300-430 Question 220
Select 3An organization uses Cisco ISE to manage authentication for its wireless network. The network consists of Cisco Catalyst 9800 Series wireless controllers and a mix of 802.1X-capable clients. The administrator wants to ensure that users are authenticated using their corporate credentials and that unauthorized devices are denied access. Which of the following steps should be implemented to achieve this?
- A
Configure the wireless controller to use RADIUS as the authentication method and point it to Cisco ISE.
- B
Enable WPA3-Personal on the wireless SSID to enforce strong encryption.
- C
Create a policy set in Cisco ISE to match the SSID and apply appropriate authentication and authorization rules.
- D
Enable MAC filtering on the wireless controller to block unauthorized devices.
- E
Deploy a certificate-based EAP method, like EAP-TLS, for enhanced security.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement 802.1X and AAA on a wireless network with Cisco ISE, the wireless controller must be configured to use RADIUS for authentication, pointing it to the ISE server. Additionally, a policy set in ISE ensures that authentication and authorization rules are applied based on the SSID. Deploying a secure EAP method, such as EAP-TLS, further strengthens the security by using certificates for mutual authentication. WPA3-Personal and MAC filtering do not meet the requirements for 802.1X-based corporate credential authentication.
- A. Correct.
Correct. Configuring the wireless controller to use RADIUS and pointing it to Cisco ISE is essential for leveraging 802.1X and AAA for authentication.
- B. Incorrect.
Incorrect. WPA3-Personal uses a pre-shared key (PSK) and does not involve 802.1X or corporate credential-based authentication, making it unsuitable for this scenario.
- C. Correct.
Correct. Creating a policy set in Cisco ISE ensures that the SSID is tied to specific authentication and authorization rules, aligning with the organization's requirements.
- D. Incorrect.
Incorrect. MAC filtering is not a robust security measure and does not align with the goal of using 802.1X and AAA for authentication.
- E. Correct.
Correct. Using a certificate-based EAP method like EAP-TLS enhances security by ensuring mutual authentication between the client and the network.