I85PREP
⌘ K
ENWLSI 300-430 study materials
ENWLSI 300-430 study resources

ENWLSI 300-430 practice questions

One question at a time. Build your ENWLSI 300-430 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Implementing a Wireless Network

In a Cisco Catalyst 9800 Series wireless controller, which command creates a policy profile that can be attached to a WLAN so client traffic is mapped to a specific VLAN?

  1. wireless profile policy <name> Correct answer.
  2. ap profile <name>
  3. wlan <name> <id>
  4. wireless profile flex <name>

Explanation

Policy profiles on the Catalyst 9800 hold the VLAN interface mapping, session timeout, and other per-client settings, and are created under wireless profile policy. A WLAN then references the policy profile with the policy <name> command inside the wlan configuration.

Question 2Implementing a Wireless Network

An engineer wants a Catalyst 9800 to use a locally configured management user account for web login instead of an external AAA server. Which configuration area must be enabled?

  1. Local EAP profile
  2. TACACS+ server group with a fallback
  3. RADIUS server group with the local server type
  4. Local netuser with the management user type Correct answer.

Explanation

Local management accounts on the 9800 are created with the username ... privilege ... command, which stores them as local netusers. The web authentication configuration must permit local users for those credentials to be accepted for GUI access.

Question 3Implementing a Wireless Network

Which Catalyst 9800 command displays the current mobility peer relationships and their tunnel status?

  1. show wireless client summary
  2. show ap summary
  3. show wireless mobility summary Correct answer.
  4. show redundancy summary

Explanation

The show wireless mobility summary command lists configured mobility peers, their IP addresses, and whether the data tunnel is up. It is the first check when validating mobility group formation.

Question 4Implementing a Wireless Network

Which protocol and port does a Catalyst 9800 use by default to establish the Control and Provisioning of Wireless Access Points connection with a Wave 2 access point?

  1. CAPWAP over TCP 5246 and TCP 5247
  2. LWAPP over UDP 12222 and 12223
  3. CAPWAP over UDP 5246 for control and UDP 5247 for data Correct answer.
  4. Mobility over UDP 16666 and 16667

Explanation

CAPWAP separates control traffic on UDP 5246 from encapsulated data traffic on UDP 5247. Both must be permitted through any firewall between the AP management subnet and the controller.

Question 5Implementing a Wireless Network

A guest WLAN must present users with a web portal where they accept a policy before gaining access, with no per-user credentials. Which Layer 3 security setting on the WLAN achieves this?

  1. Web policy with consent Correct answer.
  2. Static WEP
  3. 802.1X
  4. Web policy with authentication

Explanation

A web policy with consent intercepts HTTP traffic and shows a page requiring the user to accept the policy, after which the client is placed in the run state. No credentials are validated, which matches the guest requirement.

Question 6Implementing a Wireless Network

Which command on a Catalyst 9800 enables a specific access point to be added to the controller's AP authorization list so that only approved APs may join?

  1. ap name <name> no-shutdown
  2. wireless profile ap <name>
  3. ap auth-list ap-policy authorize Correct answer.
  4. ap dot11 5ghz shutdown

Explanation

The ap auth-list ap-policy authorize command turns on AP authorization, after which APs must be explicitly added to the authorization list. APs not on the list are denied join even if they can reach the controller.

Question 7Implementing a Wireless Network

Which two elements are required to configure a WLAN for WPA2 Enterprise with 802.1X on a Catalyst 9800? (Choose the best single answer.)

  1. A WLAN with PSK security and a local netuser
  2. A WLAN with dot1x security and an AAA server group referenced by the WLAN Correct answer.
  3. A WLAN with SAE security and a preshared key
  4. A WLAN with open security and a web consent policy

Explanation

WPA2 Enterprise requires the WLAN to use dot1x akm and a dot1x security configuration, plus an authentication server group that points to the RADIUS server. Without the AAA reference the controller has no server to validate supplicant credentials.

Question 8Implementing a Wireless Network

An engineer needs clients on a specific WLAN to be locally switched by a FlexConnect AP at a branch site. Which setting must be configured on the policy profile?

