I85PREP
⌘ K
ExtremeControl Certified Professional study materials
ExtremeControl Certified Professional study resources

ExtremeControl Certified Professional practice questions

One question at a time. Build your ExtremeControl Certified Professional understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ExtremeControl roles, authentication and policy decisions

Within which Extreme Networks management platform does the ExtremeControl application run as a tab for configuring network access control?

  1. ExtremeCloud SD-WAN
  2. Extreme Fabric Manager
  3. ExtremeAnalytics standalone server
  4. ExtremeCloud IQ Site Engine Correct answer.

Explanation

ExtremeControl is delivered as the Access Control (formerly NAC Manager) application inside ExtremeCloud IQ Site Engine. Administrators configure engines, AAA, profiles, rules, and portals from the Control tab of Site Engine.

Question 2ExtremeControl roles, authentication and policy decisions

What is the primary function of an ExtremeControl engine in a NAC deployment?

  1. To act as the syslog collector for all managed switches
  2. To replace the core routing fabric with policy-based forwarding
  3. To generate SSL certificates for every managed access point
  4. To detect, authenticate, assess, and effect authorization of end-systems connecting to the network Correct answer.

Explanation

The ExtremeControl engine is required for every deployment. It detects connecting end-systems, authenticates them (often as a RADIUS server), assesses their posture, and then authorizes them by assigning a policy role or VLAN based on the results.

Question 3ExtremeControl roles, authentication and policy decisions

An ExtremeControl engine acting as a RADIUS server listens for RADIUS authentication requests on which UDP port by default?

  1. UDP 1813
  2. UDP 1700
  3. UDP 1812 Correct answer.
  4. UDP 3799

Explanation

RADIUS authentication uses UDP 1812 by default, which is the port the ExtremeControl engine uses to receive Access-Request packets from switches and APs acting as RADIUS clients. UDP 1813 is reserved for RADIUS accounting.

Question 4ExtremeControl roles, authentication and policy decisions

Before a switch's RADIUS requests will be answered by an ExtremeControl engine, what must be true about that switch?

  1. The switch must run the same firmware version as the engine
  2. The switch must be assigned a static IP in the 169.254.0.0/16 range
  3. The switch must be added to the engine so it is included in the RADIUS clients.conf authorized clients list Correct answer.
  4. The switch must have an ExtremeControl agent installed on it

Explanation

ExtremeControl only responds to RADIUS requests from authorized clients. Adding a switch or AP under Control adds it to the engine's clients.conf with the shared secret; without that entry the engine silently ignores RADIUS packets from that source IP.

Question 5ExtremeControl roles, authentication and policy decisions

In an ExtremeControl Gateway deployment with policy-enabled Extreme switches, how is the access policy named in an ExtremeControl profile applied to the end-system?

  1. The end-system downloads the policy directly from the cloud
  2. The switch is sent the matching policy role, which must be defined and enforced in the Policy tab Correct answer.
  3. The engine pushes a full ACL file to the end-system's NIC
  4. The VLAN is always assigned and policy roles are never used

Explanation

For ExtremeControl Gateway engines, access policies in the profile map to policy roles that an administrator creates in the Policy tab and enforces to the policy-capable switches. The engine returns the role (commonly via Filter-ID) and the switch applies it locally.

Question 6ExtremeControl roles, authentication and policy decisions

For RFC 3580-enabled (non-policy) switches, how does ExtremeControl deliver authorization instead of sending a policy role?

  1. By sending a VLAN attribute mapped from the policy role using Policy Mappings Correct answer.
  2. By disabling the switch port permanently
  3. By installing a local supplicant on the switch
  4. By sending an SNMP trap that the switch interprets as a role

Explanation

RFC 3580 defines RADIUS tunnel attributes for dynamic VLAN assignment. ExtremeControl uses the Policy Mappings panel to associate each policy role with a VLAN ID or name, so RFC 3580 switches receive the VLAN attribute rather than a proprietary role.

Question 7ExtremeControl roles, authentication and policy decisions

Which ExtremeControl deployment mode passively monitors authentication without the engine acting as the inline RADIUS server, primarily to provide end-system visibility?

