After receiving an alert regarding a rogue AP, a network engineer logs into Cisco Prime and looks at the floor map where the AP that detected the rogue is located. The map is synchronized with a…

Physically going to the location and disabling power is a manual process that can be time-consuming and is not the fastest network-based method for disabling a rogue.

Creating a spoofed SSID is a form of containment, but classifying the rogue as malicious in Prime is the direct action that initiates such containment, including client deauthentication, making it the primary trigger.

Classifying a rogue AP as 'malicious' in Cisco Prime (or via the WLC through Prime) automatically triggers active containment actions, such as sending deauthentication frames to clients connected to the rogue AP or preventing the rogue from operating. This is the fastest network-based way to respond to disable its broadcasting within the enterprise network through automated mitigation.

Updating the status of the rogue to 'contained' in Cisco Prime indicates that actions have been taken or are ongoing, but it is not the action that actively disables the rogue; classifying it as 'malicious' is what initiates the active containment.