Free 300-430 Practice Test Questions 2026

Explanation:

The requirement is to minimize traffic traversing the MPLS WAN link between remote APs and the central WLC. The only way to achieve this is by configuring the APs in FlexConnect mode with local switching enabled.

When local switching is enabled, client data traffic (such as web browsing, file transfers, and application data) is switched locally at the remote site and does not traverse the CAPWAP tunnel to the central WLC. This significantly reduces WAN bandwidth consumption and minimizes latency for end users, which is critical for a multinational corporation using MPLS where WAN links are expensive and bandwidth-limited.

Why the others are wrong:

A. FlexConnect mode with OfficeExtend enabled:
OfficeExtend is designed for home-office remote workers using a residential broadband connection. It enables split tunneling but is not the appropriate solution for a corporate MPLS-connected branch office. This feature does not address WAN traffic optimization in a corporate context.

B. FlexConnect mode with local authentication:
While local authentication reduces authentication traffic over the WAN, it does not address the primary issue of data traffic traversing the MPLS link. Additionally, local authentication bypasses central AAA policies and ISE integration, which is undesirable for most enterprises.

D. FlexConnect mode with central authentication:
This option does not specify the data switching method. If central switching is the default (which it often is), then all data traffic still traverses the WAN link. Central authentication alone does not solve the bandwidth problem.

References:
Cisco 300-430 ENWLSI Official Certification Guide – Chapter on FlexConnect and Local Switching.
Cisco FlexConnect Deployment Guide – Local vs. Central Switching comparison.

Explanation:

When creating a CPU ACL (also known as a "Control Plane ACL") on a Cisco Wireless LAN Controller, the Direction parameter specifies the traffic flow relative to the CPU. The exhibit shows the ACL configuration page with "Inbound" and "Outbound" as options.

The correct selection is Inbound because CPU ACLs filter traffic that is destined to the CPU of the WLC. This includes management traffic (SSH, SNMP, HTTP/HTTPS), control plane protocols (CAPWAP, LWAPP, EAP), and other packets that require CPU processing for forwarding decisions or security functions.

When you select Inbound, the ACL is applied to traffic as it enters the controller's CPU from the network interfaces (both wired and wireless). This is the standard and recommended method for protecting the WLC's CPU from malicious traffic, DoS attacks, and unauthorized access attempts. The ACL permits or denies packets based on source/destination IP, protocol, port, and DSCP values before the CPU has to process them, thereby reducing CPU load.

How the ACL processes traffic:

Inbound (to CPU): Filters packets that are arriving at the WLC and are destined for the CPU (management interfaces, control plane, etc.). This is the primary use case.

Outbound (from CPU): Filters packets that are generated by the WLC CPU and being sent out to the network (e.g., responses, CAPWAP control messages). This is rarely used and typically not required for CPU protection.

Why the others are wrong:

B. Packet direction has no significance; it is always Any:
Direction is critically important in CPU ACLs. The ACL evaluates the traffic flow direction, and you must specify Inbound or Outbound to properly apply the rules. There is no "Any" direction option for CPU ACLs.

C. It must be Outbound because it is traffic that is generated from the WLC:
This is incorrect because CPU ACLs are primarily used to restrict traffic entering the CPU (inbound) to protect the controller. While outbound CPU ACLs exist, they are for limiting traffic generated by the CPU itself, which is not the scenario described.

D. To have the complete list of options, the CPU ACL must be created only by the CLI:
The GUI fully supports CPU ACL creation. The Direction field is available in both GUI and CLI. The complete list of options is available in both interfaces; the CLI is not required to see all options.

References:
Cisco Wireless Controller Configuration Guide – CPU Access Control Lists.
Cisco 300-430 ENWLSI Official Certification Guide – Chapter on Security: CPU ACLs.
Cisco WLC Command Reference – config acl cpu command syntax and Direction parameter.

Explanation:

FlexConnect State — Standalone Mode (Option E):
When a FlexConnect Access Point loses its CAPWAP control plane connection to the central WLC (head office WAN outage), it transitions into Standalone Mode. While in standalone mode, the AP processes traffic locally instead of relying on the controller.

Operation Mode — authentication-local/switch-local (Option A):
In order to function during a WAN failure, the WLAN must be configured for Local Switching and Local Authentication. This allows data frames to be bridged directly to the local site LAN (giving users access to local resources) and forces authentication processing onto the AP itself.

Authentication Method — WPA2 Personal (Option B):
Since 802.1X enterprise authentication typically relies on a central RADIUS server across the WAN, pre-existing or new client 802.1X authentications would fail during WAN down conditions unless configured locally. WPA2 Personal (PSK) uses pre-shared keys handled directly by the AP locally, allowing new wireless clients to successfully authenticate and associate while the WAN link is down.