  1. Set the interface to a VLAN and enable central switching
  2. Set the interface to a loopback and enable central association
  3. Set the interface to a VLAN and disable central switching Correct answer.
  4. Set the interface to the management interface and enable central DHCP

Explanation

Locally switched traffic on a FlexConnect AP requires the policy profile to disable central switching and reference the VLAN interface used at the branch. The AP then bridges client traffic onto the local VLAN.

Question 9Implementing a Wireless Network

A Catalyst 9800 pair is configured for high availability with SSO. Which statement describes client state behavior during a controller failover?

  1. Client state is synchronized so clients remain associated and traffic continues Correct answer.
  2. Only guest clients are preserved across the failover
  3. All clients must reauthenticate because state is not synchronized
  4. Client state is preserved only if mobility is also configured

Explanation

In an SSO high-availability pair the active and standby controllers synchronize client and AP state. On switchover the standby takes over and clients stay associated without reauthentication.

Question 10Implementing a Wireless Network

Which Catalyst 9800 feature allows an engineer to apply a QoS policy to traffic from a specific application seen on a WLAN using AVC?

  1. FlexConnect VLAN-based central switching
  2. Application visibility and control with a QoS policy applied to the WLAN Correct answer.
  3. AP authorization list
  4. Mobility anchor with auto-anchor

Explanation

AVC classifies traffic by application, and a QoS policy attached to the WLAN or policy profile can then mark or police that traffic. This lets the network treat business applications differently from bulk traffic.

Question 11Implementing a Wireless Network

A wireless engineer wants to verify that a client has been placed in the RUN state after completing web authentication. Which command provides the client's current state?

  1. show interface summary
  2. show ap config general
  3. show wireless client summary Correct answer.
  4. show wireless mobility summary

Explanation

The show wireless client summary output includes each client's state, such as WEBAUTH_REQD or RUN. A client in RUN has completed the web policy step and is allowed to pass traffic.

Question 12Implementing a Wireless Network

Which protocol does a Catalyst 9800 use by default for RADIUS accounting of wireless clients, and which message type reports the start of a session?

  1. TACACS+ with a start record
  2. RADIUS Accounting-Request with Acct-Status-Type Start Correct answer.
  3. Syslog message with severity 6
  4. SNMP trap with a session start OID

Explanation

RADIUS accounting sends an Accounting-Request with Acct-Status-Type set to Start when a client session begins, and Stop when it ends. The controller must have accounting enabled on the WLAN and a reachable RADIUS server.

Question 13Implementing a Wireless Network

An engineer is deploying a Catalyst 9800 in a DMZ to serve guest clients while internal clients terminate on an internal controller. Which mobility configuration supports guest traffic anchored to the DMZ controller?

  1. Configure the DMZ controller as a foreign controller and the internal as the anchor
  2. Disable mobility and use FlexConnect local switching
  3. Configure the DMZ controller as a mobility anchor and the internal controller as the foreign controller Correct answer.
  4. Configure both controllers as foreign controllers

Explanation

Guest anchoring requires the controller with the guest WLAN to be the foreign controller and the DMZ controller to be the mobility anchor. Client traffic is tunneled to the anchor, where the guest VLAN and policy live.

Question 14Implementing a Wireless Network

Which command is used on a Catalyst 9800 to capture a packet trace for a specific client for troubleshooting?

  1. monitor capture start
  2. show wireless client mac-address <mac> detail
  3. debug wireless client <mac> Correct answer.
  4. epc client <mac>

Explanation

The debug wireless client <mac> command enables a targeted client trace on the 9800, which can then be exported for analysis. It limits output to the specified client so that logs stay readable.

Question 15Implementing a Wireless Network

A FlexConnect AP at a branch loses its WAN link to the controller. Which statement describes client behavior if the WLAN is configured for local switching and local authentication?

  1. Clients immediately lose connectivity because the CAPWAP tunnel is down
  2. Clients are forced into web authentication until the WAN returns
  3. Clients remain associated and continue to pass traffic locally Correct answer.
  4. Clients are redirected to the DMZ anchor controller

Explanation

With FlexConnect local switching and local authentication, the AP can authenticate and switch clients without the controller. Existing clients keep their local VLAN connectivity during a WAN outage.

