5.5 Implement wIPS Using Cisco Catalyst Center (formerly Cisco DNA Center) 300-430 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company wants to automatically block a user from the network when wIPS detects a severe attack from that user's device. The company uses Cisco ISE for NAC. They also want to maintain a record of the event for compliance. What is the best way to achieve this?

   • AEnable ISE pxGrid and configure a policy to quarantine the device
   • BSend alarms to a syslog server for compliance
   • CManually block the device in the controller
   • DUse Stealthwatch to block the device
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A hospital is deploying wIPS using Catalyst Center. They want to monitor for rogue access points and wireless attacks in the patient-care areas, but those areas have high client density and limited available APs. They cannot afford to dedicate APs solely for monitoring. Which deployment mode should they use for the APs in these areas?

   • AMonitor mode on the 5 GHz radio and client service on the 2.4 GHz radio
   • BHybrid mode with a wIPS profile that enables monitoring on the same radio as client service
   • CDedicated monitor mode with a separate wIPS profile for full-spectrum analysis
   • DMonitor mode with a custom signature set that only detects rogues
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to automatically quarantine a user's device when wIPS detects a severe wireless attack originating from that device. The company already uses Cisco ISE for network access control. What should you configure in Catalyst Center to achieve this integration?

   • AConfigure an external syslog server to forward alarms
   • BUse the Catalyst Center REST API to manually trigger quarantine
   • CSet up an ISE pxGrid integration and create a policy to respond to wIPS alarms
   • DEnable Stealthwatch integration to send flow data
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What role does Cisco Stealthwatch play when integrated with Catalyst Center wIPS?

   • AIt provides deep packet inspection of wireless traffic to detect application-layer threats.
   • BIt analyzes network flows to provide broader context for security incidents detected by wIPS.
   • CIt manages the wIPS signatures and rules on the access points.
   • DIt acts as a wireless intrusion prevention system itself.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A bank is using Catalyst Center wIPS and receives an alarm for a 'rogue AP' that is broadcasting the corporate SSID. The security team wants to automatically block the rogue AP and also notify the network administrator. They have ISE integrated with Catalyst Center. What should they do?

   • AConfigure the wIPS alarm action to send an email and automatically contain the rogue AP via the wireless controller
   • BUse ISE to quarantine the rogue AP's MAC address
   • CUse Stealthwatch to block the rogue AP's traffic
   • DManually locate the rogue AP using the wIPS report and then block it on the firewall
   Reveal Solution Discussion Select an answer first