Implementing Cisco Enterprise Wireless Networks (ENWLSI) 300-430 Practice Exam Questions Updated

Jonnie Karnath2023-05-11T03:54:57+00:00

Cisco 300-430 practice exam questions are an invaluable resource for anyone preparing for the Implementing Cisco Enterprise Wireless Networks (ENWLSI) exam. They are regularly updated to reflect the latest exam changes, help you study and prepare with ease, increase your chances of passing on your first attempt, and ultimately achieve brilliant exam results. With 300-430 practice exam questions, you’ll be well on your way to become certified. They are designed to help you study and prepare for the exam with ease, ensuring that you’re confident and ready when the exam day arrives.

Page 1 of 7

1. Which component must be integrated with Cisco DNA Center to display the location of a client that is experiencing connectivity issues?

Cisco Hyperlocation Module

Wireless Intrusion Prevention System

Cisco Connected Mobile Experiences

Cisco Mobility Services Engine

2. An engineer is planning an image upgrade of the WLC, and hundreds of APs are spread across remote sites with limited WAN bandwidth. The engineer must minimize the WAN utilization for this upgrade.

Which approach must be used for the AP image upgrade?

Predownload the new code to the APs.

Use the Smart AP image upgrade feature.

Allow the APs to download their code after WLC reboot.

Execute parallel TFTP code upgrade on the APs via SS

3. An engineer just added a new MSE to Cisco Prime Infrastructure and wants to synchronize the MSE with the Cisco 5520 WLC, located behind a firewall in a DMZ. It is noticed that NMSP messages are failing between the two devices.

Which traffic must be allowed on the firewall to ensure that the MSE and WLC are able to communicate using NMSP?

TCP 1613

UDP 16113

UDP 1613

TCP 16113

4. Refer to the exhibit.

An engineer must connect a fork lift via a WGB to a wireless network and must authenticate the WGB certificate against the RADIUS server.

Which three steps are required for this configuration? (Choose three.)

Configure the certificate, WLAN, and radio interface on WG

Configure the certificate on the WL

Configure WLAN to authenticate using IS

Configure the access point with the root certificate from IS

Configure WGB as a network device in IS

Configure a policy on ISE to allow devices to connect that validate the certificate.

5. A corporation has recently implemented a BYOD policy at their HQ.

Which two risks should the security director be concerned about? (Choose two.)

network analyzers

malware

lost and stolen devices

keyloggers

unauthorized users

6. An engineer has configured Media Stream on the WLC and must guarantee at least 2 Mbps stream per user.

Which RRC template should the engineer use?

coarse

medium

low

ordinary

7. Refer to the exhibit.

What is the reason that the wireless client cannot get the RUN state?

It has no communication with Cisco IS

An authentication error has occurred.

It is not getting the IP address.

Because of central switching, the AP must reach the Cisco ISE directly.

8. What is the default NMSP echo interval between Cisco MSE and a Wireless LAN Controller?

10 seconds

15 seconds

30 seconds

60 seconds

9. Refer to the exhibit.

A network architect configured the Cisco Catalyst 9800 Series Controller to find out information on client types in the wireless network. RADIUS profiling is enabled so that the controller forwards the information about clients to a Cisco ISE server through vendor-specific RADIUS attributes. The ISE server is not profiling any data from the controller.

Which configuration must be added in the blank in the code to accomplish the profiling on the Cisco 9800 Series controller?

aaa accounting identity acct_method start-stop group rad-group

aaa accounting network acct_method start-stop group rad-group

aaa accounting exec acct_method start-stop group rad-group

aaa accounting commands acct_method start-stop group rad-group

10. An engineer is using Cisco Prime Infrastructure reporting to monitor the state of security on the WLAN.

Which output is produced when the Adaptive wIPS Top 10 AP report is run?

last 10 wIPS events from monitor mode APs

last 10 wIPS events from sniffer mode APs

last of 10 sniffer mode APs with the most wIPS events

last of 10 monitor mode APs with the most wIPS events

Page 2 of 7

11. An engineer is deploying a virtual MSE. The network has 3000 APs and needs 7000 IPS licenses.

To which size server does the engineer scale it?

virtual

standard

high end

low end

12. An IT administrator is managing a wireless network in which most devices are Apple iOS. A QoS issue must be addressed on the WLANs.

