Cisco 300-375 Online Practice Questions and Exam Preparation

Cisco 300-375 Online Questions & Answers

• Question 151:

  A wireless engineer has performed a Wireshark capture on an 802.1x authentication process to troubleshoot a connectivity issue. Which two types of packet does the EAP contain? (Choose two.)

  A. EAP response
  B. EAP failure
  C. EAP reply
  D. EAP complete
  E. EAP reject
  A. EAP response
  B. EAP failure

• Question 152:

  Refer to the exhibit.

  

  What is the 1.1.1.1 IP address?

  A. the wireless client IP address
  B. the RADIUS server IP address
  C. the controller management IP address
  D. the lightweight AP IP address
  E. the controller A-manager IP address
  F. the controller virtual interface IP address
  F. the controller virtual interface IP address

  ---

  Web Authentication Process

  This is what occurs when a user connects to a WLAN configured for web authentication:

  The user opens a web browser and enters a URL, for example, http://www.cisco.com. The client sends out a DNS request for this URL to get the IP for the destination. The WLC bypasses the DNS request to the DNS server and the DNS

  server responds back with a DNS reply, which contains the IP address of the destination www.cisco.com. This, in turn, is forwarded to the wireless clients.

  The client then tries to open a TCP connection with the destination IP address. It sends out a TCP SYN packet destined to the IP address of www.cisco.com.

  The WLC has rules configured for the client and hence can act as a proxy for www.cisco.com. It sends back a TCP SYN-ACK packet to the client with source as the IP address of www.cisco.com. The client sends back a TCP ACK packet in

  order to complete the three way TCP handshake and the TCP connection is fully established.

  The client sends an HTTP GET packet destined to www.cisco.com. The WLC intercepts this packet and sends it for redirection handling. The HTTP application gateway prepares a HTML body and sends it back as the reply to the HTTP

  GET requested by the client. This HTML makes the client go to the default webpage URL of the WLC, for example, http:///login.html.

  The client closes the TCP connection with the IP address, for example, www.cisco.com.

  Now the client wants to go to http://1.1.1.1/login.html. Therefore, the client tries to open a TCP connection with the virtual IP address of the WLC. It sends a TCP SYN packet for 1.1.1.1 to the WLC.

  The WLC responds back with a TCP SYN-ACK and the client sends back a TCP ACK to the WLC in order to complete the handshake.

  The client sends a HTTP GET for /login.html destined to 1.1.1.1 in order to request for the login page.

  This request is allowed up to the Web Server of the WLC, and the server responds back with the default login page. The client receives the login page on the browser window where the user can go ahead and log in.

  Reference: http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/69340-web-auth-config.html#backinfo

• Question 153:

  An engineer is configuring central web authentication using a Cisco 5508 wireless controller and the Cisco Identity Service Engine.

  Which two attributes must be configured on Cisco ISE to add the controller as a network device? (Choose two.)

  A. controller IP address
  B. authentication protocol
  C. controller software version
  D. out-of-band SGA PAC
  E. RADIUS shared secret
  A. controller IP address
  E. RADIUS shared secret

• Question 154:

  Which MDM feature do you use when a device is lost or stolen?

  A. user account disable
  B. remote wipe
  C. access revocation
  D. remote disable
  B. remote wipe

• Question 155:

  An engineer is considering an MDM integration with Cisco ISE to assist with security for lost devices. Which two functions of MDM increase security for lost devices that access data from the network? (Choose two.)

  A. PIN enforcement
  B. jailbreak/root detection
  C. data wipe
  D. data encryption
  E. data loss prevention
  A. PIN enforcement
  C. data wipe

  ---

  Wiping or Locking a Device

  Cisco ISE allows you to wipe or turn on pin lock for a device that is lost. You can do this from the Endpoints page.

  Step 1 Choose Administration > Identity Management > Identities > Endpoints.

  Step 2 Check the check box next to the device that you want to wipe or lock.

  Step 3 From the MDM Access drop-down list, choose any one of the following options as shown in :

  Full Wipe -- Removes all information from the device

  Corporate Wipe -- Removes applications that you have configured in the MDM server policies

  PIN Lock -- Locks the device

  Reference: http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_man_network_devices.html

• Question 156:

  An engineer has determined that the source of an authentication issue is the client laptop. Which three items must be verified for EAP-TLS authentication? (Choose three.)