Question 16Implementing a Wireless Network

Which Catalyst 9800 configuration enforces that client traffic on a WLAN is dropped if the client fails posture assessment, while allowing remediation traffic?

  1. Configure a static WEP key
  2. Configure a redirect ACL and a posture policy on the WLAN Correct answer.
  3. Configure an AP authorization list
  4. Configure central switching with a VLAN interface

Explanation

Posture enforcement uses a redirect ACL to send noncompliant clients to a remediation portal and a posture policy to define the required state. Compliant clients are then permitted through the normal ACL.

Question 17Implementing a Wireless Network

Which statement best describes the purpose of the management interface on a Catalyst 9800 when configuring a wireless network?

  1. It is used exclusively for mobility tunnels
  2. It carries only guest client traffic
  3. It is the VLAN interface for locally switched clients
  4. It provides the out-of-band address used for controller management and AP join Correct answer.

Explanation

The management interface is the controller's primary address for GUI, CLI, and AP join, and it must be reachable by the APs. Client VLAN interfaces are separate and are referenced by policy profiles.

Question 18Implementing a Wireless Network

An engineer is configuring a WLAN for WPA3 Enterprise and wants to ensure the strongest default management frame protection. Which setting should be enabled?

  1. Protected Management Frames set to optional
  2. AES with TKIP mixed mode
  3. 802.11r fast transition disabled
  4. Protected Management Frames set to required Correct answer.

Explanation

WPA3 requires protected management frames, so PMF must be set to required on the WLAN. Setting it to optional would allow clients that do not support PMF to associate, weakening the WPA3 guarantee.

Question 19Implementing a Wireless Network

Which command on a Catalyst 9800 is used to reset a specific access point so it rejoins the controller?

  1. ap name <name> reset Correct answer.
  2. clear ap config <name>
  3. reload ap <name>
  4. ap name <name> shutdown

Explanation

The ap name <name> reset command restarts the specified AP, causing it to re-establish its CAPWAP session. This is useful after configuration changes that require a rejoin.

Question 20Implementing a Wireless Network

A client repeatedly associates and then disassociates from a WLAN using 802.1X. Which log or output should the engineer check first to confirm whether the RADIUS server is rejecting the client?

  1. The mobility peer summary
  2. The AP authorization list status
  3. The interface summary counters
  4. The AAA authentication failures shown in the controller's client detail and RADIUS debug output Correct answer.

Explanation

Authentication failures are visible in the client detail output and in RADIUS debug, which shows the Access-Reject and its reason. This distinguishes a credential problem from an RF or DHCP problem.

Question 21Implementing a Wireless Network

Which Catalyst 9800 feature allows an administrator to define a set of VLANs and interfaces that APs in a specific site use for locally switched WLANs?

  1. Mobility anchor list
  2. AP authorization list
  3. Flex profile with VLAN-to-interface mappings Correct answer.
  4. Policy profile with central switching

Explanation

A Flex profile groups FlexConnect settings, including the VLAN-interface mappings and native VLAN, for a site. APs are assigned to the Flex profile so their locally switched WLANs use the correct branch VLANs.

Question 22Implementing a Wireless Network

A Catalyst 9800 is configured with an SSO HA pair, and the engineer notices that after a switchover the standby becomes active but APs do not rejoin. Which factor is the most likely cause?

  1. The mobility group is not configured
  2. The APs cannot reach the new active controller's management address because of a routing or firewall issue Correct answer.
  3. The WLAN is set to local switching
  4. The AP authorization list is disabled

Explanation

In SSO HA the pair shares a virtual address, and APs must be able to reach the active controller after switchover. A routing or firewall problem blocking that path prevents rejoin even though the standby took over correctly.

Question 23Implementing a Wireless Network

An engineer applies an AVC profile to a WLAN but sees no application classification. Which configuration is most likely missing?

  1. The management interface is down
  2. The WLAN is set to open authentication
  3. The APs are in local mode
  4. The AVC profile is not attached to the policy profile, or NetFlow export is not configured Correct answer.

Explanation

AVC classification requires the AVC profile to be attached to the policy profile used by the WLAN, and visibility data is exported via NetFlow to a collector. Without either piece, no application data is reported.

Question 24Implementing a Wireless Network

A FlexConnect AP is configured for local switching, but clients receive no IP address. Which configuration should the engineer verify first?

