Free 300-430 Practice Test Questions 2026

Explanation:

The exhibit shows two critical pieces of evidence indicating that the AP is compromised or spoofed:

Wireshark Capture Analysis: The capture shows UDP packets being sent from multiple source IPs (10.48.39.251, 10.48.39.214, 10.48.39.164) to destination 10.48.71.21 on port 2003. This is unusual traffic behavior for a legitimate AP. Additionally, frame 28 shows a CAPWAP MD5 Encrypted packet, but the other UDP traffic on port 9999→2003 suggests possible tunneling or data exfiltration. This type of traffic pattern is indicative of a rogue or compromised AP that is forwarding unauthorized data.

Rogue Rule Configuration: The rogue rule configuration shows a condition with -65 dBm RSSI and a time duration of -3650 secs. The negative time duration value is clearly invalid and suggests either misconfiguration or a compromised system attempting to bypass detection mechanisms. The rule also includes "Client Count" as a condition and "User configured SSID" set to Admin.

When an AP is compromised or spoofed:
It may send traffic to unauthorized destinations (as shown in the capture)
It may attempt to evade detection by manipulating rogue rules
It may impersonate legitimate APs to capture client traffic

It may establish unauthorized tunnels to external servers

What to look for in such scenarios:
Multiple APs sending identical UDP flows to the same suspicious destination
CAPWAP traffic interspersed with unauthorized UDP traffic
Invalid configuration values (negative time durations)
Source IPs not matching expected AP management addresses

Why the others are wrong

A. This is an ad hoc client:
Ad hoc clients typically show direct client-to-client communication without an AP in between. The traffic in the exhibit shows multiple sources communicating to a single destination, which is more consistent with AP behavior than ad hoc mode.

C. This is a misconfigured AP:
While misconfiguration is possible, the specific combination of suspicious UDP traffic patterns and manipulated rogue rule conditions strongly suggests malicious activity rather than simple configuration errors.

D. This is a rogue AP:
While a rogue AP could be involved, the evidence specifically points to a compromised or spoofed legitimate AP because:

The AP is sending CAPWAP MD5 Encrypted frames (frame 28), indicating it is still attempting to communicate with the WLC

It is simultaneously sending suspicious UDP traffic, suggesting the AP itself has been compromised

References:
Cisco Rogue AP Detection and Classification Guide – Signs of compromised APs.
Cisco 300-430 ENWLSI Official Certification Guide – Chapter on Wireless Security Threats.
Cisco WLC Rogue Rule Configuration – Conditions and detection mechanisms.

D.   shared secret

Explanation:

For the WLC to successfully authenticate users with Cisco ISE via RADIUS, both devices must be configured with the exact same shared secret key. The shared secret is a password used to encrypt and secure the RADIUS communication between the network access device (the WLC) and the ISE server. A mismatch is a common cause of authentication failures, as the ISE will reject RADIUS requests from a device that cannot correctly encrypt the packets with the matching secret.

When a WLC is added to ISE as a network device, the shared secret is configured in the RADIUS Authentication Settings section. The exact same shared secret must be configured on the WLC when you add the ISE as a RADIUS server. If these keys do not match, the authentication process will fail.

Why the others are wrong

A. SNMP RO community:
This is used for SNMP polling and monitoring purposes, not for authenticating wireless clients via RADIUS.

B. device interface credentials:
This option is not a standard configuration parameter for a RADIUS network device in ISE.

C. device ID:
While a Device ID might be used for other protocols (like TrustSec or TACACS+), it is not the primary cause of a failing RADIUS authentication for 802.1X user connections.

References

Cisco ISE Admin Guide: The shared secret is the key configured on the network device using the radius-host command.

Cisco Configuration Guides: Adding a WLC to ISE requires setting the shared secret correctly for RADIUS authentication.

D.   

The Cisco CMX server receives Angle-of-Arrival data from the WLC

Explanation:

The provided packet capture shows UDP traffic being sent to destination port 2003. This is the definitive indicator of the protocol in use.

