Cisco CCNP Enterprise 300-430 Questions & Answers

• Question 191:

  An engineer must implement rogue containment for an SSID. What is the maximum number of APs that should be used for containment?

  A. 1

  B. 2

  C. 3

  D. 4

  Correct Answer: D

  An individual rogue device can be contained by 1 to 4 managed APs which work in conjunction to mitigate the threat temporarily. https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/112045-handling-rogue-cuwn-00.html

• Question 192:

  What is the default IEEE 802.1x AP authentication configuration on a Cisco Catalyst 9800 Series Wireless Controller?

  A. EAP-PEAP with 802.1x port authentication

  B. EAP-TLS with 802.1x port authentication

  C. EAP-FAST with CAPWAP DTLS + port authentication

  D. EAP-FAST with CAPWAP DTLS

  Correct Answer: C

  https://www.cisco.com/c/en/us/td/docs/wireless/controller/ewc/1612/configguide/ewc_cg_16_12/ 802_1x_support.pdf

• Question 193:

  When using a Cisco Catalyst 9800 Series Wireless Controller, which statement about AutoQoS is true?

  A. It has a set of predefined profiles that you cannot modify further

  B. It matches traffic and assigns each matched packet to QoS groups

  C. It automates deployment of wired QoS and makes wireless QoS implementation easier

  D. It allows the output policy map to put specific QoS queues into specific subgroups

  Correct Answer: B

• Question 194:

  On a branch office deployment, it has been noted that if the FlexConnect AP is in standalone mode and loses connection to the WLC, all clients are disconnected, and the SSID is no longer advertised. Considering that FlexConnect local switching is enabled, which setting is causing this behavior?

  A. ISE NAC is enabled

  B. 802.11r Fast Transition is enabled

  C. Client Exclusion is enabled

  D. FlexConnect Local Auth is disabled

  Correct Answer: D

• Question 195:

  Refer to the exhibit.

  

  An engineer must connect a fork lift via a WGB to a wireless network and must authenticate the WGB certificate against the RADIUS server. Which three steps are required for this configuration? (Choose three.)

  A. Configure the certificate, WLAN, and radio interface on WGB.

  B. Configure the certificate on the WLC.

  C. Configure WLAN to authenticate using ISE.

  D. Configure the access point with the root certificate from ISE.

  E. Configure WGB as a network device in ISE.

  F. Configure a policy on ISE to allow devices to connect that validate the certificate.

  Correct Answer: ACF

  A. Configure the certificate, WLAN, and radio interface on WGB. --> That's true

  B. Configure the certificate on the WLC. --> Nope, the WLC is the authenticator, it is neither authenticated or needs to authenticate anything C. Configure WLAN to authenticate using ISE. --> True, on the controller the SSID to which the WGB will connect must be configured, and broadcasted by the LAP D. Configure the access point with the root certificate from ISE. --> If they are talking about the WGB access point, then that's true, the root certificate that signed ISE certificate needs to be installed in the WGB AP E. Configure WGB as a network device in ISE. --> That's surely wrong. The WGB is not the authenticator in the dot1x process. It is the client. The controller is the authenticator. F. Configure a policy on ISE to allow devices to connect that validate the certificate. --> As I understand it, in some ways, that's true. We need to create an authentication/authorization policy on ISE so that the WGB AP will be authenticated by ISE based on the its certificate.

• Question 196:

  A network engineer observes a spike in controller CPU overhead and overall network utilization after multicast is enabled on a controller with 500 APs. Which feature connects the issue?

  A. controller IGMP snooping

  B. multicast AP multicast mode

  C. broadcast forwarding

  D. unicast AP multicast mode

  Correct Answer: B

  Note: The question is about the reason behind CPU hike, it is not asking the solution for the issue https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/81671-multicast-wlc-lap.html

• Question 197:

  An engineer is performing a Cisco Hyperlocation accuracy test and executes the cmxloc start command on Cisco CMX. Which two parameters are relevant? (Choose two.)

  A. X, Y real location

  B. client description

  C. AP name

  D. client MAC address

  E. WLC IP address

  Correct Answer: AD

  https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/88/b_ap_4800_hyperlocatio n_deployment_guide.html

• Question 198:

  Which two steps are needed to complete integration of the MSE to Cisco Prime Infrastructure and be able to track the location of clients/rogues on maps? (Choose two.)

  A. Synchronize access points with the MSE.

  B. Add the MSE to Cisco Prime Infrastructure using the CLI credentials.

  C. Add the MSE to Cisco Prime Infrastructure using the Cisco Prime Infrastructure communication credentials configured during set up.

  D. Apply a valid license for Wireless Intrusion Prevention System.

  E. Apply a valid license for location tracking.

  Correct Answer: CE

  https://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/33/user/guide/bk_CiscoPr imeInfrastructure_3_3_0_UserGuide/bk_CiscoPrimeInfrastructure_3_3_0_UserGuide_chapter_0100110.html

• Question 199:

  Which two events are outcomes of a successful RF jamming attack? (Choose two.)

  A. disruption of WLAN services

  B. unauthentication association

  C. deauthentication broadcast

  D. deauthentication multicast

  E. physical damage to AP hardware

  Correct Answer: AE

  https://www.cisco.com/c/en/us/td/docs/wireless/mse/3350/72/wIPS_Configuration/Guide/wIPS_7 2/ msecg_appA_wIPS.html#wp1345929

• Question 200:

  An IT team is growing quickly and needs a solution for management device access. The solution must authenticate users from an external repository instead of the current local on the WLC, and it must also identify the user and determine what level of access users should have.

  Which protocol do you recommend to achieve these goals?

  A. network policy server

  B. RADIUS

  C. TACACS+

  D. LDAP

  Correct Answer: C

  https://www.cisco.com/c/en/us/td/docs/switches/lan/Denali_161/ConfigExamples_Technotes/Techzone_Articles/Example_and_Technotes_Denali_16_1_1/Example_and_Technotes_ Denali_16_1_1_chapter_010110.pdf https:// community.cisco.com/t5/wireless-mobility-documents/wlc-and-acs-5-x-tacacs-configuration-example-web-authentication/ta-p/3120681