Why Other Options Are Incorrect:

C. authentication-central/switch-central:
Central switching routes all user traffic through the CAPWAP tunnel to the WLC at HQ. If the WAN is down, central switching breaks client connectivity entirely.

D. lightweight mode:
While FlexConnect APs are lightweight APs overall, when the CAPWAP tunnel drops, the operational mode shifts specifically to standalone mode to handle local survival.

F. WEB authentication:
Central WebAuth requires reachability back to the controller's internal portal or an external ISE node across the WAN. Without local fallback configuration, central web authentication fails when the WAN is down.

References:

Cisco FlexConnect Configuration Guide: Details FlexConnect standalone mode operations, local switching vs. central switching behaviors during WAN outages, and supported local authentication mechanisms (e.g., Local 802.1X, WPA2-PSK/Personal).

Explanation:

On the Cisco Catalyst 9800 Series Wireless Controller, Cisco Hyperlocation is enabled within the AP Join Profile.

To configure it via the web interface, you navigate to Configuration > Tags & Profiles > AP Join. When you create or edit an AP Join Profile, you will find a Hyperlocation tab under the AP section. From this tab, you can check the Enable Hyperlocation box and configure related parameters like detection thresholds and NTP server settings for high-accuracy client tracking.

Why the others are wrong:

A. Policy Profile:
Policy Profiles primarily define WLAN-specific policies such as VLAN mapping and Quality of Service (QoS). They are not used to enable the global Hyperlocation feature for access points.

C. Flex Profile:
Flex Profiles are used to configure FlexConnect-specific settings for APs in remote locations, such as local switching and ACLs. They do not contain the Hyperlocation configuration options.

D. RF Profile:
RF Profiles are dedicated to radio frequency settings, like transmit power control (TPC), dynamic channel assignment (DCA), and data rates. Hyperlocation is a location service and is not configured here.

References:

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide – Configuring Cisco Hyperlocation (GUI procedure).
ExamTopics 300-430 discussion, confirming the location of the Hyperlocation settings.

Explanation:

Reporting Capabilities in Cisco Prime Infrastructure:
Cisco Prime Infrastructure allows administrators to generate historical data reports—including guest access statistics, client association logs, and compliance audits—for specific custom timeframes (such as two weeks).

Export and Delivery Formats:
When running scheduled or ad-hoc reports in Prime Infrastructure, reports can be saved, exported, or automatically emailed in CSV (Comma-Separated Values for spreadsheet processing) or PDF (Portable Document Format for formal presentation and archival).

Why Other Options Are Incorrect:

C. XLS:
While raw report data exported in CSV format can easily be opened in Microsoft Excel, Cisco Prime Infrastructure exports structured spreadsheets specifically as .csv rather than standard .xls or .xlsx workbook formats.

D. DOC:
Cisco Prime Infrastructure does not support exporting report outputs to Microsoft Word (.doc/.docx) document formats.

E. plain text:
Unformatted plain text (.txt) is not an export option for graphical and tabular reports generated by Cisco Prime.

References

Cisco Prime Infrastructure User Guide (Reports & Dashboard Chapter): Specifies that scheduled or executed report instances can be viewed, saved, and exported directly in CSV and PDF formats.

Explanation:



A common design for a BYOD (Bring Your Own Device) onboarding solution uses a dual-SSID approach to simplify the enrollment process.

Provisioning SSID: This is an open or partially open network used solely for the initial onboarding of a new device[citation:7]. Its purpose is to allow the client to connect and download the necessary configuration profile or certificates.

Access SSID: After provisioning, the device is configured to connect to this secure, production SSID (e.g., using WPA2-Enterprise) to gain full access to corporate resources.

A key consideration is the client's connection experience. While a common technique is to use a downloadable ACL to restrict the provisioning SSID to just the ISE/onboarding server, an ACL should not be enforced to force the client to switch to the new, real SSID[citation:7]. The configuration profile installed during provisioning handles this automatically; the client is configured to forget or deprioritize the open provisioning SSID and connect to the secure access SSID. Using an ACL to enforce this is not a supported or stable method for managing this transition and can cause connectivity issues after a client successfully roams. The network should be configured so that when the client disconnects from the provisioning SSID after receiving its certificate, it will naturally connect to the permanent access SSID based on its newly configured profile[citation:7].

Why the others are wrong:

A. After using the provisioning SSID, an ACL that used to make the client switch SSIDs forces the user to associate and traverse the network by MAC filtering.
This is incorrect. ACLs are used to restrict traffic on the provisioning SSID to the onboarding portal, not to force an SSID switch. The client moves to the new SSID because it is configured to do so in its profile. MAC filtering is not a standard method for handling the SSID transition.

