300-430 Practice Questions

The AVC (Application Visibility and Control) Profile is where specific applications, identified by NBAR2, are mapped to QoS policies. Within the AVC profile, an administrator can select an application like 'cisco-jabber-video' and assign it a marking action (e.g., DSCP) and a QoS profile (e.g., Platinum), and also choose to drop or permit the traffic. This profile is then applied to a WLAN.

When FlexConnect APs are in local switching mode, client DHCP packets are bridged directly to the local wired network and do not traverse the CAPWAP tunnel to the WLC. For the WLC to become aware of the client's IP address, the 'Learn Client IP Address' feature must be enabled on the WLAN. This causes the AP to snoop the DHCP transaction locally and report the client's IP address back to the WLC.

The Cisco ISE Profiling Service is responsible for device classification. It uses a variety of data collectors, called 'probes' (e.g., RADIUS, DHCP, HTTP), to gather attributes from endpoints. These attributes are then compared against a library of profiles to identify the device's operating system, hardware model, and other characteristics. The resulting profile can then be used in authorization policies to assign the correct VLAN, ACL, or QoS.

When a rogue AP is detected on the wired network, the Rogue Location Discovery Protocol (RLDP) is the primary tool used for location. When initiated from Prime Infrastructure, a nearby managed AP is instructed to send special frames to the rogue. If the rogue is on the wire, it will forward these frames, which can be traced back to the switchport it is connected to. This helps physically locate the unauthorized device.

Standard multicast over Wi-Fi is sent at a low, mandatory data rate to ensure all clients can receive it, which consumes significant airtime. Multicast Direct enhances this by allowing the WLC to instruct the AP to transmit the multicast stream at a higher, dynamically chosen multicast data rate based on the capabilities of the subscribed clients. This significantly improves airtime efficiency, allowing for higher quality video streams without degrading overall network performance.

The optimal configuration is to enable Multicast-Unicast mode, which ensures reliable delivery by converting multicast frames to unicast frames over the air. Disabling Global IGMP Snooping on the WLC prevents it from processing IGMP reports from the wired side, thus protecting its CPU. The WLC will still snoop IGMP packets from wireless clients to manage multicast group membership for the unicast conversion.

Cisco DNA Center integrates with Cisco CleanAir technology. When an AP detects non-Wi-Fi interference, the Spectrum Analyzer view can be accessed for that AP. This tool provides detailed information about the RF environment and classifies interference sources based on their signatures, allowing the engineer to identify devices like microwave ovens, cordless phones, or Bluetooth devices.

The Certificate Authentication Profile in Cisco ISE is specifically designed for granular control over certificate-based authentication. Within this profile, you can configure ISE to check specific attributes of a client certificate, such as the Subject, Common Name (CN), or Subject Alternative Name (SAN), and use those values in policy decisions. This is the correct location to enforce a check against a specific SAN value.

Cisco Hyperlocation achieves high accuracy by using Angle of Arrival (AoA) technology. This is enabled by a special hardware component, the Hyperlocation Module (e.g., WSM01), which attaches to a compatible AP. This module contains a circular array of 32 antennas that can determine the precise direction from which a client's signal is arriving, significantly improving location accuracy from the standard 5-7 meters down to 1-3 meters.