  A. The client certificate is formatted as X.509 version 3.
  B. The validate server certificate option is disabled.
  C. The client certificate has a valid expiration date.
  D. The user account is the same in the certificate.
  E. The supplicant is configured correctly.
  F. The subject key identifier is configured correctly.
  A. The client certificate is formatted as X.509 version 3.
  D. The user account is the same in the certificate.
  F. The subject key identifier is configured correctly.

  ---

  Reference: http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a008009256b.shtml

• Question 157:

  Access points at branch sites for a company are in FlexConnect mode and perform local switching, but they authenticate to the central RADIUS at headquarters. VPN connections to the headquarters have gone down, but each branch site has a local authentication server.

  Which three features on the wireless controller can be configured to maintain network operations if this situation reoccurs? (Choose three.)

  A. Put APs in FlexConnect Group for Remote Branches.
  B. Set Branch RADIUS as Primary.
  C. Put APs in AP Group Per Branch.
  D. Put APs in FlexConnect Group Per Branch.
  E. Set Branch RADIUS as Secondary.
  F. Set HQ RADIUS as Primary.
  A. Put APs in FlexConnect Group for Remote Branches.
  E. Set Branch RADIUS as Secondary.
  F. Set HQ RADIUS as Primary.

• Question 158:

  Which two considerations must a network engineer have when planning for voice over wireless roaming? (Choose two.)

  A. Roaming with only 802.1x authentication requires full reauthentication.
  B. Roaming time increases when using 802.1x + Cisco Centralized Key Management.
  C. Full reauthentication introduces gaps in a voice conversation.
  D. Roaming occurs when the phone has reached -80 dBs or below.
  E. Roaming occurs when the phone has seen at least four APs.
  A. Roaming with only 802.1x authentication requires full reauthentication.
  C. Full reauthentication introduces gaps in a voice conversation.

  ---

  Explanation: In the absence of CCKM, a WPA/WPA2 client must perform a full EAP authentication to a remote AAA/RADIUS server, followed by a WPA/WPA2 4-way handshake whenever it roams. This process can take more than one second. With CCKM, the roaming client and WLC can use pre-established keying material to immediately establish a PTK--normally within a few ten of milliseconds.

• Question 159:

  An engineer has configured passive fallback mode for RADIUS with default timer settings. What will occur when the primary RADIUS fails then recovers?

  A. RADIUS requests will be sent to the secondary RADIUS server until the secondary fails to respond.
  B. The controller will immediately revert back after it receives a RADIUS probe from the primary server.
  C. After the inactive time expires the controller will send RADIUS to the primary.
  D. Once RADIUS probe messages determine the primary controller is active the controller will revert back to the primary RADIUS.
  C. After the inactive time expires the controller will send RADIUS to the primary.

• Question 160:

  Which command is an SNMPv3-specific command that an engineer can use only in Cisco IOS XE?

  A. snmp-server user remoteuser1 group1 remote 10.12.8.4
  B. snmp-server host 172.16.1.33 public
  C. snmp-server community comaccess ro 4
  D. snmp-server enable traps wireless
  A. snmp-server user remoteuser1 group1 remote 10.12.8.4

  ---

  SUMMARY STEPS

  1.

  enable

  2.

  configure terminal

  3.

  snmp-server group [group-name {v1 | v2c | v3 [auth | noauth | priv]}] [read read-view] [write write-view] [notify notify-view] [access access-list]

  4.

  snmp-server engineID {local engine-id | remote ip-address [udp-port udp-port-number] [vrf vrf-name] engine-id-string}

  5.

  snmp-server user user-name group-name [remote ip-address [udp-port port]] {v1 | v2c | v3 [encrypted] [auth{md5 | sha} auth-password]} [access access-list]

  6.

  end Reference: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/3850/snmp-xe-3se-3850-book/nm-snmp-snmpv3.html#GUID-54F1E297-CE1D-45FE-9751-B8D129606010