Far Out 300-375 Ebook 2021

NEW QUESTION 1
Which configuration step is necessary to enable Visitor Connect on an SSID?

• A. A preauthentication ACL must be defined.


• B. Local client profiling must be enabled.


• C. The SSID must use MAC filtering.


• D. A passive client must be enabled.

Answer: A

Explanation:

The Pre-Authentication Flex Connect ACL is required for filex mode deployments. For more information, see the Configuring FlexConnect ACLs. https://www.cisco.com/c/en/us/td/docs/wireless/mse/7-6/CMX_Dashboard/Guide/

NEW QUESTION 2
Refer to the exhibit.

A network engineer must configure a WLAN on a Cisco IOS-XE controller to support corporate devices (using VLAN 30) and BYOD (using VLAN 40) on the same secure SSID. The security team has built an ISE deployment to be used for VLAN assignment and to restrict access based on policy and posture compliance.
Given the existing WLAN configuration, which configuration change must be made?

• A. remove ip dhcp required


• B. Add aaa-override


• C. Remove nac


• D. Add mac-filtering default

Answer: B

NEW QUESTION 3
An engineer is configuring EAP-TLS with a client trusting server model and has configured a public root certification authority. Which action does this allow?

• A. specifies a second certification authority to trust


• B. utilizes two subcertification authority servers


• C. creates a PKI infrastructure


• D. validates the AAA server

Answer: D

Explanation:

To support EAP-TLS, the AAA server (for example, Cisco Secure ACS) must have a certificate. Either a public certification authority or a private certification authority can be used to issue the AAA server certificate. The AAA server will trust a client certificate that was issued from the same root
certification authority that issued its certificate.
https://www.cisco.com/en/US/tech/ CK7 22/ CK8 09/technologies_white_paper09186a008009256b.sht ml

NEW QUESTION 4
How many mobility peers can a Cisco Catalyst 3850-MC node have?

• A. 8


• B. 2


• C. 6


• D. 16


• E. 4

Answer: A

NEW QUESTION 5
You are configuring the social login for a guest network. Which three options are configurable social connect in Cisco CMS visitor connect? (Choose three.)

• A. Linkedin


• B. Pinterest


• C. Medium


• D. Google+


• E. Facebook


• F. MySpace

Answer: ADE

NEW QUESTION 6
Which three WLAN polices can be controlled by using the Cisco IBNS on the Cisco WLC and Cisco Secure ACS? (Choose three.)

• A. QoS setting


• B. VLAN


• C. EAP type


• D. ACL


• E. authentication priority order


• F. NAC state

Answer: ABD

NEW QUESTION 7

• A. Mastered


• B. Not Mastered

Answer: A

Explanation:
Please refer the link below in Explanation to configure this simulation.
Example:
Use this link to configure all the steps for this simulation : http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/116880-configwpa2- psk-00.html

NEW QUESTION 8
Which Cisco feature must an engineer configure on a cisco WLC to enable PCI specification compliance for communication of neighbor radio information?

• A. RF Grouping


• B. MFP


• C. Rogue Access Point Detection


• D. RRM NDP


• E. Off Channel Scanning

Answer: D

NEW QUESTION 9
Refer to the exhibit.

A customer is having problems with clients associating to me wireless network. Based on the configuration, which option describes the most likely cause of the issue?

• A. Both AES and TKIP must be enabled


• B. SA Query Timeout is set too low


• C. Comeback timer is set too low


• D. PME is set to "required"


• E. MAC Filtering must be enabled

Answer: E

NEW QUESTION 10
Which customizable security report on Cisco Prime Infrastructure would show rogue APs detected since a point in time?

• A. New Rogue APs


• B. Rogue AP Events


• C. Rogue APs


• D. Rogue AP Count Summary


• E. Network Summary

Answer: C

NEW QUESTION 11
Refer to the exhibit. You are configuring an autonomous AP for 802.1x access to a wired infrastructure. What does the command do?

• A. It enables the AP to override the authentication timeout on the RADIUS server.