  1. Inline enforcement mode
  2. Quarantine-only mode
  3. Passive mode Correct answer.
  4. Captive portal mode

Explanation

Passive Mode (and Pass-Through Mode) are the foundational visibility use cases taught in ExtremeControl Installation and Configuration. Passive mode observes end-system activity to populate the End-Systems table without taking over enforcement, which is useful for discovery before full NAC rollout.

Question 8ExtremeControl roles, authentication and policy decisions

Which protocol allows an ExtremeControl engine to force reauthentication of an already-authenticated end-system by sending a Change of Authorization or Disconnect message?

  1. RFC 3580 dynamic VLAN
  2. SNMPv3 inform
  3. RFC 3576 RADIUS Dynamic Authorization (CoA) Correct answer.
  4. TACACS+ command authorization

Explanation

RFC 3576 (later RFC 5176) defines RADIUS Change of Authorization (CoA) and Disconnect messages. ExtremeControl uses these to force a reauth on a connected end-system so a new profile or role is applied without waiting for the next natural authentication.

Question 9ExtremeControl roles, authentication and policy decisions

On which UDP port does ExtremeControl send RADIUS Change of Authorization (CoA) messages per the standardized Dynamic Authorization assignment?

  1. UDP 1812
  2. UDP 3799 Correct answer.
  3. UDP 8443
  4. UDP 514

Explanation

UDP 3799 is the IANA-assigned RADIUS Dynamic Authorization (CoA/Disconnect) port. ExtremeControl uses 3799 (and the legacy 1700) to send CoA messages from the engine to the authenticating switch or AP.

Question 10ExtremeControl roles, authentication and policy decisions

When configuring an ExtremeControl engine to authenticate users against Microsoft Active Directory, which configuration object holds the directory connection details used for authentication and authorization?

  1. The Portal Configuration
  2. The Notification Engine
  3. The End-System Zone
  4. The AAA Configuration referencing an LDAP configuration Correct answer.

Explanation

The AAA Configuration defines the RADIUS and LDAP settings that provide authentication and authorization services. Connecting to Active Directory is done by adding an LDAP configuration referenced by the AAA Configuration, enabling user and host lookups against AD.

Question 11ExtremeControl roles, authentication and policy decisions

What is the difference between a Basic and an Advanced AAA Configuration in ExtremeControl?

  1. Basic supports only MAC authentication while Advanced supports only 802.1X
  2. Basic defines one set of authentication/authorization services for all end-systems, while Advanced maps different services based on end-system-to-server mappings Correct answer.
  3. Basic is for wireless only and Advanced is for wired only
  4. Basic uses TACACS+ and Advanced uses RADIUS

Explanation

A Basic AAA Configuration applies one RADIUS/LDAP service set to all end-systems. An Advanced AAA Configuration uses mappings so different users or end-systems are directed to different authentication servers, for example routing faculty and students to separate RADIUS servers.

Question 12ExtremeControl roles, authentication and policy decisions

In an Advanced AAA Configuration, what is the recommended purpose of the automatically created 'Any' mapping placed last in the mapping list?

  1. To drop all unmatched RADIUS requests immediately
  2. To force every end-system to the captive portal
  3. To serve as a catch-all so end-systems that match no earlier mapping are still handled rather than dropped Correct answer.
  4. To disable LDAP for unmatched users

Explanation

Advanced AAA mappings are evaluated top-down by precedence, and a request matching none of them is dropped. Keeping the 'Any' mapping as the final entry provides a catch-all so unmatched end-systems still receive an authentication service instead of being silently discarded.

Question 13ExtremeControl roles, authentication and policy decisions

After making changes to ExtremeControl engine configuration such as AAA or profiles, what action must an administrator take to push those changes to the engines?

  1. Reboot every managed switch
  2. Perform an Enforce to the ExtremeControl engine(s) Correct answer.
  3. Clear the browser cache
  4. Re-image the engine appliance

Explanation

Configuration changes are staged in Site Engine and must be applied with the Enforce operation, which synchronizes the configuration to the ExtremeControl engines. Until enforced, the engines continue running their previously enforced configuration.

Question 14ExtremeControl roles, authentication and policy decisions

Which RADIUS return attribute is commonly used by ExtremeControl to communicate a policy role name to an authenticating switch or wireless controller?