Cisco's documentation for Hyperlocation and CMX explicitly states that Angle-of-Arrival (AoA) data is sent from the Wireless LAN Controller (WLC) to the CMX server using UDP destination port 2003 . The capture also shows the source port as 9999, which matches the documented behavior for these AoA messages .

The purpose of this traffic is to provide precise location data. The AP generates the AoA information, encapsulates it within CAPWAP, and sends it to the WLC. The WLC then forwards this data to the CMX server over UDP port 2003 for processing .

Why the others are wrong

A. The Cisco CMX server receives NetFlow data from the WLC:
NetFlow exports are typically sent to a collector on ports like 2055 (UDP) . The capture shows traffic on port 2003, which is not used for NetFlow.



B. The Cisco CMX server receives NMSP traffic from the WLC:
NMSP (Network Mobility Services Protocol) is the primary control protocol between the WLC and CMX. Cisco documentation confirms that NMSP traffic uses TCP port 16113, not UDP port 2003 . The traffic in the capture is UDP, clearly distinguishing it from NMSP.

C. The Cisco CMX server receives SNMP traffic from the WLC:
SNMP traffic (traps or polling) uses well-known UDP ports 161 and 162 . The destination port in the capture is 2003, which is not associated with SNMP communication between these devices.

References

Cisco Hyperlocation Deployment Guide specifies that AoA messages are sent from the WLC to CMX using UDP destination port 2003 with a source port of 9999 .
Cisco CMX Configuration Guide confirms that NMSP uses TCP 16113 .

C.   Allow HTTPs traffic only before authentication and block all other traffic.

D.   Allow all the traffic before authentication and intercept HTTP only.

Explanation:

Option C Configuration:
When configuring pre-authentication Access Control Lists (ACLs) for Cisco CMX Facebook Wi-Fi, administrators can restrict pre-login network capabilities so that only secure encrypted web traffic is permitted to establish communication with Facebook's OAuth servers and landing portals, while blocking all other unverified IP traffic.

Option D Configuration:
Alternatively, the pre-authentication ACL can be configured to permit all traffic by default except standard HTTP web requests. By denying/intercepting raw HTTP traffic, the WLC/CMX infrastructure intercepts the user's initial unencrypted HTTP browser request and redirects it to the Facebook check-in page for authentication before granting unrestricted internet access.

Why Other Options Are Incorrect

A. Allow HTTP traffic only before authentication and block all the traffic:
Allowing only unencrypted HTTP blocks necessary HTTPS handshakes required by Facebook's secure check-in portal, preventing the authentication flow from completing.

B. Allow all the traffic before authentication and intercept HTTPS only:
Intercepting HTTPS requires active man-in-the-middle SSL interception, which causes severe browser security certificate warnings/errors for clients prior to authentication.

E. Allow SNMP traffic only before authentication and block all the traffic:
SNMP is a management protocol used between network devices and monitoring systems; it plays no role in client guest access or captive portal redirection.

Reference

Cisco CMX Connect and Engage Configuration Guide (Facebook Wi-Fi Chapter): Explicitly lists pre-authentication ACL rules, specifying options to either permit HTTPS traffic exclusively prior to authentication or permit general traffic while intercepting HTTP traffic for portal redirection.

A.   Time Difference of Arrival

Explanation:

Cisco Hyperlocation is the premier solution for high-accuracy Wi-Fi client tracking, delivering an average accuracy of 1 to 3 meters . This performance is achieved by leveraging specialized AP hardware, such as the Cisco Aironet 4800 series, which uses an advanced antenna array to precisely measure the Angle of Arrival (AoA) of client signals . Location calculations also consider factors like RSSI for a very accurate assessment . For optimal performance, Hyperlocation requires unobstructed line-of-sight between the client and at least four Hyperlocation APs that form a "convex hull" around the client . Accurate AP placement documentation is also critical, as location errors are compounded if AP locations or orientation are off by as little as an inch .

