4.5 Guest Lifecycle Management Using Cisco ISE and Cisco WLC CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A university wants to offer guest Wi-Fi for visitors. They want to use a MAC address-based authentication method for devices that have been pre-registered by the IT department, while other devices should be redirected to a web portal for self-registration. What is the best approach?

   • AConfigure the WLAN with 802.1X for all devices.
   • BConfigure the WLAN with open authentication and rely on the WLC's local MAC filter.
   • CConfigure the WLAN with WebAuth only, and ignore MAC filtering.
   • DConfigure the WLAN with MAC filtering as the first authentication method and WebAuth as a fallback.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A coffee shop chain wants to provide free Wi-Fi to customers, but they want to limit each guest to 2 Mbps download speed and block peer-to-peer traffic. They are using Cisco ISE and WLC. What should be configured?

   • ASet the guest account to have a maximum session time of 2 hours, and rely on the ISP to block peer-to-peer.
   • BConfigure the bandwidth limit and ACL directly on the WLC for the guest SSID.
   • CIn ISE authorization policy, assign a bandwidth limit of 2 Mbps and an ACL that blocks peer-to-peer traffic.
   • DUse a local VLAN on the WLC with a bandwidth limit, and block peer-to-peer using a firewall.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's guest Wi-Fi is not working. Guests can connect to the SSID but are not being redirected to the login portal. The WLC is configured for WebAuth and RADIUS to ISE. What should you check first?

   • ACheck the guest account expiration policy in ISE.
   • BCheck the WLC's RF channel settings.
   • CCheck the WLC's WebAuth configuration and the RADIUS server settings to ensure the portal URL is correct and ISE is reachable.
   • DCheck the guest's device for malware.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A manufacturing company wants to implement a guest lifecycle for visitors. They want a sponsor to create an account for each visitor, the visitor to use the account for the day, and the account to be automatically removed after 24 hours. Which sequence of steps should be implemented?

   • ASponsor creates account → guest authenticates via portal → account expires after 24 hours → ISE automatically deletes the account.
   • BGuest self-registers → sponsor approves → guest accesses → account is manually deleted by sponsor.
   • CSponsor creates account → guest accesses → account never expires → sponsor deletes it manually.
   • DGuest uses social login → account is created automatically → expires after 24 hours.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A law firm wants to provide guest Wi-Fi to clients. They want to limit each guest to a maximum of 2 concurrent sessions and an idle timeout of 15 minutes. They also want to assign guests to a restricted VLAN. Where should these settings be configured?

   • AConfigure the guest account policy in ISE, but assign the VLAN using a DHCP option.
   • BConfigure the guest account policy on the guest's device.
   • CConfigure the WLC with maximum sessions and idle timeout, and the VLAN on the WLC.
   • DConfigure the guest account policy in ISE with maximum sessions and idle timeout, and the authorization policy for VLAN assignment.
   Reveal Solution Discussion Select an answer first