  1. Calling-Station-Id
  2. NAS-Identifier
  3. Acct-Session-Id
  4. Filter-Id Correct answer.

Explanation

ExtremeControl commonly returns the policy role as a Filter-Id attribute in the RADIUS Access-Accept; the switch or controller maps that Filter-Id string to a locally defined role. Some devices instead use Service-Type for management access.

Question 15ExtremeControl roles, authentication and policy decisions

When deploying an ExtremeControl Controller engine (rather than a Gateway), where are the policy roles that authorize end-systems defined?

  1. Only on the upstream core router
  2. Locally in the ExtremeControl Controller's own policy configuration Correct answer.
  3. On each end-system via a host agent
  4. In the cloud-only ExtremeCloud IQ tenant

Explanation

On an ExtremeControl Controller engine, authorization is implemented locally by assigning a policy role to the end-system, so all referenced policy roles must exist in the controller's own policy configuration. Administrators typically import that default policy into the Policy tab to review and edit it.

Question 16ExtremeControl roles, authentication and policy decisions

On which TCP ports does ExtremeControl provide its captive portal listening service for end-systems?

  1. TCP 22 and TCP 23
  2. TCP 1812 and TCP 1813
  3. TCP 161 and TCP 162
  4. TCP 80 (HTTP) and TCP 443 (HTTPS) Correct answer.

Explanation

The captive portal listens on TCP 80 (HTTP) and TCP 443 (HTTPS) so redirected end-systems can reach the registration or remediation web pages. ExtremeControl web administration and engine-to-engine communication use 8080/8443.

Question 17ExtremeControl roles, authentication and policy decisions

Which CLI command run on the ExtremeControl engine returns detailed status data about the engine's operation and is useful during installation validation?

  1. show running-config
  2. nacstatus Correct answer.
  3. ipconfig /all
  4. traceroute engine

Explanation

The nacstatus command, executed from the ExtremeControl engine CLI, provides detailed operational data about the engine. While Show Support is the recommended comprehensive collection method, nacstatus remains a quick way to verify engine health.

Question 18ExtremeControl roles, authentication and policy decisions

What is the role of the shared secret configured when adding a switch as a RADIUS client to an ExtremeControl engine?

  1. It encrypts all end-system data traffic on the switch port
  2. It is the password end-users type into the captive portal
  3. It authenticates the RADIUS message exchange between the switch and the engine and must match on both sides Correct answer.
  4. It sets the VLAN ID for the guest network

Explanation

The RADIUS shared secret is a symmetric key configured identically on the authenticator (switch/AP) and the ExtremeControl engine. It validates that RADIUS packets come from a trusted client and protects the User-Password attribute; a mismatch causes authentication to fail silently or with errors.

Question 19ExtremeControl roles, authentication and policy decisions

An ExtremeControl Gateway engine using RFC 3580 VLAN assignment briefly links a switch port down and up after a VLAN change. Why is this behavior necessary?

  1. To clear the switch MAC table of all entries
  2. To force the end-system to release and renew its IP address in the new VLAN Correct answer.
  3. To trigger a firmware upgrade on the switch
  4. To reset the RADIUS shared secret

Explanation

When an RFC 3580 device moves an end-system to a new VLAN, the engine links the port down and up so the host detects the change and requests a new DHCP lease appropriate to the new VLAN. The DHCP Resolution Delay Time setting must allow enough time for that renewal before IP resolution.

Question 20ExtremeControl roles, authentication and policy decisions

Which set of credentials secures the web services interface between the ExtremeCloud IQ Site Engine server and an ExtremeControl engine?

  1. The end-user portal credentials
  2. The RADIUS shared secret only
  3. The SNMP community string
  4. The ExtremeControl engine Web Service Credentials Correct answer.

Explanation

The ExtremeControl engine Web Service Credentials authenticate the web services channel between the Site Engine server and the engine. If non-default credentials are used, a newly added engine must be pre-provisioned (for example via configWebCredentials) before it can communicate.

Question 21ExtremeControl roles, authentication and policy decisions

Which authentication method should be configured for IoT devices and printers that cannot run an 802.1X supplicant?

