Client Connectivity Configuration (20%)

350-101 · 60 questions

• University laptops associate to the 802.1X campus WLAN, then fail authentication. The external RADIUS server log says the wireless controller is not a known network device. What must be added on that server before students can pass authentication?
• A bank builds a WLAN allow list from each laptop's hardware MAC address. Windows laptops present a randomized MAC address through association and fail the filter, even though those hardware addresses are on the list. Which client behavior explains the failure?
• Hospital laptops use PEAP to an external RADIUS server and fail with a server-certificate warning. The controller is already a trusted network device on that server. What has to be fixed for the laptops to trust the authentication server?
• A bank wants branch guest sessions to terminate on a controller in the DMZ, not on the branch employee VLAN. Each branch already has its own controller. Which guest design places that traffic on the DMZ controller?
• University voice handsets complete a full EAP exchange every time they change access points, and the call audio gaps. The WLAN is already 802.1X. Which roaming mechanism avoids repeating that full EAP exchange inside the same mobility domain?
• A hotel wants lobby visitors to join a WLAN with no password and no 802.1X login, while still encrypting each visitor's frames so other guests cannot sniff them. Which security configuration matches that requirement?
• Hotel guests associate to the guest WLAN and never see the captive portal, and they never get an address. The pre-authentication ACL on that WLAN blocks DHCP and DNS. What must that ACL allow before the portal can run?
• A hotel wants lobby guests to type a username on a page hosted by the wireless controller, with no external policy server in the design. Which authentication fits?
• Hospital voice handsets roam without a full EAP exchange, but each roam still takes a long time while the handset scans every channel. Which mechanism shortens that scan?
• A bank will not allow user passwords on the office WLAN and requires each laptop and the authentication server to prove identity with a certificate. Which method fits?
• University iPhones must use EAP-TLS on the campus WLAN. Students who only receive a verbal passphrase cannot get the phones to present a certificate. What do the phones need before they can connect that way?
• A hotel wants the staff WLAN to use one shared passphrase and WPA3, with protected management frames, and it does not want a RADIUS server. Which WLAN security matches that?
• Hotel guests on the guest WLAN can reach other guests' devices directly. The hotel wants that client-to-client traffic stopped and the SSID left in place. Which configuration does that?
• Hotel phones stay associated to a distant access point at a weak signal while a nearer access point is idle. The WLAN already has fast transition. Which feature lets the infrastructure suggest that the phone move?
• A clinic laptop passes 802.1X and then fails posture. ISE is supposed to move that session onto a remediation VLAN without a new association. What must ISE send?
• A university laptop fails the dorm PSK on every try. A new phone, given the same passphrase by the help desk, joins immediately. The laptop has an old passphrase saved for that SSID. What should the student do on the laptop?
• Bank Windows laptops must be on the domain WLAN at the logon screen, before any user signs in, so they can run startup scripts. They only join the WLAN after the user enters a password. What is the supplicant missing?
• A hotel sets a staff WLAN to WPA3 and then disables protected management frames. WPA3 clients refuse the WLAN. What does WPA3 require here?
• Voice handsets on a campus WLAN cannot use 802.11r, and each roam still runs a full EAP exchange. The access points are on one controller. Which feature avoids that full exchange without 802.11r?
• A lab WLAN uses MAC filtering as its only control and calls that authentication. A tester sets a laptop to an allowed MAC address and joins with no credentials. What did the filter fail to do?
• A corporate laptop has its EAP-TLS certificate in the machine certificate store. The Windows supplicant for the office WLAN is set to use a certificate from the user store, and authentication fails before a password prompt. What is mis-set?
• Hotel guests get an address on the guest WLAN and never see the ISE portal. DHCP works. The WLAN is meant to use central web authentication, and the session is not being redirected. What is missing?
• Bank laptops present machine certificates for EAP-TLS. The RADIUS server log says it does not trust the authority that issued those certificates. What is missing on the server?
• Staff roam between two buildings, each with its own Catalyst 9800, and their phones get a new address every time, which drops the call. The SSID and security match. Mobility is not configured between the controllers. What is missing?
• After a brief WAN blip, a clinic controller marks its only RADIUS server dead. New 802.1X clients fail until the dead timer ends, and there is no second server. What should be added?
• Handsets that support fast transition still do a full EAP exchange when they roam across a campus. The WLAN has fast transition enabled, and the two access points advertise different mobility domain names. What breaks the fast roam?
• Bank guests get online and can also resolve internal bank hostnames. The guest DHCP scope is handing out the internal DNS servers. What should change?
• Hotel guests reach the captive portal and the browser warns that the portal certificate is not trusted. The portal page is otherwise the right one. What should be installed?
• After a dorm WLAN moves from WPA2 to WPA3, student phones keep failing. Each phone has the old WPA2 network saved and offers WPA2. A phone that forgets the network and joins fresh succeeds with WPA3. What should the other students do?
