300-430 Question 226
Select 3An enterprise wireless network is configured to support multiple user groups such as employees, contractors, and guests. The network administrator decides to implement Identity-Based Networking to enforce different policies for these groups. Which of the following configurations would be appropriate to achieve this goal?
- A
Assign VLANs dynamically based on user group membership using RADIUS attributes.
- B
Apply QoS profiles to prioritize traffic based on user roles, such as higher priority for employees and lower for guests.
- C
Use a single VLAN for all user groups and enforce policies using Access Control Lists (ACLs) on the wireless LAN controller.
- D
Enable WPA2-Personal for all groups to provide group-specific identity enforcement.
- E
Configure RADIUS to apply downloadable ACLs (dACLs) for group-specific access control.
Show answer and explanation
Correct answers: A, B, E
Explanation
Identity-Based Networking in wireless architectures allows administrators to enforce policies dynamically based on user roles or group memberships. This can be achieved through dynamic VLAN assignment (to segment traffic), QoS profiles (to prioritize traffic), and RADIUS-based downloadable ACLs (to control access). These mechanisms ensure that each user group receives appropriate network resources and access control, aligning with enterprise security and performance requirements.
- A. Correct.
Dynamic VLAN assignment based on user group membership using RADIUS attributes is a key feature of Identity-Based Networking and allows for logical segmentation of users based on their roles.
- B. Correct.
Applying QoS profiles based on user roles ensures that critical traffic (e.g., employees’ VoIP or video conferencing) is prioritized over less critical traffic from other groups like guests.
- C. Incorrect.
Using a single VLAN for all user groups does not align with Identity-Based Networking principles. It does not provide sufficient segmentation or control over traffic policies for different user groups.
- D. Incorrect.
WPA2-Personal does not provide user or group-specific identity enforcement, as it uses a shared key for authentication rather than individual user credentials.
- E. Correct.
Downloadable ACLs (dACLs) allow RADIUS to dynamically enforce group-specific access control policies, which is a core component of Identity-Based Networking.