  1. EAP-TLS with client certificates
  2. MAC authentication (MAC-based authentication) Correct answer.
  3. Kerberos snooping only
  4. Captive portal with username and password

Explanation

Devices without a supplicant, such as printers and IoT sensors, are authenticated by MAC authentication, where the switch sends the device MAC as the credential. ExtremeControl can then match the MAC or its OUI to an end-system group and assign an appropriate role.

Question 22ExtremeControl roles, authentication and policy decisions

When integrating ExtremeWireless access points so they can authenticate clients through ExtremeControl, where must the APs be added?

  1. Under Control > Switches so they are added to the engine's authorized RADIUS clients Correct answer.
  2. Into the ExtremeAnalytics flow collector
  3. Into the Fabric Connect L3 VSN
  4. Into the SD-WAN orchestrator

Explanation

APs that send RADIUS to the engine must be added under the Control Switches tab so they are written to the engine's clients.conf and recognized as authorized RADIUS clients. Without this entry the engine ignores their RADIUS requests.

Question 23ExtremeControl roles, authentication and policy decisions

Which statement best describes an ExtremeControl Profile?

  1. It is the physical cabling diagram for the engine
  2. It is the list of SNMP traps the engine forwards
  3. It specifies the authorization (accept policy) and assessment requirements applied to matching end-systems Correct answer.
  4. It is the DHCP scope used by the captive portal

Explanation

An ExtremeControl Profile defines what happens to end-systems that match a rule: which accept policy or role is authorized and whether and how the end-system is assessed for posture. Site Engine ships ten system-defined profiles that can be edited or cloned.

Question 24ExtremeControl roles, authentication and policy decisions

By default, how many times will a switch retry contacting an ExtremeControl engine for a timed-out RADIUS request before considering it failed, per the RADIUS Timeout Retry Count setting?

  1. 1 retry (2 total attempts)
  2. 3 retries (4 total attempts) Correct answer.
  3. 5 retries (6 total attempts)
  4. 0 retries (1 attempt)

Explanation

The default RADIUS Timeout Retry Count is 3, meaning the switch retries a timed-out request three times for a total of four attempts before declaring the engine unreachable. This setting helps tune failover to a secondary engine.

Question 25ExtremeControl roles, authentication and policy decisions

What is the purpose of proxy RADIUS in an ExtremeControl AAA Configuration?

  1. To convert RADIUS into SNMP for legacy switches
  2. To disable accounting on all engines
  3. To forward RADIUS authentication requests to an external back-end RADIUS server for processing Correct answer.
  4. To encrypt the captive portal with TLS 1.3

Explanation

With proxy RADIUS, the ExtremeControl engine forwards Access-Request packets to an upstream RADIUS server (for example a Microsoft NPS or another enterprise RADIUS) that performs the actual credential validation, then relays the response. This is taught in the Installation and Configuration course's authentication topics.

Question 26ExtremeControl roles, authentication and policy decisions

In the ExtremeControl rules engine, how are access control rules evaluated to determine which ExtremeControl profile an end-system receives?

  1. Rules are evaluated in random order each authentication
  2. Rules are evaluated top-down in order, and the first matching rule assigns the profile Correct answer.
  3. All matching rules are applied simultaneously and merged
  4. Only the last rule in the list is ever applied

Explanation

The ExtremeControl rules engine evaluates rules in order from the top of the list down. The first rule whose conditions all match the end-system determines the assigned ExtremeControl profile (and end-system zone), so rule ordering is critical to correct policy outcomes.

Question 27ExtremeControl roles, authentication and policy decisions

Which of the following is a valid rule component (condition) that can be combined to build an ExtremeControl access control rule?

  1. BGP autonomous system number
  2. Spanning-tree priority
  3. OSPF area ID
  4. End-System Group, User Group, and Location Group Correct answer.

Explanation

ExtremeControl rules are built from rule components such as End-System Groups, User Groups, Location Groups, Device Type Groups, authentication type, and time. Combining these contextual conditions lets an administrator match precisely which end-systems should receive a given profile.

Question 28ExtremeControl roles, authentication and policy decisions

An administrator wants to group all printers by their manufacturer's MAC OUI so they can be matched in a rule. Which rule component should be used?

  1. A Location Group keyed on switch IP
  2. An End-System Group based on MAC OUI Correct answer.
  3. A User Group based on LDAP membership
  4. A Time Group based on business hours

Explanation

End-System Groups can be defined by MAC address or MAC OUI, letting an administrator collect all devices from a printer vendor into one group. A rule can then match that group and assign a printer-appropriate profile, and such groups can even exempt those devices from registration.

