Cisco Exam 300-430 Topic 5 Question 78 Discussion

Actual exam question for Cisco's 300-430 exam

Question #: 78
Topic #: 5

WPA2 Enterprise with 802.1X is being used for clients to authenticate to a wireless network through a Cisco ISE server. For security reasons, the network engineer wants to ensure that only PEAP authentication is used. The engineer sent instructions to clients on how to configure the supplicants, but the ISE logs still show users authenticating using EAP-FAST. Which action ensures that access to the network is restricted for these users unless the correct authentication mechanism is configured?

AEnable AAA override on the SSID, gather the usernames of these users, and disable the RADIUS accounts until the devices are correctly configured.

BEnable AAA override on the SSID and configure an ACL on the WLC that allows access to users with IP addresses from a specific subnet.

CEnable AAA override on the SSID and configure an access policy in Cisco ISE that denies access to the list of MACs that have used EAP-FAST.

DEnable AAA override on the SSID and configure an access policy in Cisco ISE that allows access only when the EAP authentication method is PEAP.

Show Suggested Answer

Suggested Answer: A

by Lili at Dec 06, 2024, 03:29 AM

Limited Time Offer

25%

Off

Get Premium 300-430 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Keshia

1 months ago

Hold up, are we sure the users aren't just trying to sneak in some EAP-FAST action? Maybe they're just feeling nostalgic for the good old days. Either way, D is the answer, and I'm not going to judge their authentication preferences.

upvoted 0 times

Bernadine

14 days ago

User 1: Maybe they just miss EAP-FAST, who knows.

upvoted 0 times

...

2 months ago

Hmm, I'm not sure about that. Disabling RADIUS accounts or configuring an ACL on the WLC based on IP addresses seems a bit too heavy-handed. D looks like the more targeted and secure approach.

upvoted 0 times

Timmy

28 days ago

User 2: Yeah, it seems like the most secure option to ensure only PEAP authentication is used.

upvoted 0 times

...

Corrina

1 months ago

User 1: I think option D is the way to go.

upvoted 0 times

...

Billy

2 months ago

I agree with Gail, D seems like the most logical choice to ensure only PEAP authentication is used.

upvoted 0 times

...

Dominque

2 months ago

I think the correct answer is D. Enabling AAA override and configuring an access policy in Cisco ISE to allow access only when the EAP authentication method is PEAP seems like the most straightforward way to ensure that users can only use the desired authentication mechanism.

upvoted 0 times

...

Gail

2 months ago

I think the answer is D, because it specifically mentions restricting access based on the authentication method.

upvoted 0 times

...