B. If multiple WLCs are used, the WLAN IDs must be exact for the clients to be provisioned and traverse the network correctly.
This is not required for the provisioning process. The client is not reliant on the internal WLAN ID of the controller. The transition between SSIDs is driven by the client's configuration profile, not by a specific WLAN ID across the mobility group.

C. SSIDs for this setup must be configured with NAC State-RADIUS NAC for the clients to authenticate with Cisco ISE, or with NAC State-ISE NAC for Cisco ISE to associate the client.
This is incorrect. The concept of "NAC State" as described is not a valid configuration method for SSIDs. The client's authentication method is based on the Layer 2/3 security settings of the SSID, not a specific "NAC state" toggle.

References:
Cisco Wireless LAN Controller Configuration Guide – BYOD and Onboarding Designs[citation:7].

Explanation:

On the Cisco Catalyst 9800 Series Wireless Controller, the default 802.1X AP authentication configuration uses EAP-FAST with CAPWAP DTLS. This is the factory-default setting for securing the CAPWAP control plane between the AP and the WLC. When an AP joins the controller for the first time, it attempts to authenticate using EAP-FAST over the CAPWAP DTLS tunnel. This configuration is established through the AP Join Profile, where the AP Authorization setting defaults to EAP-FAST and DTLS is enabled for encryption.

This default ensures that APs authenticate securely during the join process, protecting against rogue APs and man-in-the-middle attacks.

Why the others are wrong

A. EAP-PEAP with 802.1x port authentication:
EAP-PEAP is an alternative authentication method for APs but is not the default. The default is EAP-FAST. Additionally, "802.1x port authentication" refers to wired switch port security, not to AP authentication to the WLC.

B. EAP-TLS with 802.1x port authentication:
EAP-TLS is also a valid method but not the default. It requires digital certificates, whereas EAP-FAST uses PACs. The default is EAP-FAST.

C. EAP-FAST with CAPWAP DTLS + port authentication:
This option incorrectly adds "port authentication," which is a separate wired switch feature. The default uses only EAP-FAST and CAPWAP DTLS for the AP-to-WLC tunnel.

References:
Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide – AP Authorization Settings.
Cisco 300-430 ENWLSI Official Certification Guide – Chapter on AP and WLC Security.

Explanation:

The engineer's goal is to track guest traffic flow, which involves gathering data on how guest devices move, dwell, and are distributed throughout a venue. Within Cisco Connected Mobile Experiences (CMX), the service designed for this specific purpose is the Detect and Locate service .

The Detect and Locate service is the core location engine within CMX. It gathers real-time location data from the wireless infrastructure by detecting mobile devices (including non-associated devices) and forwarding their signal information to the Mobility Services Engine (MSE) for analysis . This granular location information is the foundational data used to build the traffic flow reports and analytics that the engineer requires.

Why the others are wrong:

A. analytics:
This is the visualization and reporting component that interprets and displays the data collected by the Detect and Locate service. It is the end result, not the mechanism for tracking the traffic .

B. connect and engage:
This service is focused on guest access, captive portals, and sending targeted notifications or promotions to visitors. It does not perform the core function of tracking device movement or traffic flow .

C. presence:
The Presence service is a more basic form of location analytics. It determines whether a device is simply "in" or "out" of a defined site, providing aggregate visitor counts and dwell time, but it does not offer the detailed traffic flow analysis that is the requirement in this scenario .

References:
Exam discussion 300-430 topic 1 question 63 .
Cisco CMX Analytics Configuration Guide – Presence Analytics .

Explanation:

The requirement is to ensure client devices can still connect via 802.1X authentication even when the WLC cannot communicate with the external RADIUS server. This is a classic high-availability scenario where the WLC acts as a backup authentication server.

Local EAP enables the Wireless LAN Controller to perform EAP authentication locally without contacting an external RADIUS server . When configured, the WLC maintains a local database of user credentials and can authenticate clients directly if the RADIUS server becomes unreachable. This provides failover capability, ensuring business continuity for wireless authentication even during WAN outages or RADIUS server failures.

The local EAP feature supports EAP methods such as PEAP, EAP-TLS, and EAP-FAST, with the WLC acting as the EAP server. When RADIUS communication is restored, authentication can seamlessly revert to the external server.

Why the others are wrong:

A. pre-authentication: This is not a standard feature for 802.1X failover scenarios. Pre-authentication typically refers to mechanisms used in fast roaming (like OKC or 802.11r) to reduce authentication delays, not for RADIUS failover.

C. authentication caching:
While authentication caching (or "cached RADIUS") can store credentials temporarily, it is not the primary method for ensuring client connectivity during RADIUS outages. It has limitations and is not as reliable as Local EAP for this purpose.