Question 29ExtremeControl roles, authentication and policy decisions

Which 802.1X-related EAP method uses mutual certificate-based authentication between the supplicant and the RADIUS server, offering the strongest assurance for managed endpoints?

  1. EAP-TLS Correct answer.
  2. PAP
  3. MAC authentication bypass
  4. CHAP

Explanation

EAP-TLS uses X.509 certificates on both the supplicant and the server for mutual authentication, making it the most secure 802.1X method and ideal for domain-joined or MDM-managed endpoints. ExtremeControl supports proxying or terminating 802.1X EAP exchanges.

Question 30ExtremeControl roles, authentication and policy decisions

What is the function of an end-system zone in ExtremeControl?

  1. It defines the wireless RF channel plan
  2. It sets the RADIUS shared secret per VLAN
  3. It groups end-systems so administrator access to end-system information and configuration can be limited by zone Correct answer.
  4. It controls the spanning-tree root bridge

Explanation

End-system zones group end-systems so that a Site Engine administrator's visibility and configuration rights can be restricted to specific zones. Rules assign an end-system to a zone using components like End-System Groups, Location Groups, and User Groups during authentication.

Question 31ExtremeControl roles, authentication and policy decisions

How does the ExtremeControl Registration feature typically onboard a guest who connects for the first time?

  1. It silently grants full network access with no interaction
  2. It redirects the guest to a web portal to register their end-system before granting access Correct answer.
  3. It blocks the guest permanently with no recourse
  4. It requires the guest to install an 802.1X certificate manually

Explanation

The Registration solution redirects unknown guests, contractors, or students to a captive web page to register their device. After successful registration the end-system is permitted access, optionally subject to posture assessment, until registration is revoked.

Question 32ExtremeControl roles, authentication and policy decisions

Which ExtremeControl capability checks a connecting end-system's security posture, such as antivirus status or patch level, before granting full access?

  1. NetFlow export
  2. Spanning-tree guard
  3. LLDP-MED
  4. Assessment Correct answer.

Explanation

Assessment evaluates an end-system's security posture by connecting to vulnerability assessment services or using agent-based checks. Based on the health results, ExtremeControl may grant access, quarantine the device, or send it to remediation.

Question 33ExtremeControl roles, authentication and policy decisions

An end-system fails its security assessment. To which kind of policy role does ExtremeControl typically assign it?

  1. An Enterprise full-access role
  2. The administrator management role
  3. A trunk role with all VLANs allowed
  4. A Quarantine policy role (or quarantine VLAN) Correct answer.

Explanation

When the assessment result is negative, ExtremeControl restricts the end-system by assigning a Quarantine policy role or quarantine VLAN. The device is isolated, often redirected to a remediation page, until it remediates and passes a follow-up assessment.

Question 34ExtremeControl roles, authentication and policy decisions

What does the assessment Remediation process provide to a quarantined end-system?

  1. A web page guiding the user to fix the issues that caused quarantine before regaining access Correct answer.
  2. An automatic firmware downgrade of the switch
  3. A new RADIUS shared secret
  4. Permanent removal from the End-Systems table

Explanation

Remediation presents the quarantined user with a web page describing the failed checks and steps to fix them, such as updating antivirus or applying patches. After remediation the end-system is reassessed and, if compliant, granted appropriate access.

Question 35ExtremeControl roles, authentication and policy decisions

Which option enables ExtremeControl to assign a different ExtremeControl profile based on whether an end-system is in a specific LDAP/Active Directory group?

  1. A Location Group based on switch port
  2. A User Group derived from LDAP/AD group membership used in a rule Correct answer.
  3. A Time Group based on the day of week
  4. A Device Type Group based on OUI

Explanation

User Groups can be built from LDAP or Active Directory group membership. A rule referencing that User Group lets ExtremeControl assign role-based access, for example giving faculty a different profile than students based on their AD group.

Question 36ExtremeControl roles, authentication and policy decisions

To require both machine authentication and user authentication (so access is granted only when a domain machine has a domain user logged in), an administrator combines which conditions in the ExtremeControl rule?

