Cisco CCNP 300-430 Questions & Answers

• Question 1:

  DRAG DROP

  A network engineer must get an autonomous AP to authenticate to the upstream switch via IEEE 802.1 X. Drag and drop the commands from the left onto the right to complete the configuration.

  Select and Place:

  

  Correct Answer:

  

• Question 2:

  DRAG DROP

  The network management team in a large shopping center has detected numerous rogue APs from local coffee shops that are broadcasting SSIDs. All of these SSIDs have names starting with ATC (for example, ATC302, ATC011, and ATC566). A wireless network engineer must appropriately classify these SSIDs using the Rogue Rules feature. Drag and drop the options from the left onto the categories in which they must be used on the right. Not all options are used.

  Select and Place:

  

  Correct Answer:

  

• Question 3:

  A network administrator managing a Cisco Catalyst 9800-80 WLC must place all iOS connected devices to the guest SSID on VLAN 101. The rest of the clients must connect on VLAN 102 to distribute load across subnets. To achieve this configuration, the administrator configures a local policy on the WLC.

  Which two configurations are required? (Choose two.)

  A. Allow HTTP and DHCP profiling under policy map.

  B. Enable device classification on global wireless settings

  C. Add local profiling policy under global security policy settings

  D. Assign a policy map under global security policy settings

  E. Create a service template

  Correct Answer: BE

• Question 4:

  A healthcare organization notices many rogue APs and is concerned about a honeypot attack.

  Which configuration must a wireless network engineer perform in Cisco Prime Infrastructure to prevent these attacks most efficiently upon detection?

  A. Set the auto containment level to 0 and select the Ad Hoc Rogue AP containment option.

  B. Set the auto containment level to 0 and select the Using Our SSID containment option

  C. Set the manual containment level to 4 and select the Ad Hoc Rogue AP containment option.

  D. Set the auto containment level to 4 and select the Using Our SSID containment option.

  Correct Answer: C

• Question 5:

  An engineer completes the setup of a wo-node Cisco ISE deployment for a guest portal. When testing the portal, the engineer notices that sometimes there is a certificate CN mismatch.

  Which certificate type helps resolve this issue?

  A. Public-Signed Root

  B. Self-Signed Standard

  C. Public-Signed SAN

  D. Self-Signed Wildcard

  Correct Answer: D

• Question 6:

  In a Cisco WLAN deployment, it is required that all APs from branch 1 remain operational even if the control plane CAPWAP tunnel is down because of a WAN failure to headquarters.

  Which operational mode must be configured on the APs?

  A. Disconnected

  B. Connected

  C. Lightweight

  D. Standalone

  Correct Answer: D

• Question 7:

  An engineer is deploying a virtual MSE. The network has 3000 APs and needs 7000 IPS licenses. To which size server does the engineer scale it?

  A. virtual

  B. standard

  C. high end

  D. low end

  Correct Answer: C

• Question 8:

  ALLAR A network engineer must segregate all iPads on the guest WLAN to a separate VLAN.

  How does the engineer accomplish this task without using Cisco ISE?

  A. Enable RADIUS DHCP profiling on the WLAN.

  B. Create a local policy on the WLC.

  C. Use an mDNS profile for the iPad device.

  D. Use 802.1x authentication to profile the devices

  Correct Answer: B

• Question 9:

  An engineer wants to upgrade the APs in a Cisco FlexConnect group. To accomplish this upgrade, the FlexConnect AP Upgrade setting will be used One AP of each model with the lowest MAC address in the group must receive the upgrade directly from the controller.

  Which action accomplishes this direct upgrade?

  A. Reboot all APs before the upgrade.

  B. Remove the APs from the group

  C. Do not set any master APs. 9 0

  D. Allocate the master APs to different groups

  Correct Answer: D

• Question 10:

  On a Cisco Catalyst 9800 Series Wireless Controller, an engineer wants to prevent a FlexConnect AP from allowing wireless clients to connect when its Ethernet connection is nonoperational.

  Which command set prevents this connection?

  A. config terminal wireless profile flex [profile name] fallback-radio-shut end

  B. config terminal wireless flexconnect profile [profile name] fallback-radio-shut end

  C. config terminal wireless flexconnect profile [profile name) ethernet-fallback-enable end

  D. config terminal wireless profile flex [profile name] ethernet-fallback-enable end

  Correct Answer: A