  1. The mobility anchor list
  2. The AP authorization list
  3. The WPA3 PMF setting
  4. The VLAN-to-interface mapping in the Flex profile and the branch trunk configuration Correct answer.

Explanation

Locally switched clients rely on the AP bridging traffic onto the mapped VLAN, so the Flex profile mapping and the trunk to the AP must both carry that VLAN. A missing mapping or trunk VLAN prevents DHCP from reaching the client.

Question 25Implementing a Wireless Network

An engineer wants to ensure that only clients matching a specific posture result are placed into a restricted VLAN while others use the normal VLAN. Which Catalyst 9800 construct supports this?

  1. A posture policy combined with a redirect ACL and VLAN interface assignment Correct answer.
  2. A static WEP key on the WLAN
  3. An AP authorization list entry
  4. A mobility anchor with auto-anchor

Explanation

Posture policies evaluate client compliance and can direct noncompliant clients to a restricted VLAN or redirect them to remediation. The redirect ACL and VLAN interface assignment implement that restriction.

Question 26Implementing a Wireless Network

On a Catalyst 9800, which interface is used by the controller to source CAPWAP control traffic to access points by default?

  1. The redundancy-port interface
  2. The virtual interface
  3. The management interface Correct answer.
  4. The service-port interface

Explanation

The management interface is the default source for CAPWAP control and data traffic unless an AP is configured with a specific controller name or the global AP fallback is changed. The service port is for out-of-band management, the virtual interface handles client web auth and DHCP relay, and the redundancy port is for HA state.

Question 27Implementing a Wireless Network

An engineer is configuring a Catalyst 9800 WLAN for guest access and wants clients to be redirected to an external web portal before being allowed on the network. Which configuration is required on the WLAN?

  1. Set the WLAN to use web policy with an external web auth type and provide the redirect URL. Correct answer.
  2. Configure the WLAN for static WEP and enable MAC filtering on the guest VLAN.
  3. Enable FlexConnect local switching and assign the guest VLAN to the AP group.
  4. Enable 802.1X with an external RADIUS server and set the default VLAN to the guest VLAN.

Explanation

Web authentication on the Catalyst 9800 is enabled by setting the WLAN web policy to enabled and choosing the web auth type. For an external portal, the web auth type must be external and the redirect URL must point to the portal; the controller then intercepts HTTP/HTTPS and redirects the client.

Question 28Implementing a Wireless Network

A Catalyst 9800 is configured with an SSO HA pair. Which statement describes what happens to client state when the active controller fails over to the standby?

  1. Client entries are synchronized to the standby and remain in their current state after switchover. Correct answer.
  2. Only clients using local switching are maintained; centrally switched clients are dropped.
  3. All clients are deauthenticated and must reassociate with the new active controller.
  4. Clients are moved to a default VLAN until they reauthenticate with the RADIUS server.

Explanation

With SSO HA, the standby controller maintains synchronized client state, including authentication and mobility state, so clients are not forced to reassociate during a switchover. This minimizes disruption and preserves sessions.

Question 29Implementing a Wireless Network

An engineer wants to apply a QoS policy to traffic from a specific application detected by Application Visibility and Control on a Catalyst 9800 WLAN. Which sequence of steps is required?

  1. Enable AVC on the WLAN, create a QoS policy that matches DSCP values, and apply it to the management interface.
  2. Create an AVC profile, attach it to the WLAN, then create a QoS policy that references the AVC application and apply it to the WLAN. Correct answer.
  3. Enable NetFlow on the WLAN, export flows to a collector, and apply QoS based on the collector's classification.
  4. Create a QoS policy that matches the application name, apply it to the AP join profile, and enable AVC on the AP.

Explanation

AVC must first be enabled by attaching an AVC profile to the WLAN so the controller can classify applications. Then a QoS policy can be created with a class that matches the AVC application, and that policy is applied to the WLAN to enforce treatment.

Question 30Implementing a Wireless Network

A FlexConnect AP at a branch is configured for local switching, but wireless clients fail to obtain an IP address. The WLAN is mapped to VLAN 10 and the AP's trunk port allows VLAN 10. Which configuration on the Catalyst 9800 should the engineer verify?

