nerdexam
Cisco

300-365 · Question #65

An engineer configures the wireless LAN controller to perform 802.1x user authentication. Which option must be enabled to ensure that client devices can connect to the wireless, even when WLC cannot…

The correct answer is A. local EAP. Local EAP allows the WLC to act as an authentication server itself, enabling clients to complete 802.1x authentication even when the external RADIUS server is unreachable.

WLAN Security Deployment

Question

An engineer configures the wireless LAN controller to perform 802.1x user authentication. Which option must be enabled to ensure that client devices can connect to the wireless, even when WLC cannot communicate with the RADIUS?

Options

  • Alocal EAP
  • BCisco Centralized Key Management
  • Cauthentication caching
  • Dpre-authentication

How the community answered

(15 responses)
  • A
    93% (14)
  • C
    7% (1)

Why each option

Local EAP allows the WLC to act as an authentication server itself, enabling clients to complete 802.1x authentication even when the external RADIUS server is unreachable.

Alocal EAPCorrect

Local EAP is a feature on the Cisco WLC that processes EAP authentication requests locally using a local user database or an embedded LDAP backend, acting as a fallback when the configured RADIUS server is unavailable - it handles the full EAP exchange on the controller without requiring an external AAA server.

BCisco Centralized Key Management

Cisco Centralized Key Management (CCKM) is a fast-roaming technology that allows clients to re-associate to new APs without a full re-authentication, but it does not provide authentication when RADIUS is unreachable.

Cauthentication caching

Authentication caching (also called RADIUS authentication caching) can cache previously authenticated credentials for a period, but it is not the primary mechanism designed to provide full EAP authentication locally when RADIUS is down.

Dpre-authentication

Pre-authentication is a concept associated with 802.11r fast BSS transition or proactive key caching before roaming, and it does not address the scenario of RADIUS server unavailability.

Concept tested: WLC local EAP fallback when RADIUS is unavailable

Source: https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100268-local-eap-wlc-config.html

Topics

#local EAP#RADIUS fallback#802.1x#WLC authentication

Community Discussion

No community discussion yet for this question.

Full 300-365 Practice