300-430 Sample Questions & Answers

A Control Plane ACL is specifically designed to protect the CPU of a network device like a WLC or router. It filters traffic that is punted to the control plane for processing, such as management traffic (SSH, SNMP, HTTPS) and routing protocol updates. Applying a Control Plane ACL is a best practice for hardening the controller against DoS attacks and unauthorized access attempts directed at the device itself.

In the Catalyst 9800's policy model, the Policy Profile is where QoS settings for wireless clients are defined. Within the Policy Profile, under the QoS tab, you can configure both upstream (client to AP) and downstream (AP to client) QoS mappings. To mark traffic from the client with DSCP EF, you would configure the 'UP QoS Map' to map the WMM UP value for voice (typically 6) to a DSCP value of EF (46).

RLDP (Rogue Location Discovery Protocol) is a dual-purpose feature. While primarily for locating rogue devices, it also enables the tracking of Wi-Fi RFID tags. When RLDP is enabled, the WLC can instruct associated APs to send special frames to the RFID tag. The tag's response is heard by multiple APs, and this information is forwarded via NMSP to CMX, which then calculates the tag's location without requiring the tag to be a fully authenticated data client.

Bonjour uses multicast DNS (mDNS), which relies on link-local multicast addresses (224.0.0.251) that are not routable. To allow discovery across different VLANs (subnets), the WLC must act as an mDNS Gateway. When this feature is enabled, the WLC listens for mDNS advertisements on one VLAN, caches them, and then responds to mDNS queries from clients on other VLANs, effectively bridging the service discovery process across Layer 3 boundaries.

This is true. When FlexConnect Local Authentication is configured, the WLC pushes the user credentials or certificate information for currently associated clients to the FlexConnect AP. If the AP enters standalone mode, it can use this cached information to act as a limited RADIUS server and authenticate new or re-authenticating clients without needing to contact the central ISE server. This provides a high degree of fault tolerance.

The Sponsored Guest Portal in Cisco ISE is designed for this exact workflow. A guest initiates the registration process on their own, providing their details and the email address of their internal sponsor. ISE then sends an approval request to the sponsor. Only after the sponsor approves the request does ISE grant network access to the guest, fulfilling the company's security policy.

802.1X AP Authentication provides the most secure method for authenticating APs to a WLC. In this model, the AP acts as a supplicant and the WLC acts as an authenticator, proxying the request to a RADIUS server (like ISE). Modern Cisco APs use their built-in Secure Unique Device Identifier (SUDI) certificate for this process, ensuring that only legitimate, company-owned APs can join the controller.

Split Tunneling is the feature that controls whether traffic from a client connected to an OfficeExtend AP can access the local network. When enabled, traffic destined for the corporate network is tunneled back to the WLC, while other traffic (like internet or local printer access) is switched locally onto the home network. By disabling split tunneling, all traffic from the corporate SSID is forced through the secure CAPWAP tunnel to the corporate WLC, effectively isolating corporate devices from the local home network.

In a central switching scenario, client traffic is tunneled from the FlexConnect AP to the WLC inside a CAPWAP tunnel. The WLC then decapsulates the traffic and places it onto a VLAN or interface. Any ACLs applied to this specific VLAN/interface on the WLC will filter the client's traffic. Since DHCP is fundamental client traffic, an ACL on this interface is the most likely place for the block to occur.