Which configuration must be performed?

Enable Fastlane globally under Wireless > Access Points > Global Configuration.

Create a new AVC Profile named AUTOQOS-AVC-PROFILE and apply to all WLANs.

Enable Fastlane under each WLAN setting.

Enable WMM TSPEC/TCLAS negotiation under Wireless > Advanced.

13. An engineer is troubleshooting a Cisco CMX high-availability deployment and notices that the primary and backup Cisco CMX servers are both considered primary.

Which command must the engineer run on the backup server?

cmxha convert backup

cmxha backup convert

cmxha secondary convert

cmxha convert secondary

14. An engineer is ensuring that, on the IEEE 802.1X wireless network, clients authenticate using a central repository and local credentials on the Cisco WLC.

Which two configuration elements must be completed on the WLAN? (Choose two.)

TACACS+

MAC authentication

local EAP enabled

web authentication

LDAP server

15. A FlexConnect remote office deployment is using five 2702i APs indoors and two 1532i APs outdoors.

When a code upgrade is performed and FlexConnect Smart AP Image Upgrade is leveraged, but no FlexConnect Master AP has been configured, how many image transfers between the WLC and APs will occur?

16. A customer wants the APs in the CEO’s office to have different usernames and passwords for administrative support than the other APs deployed throughout the facility.

Which feature must be enabled on the WLC and APs to achieve this goal?

local management users

HTTPS access

802.1X supplicant credentials

override global credentials

17. Which statement about the VideoStream/Multicast Direct feature is true?

IP multicast traffic is reliable over WLAN by default as defined by the IEEE 802.11 wireless multicast delivery mechanism.

Each VideoStream client acknowledges receiving a video IP multicast stream.

It converts the unicast frame to a multicast frame over the air.

It makes the delivery of the IP multicast stream less reliable over the air, but reliable over Ethernet.

18. What is an important consideration when implementing a dual SSID design for BYOD?

After using the provisioning SSID, an ACL that used to make the client switch SSIDs forces the user to associate and traverse the network by MAC filtering.

If multiple WLCs are used, the WLAN IDs must be exact for the clients to be provisioned and traverse the network correctly.

SSIDs for this setup must be configured with NAC State-RADIUS NAC for the clients to authenticate with Cisco ISE, or with NAC State-ISE NAC for Cisco ISE to associate the client.

One SSID is for provisioning and the other SSID is for gaining access to the network. The use of an ACL should not be enforced to make the client connect to the REAL SSID after provisioning.

19. Which QoS level is recommended for guest services?

gold

bronze

platinum

silver

20. WPA2 Enterprise with 802.1X is being used for clients to authenticate to a wireless network through a Cisco ISE server. For security reasons, thenetwork engineer wants to ensure that only PEAP authentication is used. The engineer sent instructions to clients on how to configure the supplicants, but the ISE logs still show users authenticating using EAP-FAST.

Which action ensures that access to the network is restricted for these users unless the correct authentication mechanism is configured?

Enable AAA override on the SSID, gather the usernames of these users, and disable the RADIUS accounts until the devices are correctly configured.

Enable AAA override on the SSID and configure an ACL on the WLC that allows access to users with IP addresses from a specific subnet.

Enable AAA override on the SSID and configure an access policy in Cisco ISE that denies access to the list of MACs that have used EAP-FAS

Enable AAA override on the SSID and configure an access policy in Cisco ISE that allows access only when the EAP authentication method is PEA

Page 3 of 7

21. A customer requires wireless traffic from the branch to be routed through the firewall at corporate headquarters. A RADIUS server is in each branch location.