  1. Switch model AND firmware version
  2. VLAN 1 AND spanning-tree forwarding
  3. User is in a Domain Users group AND end-system is in a Domain Devices group Correct answer.
  4. Captive portal AND MAC OUI of a printer

Explanation

Machine-plus-user enforcement is built by requiring the end-system to be in a Domain Devices group (proving it is a domain-joined machine) AND the user to be in a Domain Users group. Only when both conditions match does the rule assign the trusted corporate profile.

Question 37ExtremeControl roles, authentication and policy decisions

How does ExtremeControl most commonly learn an end-system's hostname for use in rules when DHCP fingerprinting is unavailable?

  1. By reading the BIOS serial number over RADIUS
  2. By performing a reverse DNS lookup of the end-system's learned IP address Correct answer.
  3. By querying the switch spanning-tree table
  4. By decoding the wireless SSID name

Explanation

ExtremeControl learns hostnames from DHCP fingerprinting or, alternatively, from a reverse DNS lookup of the end-system's IP address. The IP must first be resolved, which is why a minimal level of access is needed for DHCP and IP resolution to complete.

Question 38ExtremeControl roles, authentication and policy decisions

When configuring a Guest policy role, the documentation warns that discarding NetBIOS traffic could impact which ExtremeControl process?

  1. RADIUS accounting
  2. MAC-to-IP resolution Correct answer.
  3. Spanning-tree convergence
  4. NTP time synchronization

Explanation

ExtremeControl cautions that a restrictive Guest role which discards traffic such as NetBIOS can interfere with the engine's MAC-to-IP resolution process. Administrators must permit the communication the engine needs between end-systems and the engine when designing roles.

Question 39ExtremeControl roles, authentication and policy decisions

Which statement about changes to ExtremeControl rule components (such as adding members to an End-System Group) is correct?

  1. They require a full Enforce and a switch reboot
  2. They take effect only after the engine is reimaged
  3. They are ignored until the next certificate renewal
  4. They are automatically synchronized to engines on the next status update and do not require an Enforce Correct answer.

Explanation

Changes to rule components do not require an Enforce; Site Engine automatically synchronizes them to the engines on the next status update. The changes affect an end-system the next time it authenticates or is assessed.

Question 40ExtremeControl roles, authentication and policy decisions

An administrator wants faculty to authenticate to one RADIUS server and students to another within the same ExtremeControl deployment. Which configuration achieves this?

  1. A single Basic AAA Configuration
  2. An Advanced AAA Configuration with end-system-to-authentication-server mappings Correct answer.
  3. Two separate captive portals only
  4. A Location Group on each switch port

Explanation

An Advanced AAA Configuration supports mappings that route different users or end-systems to different authentication servers. This lets faculty and student traffic be proxied to separate RADIUS back ends based on the mapping criteria.

Question 41ExtremeControl roles, authentication and policy decisions

What does enabling MAC Locking for an end-system in ExtremeControl enforce?

  1. It permanently disables the device's wireless radio
  2. It changes the device's MAC address randomly
  3. It locks the end-system's MAC to a specific switch and/or port so it is only authorized there Correct answer.
  4. It encrypts the MAC address in all RADIUS packets

Explanation

MAC Locking ties an authorized end-system MAC to a specific switch and port (or switch), so the same MAC presented on a different location is not granted the same access. This helps prevent MAC spoofing from another part of the network.

Question 42ExtremeControl roles, authentication and policy decisions

Which authentication type takes the highest precedence in ExtremeControl when an end-system has used multiple authentication methods?

  1. Auto Tracking
  2. MAC
  3. Switch Quarantine Correct answer.
  4. RADIUS Snooping

Explanation

ExtremeControl lists all authentication types in order of precedence from highest to lowest as Switch Quarantine, 802.1X, CHAP, PAP, Kerberos, MAC, CEP, RADIUS Snooping, then Auto Tracking. Switch Quarantine sits at the top of this precedence list.

Question 43ExtremeControl roles, authentication and policy decisions

Which least-secure device type detection method relies on the User-Agent string returned by the end-system's browser and can be spoofed by the end user?