  1. That the WLAN has a FlexConnect local switching VLAN mapping to VLAN 10 in the Flex profile. Correct answer.
  2. That the FlexConnect profile has a native VLAN configured for the AP's management traffic.
  3. That the AP is in local mode and not FlexConnect mode.
  4. That the WLAN is configured with central switching and the management interface is reachable.

Explanation

For locally switched FlexConnect WLANs, the controller must map the WLAN to a VLAN ID in the Flex profile, and the AP must tag client traffic with that VLAN. If the mapping is missing, the AP may forward untagged or incorrect VLAN traffic, preventing DHCP.

Question 31Implementing Cisco Wireless Guest Access

A guest WLAN is configured with web policy authentication and a pre-authentication ACL of GUEST_PREAUTH. Which statement describes what this ACL controls on the controller?

  1. It defines the VLAN pool that guest clients are assigned to after authentication
  2. It filters traffic for clients before they complete web authentication, restricting them to the redirect and DHCP/DNS services Correct answer.
  3. It specifies which RADIUS attributes are returned to the client after successful web login
  4. It filters traffic after the client is fully authenticated and assigned a post-authentication role

Explanation

On a web-policy WLAN, the pre-authentication ACL is applied to the client's traffic while it is still unauthenticated, so it must permit only what is needed to reach the login page (DHCP, DNS, and the redirect target). Once web authentication succeeds, the client moves to a post-authentication state and the pre-auth ACL no longer governs its traffic.

Question 32Implementing Cisco Wireless Guest Access

Which guest deployment model keeps all guest traffic off the enterprise internal network by tunneling client traffic to a dedicated guest anchor controller in a DMZ?

  1. Mobility Express standalone mode
  2. FlexConnect local switching
  3. Auto-anchor mobility (guest tunneling) Correct answer.
  4. Local EAP termination

Explanation

Auto-anchor (guest tunneling) mobility lets the foreign controller build an EoIP tunnel to a guest anchor controller placed in a DMZ, so guest traffic egresses there and never touches internal VLANs. This is the standard design for isolating guest access from corporate resources.

Question 33Implementing Cisco Wireless Guest Access

An administrator wants a guest portal where the controller itself hosts the login page and no external server is required. Which web authentication type should be selected on the WLAN?

  1. Web Passthrough
  2. Web Consent
  3. Central Web Authentication
  4. Web Authentication (internal) Correct answer.

Explanation

The internal web authentication option makes the controller serve the guest login page and validate local guest credentials without an external web server. Web Passthrough and Web Consent use controller-hosted pages but do not require a username/password login, and Central Web Authentication delegates the portal to an external ISE server.

Question 34Implementing Cisco Wireless Guest Access

A guest WLAN uses web passthrough authentication. What happens to a client that opens a browser for the first time?

  1. It is redirected to a configured login page and, after the page is served, is allowed through without credentials Correct answer.
  2. It must complete an 802.1X exchange before the browser opens
  3. It is placed in a quarantine VLAN until an administrator approves it
  4. It is prompted for a username and password hosted on the controller

Explanation

Web passthrough presents a redirect page for informational purposes and then permits the client without requiring credentials. It is commonly used for guest splash pages or terms-of-use display where no identity check is needed.

Question 35Implementing Cisco Wireless Guest Access

Which component must be reachable by guest clients for a Cisco central web authentication flow to redirect them to an external portal?

  1. The corporate DNS server on the internal VLAN
  2. Only the anchor controller's management interface
  3. The Cisco ISE or external portal server plus the redirect ACL permitting client-to-portal traffic Correct answer.
  4. The Mobility Group name configured on the foreign controller

Explanation

Central web authentication depends on an external portal (typically ISE) that the unauthenticated client must reach, so the pre-authentication ACL must permit client-to-portal traffic and DNS. The redirect URL points clients at that portal.

Question 36Implementing Cisco Wireless Guest Access

A guest network must enforce a maximum session duration of 8 hours regardless of activity. Which guest user configuration achieves this?