Which Cisco FlexConnect configuration must be used?

central authentication and local switching

central authentication and central switching

local authentication and local switching

local authentication and central switching

22. You are configuring the social login for a guest network.

Which three options are configurable social connectors in Cisco CMX Visitor Connect? (Chose three)

Linkedn

Medium

Google+

Facebook

Myspace

23. A customer is concerned that their wireless network is detecting spurious threats from channels that are not being used by their wireless infrastructure.

Which two technologies must they deploy? (Choose two.)

FlexConnect mode

monitor mode

sniffer mode with no submode

local mode with WIPS submode

rogue detector mode

24. A healthcare organization notices many rogue APs and is concerned about a honeypot attack.

Which configuration must a wireless network engineer perform in Cisco Prime Infrastructure to prevent these attacks most efficiently upon detection?

Set the auto containment level to 0 and select the Using Our SSID containment option.

Set the manual containment level to 4 and select the Ad Hoc Rogue AP containment option.

Set the auto containment level to 0 and select the Ad Hoc Rogue AP containment option.

Set the auto containment level to 4 and select the Using Our SSID containment option.

25. A network administrator managing a Cisco Catalyst 9800 WLC must place all iOS connected devices to the guest SSID on VLAN 101. The rest of the clients must connect on VLAN 102 distribute load across subnets. To achieve this configuration, the administrator configures a local policy on the WLC.

Which two configurations are required? (Choose two.)

Assign a policy map under global security policy settings.

Add local profiling policy under global security policy settings.

Create a service template.

Allow HTTP and DHCP profiling under policy map.

Enable device classification on global wireless settings.

26. An engineer must enable LSS for the AppleTV mDNS service only when ORIGIN is set to Wired.

Which action meets this requirement?

Set ORIGIN to Wired. Enable LSS by using the config mdns service Iss All command.

Set ORIGIN to Wired. Enable LSS by using the config mdns service Iss AppleTV command.

Set ORIGIN to either Wireless or All. Enable LSS by using the config mdns service Iss All command.

Set ORIGIN to either Wireless or All. Enable LSS by using the config mdns service Iss enable AppleTV command.

27. A customer has a distributed wireless deployment model where the WLCs are located in the data centers. Because the file servers are located in the data center, the traffic from the corporate WLAN “Corp-401266017” must go through the controllers, where the guest WLAN “Guest-19283746” traffic must use the local Internet line installed in each office.

Which configuration will accomplish this task?

Disable Local Switching for the corporate and guest WLA

Disable Local Switching for the corporate WLAN and enable it for the guest WLA

Enable Local Switching for the corporate and guest WLA

Enable Local Switching for the corporate WLAN and disable it for the guest WLA

28. An engineer needs to provision certificates on a Cisco Catalyst 9800 Series Wireless Controller. The customer uses a third-party CA server.

Which protocol must be used between the controller and CA server to request and install certificates?

SCEP

TLS

LDAP

SSL

29. An engineer is configuring a BYOD deploymernt strategy and prefers a single SSID model.

Which technology is required to accomplish this configuration?

mobility service engine

wireless control system

identify service engine

Prime Infrastructure

30. An engineer is performing a Cisco Hyperlocation accuracy test and executes the cmxloc start command on Cisco CMX.

Which two parameters arerelevant? (Choose two.)

X, Y real location

client description

AP name

client MAC address

WLC IP address

Page 4 of 7

31. A wireless engineer must implement a corporate wireless network for a large company in the most efficient way possible. The wireless network must support 32 VLANs for 300 employees in different departments.

Which solution must the engineer choose?

Configure a second WLC to support half of the APs in the deployment.

Configure one single SSID and implement Cisco ISE for VLAN assignment according to different user roles.

Configure different AP groups to support different VLANs, so that all of the WLANs can be broadcast on both radios.