  1. DHCP fingerprinting
  2. Use Captive Portal Data (browser agent string) Correct answer.
  3. SNMP query of the switch
  4. Active Directory group lookup

Explanation

The Use Captive Portal Data option detects device type from the browser's User-Agent string. The documentation notes this is the least secure detection method because the agent string can be faked, though it is useful when agent-based assessment needs OS detection at remediation.

Question 44ExtremeControl roles, authentication and policy decisions

An administrator wants to exempt corporate printers from having to register through the guest portal. How can ExtremeControl accomplish this?

  1. Disable RADIUS on all switches
  2. Lower the RADIUS retry count to zero
  3. Assign every printer to the Quarantine role
  4. Configure an end-system group (for example by MAC OUI) that is exempt from registration Correct answer.

Explanation

End-system or user groups can be configured to exempt certain devices or users from registration based on authentication type, MAC address, or username. Grouping printers by their vendor MAC OUI and marking that group exempt lets them onboard without the registration portal.

Question 45ExtremeControl roles, authentication and policy decisions

What is the role of a Portal Configuration in ExtremeControl?

  1. It defines the appearance and behavior of the captive portal used for registration and remediation Correct answer.
  2. It stores the RADIUS accounting database
  3. It manages the spanning-tree root election
  4. It sets the engine's NTP servers

Explanation

A Portal Configuration controls the captive portal experience, including branding, the registration/guest flow, and remediation pages. Different portal configurations can be applied so guests, contractors, and BYOD users see appropriate onboarding pages.

Question 46ExtremeControl roles, authentication and policy decisions

In an ExtremeControl Profile, selecting 'Use User/Host LDAP Policy Mappings' for authorization causes the accept policy to be determined by what?

  1. The switch's spanning-tree priority
  2. End-system information in the LDAP database combined with the configured LDAP Policy Mappings Correct answer.
  3. The captive portal language setting
  4. The RADIUS accounting interim interval

Explanation

When a profile uses User/Host LDAP Policy Mappings, the accept policy is assigned based on attributes retrieved from the LDAP database for that user or host, mapped through the LDAP Policy Mappings defined in the authentication mapping. This enables directory-driven role assignment.

Question 47ExtremeControl roles, authentication and policy decisions

Which feature lets ExtremeControl apply targeted, role-based identities that follow a user regardless of where or how they connect to the network?

  1. Static port-based VLANs only
  2. MAC address aging timers
  3. Role-based access control with contextual identity (user, time, location, device, posture) Correct answer.
  4. Jumbo frame configuration

Explanation

ExtremeControl builds a contextual identity by matching attributes such as user, time, location, device type, and posture, then applies a role-based identity that follows the user across wired and wireless connections. This delivers consistent policy regardless of connection point.

Question 48ExtremeControl roles, authentication and policy decisions

Which assessment approach uses software running on the end-system to inspect detailed posture such as installed patches and running services?

  1. RFC 3580 VLAN assignment
  2. SNMP trap collection
  3. DHCP option 82 insertion
  4. Agent-based assessment Correct answer.

Explanation

Agent-based assessment uses an assessment agent on the end-system to gather detailed posture data such as patch levels, antivirus status, and running services. Agentless network-based assessment is an alternative when an agent cannot be deployed.

Question 49ExtremeControl roles, authentication and policy decisions

Why must an ExtremeControl Controller engine's policy configuration be imported into the Policy tab before editing roles?

  1. Because the controller stores its policy roles locally and they must be reviewed and re-enforced back to the controller Correct answer.
  2. Because the cloud deletes the policy every 24 hours
  3. Because the Policy tab cannot read VLAN names
  4. Because RADIUS requires the policy to be exported as CSV

Explanation

An ExtremeControl Controller enforces authorization locally using its own policy configuration. To customize it, an administrator creates a policy domain, assigns the controller, imports its default policy into the Policy tab, edits the roles and rules, then enforces the changes back to the controller.

Question 50ExtremeControl roles, authentication and policy decisions

The Assessment Warning system-defined end-system group contains end-systems that must do what before being granted access?

  1. Pay an access fee
  2. Acknowledge assessment warnings before being granted network access Correct answer.
  3. Reinstall their operating system
  4. Register a second device

Explanation

The Assessment Warning is one of the six system-defined end-system groups. It contains end-systems that have assessment warnings which the user must acknowledge before being granted network access, balancing security awareness with usability.