Cisco CCNP Enterprise 300-430 Questions & Answers

• Question 41:

  An engineer is ensuring that, on the IEEE 802.1X wireless network, clients authenticate using a central repository and local credentials on the Cisco WLC. Which two configuration elements must be completed on the WLAN? (Choose two.)

  A. TACACS+

  B. MAC authentication

  C. local EAP enabled

  D. web authentication

  E. LDAP server

  Correct Answer: CE

• Question 42:

  An engineer is designing a high availability wireless network. What mechanism should be the focus for high availability?

  A. SNR

  B. channel reuse

  C. RSSI

  D. cell overlap

  Correct Answer: D

• Question 43:

  Refer to the exhibit.

  

  An engineer configured a BYOD policy that allows for printing on the WLAN using Bonjour services. However, the engineer cannot get printing to work. The WLC firmware is 8.x. What must be implemented on the controller?

  A. Enable mDNS and IGMP snooping.

  B. Activate location-specific services.

  C. Configure Secure Web Mode Cipher-Option SSLv2.

  D. Increase the IGMP Query Interval value

  Correct Answer: A

  To apply mDNS policy, mDNS snooping is required. https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/multicast_broadcast_setup.html#concept_D4C479155D1A4024804CA7230E939D87

• Question 44:

  WPA2 Enterprise with 802.1X is being used for clients to authenticate to a wireless network through a Cisco ISE server. For security reasons, the network engineer wants to ensure that only PEAP authentication is used. The engineer sent instructions to clients on how to configure the supplicants, but the ISE logs still show users authenticating using EAP-FAST. Which action ensures that access to the network is restricted for these users unless the correct authentication mechanism is configured?

  A. Enable AAA override on the SSID, gather the usernames of these users, and disable the RADIUS accounts until the devices are correctly configured.

  B. Enable AAA override on the SSID and configure an ACL on the WLC that allows access to users with IP addresses from a specific subnet.

  C. Enable AAA override on the SSID and configure an access policy in Cisco ISE that denies access to the list of MACs that have used EAP-FAST.

  D. Enable AAA override on the SSID and configure an access policy in Cisco ISE that allows access only when the EAP authentication method is PEAP.

  Correct Answer: D

• Question 45:

  A wireless administrator must assess the different client types connected to Cisco Catalyst 9800 Series Wireless Controller without using any external servers. Which configuration must be added to the controller to achieve this assessment?

  A. native profile

  B. MAC classification

  C. local profile

  D. device classification

  Correct Answer: D

  Source: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215661-in-depth-look-into-client-profiling-on-9.html and logging into my own 9800.

• Question 46:

  A company wants to switch to BYOD to reduce IT support costs for the company. Which option is an impact of BYOD should be considered?

  A. increased VPN connections

  B. restricted device enforcement

  C. increased phishing attacks

  D. decreased support calls

  Correct Answer: A

• Question 47:

  Which EAP method can an AP use to authenticate to the wired network?

  A. EAP-GTC

  B. EAP-MD5

  C. EAP-TLS

  D. EAP-FAST

  Correct Answer: D

• Question 48:

  An engineer is troubleshooting a Cisco CMX high-availability deployment and notices that the primary and backup Cisco CMX servers are both considered primary. Which command must the engineer run on the backup server?

  A. cmxha convert backup

  B. cmxha backup convert

  C. cmxha secondary convert

  D. cmxha convert secondary

  Correct Answer: C

  cmxha secondary{ convert | info } https://www.cisco.com/c/en/us/td/docs/wireless/mse/10-3/cmx_command/cmxcli103.pdf

• Question 49:

  You are configuring the social login for a guest network. Which three options are configurable social connectors in Cisco CMX Visitor Connect? (Chose three)

  A. Linkedn

  B. Pinterest

  C. Medium

  D. Google+

  E. Facebook

  F. Myspace

  Correct Answer: ADE

• Question 50:

  Refer to the exhibit.

  

  A network architect configured the Cisco Catalyst 9800 Series Controller to find out information on client types in the wireless network. RADIUS profiling is enabled so that the controller forwards the information about clients to a Cisco ISE server through vendor- specific RADIUS attributes. The ISE server is not profiling any data from the controller. Which configuration must be added in the blank in the code to accomplish the profiling on the Cisco 9800 Series controller?

  A. aaa accounting identity acct_method start-stop group rad-group

  B. aaa accounting network acct_method start-stop group rad-group

  C. aaa accounting exec acct_method start-stop group rad-group

  D. aaa accounting commands acct_method start-stop group rad-group

  Correct Answer: A

  https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215661-in-depth-look-into-client-profiling-on-9.html#anc12