Configure 16 WLANs to be broadcast on the 2.4-GHz band and 16 WLANs to be broadcast on the 5.0-GHz band.

32. An engineer is adding APs to an existing VolMLAN to allow for location based services.

Which option will the primary change be to the network?

increased transmit power on all APs

moving to a bridging model

AP footprint

cell overlap would decrease

triangulation of devices

33. DRAG DROP

The network management team in a large shopping center has detected numerous rogue APs from local coffee shops that are broadcasting SSIDs. All of these SSIDs have names starting with ATC (for example, ATC302, ATC011, and ATC566). A wireless network engineer must appropriately classifythese SSIDs using the Rogue Rules feature.

Drag and drop the options from the left onto the categories in which they must be used on the right. Not all options are used.

34. Which two steps are needed to complete integration of the MSE to Cisco Prime Infrastructure to track the location of clients/rogues on maps? (Choose two.)

Synchronize access points with the MS

Add the MSE to Cisco Prime Infrastructure using the CLI credentials.

Add the MSE to Cisco Prime Infrastructure using the Cisco Prime Infrastructure communication credentials.

Apply a valid license for Wireless Intrusion Prevention System.

Apply a valid license for location tracking.

35. A customer is deploying local web authentication.

Which software application must be implemented on Cisco ISE to utilize as a directory service?

Solaris Directory Service

LDAP

SAML

Novell eDirectory

36. Where is a Cisco OEAP enabled on a Cisco Catalyst 9800 Series Wireless Controller?

RF Profile

Flex Profile

Policy Profile

AP Join Profile

37. A user is trying to connect to a wireless network that is configured for WPA2-Enterprise security using a corporate laptop. The CA certificate for the authentication server has been installed on the Trusted Root Certification Authorities store on the laptop. The user has been prompted to enter the credentials multiple times, but the authentication has not succeeded.

What is causing the issue?

There is an IEEE invalid 802.1X authentication policy on the authentication server.

The user Active Directory account is locked out after several failed attempts.

There is an invalid 802.1X authentication policy on the authenticator.

The laptop has not received a valid IP address from the wireless controller.

38. A Cisco WLC has been added to the network and Cisco ISE as a network device, but authentication is failing.

Which configuration within the network device configuration should be verified?

SNMP RO community

device interface credentials

device ID

shared secret

39. Refer to the exhibit.

The security team has implemented ISE as an AAA solution for the wireless network. The wireless engineer notices that though clients are able to authenticate successfully, the ISE policies that are designed to place them on different interfaces are not working.

Which configuration must be applied in the RADIUS Authentication Settings section from the ISE Network Device page?

Disable KeyWrap.

Use ASCII for the key input format.

Change the CoA Port.

Correct the shared secret.

40. What is the maximum time range that can be viewed on the Cisco DNA Center issues and alarms page?

3 hours

24 hours

3 days

7 days

Page 5 of 7

41. Refer to the exhibit.

A network administrator deploys the DHCP profiler service in two ISE servers: 10.3.10.101 and 10.3.10.102. All BYOD devicesconnecting to WLAN on VLAN63 have been incorrectly profiled and are assigned as unknown profiled endpoints.

Which action efficiently rectifies the issue according to Cisco recommendations?

Nothing needed to be added on the Cisco WLC or VLAN interface. The ISE configuration must be fixed.

Disable DHCP proxy on the Cisco WL

Disable DHCP proxy on the Cisco WLC and run the ip helper-address command under the VLAN interface to point to DHCP and the two ISE servers.

Keep DHCP proxy enabled on the Cisco WLC and define helper-address under the VLAN interface to point to the two ISE servers.

42. An administrator receives reports of many interferers in the wireless network and wants to get the location of these interferers from the maps in Cisco Prime Infrastructure.

When looking at the floor plans/maps, the administrator does not see any interferers, but can see all wireless clients located successfully.

Which two statements define the cause of the issue? (Choose two.)

