CiscoProfessional level300-430Page 3 of 4

300-430 exam dumps: questions 201 to 300 of 323

Page 3 of the free 300-430 question bank for the Implementing Cisco Enterprise Wireless Networks exam. Questions 201 to 300 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated February 2025

Start timed practice exam Questions 201 to 300

Free 300-430 practice questions

Questions 201 to 205 of 323

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

300-430 Question 201

Select 3

An enterprise network administrator is configuring a Guest Wi-Fi network using a Central Web Authentication (CWA) solution with Cisco ISE. The goal is to allow guest users to self-register, receive login credentials via email, and access the network after authentication. Which of the following actions are required to ensure a successful CWA implementation?

A
Configure a redirect ACL on the WLAN to allow unauthenticated users to reach the ISE portal.
B
Enable Layer 3 Security with WPA2-Enterprise on the guest SSID.
C
Set up a self-registration portal on Cisco ISE and link it to the guest WLAN.
D
Configure the WLC to redirect HTTP/HTTPS traffic to the Cisco ISE portal.
E
Assign guest users to a restricted VLAN after authentication.

Show answer and explanation

Correct answers: A, C, D

Explanation

Central Web Authentication (CWA) using Cisco ISE involves redirecting unauthenticated users from the guest SSID to an ISE-hosted portal for authentication and self-registration. Key steps include configuring a redirect ACL, setting up a self-registration portal on ISE, and enabling traffic redirection on the WLC. WPA2-Enterprise is not applicable for guest networks in this scenario, and while VLAN assignment may be done post-authentication, it is not a requirement for CWA implementation.

A. Correct.
Correct: The redirect ACL is required to allow unauthenticated users to access the Cisco ISE portal for self-registration and authentication.
B. Incorrect.
Incorrect: WPA2-Enterprise is not typically used for guest networks; instead, open authentication with redirection to a CWA portal is used.
C. Correct.
Correct: A self-registration portal must be configured on Cisco ISE to collect guest user details and generate login credentials.
D. Correct.
Correct: HTTP/HTTPS traffic needs to be redirected to the Cisco ISE portal for user authentication and registration.
E. Incorrect.
Incorrect: While assigning users to a restricted VLAN is a good practice, it is not a requirement for the CWA implementation process itself.

300-430 Question 202

Select 4

You are configuring a Guest Wi-Fi network for a client using Cisco ISE. The client wants users to self-register through a captive portal and be granted network access after accepting terms and conditions. Which of the following steps must you configure in Cisco ISE to implement Centralized Web Authentication (CWA) with a self-registration portal?

A
Configure a Guest Portal with self-registration enabled in Cisco ISE
B
Set up a Policy Set in Cisco ISE with Authentication and Authorization rules
C
Enable RADIUS Change of Authorization (CoA) on the network access device
D
Configure an ACL on the network access device to redirect HTTP/HTTPS traffic to Cisco ISE
E
Enable 802.1X authentication for guest users

Show answer and explanation

Correct answers: A, B, C, D

Explanation

Centralized Web Authentication (CWA) with a self-registration portal requires multiple configurations in Cisco ISE and the network infrastructure. A Guest Portal with self-registration provides the interface for users to register and accept terms. Policy Sets define the rules for handling guest traffic. RADIUS CoA is essential for updating the user's session after portal authentication, and ACLs on the network device redirect guest traffic to Cisco ISE for authentication. 802.1X is not typically used in guest access scenarios since it is designed for secure employee access.

A. Correct.
Correct: A Guest Portal with self-registration is required to allow users to create their own accounts and accept terms and conditions.
B. Correct.
Correct: Policy Sets in Cisco ISE define the Authentication and Authorization rules needed for CWA and guest access workflows.
C. Correct.
Correct: RADIUS CoA is mandatory for updating the user's session after successful authentication through the portal.
D. Correct.
Correct: ACLs on the network access device are necessary to redirect guest users' HTTP/HTTPS traffic to the Cisco ISE captive portal for authentication.
E. Incorrect.
Incorrect: 802.1X is not typically used for guest users in CWA scenarios. Instead, MAC Authentication Bypass (MAB) or open authentication is used to provide network access for redirection.

300-430 Question 203

Single answer

An organization wants to implement a Guest Wi-Fi network using Cisco ISE's Central Web Authentication (CWA) with a self-registration portal. The IT administrator has configured the WLC and ISE to redirect guest users to the self-registration portal for authentication. However, after connecting to the guest network, users are not redirected to the portal. Which configuration step is MOST likely missing or misconfigured?

A
The WLC's ACL blocking unauthenticated user access to the Internet is not applied.
B
The redirect ACL is not configured or is not applied on the WLC.
C
The ISE Guest Portal is not enabled or published.
D
The guest SSID is not configured for Layer 3 security with Web Authentication.

Show answer and explanation

Correct answer: B

Explanation

For Cisco ISE's CWA with a self-registration portal to function properly, the WLC must have a redirect ACL configured and applied. This ACL ensures that unauthenticated users are redirected to the ISE portal for authentication. If the redirect ACL is missing or misconfigured, users will not be redirected, causing the issue described in the question.