Why the others are wrong:

A. Time Difference of Arrival (TDoA):
While a valid location technique, it is not the primary, top-tier accuracy solution deployed by Cisco, which focuses on Hyperlocation (AoA) for its most precise use cases .

B. Bluetooth Low Energy (BLE):
Physical BLE beacons have substantial shortcomings, including battery life and maintenance costs . Cisco's virtual BLE solution (Beacon Point) is simpler to manage but still does not generally match the median 1-3 meter accuracy of Hyperlocation for active Wi-Fi clients .

C. RSSI Lateration:
This method relies solely on Received Signal Strength Indication (RSSI) and is significantly less accurate than Hyperlocation. It is the baseline technique used before Hyperlocation is enabled .

References:
Cisco Hyperlocation Deployment Guide – AoA technology and accuracy requirements .
Cisco Hyperlocation Solution Data Sheet – 1 to 3 meter location accuracy .
Cisco Connected Mobile Experiences – Hyperlocation vs. RSSI performance .

A.   RADIUS server overwrite interface

Explanation:

The requirement is to place Android devices into a separate VLAN without deploying Cisco ISE. The feature that meets this exact need on the Cisco WLC is WLAN Local Policy (also known as native profiling and policy classification) .

How it works: The WLC profiles endpoints natively using attributes like MAC OUI, DHCP options, and HTTP user-agent strings. When a client connects, the WLC classifies the device type (e.g., Android, Windows, iPhone) and applies the action defined in the local policy . For instance, you can create a policy that matches "Device Type" as "Android" and then assign a specific VLAN ID as the action . This configuration is done directly on the WLC and does not require any external RADIUS server or ISE .

Why the others are wrong:

B. RADIUS server overwrite interface:
This is not a valid feature name on the Cisco WLC. The correct feature for RADIUS-based VLAN assignment is "AAA override" .

C. AAA override:
This feature enables dynamic VLAN assignment based on attributes returned by a RADIUS server (such as Cisco ISE) . Since the CTO explicitly does not want to deploy ISE, AAA override is not suitable for this scenario . Additionally, if AAA override is enabled, it takes higher precedence than local policies, which would interfere with the desired configuration .

D. custom AVC profile:
Application Visibility and Control (AVC) profiles are used for monitoring, marking (QoS), dropping, or rate-limiting specific application traffic (e.g., Facebook, YouTube) . AVC does not support dynamic VLAN assignment based on device type .

References:
Cisco WLC Configuration Guide (Release 7.5) – Local Policies based on device type .
Exam discussion confirming WLAN local policy is the correct answer for this scenario .
Cisco Native Profiling documentation showing Android device classification and VLAN assignment .

A.   supplicant credentials

Explanation:

For an AP to authenticate to the wired network using 802.1X, it must act as a supplicant that presents credentials to the switch authenticator. The exact configuration for this is found on the Global Configuration page of the WLC.

On this page (accessible via Wireless > Access Points > Global Configuration), the section labeled 802.1x Supplicant Credentials is where you enable 802.1X authentication and configure the username and password that will be inherited by all APs joining the controller. This provides the credentials the AP needs to authenticate to the switch and RADIUS server.

Why the others are wrong:

B. RADIUS shared secret:
This is used to secure RADIUS communication between the switch (acting as the authenticator) and the RADIUS server, not for the AP to authenticate to the switch.

C. local access point credentials:
This is a less precise term. The required configuration is the 802.1X supplicant credentials (username/password) on the Global Configuration page.

D. TACACS server IP address:
TACACS+ is primarily used for device administration (like AAA for login to the WLC or switch), not for 802.1X port-based authentication of an AP.

References
Cisco Wireless Controller Configuration Guide – Configuring Authentication for Access Points (Global Configuration page).