• B. It configures how long the AP must wait for a client to reply to an EAP/dot1x message before the authentication fails.


• C. It enables the supplicant to override the authentication timeout on the client


• D. It configures how long the RADIUS server must wait for supplicant to reply to an EAP/dot1x message before the authentication fails.

Answer: C

NEW QUESTION 12
An engineer is considering an MDM integration with Cisco ISE to assist with security for lost devices. Which two functions of MDM increase security for lost devices that access data from the network? (Choose two.)

• A. PIN enforcement


• B. Jailbreak/root detection


• C. data wipe


• D. data encryption


• E. data loss prevention

Answer: AC

NEW QUESTION 13
Clients are failing EAP authentication. A debug shows that an EAPOL start is sent and the clients are then de-authenticated. Which two issues can cause this problem? (Choose two.)

• A. The WLC certificate has changed.


• B. The WLAN is not configured for the correct EAP supplicant type.


• C. The shared secret of the WLC and RADIUS server do not match.


• D. The WLC has not been added to the RADIUS server as a client.


• E. The clients are configured for machine authentication, but the RADIUS server is configured for user authentication.

Answer: CD

NEW QUESTION 14
A customer is concerned that radar is impacting the access point that service the wireless network in an office located near an airport. On which type of channel should you conduct spectrum analysis to identify if radar is impacting the wireless network?

• A. UNII-3 channels


• B. UNII-1 channels


• C. 802.11b channels


• D. 2.4 GHz channels


• E. UMII-2 channels


• F. Channels 1, 5, 9, 13

Answer: E

NEW QUESTION 15
MFP is enabled globally on a WLAN with default settings on single controller wireless network. Older client devices are disconnected from the network during a deauthentication attack. What is the
cause of this issue?

• A. The client devices do not support WPA.


• B. The client devices do not support CCXv5.


• C. The MFP on the WLAN is set to optional


• D. The NTP server is not configured on the controlle

Answer: C

NEW QUESTION 16
An engineer is implementing SNMP v3 on a Cisco 5700 Series WLC. Which three commands are the
minimum needed to configure SNMP v3? (Choose three.)

• A. snmp-server enable traps


• B. snmp-server group


• C. snmp-server user


• D. snmp-server community


• E. snmp-server context


• F. snmp-server engineID

Answer: BCF

NEW QUESTION 17
Refer to the exhibit.

What is the 1.1.1.1 IP address?

• A. the wireless client IP address


• B. the RADIUS server IP address


• C. the controller management IP address


• D. the lightweight IP address


• E. the controller AP-manager IP address


• F. the controller virtual interface IP address

Answer: F

NEW QUESTION 18
When using the Standalone Profile Editor in the Cisco AnyConnect v3.0 to create a new NAM profile, which two statements describe the profile becoming active? (Choose two.)

• A. selects the new profile from NAM


• B. selects "Network Repair" from NAM


• C. becomes active after a save of the profile name


• D. ensures use of "configuration.xml" as the profile name


• E. ensures use of "config.xml" as the profile name


• F. ensures use of "nam.xml" as the profile name

Answer: BD

NEW QUESTION 19
Refer to the exhibit.

In this IBN topology, which device acts as the RADIUS server?

• A. directory server


• B. Cisco ISE


• C. Cisco UCS


• D. Cisco Catalyst 3850 Series Switch

Answer: D

NEW QUESTION 20
When you configure BYOD access to the network, you face increased security risks and challenges. Which challenge is resolved by deploying digital client certificates?

• A. managing the increase connected devices


• B. ensuring wireless LAN performance and reliability


• C. providing device choice and support


• D. enforcing company usage policies

Answer: D

NEW QUESTION 21
An engineer has configured central web authentication on the wireless network, but clients are receiving untrusted certificate errors on their internet browsers when directed to the guest splash page. Which file must be provided to an approved trusted certificate authority to fix this issue?

• A. EAP-TLS certificate generate by WLC


• B. CSR generated by identity Service Engine


• C. CSR generated by the WLC


• D. EAP-TLS certificate generated by the access point

Answer: B

NEW QUESTION 22
......