A. Incorrect.
This would block unauthenticated users from accessing the Internet, but it is not responsible for redirecting users to the self-registration portal. The issue here relates to redirection, not Internet access control.
B. Correct.
The redirect ACL specifies the traffic that needs to be intercepted and redirected to the ISE portal. If this is not configured or not applied, users will not be redirected to the portal, causing the described issue.
C. Incorrect.
While the Guest Portal needs to be enabled and published, this is not the root cause of the specific issue described. If this were the issue, users would see an error page rather than no redirection at all.
D. Incorrect.
Layer 3 security with Web Authentication is required for guest access, but the described issue is about the redirection to the self-registration portal. This configuration alone does not ensure proper redirection.

300-430 Question 204

Select 3

An organization wants to provide secure guest Wi-Fi access using a Captive Web Portal (CWP) through Cisco ISE. Guests should be able to self-register and receive their login credentials. During the configuration, which of the following steps must be implemented to achieve a successful Central Web Authentication (CWA) process?

A
Configure a redirect ACL on the Wireless LAN Controller (WLC) to forward unauthenticated users to the Cisco ISE portal
B
Enable RADIUS Change of Authorization (CoA) on Cisco ISE
C
Create a DHCP scope on the WLC for guest users to provide IP addresses
D
Configure a policy set in Cisco ISE to match the guest WLAN and apply the CWA profile
E
Enable WPA3-Enterprise security on the guest WLAN

Show answer and explanation

Correct answers: A, B, D

Explanation

To implement CWA using Cisco ISE, it is essential to configure a redirect ACL on the WLC to forward unauthenticated traffic to ISE, enable RADIUS CoA for dynamic reauthorization after successful registration, and create a policy set in ISE to match guest WLAN traffic and apply the CWA rules. These steps ensure the guest devices are redirected to the self-registration portal, authenticated, and authorized appropriately. Configuring DHCP on the WLC or using WPA3-Enterprise security is not relevant to the CWA process.

A. Correct.
Correct: A redirect ACL is required on the WLC to forward unauthenticated traffic to the Cisco ISE portal for guest self-registration.
B. Correct.
Correct: RADIUS Change of Authorization (CoA) is necessary for ISE to dynamically reauthorize the guest device once it has registered and authenticated.
C. Incorrect.
Incorrect: While DHCP is critical for guest devices to obtain IP addresses, DHCP configuration is typically done on a dedicated DHCP server, not directly on the WLC in most enterprise environments.
D. Correct.
Correct: A policy set in Cisco ISE is needed to identify guest WLAN traffic and apply the appropriate CWA redirection and authentication rules.
E. Incorrect.
Incorrect: WPA3-Enterprise is not applicable for guest networks that use CWA, as the guest network typically uses open authentication with a web-based portal.

300-430 Question 205

Select 3

An organization is deploying guest Wi-Fi access and plans to use Local Web Authentication (LWA). They want to integrate the solution with Cisco Identity Services Engine (ISE) for authentication and policy enforcement. Which of the following configurations are required to successfully implement LWA using ISE or WLC?

A
Configure the WLAN on the WLC to use the 'Layer 3 Web Policy' with the 'Authentication' option enabled.
B
Ensure that the WLC is added as a Network Device in Cisco ISE with a shared secret.
C
Enable 802.1X authentication on the WLAN for all guest users.
D
Configure a redirect URL on the WLC to point to the ISE's Guest Portal.
E
Use the default WLC self-signed certificate for HTTPS redirection.

Show answer and explanation

Correct answers: A, B, D

Explanation

To implement Local Web Authentication (LWA) using Cisco ISE or WLC, the WLAN must be configured with a Layer 3 Web Policy with authentication enabled, the WLC must be added to ISE as a Network Device with a shared secret, and a redirect URL must be configured to direct users to the ISE's Guest Portal. Using 802.1X for guest access is not required, and a valid certificate should replace the default WLC self-signed certificate to avoid browser trust issues.

A. Correct.
Correct: Local Web Authentication requires the WLAN to be configured with a Layer 3 Web Policy and the 'Authentication' option enabled to trigger the redirection to the ISE portal.
B. Correct.
Correct: The WLC must be added to Cisco ISE as a Network Device with the proper shared secret to enable communication and RADIUS authentication.
C. Incorrect.
Incorrect: 802.1X is not used for guest access in an LWA setup. Instead, guests are authenticated through the web portal after being redirected.
D. Correct.
Correct: A redirect URL is required to point the client devices to the ISE's Guest Portal for web-based authentication.
E. Incorrect.
Incorrect: The default self-signed certificate on the WLC is not recommended because it may cause browser warnings. A valid, trusted certificate should be used to avoid trust issues.

Timed practice exam

Take a 300-430 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

300-430 practice questions 201 to 300 of 323

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 4 pages of up to 100 questions.