D. Cisco Centralized Key Management (CCKM):
CCKM is a fast roaming protocol that reduces authentication time for roaming clients. It is unrelated to RADIUS failover or maintaining connectivity when the RADIUS server is unavailable.

References:

Cisco 300-430 ENWLSI Exam Topics – Section 6.4: Implement Identity-Based Networking.

Cisco Wireless Controller Configuration Guide – Local EAP authentication configuration.

Explanation:

The "angle of arrival" (AoA) method, as implemented in Cisco's Hyperlocation technology, determines a client device's location by measuring the angle of incidence of Wi-Fi signals . Specialized access points with a hyperlocation module and antenna use this technique . The AP measures the angle at which a client's signal arrives and, in combination with similar measurements from other APs, uses triangulation to calculate the precise location . This provides accuracy within one meter, significantly outperforming traditional received signal strength indicator (RSSI) methods, which are only accurate to within 5–8 meters .

In the exam's context, AoA is implemented through Cisco's Hyperlocation feature and is associated with both angle of incidence measurement and triangulation.

Why the others are wrong:

A. received signal strength:
This is an older location method used for standard RSSI-based tracking, not the primary technique for AoA .

B. triangulation:
While triangulation is used in conjunction with AoA for location calculation, it is not the method of measurement itself .

C. time distance of arrival:
This refers to a different technique that measures signal timing differences, not the angle-based AoA method .

D. angle of incidence:
This is the correct measurement technique used by AoA, but the question asks which method AoA uses to determine location; the overall calculation relies on triangulation of AoA data from multiple APs .

References:
Cisco Hyperlocation solution uses Angle-of-Arrival (AoA) of Wi-Fi signals to determine location, with AoA using phase measurements for triangulation .
Hyperlocation requires APs with hyperlocation modules and halo antennas to detect the angle of incidence .

Explanation:

VLAN-based central switching is a FlexConnect feature that allows the access point (AP) to make intelligent forwarding decisions based on the VLAN assigned to a client by ISE during authentication .

Here's how it solves your problem:

Dynamic Assignment: ISE authenticates the user and returns a specific VLAN ID (e.g., via the Tunnel-Private-Group-ID attribute) . This is the "dynamic group to specific IP subnet" part of your requirement.

Intelligent Forwarding: The FlexConnect AP checks if this assigned VLAN is locally available on its trunk port .

If Available: The AP performs local switching. The user's data traffic is offloaded directly to the local network at the remote site, which minimizes WAN usage and latency .

If Not Available: The AP performs central switching. The traffic is tunneled back to the WLC over CAPWAP, ensuring connectivity even for subnets that don't exist at the remote location .

Why the Others Are Incorrect:

A. learn client IP address:
This feature is typically used for centrally switched WLANs to help the controller learn client IP addresses. It does not control whether traffic is switched locally or centrally .

B. FlexConnect local authentication:
While this allows authentication to occur locally if the WAN link is down, it does not control the data path. The decision to tunnel or offload traffic is handled by the VLAN-based switching feature .

D. central DHCP processing:
This feature forces DHCP packets to be processed centrally by the WLC. It ensures consistent IP address assignment but does not dictate that all subsequent user data traffic be centrally switched .

References:
Cisco FlexConnect Configuration Guides detail that VLAN-based central switching enables per-packet decisions based on AAA-overridden VLANs, applicable only to locally switched WLANs .

Explanation:

The scenario requires maintaining the wireless voice traffic's Class of Service (CoS) value to determine its queue priority and then mapping that to the appropriate DSCP value when the traffic leaves the switch port. This is a standard QoS requirement for preserving end-to-end markings in a wireless network.

Why the others are wrong:

A. Platinum QoS configured on the WLAN:
This defines the policy on the WLC (e.g., setting the WLAN to Platinum to automatically mark traffic as DSCP EF). It ensures the correct marking is applied inside the controller but does not configure the switch to trust and preserve those markings when the packets arrive from the WLC.

B. WMM set to required on the WLAN:
WMM is a wireless standard that extends QoS to the 802.11 wireless link (using 802.11e UP values). While essential for wireless QoS, it does not govern how the wired switch port treats the traffic. The question is specifically about the switch's behavior.

C. mls qos trust dscp configured on the controller switch port:
This is a common point of confusion. While it is a valid command, Cisco guidance specifically differentiates the configuration for the WLC uplink versus the AP switch ports. AP uplink ports are configured with mls qos trust dscp, but the WLC uplink port is configured with mls qos trust cos. The traffic from the WLC arrives with a CoS value, and trusting that CoS is the specific recommended method.

References:

Cisco Wireless IP Phone 7921G Deployment Guide: "Configure the Cisco Unified Wireless LAN Controller for trust COS".

Cisco Catalyst 3750/3560 QoS Documentation:The mls qos trust cos command trusts CoS values for queue classification and DSCP mapping