300-425 Question 196
Select 3A university campus wants to implement BYOD and guest access for its wireless network. The IT administrator needs to ensure that students can connect their personal devices securely while also providing internet-only access to campus visitors without compromising the internal network. Which combination of features should the IT administrator implement to meet these requirements?
- A
Use Cisco Identity Services Engine (ISE) to enable device profiling and policy enforcement for BYOD users.
- B
Configure a dedicated Guest WLAN with Layer 3 security and web-based captive portal authentication.
- C
Enable WPA3-Enterprise with certificate-based authentication for guest users to improve security.
- D
Deploy a separate VLAN for guest traffic with Access Control Lists (ACLs) to restrict access to internal resources.
- E
Enable band steering to improve performance for both BYOD and guest users on the 5 GHz band.
Show answer and explanation
Correct answers: A, B, D
Explanation
To successfully implement BYOD and guest access, the IT administrator needs to combine secure authentication and access control for BYOD users (using Cisco ISE for device profiling and policy enforcement) with dedicated and isolated access for guest users (using a Guest WLAN with a captive portal and VLAN segmentation with ACLs). These measures ensure both secure access for personal devices and restricted access for guest users, safeguarding the internal network.
- A. Correct.
Cisco ISE enables advanced policy enforcement and device profiling for BYOD users, ensuring secure access based on user roles and device types. This is essential for managing personal devices brought by students.
- B. Correct.
A dedicated Guest WLAN with a captive portal provides a simple and secure way to authenticate guest users and ensures their access is limited to internet-only services.
- C. Incorrect.
WPA3-Enterprise with certificate-based authentication is not typically used for guest access. Guest users are usually authenticated through simpler methods like captive portals to ease their onboarding process.
- D. Correct.
Deploying a separate VLAN for guest traffic with ACLs ensures that guest users are isolated from internal resources, protecting the internal network from unauthorized access.
- E. Incorrect.
While band steering can improve wireless performance, it does not address security or access control requirements for BYOD or guest users.