300-425 Question 199
Select 2A retail organization wants to implement a wireless network that supports BYOD and guest access in their stores. They require that guest users must authenticate through a captive portal and be isolated from internal resources, while BYOD devices must authenticate using their Active Directory credentials and be assigned to different VLANs based on device type. Which combination of solutions will best meet these requirements?
- A
Configure a Cisco ISE server for handling authentication and VLAN assignment for BYOD devices.
- B
Enable open authentication on the guest SSID and configure an ACL to restrict guest access.
- C
Implement a captive portal on the guest SSID for authentication and use Layer 2 isolation to prevent access to internal resources.
- D
Use Cisco Prime Infrastructure to assign VLANs dynamically based on device type.
- E
Deploy a separate WLAN controller for guest traffic to ensure complete separation from corporate resources.
Show answer and explanation
Correct answers: A, C
Explanation
The combination of Cisco ISE for BYOD authentication and VLAN assignment, along with a captive portal and Layer 2 isolation for guest access, ensures the organization meets the requirements for both BYOD and guest network use cases. These solutions ensure secure authentication, proper VLAN assignment, and isolation of guest traffic from corporate resources.
- A. Correct.
Cisco ISE (Identity Services Engine) is used to authenticate BYOD devices and assign them to the appropriate VLAN based on policies, which meets the organization's requirement for BYOD access.
- B. Incorrect.
Open authentication does not provide a secure method for guest access and does not satisfy the requirement for a captive portal or ACL-based restrictions.
- C. Correct.
Using a captive portal for guest authentication ensures that guests can authenticate before accessing the network, while Layer 2 isolation prevents guests from accessing internal resources, aligning with the organization's needs.
- D. Incorrect.
Cisco Prime Infrastructure is not designed to dynamically assign VLANs based on device type. This functionality is better handled by Cisco ISE.
- E. Incorrect.
Deploying a separate WLAN controller for guest traffic may provide additional separation, but it is not necessary for meeting the stated requirements and would incur additional costs and complexity.