• Factory scanners that only support WPA2 stop joining after a staff WLAN is set to WPA3 only. Phones that support WPA3 must keep using WPA3. Which WLAN setting lets both on?
• A new phone fails EAP-TLS on a campus WLAN. The same certificate works in a laptop. The phone's clock is set a year behind, and the certificate's start date is last month. What should change on the phone?
• A factory lab wants 802.1X for six laptops and has no RADIUS server on site. The production WLAN must keep using the corporate RADIUS servers. What fits the lab WLAN?
• A phone roams between two campus access points and keeps the SSID. The new policy puts it in a different VLAN. Existing sessions stall until the phone gets an address in the new subnet. What kind of roam is this?
• After a hospital RADIUS certificate is reissued by a new CA, laptops reject the server. The new certificate is in date, and the laptops trust only the old CA. What do the laptops need?
• Hotel guests get an address and can resolve the portal name. The browser never opens the portal. The pre-authentication filter allows DHCP and DNS only. What is missing from that filter?
• Clinic laptops reject the RADIUS server during PEAP. The certificate is inside its dates and is signed by a CA the laptops trust, and the name on the certificate is the old lab name. The laptops are set to check the production server name. What is wrong?
• Production laptops fail 802.1X on a new WLAN. The same accounts succeed on the existing WLAN. The new WLAN is aimed at a lab RADIUS server that has none of those accounts. What should change?
• A campus WLAN now requires EAP-TLS. A laptop has a working certificate profile and an older PEAP profile, and it keeps offering PEAP. A laptop that is set to the certificate profile joins. What should the other laptops change?
• Visitors at a city hall are given the employee pre-shared key so they can get online. They land on the employee WLAN and can see employee servers. What should replace that shortcut?
• A plant WLAN requires fast transition. Newer phones roam quickly. Older scanners that do not support fast transition cannot associate at all. What does the requirement do to those scanners?
• A lobby WLAN uses Enhanced Open. Guests join with no password and the frames are encrypted. A technician wants to add a pre-shared key so that encryption will start. What is the right response?
• Phones fail a WPA2 pre-shared key that the front desk swears is correct. The controller value matches the card except for a space at the end. What is wrong?
• A laptop fails authorization on a campus WLAN. It uses a random MAC on that SSID, and the only allow rule matches the laptop's hardware MAC. The same laptop joins a WLAN that does not match on MAC. What should change for the campus WLAN?
• Handsets that support fast transition only over the distribution system do a full EAP roam. The WLAN offers fast transition only over the air. Phones that support the over-the-air method roam quickly. What should change for the handsets?
• Hotel guests never see the portal. The pre-authentication filter allows the portal and blocks DHCP. A guest that is given a static address can open the portal. What is the filter blocking that the guests need first?
• Guest phones associate at a branch and then fail. The mobility tunnel to the anchor controller is up. The guest WLAN exists on the branch and does not exist on the anchor. What is missing on the anchor?
• A laptop fails EAP-TLS. Its user certificate expired last week. The RADIUS server certificate is valid, and a laptop with a current user certificate joins. What should be renewed?
• Guests are redirected to a local web page and then rejected. The guest account on the controller expired yesterday. The redirect itself loads. What should be updated?
• A laptop fails EAP-TLS. The user certificate is in the certificate store and is valid. The supplicant is set to use a smart card, and no smart card is present. What should change?
• A phone clings to the first access point long after a nearer access point is much stronger. The phone is set to stay associated until the signal is very poor. What is deciding the roam?
• Handsets that support neighbor reports drop calls while they roam. Neighbor reports are disabled, so each handset scans every channel before it moves. What should be enabled?
• Laptops are set to trust a RADIUS name. The certificate contains that name and not the server's IP address. The WLAN is configured with the IP address, and the laptops reject the server. Why?
• A lab WLAN uses local EAP on the controller. One new engineer fails, and other local users join. That engineer was never added to the local user list. What is missing?
• A WPA2 WLAN requires protected management frames. New phones join. Older scanners that cannot protect management frames never associate. What does the requirement do?
• Guests are anchored on a controller in the DMZ. An engineer moves the guest VLAN onto the campus switch so the anchor is no longer in the path. Guests can now reach campus servers. What was bypassed?
• The pre-shared key on a WLAN was rotated. Phones that still have the old key saved fail. A phone that is given the new key joins. What do the failing phones still have?
• Guests reach the internet before they authenticate. The pre-authentication filter allows DHCP, DNS, the portal, and general internet access. What is the filter allowing that it should not?
• Some laptops reject the RADIUS server and others accept it. The server certificate is signed by an intermediate CA. The laptops that accept it have that intermediate installed, and the others do not. What is missing on the failing laptops?
• A laptop fails EAP-TLS after a user logs on. The machine certificate is present and valid. The profile is set for user authentication, and this user has no certificate. What is missing?
• Clients authenticate while the primary RADIUS server is up. When it is down, they fail. The secondary server is reachable, and its shared secret does not match the controller. What is wrong?