MSE is not added to Cisco Prime infrastructure and synchronized.

Interferer tracking is not enabled on the MS

SNMP between Cisco Prime Infrastructure and the WLC is failing.

Context Aware Service tracking limit has already been reached with tracking other elements.

NSMP communication is inactive with the WL

43. A wireless engineer has performed a Wireshark ccapture on an 802.1x authentication process to troubleshoot a connectivity issue.

Which two types of packet does the EAP contain? (Choose two.)

EAP complete

EAP response

EAP failure

EAP request

EAP reply

44. Refer to the exhibit.

An engineer needs to manage non-802.11 interference.

What is observed in the output on PI?

At least one strong interferer is impacting connectivity at this site.

Several light interferers are collectively impacting connectivity at this site.

The three individual clusters shown indicate poor AP placement.

RF at this site is unable to provide adequate wireless performance.

45. A Cisco CMX 3375 appliance on the 10.6.1 version code counts duplicate client entries, which creates wrong location analytics. The issue is primarily from iOS clients with the private MAC address feature enabled. Enabling this feature requires an upgrade of the Cisco CMX 3375 appliance in a high availability pair to version 10.6.3. SCP transfers the Cisco CMX image, but the upgrade script run fails.

Which configuration change resolves this issue?

Upgrade the high availability pair to version 10.6.2 image first and then upgrade to version 10.6.3.

Save configuration and use the upgrade script to upgrade the high availability pair without breaking the high availability.

Break the high availability using the cmxha config disable command and upgrade the primary and secondary individuality.

Run root patch to first upgrade to version 10.6.2 and then migrate to version 10.6.3.

46. A wireless network engineer must present a list of all rogue APs with a high severity score to senior management.

Which report must be created in Cisco Prime Infrastructure to provide this information?

Rogue AP Count Summary

New Rogue APs

Rogue AP Events

Rogue APs

47. All APs are receiving multicast traffic, instead of only the APs that need it.

What is the cause of this problem?

The multicast group includes all APs

The wrong multicast address was used

The multicast group is assigned the wrong VLAN

Multicast IGMP snooping is not enabled

48. Which customizable security report on Cisco Prime Infrastructure will show rogue APs detected since a point in time?

Network Summary

Rogue APs Events

New Rogue APs

Rogue APs Count Summary

49. An engineer is implementing a FlexConnect group for access points at a remote location using local switching but central DHCP.

Which client feature becomes available only if this configuration is changed?

multicast

static IP

fast roaming

mDNS

50. An enterprise has two WLANs configured on WLC. It is reported that when converting APs to FlexConnect mode, WLAN A works but WLAN B does not. When converting APs to local mode, WLAN B works, but WLAN A does not.

Which action is needed to complete this configuration?

Create a Cisco FlexConnect group with WLAN-VLAN mapping.

Disable local switching on the WLANs.

Map the AP group to the WLAN interface.

Join the APs to a Cisco FlexConnect group.

Page 6 of 7

51. Refer to the exhibit.

An engineer is creating an ACL to restrict some traffic to the WLC CPU.

Which selection must be made from the direction drop- down list?

It must be Inbound because traffic goes to the WL

Packet direction has no significance; it is always Any.

It must be Outbound because it is traffic that is generated from the WL

To have the complete list of options, the CPU ACL must be created only by the CL

52. An IT department receives a report of a stolen laptop and has information on the MAC address of the laptop.

Which two settings must be set on the wireless infrastructure to determine its location? (Choose two.)

Location History for Clients must be enabled on the MS

Client location tracking must be enabled on the MS

Location History for Visitors must be enabled on the MS

Location History for Rogue APs & Rogue Clients must be enabled on the MS

Tracking optimization must be enabled on the WL

53. Which devices can be tracked with the Cisco Context Aware Services?

wired and wireless devices

wireless devices

wired devices

Cisco certified wireless devices

54. An enterprise started using WebEx as a virtual meeting solution. There is a concern that the existing wireless network will not be able to support the increased amount of traffic as a result of using WebEx. An engineer needs to remark the QoS value for this application to ensure high quality inmeetings.

