identity. The policy should limit the bandwidth for guest users but not for employees. Both groups use the same SSID. What is the correct configuration?

On the WLC, configure a static ACL that matches the guest IP range and applies a bandwidth limit.

In ISE, create a policy that assigns guests to a different VLAN and configure the VLAN's switchport with a bandwidth limit.

In ISE, create two authorization profiles: one for guests with a 'QoS Level' of 'Bronze' and one for employees with a 'QoS Level' of 'Gold'.

On the WLC, create two SSIDs, one for guests and one for employees, and configure different QoS profiles on each.

CiscoCertified Network Professional Enterprise Wireless (ENWLSI)

Domain 6Objective 4

6.4 Implement Identity-Based Networking on Different Wireless Architectures (VLANs, QoS, ACLs) 300-430 Practice Questions (Page 8)

Part of the Security for Wireless Client Connectivity domain, which accounts for 20% of the 300-430 exam. Cisco does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

20%of the exam

10 Concepts in This Objective

Identity-Based Networking Overview
Identity Sources and Authentication
VLAN Assignment Based on Identity
QoS Policies Based on Identity
ACL Enforcement Based on Identity
Identity-Based Networking on Centralized Architectures
Identity-Based Networking on Converged Architectures
Identity-Based Networking on Cloud and SD-Access
Integration with AAA and Policy Servers
Troubleshooting Identity-Based Networking

Questions 36–40

36application · medium
A company is deploying wireless in a cloud-managed architecture (e.g., Meraki). They want to implement identity-based networking where users are assigned to different VLANs based on their AD group. The wireless clients authenticate via 802.1X with ISE. What is the primary mechanism to achieve this?
Select an answer first
37application · medium
A hospital uses a centralized WLC with CAPWAP and Cisco ISE. Doctors authenticate with 802.1X and must be placed in VLAN 50, while guest users authenticate via the guest portal and must be placed in VLAN 60. The SSID is shared by both groups. Which configuration is required on the WLC to achieve the VLAN assignment?
Select an answer first
38application · medium
A company is deploying wireless in a Software-Defined Access (SD-Access) fabric. They want to implement identity-based networking where users are assigned to a specific virtual network (VN) and scalable group (SGT) based on their identity. Which component is responsible for translating the user's identity into the VN and SGT assignment?
Select an answer first
39application · medium
A university uses Cisco Catalyst 9800 WLCs with Cisco ISE for 802.1X authentication. The registrar's office staff must be placed in VLAN 20, while all other authenticated staff must be in VLAN 10. Both groups authenticate against the same Active Directory domain. The wireless LAN is configured with a single SSID. Which ISE configuration change is required to achieve this VLAN separation?
Select an answer first
40application · medium
A company uses a centralized WLC (Cisco 9800) with CAPWAP. They want to apply a per-user QoS policy based on the user's identity. The policy should limit the bandwidth for guest users but not for employees. Both groups use the same SSID. What is the correct configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 300-430

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “300-430” is a trademark of its owner, used for identification only.

6.4 Implement Identity-Based Networking on Different Wireless Architectures (VLANs, QoS, ACLs) 300-430 Practice Questions (Page 8)

Questions 36–40

A company is deploying wireless in a cloud-managed architecture (e.g., Meraki). They want to implement identity-based networking where users are assigned to different VLANs based on their AD group. The wireless clients authenticate via 802.1X with ISE. What is the primary mechanism to achieve this?

A company uses a centralized WLC (Cisco 9800) with CAPWAP. They want to apply a per-user QoS policy based on the user's identity. The policy should limit the bandwidth for guest users but not for employees. Both groups use the same SSID. What is the correct configuration?

Keep studying — Security for Wireless Client Connectivity