  1. Set the DHCP timeout to 28800 seconds on the guest user account
  2. Set the session timeout to 28800 seconds on the guest user account Correct answer.
  3. Set the idle timeout to 28800 seconds on the guest user account
  4. Set the ARP timeout to 28800 seconds on the guest user account

Explanation

The session timeout is an absolute limit measured from login and terminates the guest session after the configured duration even if the client stays active. Idle timeout, by contrast, only expires a session after a period of inactivity.

Question 37Implementing Cisco Wireless Guest Access

Where are locally created guest user accounts stored when the guest WLAN uses the controller's internal web authentication?

  1. On the anchor controller only, replicated to foreign controllers
  2. In the global Mobility Group database shared by all controllers
  3. In the local user database on the controller that serves the guest portal Correct answer.
  4. In the RADIUS server's guest OU

Explanation

Local guest accounts created for internal web authentication are held in the controller's local user database. That controller validates the credentials when the guest submits the login form.

Question 38Implementing Cisco Wireless Guest Access

An administrator is configuring a guest WLAN that uses an external captive portal with social login. Which authentication method on the WLAN is most appropriate?

  1. Central Web Authentication pointing to the external portal Correct answer.
  2. Open authentication with no web policy
  3. Web Consent with a local page
  4. Web Authentication with internal credentials

Explanation

Central Web Authentication delegates the portal and credential/social-login handling to an external server such as ISE, which is required for social login workflows. Internal web authentication and consent pages cannot perform third-party identity federation.

Question 39Implementing Cisco Wireless Guest Access

Which two elements are required on the foreign controller to support guest anchoring to a DMZ anchor controller? (Choose the best single answer.)

  1. A mobility group containing the anchor and a matching mobility domain name Correct answer.
  2. A FlexConnect group and a local VLAN pool
  3. A RADIUS proxy and a TACACS+ server
  4. An L2TP tunnel and a public IP address

Explanation

Guest anchoring relies on the foreign controller joining a mobility group that includes the anchor controller, with both using the same mobility domain name so the EoIP tunnel can be established. Without that relationship the anchor cannot be selected for the WLAN.

Question 40Implementing Cisco Wireless Guest Access

A guest client behind a web-policy WLAN cannot reach the login page. The pre-authentication ACL permits only DHCP and DNS. What is the most likely cause?

  1. The WLAN is using WPA2-PSK instead of open
  2. The ACL does not permit traffic to the virtual interface or portal server address Correct answer.
  3. The client's session timeout is too short
  4. The anchor controller is in the wrong mobility group

Explanation

For the redirect to work, the pre-authentication ACL must allow the client to reach the virtual interface (or external portal) so the HTTP redirect and login page can be delivered. Permitting only DHCP and DNS blocks that traffic and the page never loads.

Question 41Implementing Cisco Wireless Guest Access

Which virtual interface setting is used to answer DNS requests from unauthenticated guest clients so they can be redirected without a real DNS server?

  1. The anchor controller's management IP
  2. The mobility domain name
  3. The WLAN's DHCP option 43 value
  4. The virtual interface's DNS hostname resolution feature Correct answer.

Explanation

The controller's virtual interface can answer DNS queries for configured hostnames, allowing unauthenticated guests to resolve the redirect target before they have full network access. This supports the captive-portal flow without exposing internal DNS.

Question 42Implementing Cisco Wireless Guest Access

A guest user account is created with a lifetime of one day and a session timeout of two hours. What is the effect?

  1. The account can be used for up to one day, and each login session is limited to two hours Correct answer.
  2. The account expires after two hours and sessions last one day
  3. Both values must be equal or the account is rejected
  4. The lifetime applies only to the anchor controller and the session timeout only to the foreign controller

Explanation

Lifetime governs how long the guest account itself remains valid from creation, while session timeout caps each individual authenticated session. They are independent settings, so the account is usable for a day and each session is capped at two hours.

Question 43Implementing Cisco Wireless Guest Access

Which statement about guest access with FlexConnect in local switching mode is true?

  1. Guest clients cannot be assigned to a guest VLAN
  2. Guest traffic is always anchored to a DMZ controller
  3. Guest traffic requires Central Web Authentication and cannot use internal web auth
  4. Guest traffic is switched locally at the AP and does not traverse a CAPWAP tunnel to the controller Correct answer.