A.   TSPEC

D.   WMM

Explanation:

Wi-Fi Multimedia / WMM (Option D):
The exhibit shows Call Admission Control (CAC) enabled on the 802.11a/5GHz radio. CAC requires Wi-Fi Multimedia (WMM) to classify audio traffic into specific Access Categories (AC_VO for voice). Without WMM support on the VoWLAN phone, the client cannot tag frames with appropriate Quality of Service (QoS) priorities or negotiate bandwidth reservations with the access point.

Traffic Specification / TSPEC (Option A):
When Admission Control (ACM) is checked, clients are mandated to request explicit bandwidth allocation before establishing a call. VoWLAN phones use TSPEC requests (a subset of WMM/802.11e specifications) to negotiate CAC with the controller/AP. If a phone lacks TSPEC support, its voice call attempts will be blocked or relegated to best-effort traffic when ACM is enforced.

Why Other Options Are Incorrect:

B. SIFS:
Short Interframe Space (SIFS) is a fundamental, fixed IEEE 802.11 MAC-layer timing interval used across all wireless operations; it is not a configurable end-user phone feature required for Call Admission Control.

C. 802.11e:
While WMM is derived from the IEEE 802.11e standard, Cisco enterprise VoWLAN implementations specifically negotiate CAC and QoS parameters through the WMM and TSPEC frame extensions rather than requiring standalone 802.11e signaling.

E. APSD:
Automatic Power Save Delivery (U-APSD) manages power-saving sleep cycles for battery-operated wireless handsets, but it is not shown or involved in the Call Admission Control (CAC) parameters displayed in the exhibit.

References:

Cisco Wireless Controller Configuration Guide (Configuring Voice Parameters): Highlights that enabling Admission Control (ACM) requires WMM-capable clients that send TSPEC requests to ensure medium time allocation and prevent cell overloading.

C.   At least one strong interferer is impacting connectivity at this site.

Explanation:

The exhibit shows a CleanAir interference map from Prime Infrastructure (PI). The colored dots and clusters represent interferers detected by CleanAir-capable APs. The presence of five distinct numbered clusters (1 through 5) in the Living Room area indicates multiple interferers are being tracked.

However, the key observation is that cluster #5 is centrally located and appears as a dense, concentrated red/orange area. In CleanAir visualizations, the color and intensity of the interferer icon indicate severity:

Red/Orange = Severe or Strong interference.
Yellow = Moderate.
Green/Blue = Mild or Weak.

The exhibit shows at least one strong interferer (cluster #5) in the middle of the Living Room, which is likely causing significant connectivity issues for nearby clients and APs.

Why the others are wrong:

A. Several light interferers are collectively impacting connectivity:
The exhibit shows dense, colored clusters, not "light" interferers. Light interferers would appear as small, scattered dots without concentrated clustering.

B. The three individual clusters shown indicate poor AP placement:
The clusters represent interferers, not AP placement issues. Poor AP placement would appear as coverage holes or low signal-to-noise ratio, not as interference clusters.

References:

Cisco Prime Infrastructure CleanAir Documentation – Interference visualization and severity indicators.
Cisco 300-430 ENWLSI Official Certification Guide – Chapter on CleanAir and interference management.

A.   HTTPS

E.   NMSP

Explanation:

SOAP (Simple Object Access Protocol):
Cisco Prime Infrastructure interfaces directly with the Cisco Mobility Services Engine (MSE) using SOAP/XML web services API calls. Prime Infrastructure uses SOAP to push service configurations (such as CAS location tracking, wIPS policies, or floor maps) to the MSE and query analytical reports.

HTTPS (Hypertext Transfer Protocol Secure):
All API interactions and administrative communication sessions between Cisco Prime Infrastructure and the MSE are encrypted via HTTPS (typically over TCP port 443). HTTPS provides transport-layer security and data integrity for SOAP payloads transferred between the management server and the location engine.