What must be implemented to accomplish this task?

QoS preferred call index

UP to DSCP map

AVC profiles

WLAN quality of service profile

55. Refer to the exhibit.

The image shows a packet capture that was taken at the CLI of the Cisco CMX server. It shows UDP traffic from the WLC coming into the server.

What does the capture prove?

The Cisco CMX server receives NetFlow data from the WL

The Cisco CMX server receives NMSP traffic from the WL

The Cisco CMX server receives SNMP traffic from the WL

The Cisco CMX server receives Angle-of-Arrival data from the WL

56. A network engineer wants to implement QoS across the network that supports multiple VLANs. All the APs are connected to switch ports and are configured in local mode.

Which trust model must be configured on the switch ports to which the APs are connected?

CoS

WMM UP

DSCP

IPP

57. A network engineer is implementing a wireless network and is considering deploying a single SSID for device onboarding.

Which option is a benefit of using dual SSIDs with a captive portal on the onboard SSID compared to a single SSID solution?

limit of a single device per user

restrict allowed devices types

allow multiple devices per user

minimize client configuration errors

58. An engineer is implementing RADIUS to restrict administrative control to the network with the WLC management IP address of 192.168.1.10 and an AP subnet of 192.168.2.0/24.

Which entry does the engineer define in the RADIUS server?

administrative access defined on the WLC and the network range 192.168.2.0/255.255.254.0

NAS entry of the virtual interface and the network range 192.168.2.0/255.255.255.0

shared secret defined on the WLC and the network range 192.168.1.0/255.255.254.0

WLC roles for commands and the network range 192.168.1.0/255.255.255.0

59. An engineer must achieve the highest level of location accuracy possible for a new mobile application.

Which technology must be implemented for this use case?

Time Difference of Arrival

Bluetooth Low Energy

RSS lateration

ToA lateration

60. An engineer must control administrative access to the WLC using their Active Directory without being concerned about RBAC after the admin user is authenticated.

Which two features does the engineer configure to accomplish this task? (Choose two.)

Device Admin Policy Set

User Access Mode: ReadWrite

ACL

RADIUS server

TACACS server

Page 7 of 7

61. Which EAP method can an AP use to authenticate to the wired network?

EAP-GTC

EAP-MD5

EAP-TLS

EAP-FAST

62. An engineer must implement a CPU ACL that blocks web management traffic to the controller, but they also must allow guests to reach a Web Authentication Redirect page.

To which IP address is guest client HTTPS traffic allowed for this to work?

DNS server IP

controller management IP

virtual interface IP

client interface IP

63. The CTO of an organization wants to ensure that all Android devices are placed into a separate VLAN on their wireless network. However, the CTO does not want to deploy ISE.

Which feature must be implemented on the Cisco WLC?

WLAN local policy

RADIUS server overwrite interface

AAA override

custom AVC profile

64. Refer to the exhibit.

An engineer is troubleshooting a client connectivity issue. The client is in the RUN state, and no traffic is passed after authenticating by using Cisco ISE.

Which action resolves the problem?

Configure a different client VLAN after authentication.

Disable the ACL that prevents traffic from being allowed.

Apply a lower WMM Qo

Enable rate-limiting to the client.

65. Which three properties are used for client profiling of wireless clients? (Choose three.)

HTTP user agent

DHCP

MAC OUI

hostname

OS version

IP address

Facebook Twitter LinkedIn Google + Email

Implementing Cisco Enterprise Wireless Networks (ENWLSI) 300-430 Practice Exam Questions Updated

Implementing Cisco Enterprise Wireless Networks (ENWLSI) 300-430 Practice Exam Questions Updated

Author

LEAVE A COMMENT Cancel reply

Related Posts