Explanation

In FlexConnect local switching, client traffic including guest traffic is bridged at the access point onto the local VLAN rather than tunneled to the controller. This changes the isolation design, since anchoring to a DMZ controller is not part of the local-switching data path.

Question 44Implementing Cisco Wireless Guest Access

What is the primary security benefit of terminating guest traffic on a DMZ anchor controller?

  1. Guest sessions bypass the pre-authentication ACL
  2. Guest traffic egresses outside the corporate firewall boundary and cannot reach internal subnets directly Correct answer.
  3. Guest clients are authenticated with 802.1X before reaching the internet
  4. Guest credentials are encrypted with WPA3 on the anchor

Explanation

Placing the anchor in a DMZ means guest packets are tunneled out of the internal network and exit through the DMZ, so guests never share internal VLANs or routing with corporate resources. This limits lateral exposure if a guest device is compromised.

Question 45Implementing Cisco Wireless Guest Access

Which Cisco ISE construct defines the guest portal page, sponsor workflow, and guest account policies for central web authentication?

  1. A network device group in ISE
  2. An authorization profile in ISE
  3. A guest portal configured under Guest Access in ISE Correct answer.
  4. A posture policy in ISE

Explanation

In ISE, guest portals bundle the portal page, authentication flow, and sponsor/guest account behavior used for guest access. The controller references the portal through the redirect and authorization configuration.

Question 46Implementing Cisco Wireless Guest Access

A guest WLAN is configured for web consent. Which client experience matches this configuration?

  1. The client must install a posture agent before proceeding
  2. The client sees an acceptable-use page and clicks to continue, with no credentials required Correct answer.
  3. The client is denied access until an administrator approves the MAC address
  4. The client must enter a username and password issued by a sponsor

Explanation

Web consent presents a terms-of-use or acceptable-use page that the guest accepts to gain access; no identity is collected. It is the lightest web policy and is often used where only legal acknowledgment is needed.

Question 47Implementing Cisco Wireless Guest Access

An engineer needs guest clients to receive addresses from a dedicated guest subnet while the WLAN is centrally switched and anchored. Where should the guest interface be configured?

  1. On the WLAN's FlexConnect group
  2. On the anchor controller, because anchored client traffic egresses there Correct answer.
  3. On both controllers with identical IP addresses
  4. On the foreign controller only, because clients associate there

Explanation

With guest anchoring, client data traffic is tunneled to the anchor controller, so the interface and DHCP scope that serve guest addresses must exist on the anchor. Configuring the guest interface only on the foreign controller would leave the anchored traffic without a valid egress interface.

Question 48Implementing Cisco Wireless Guest Access

Which setting on the guest WLAN determines whether clients are redirected to an external portal rather than the controller's internal page?

  1. The WLAN's radio policy
  2. The WLAN's session timeout
  3. The web authentication type selected for the WLAN Correct answer.
  4. The WLAN's DHCP proxy setting

Explanation

The web authentication type chosen on the WLAN (internal, passthrough, consent, or central) determines where the portal is hosted and how the client is redirected. Radio policy, timers, and DHCP proxy do not select the portal location.

Question 49Implementing Cisco Wireless Guest Access

A guest deployment requires that sponsored accounts be created by reception staff and delivered by email. Which solution component provides this workflow?

  1. FlexConnect local switching with a guest VLAN
  2. The controller's local guest user database with session timeout
  3. The virtual interface DNS feature
  4. Cisco ISE guest access with sponsor groups and email notification Correct answer.

Explanation

Sponsor-based guest creation, including email delivery of credentials, is a function of the ISE guest access service with sponsor groups configured. The controller's local database does not provide sponsor roles or automated email delivery.

Question 50Implementing Cisco Wireless Guest Access

Which pre-authentication ACL entry is typically required so that unauthenticated guests can obtain an IP address before logging in?

  1. Permit UDP from the client to the DHCP server on ports 67 and 68 Correct answer.
  2. Permit UDP from the client to the RADIUS server on port 1812
  3. Permit TCP from the client to the corporate file server on port 445
  4. Permit IP from any to any

Explanation

Before authentication, guests still need an address, so the pre-authentication ACL must allow DHCP traffic between client and server. Permitting broad or unrelated services would defeat the purpose of restricting unauthenticated clients.