Why Other Options Are Incorrect:

B. Telnet:
Telnet sends unencrypted cleartext across the network and is disabled for administrative management between Cisco enterprise wireless platforms.

D. SSH:
While SSH is used for CLI administration (logging into the underlying Linux shell on the MSE/Prime appliances), it is not the programmatic management protocol used for Prime Infrastructure GUI integration and service synchronizations.

E. NMSP:
Network Mobility Services Protocol (NMSP) runs strictly between the Wireless LAN Controller (WLC) and the MSE to exchange client RSSI telemetry and wIPS events; it is not used directly for communication between Cisco Prime Infrastructure and the MSE.

References

Cisco Unified Wireless Network Protocol and Port Matrix: Details management channels, specifying SOAP/XML over HTTPS for Cisco Prime Infrastructure-to-MSE integration.

Cisco Prime Infrastructure User Guide: Details the requirements for adding and synchronizing an MSE node using SOAP web services over HTTPS.

B.   LDAP

Explanation:

To support Local Web Authentication (LWA) using Cisco ISE as a centralized database, the directory service that must be implemented on ISE is LDAP (Lightweight Directory Access Protocol) . When a user enters credentials, the WLC sends a RADIUS Access-Request to ISE, which then queries the configured external identity source . For this use case, the external source is an LDAP-compliant directory .

Cisco ISE can integrate with LDAP v3 servers, including Microsoft Active Directory, Sun Directory Server, and Novell eDirectory, using pre-defined schemas . The configuration is done by navigating to Administration > Identity Management > External Identity Sources > LDAP in the ISE GUI .

Why the others are wrong:

A. Solaris Directory Service:
This is not a valid directory service product name. Cisco ISE supports Sun Directory Server, but "Solaris Directory Service" does not exist as a standalone directory service option.

C. SAML:
Security Assertion Markup Language (SAML) is a federation protocol used for single sign-on (SSO) and web-based authentication, not for local web authentication with LDAP. It is not a directory service.

D. Novell eDirectory:
While Novell eDirectory is a valid LDAPv3-compliant directory that can be used , LDAP is the protocol that must be implemented. The question asks for the software application, and LDAP is the correct generic answer.

References
Cisco ISE Admin Guide – External Identity Sources: LDAP configuration .
Study CCNP – WebAuth Types: LWA with external database on RADIUS or LDAP server .

B.   NMSP

Explanation:

The issue described is that no wIPS alarm information is reaching the new MSE from the WLCs. For wIPS (Wireless Intrusion Prevention System) to function, the communication chain between the WLC and the MSE relies on the Network Mobility Services Protocol (NMSP) .

NMSP is the secure, two-way protocol that manages all communication between the controller and the MSE. In a wIPS deployment, it provides the specific pathway for alarm data to be aggregated from controllers and forwarded to the wIPS service running on the MSE . The MSE then forwards these alarms to the management system (like Cisco Prime Infrastructure) using SNMP traps .

Therefore, if NMSP is blocked or not functioning correctly between the controllers and the MSE, no alarm information will be received by the MSE, even if the wIPS APs are correctly detecting attacks.

Why the others are wrong:

A. SOAP/XML:
This protocol is used for communication between the MSE and the management system (like Prime Infrastructure) for configuration and profile management, not for the WLC-to-MSE alarm data flow .

C. CAPWAP:
This protocol is used for communication between the Access Points and the Controller. Alarm data is encapsulated inside the CAPWAP control tunnel between the AP and the WLC . However, it is not the protocol used for communication from the WLC to the MSE.

D. SNMP:
While SNMP traps are used to forward wIPS alarm information from the MSE to the management system, the communication from the controller to the MSE for wIPS alarm data uses NMSP .

References:
Cisco Adaptive wIPS Deployment Guide – wIPS Alarm Flow and NMSP specification .
Cisco Enterprise Mobility Design Guide – Adaptive wIPS architecture .
Cisco 9800 Series WLC Configuration Guide – NMSP parameters .