300-425 Question 242
Select 3You are managing a Cisco wireless network for a large enterprise. During a routine check in the Cisco DNA Center, you notice a high-priority alarm indicating multiple rogue access points detected in a sensitive area. What steps should you take to address this issue effectively?
- A
Classify the rogue APs as 'Malicious' if they are spoofing authorized SSIDs or pose a security threat.
- B
Ignore the alarm, as rogue APs are typically harmless and do not require action.
- C
Use the Cisco Wireless LAN Controller (WLC) to contain the rogue APs by blocking their communication.
- D
Verify whether the detected rogue APs are actually legitimate devices like neighboring networks or misconfigured authorized APs.
- E
Disable rogue detection on the controller to avoid future alarms.
Show answer and explanation
Correct answers: A, C, D
Explanation
To manage rogue APs effectively, it is critical to classify the threat level, verify the legitimacy of the detected devices, and take action to mitigate risks such as containing malicious APs. Ignoring the alarm or disabling rogue detection will leave the network vulnerable to potential attacks.
- A. Correct.
Classifying rogue APs as 'Malicious' helps prioritize mitigation actions for devices that pose a security risk, such as spoofing SSIDs or performing unauthorized activity.
- B. Incorrect.
Ignoring the alarm is not a best practice, as rogue APs can compromise network security and user data.
- C. Correct.
Containing rogue APs using the WLC is an effective way to block their communication and prevent security risks within your network.
- D. Correct.
Verifying the rogue APs ensures that false positives (e.g., neighboring networks or misconfigured authorized APs) are not mistakenly classified as threats.
- E. Incorrect.
Disabling rogue detection is not recommended, as it would prevent the system from identifying security threats in the future.