nerdexam
Cisco

300-430 · Question #289

You are seeing an excessive number of rogue AP alarms in Cisco Prime Infrastructure. All these alarms have a severity level of Minor. Which two actions must be taken to make more efficient use of…

The correct answer is A. Create and install configuration templates to establish rogue rules that use specific criteria to C. Create and install a configuration template that modifies the minimum rogue detection RSSI of the. Excessive Minor rogue AP alarms can be reduced by creating intelligent rogue classification rules and raising the minimum detection RSSI threshold to filter out distant, non-threatening devices.

Monitoring and Troubleshooting

Question

You are seeing an excessive number of rogue AP alarms in Cisco Prime Infrastructure. All these alarms have a severity level of Minor. Which two actions must be taken to make more efficient use of rogue AP alarms? (Choose two.)

Options

  • ACreate and install configuration templates to establish rogue rules that use specific criteria to
  • BDisable rogue detection on the infrastructure APs that are detecting the rogue APs.
  • CCreate and install a configuration template that modifies the minimum rogue detection RSSI of the
  • DDelete the alarms. They do not return even if the same rogue AP is detected again.
  • EClear the alarms. They do not return even if the same rogue AP is detected again.

How the community answered

(26 responses)
  • A
    69% (18)
  • B
    4% (1)
  • D
    15% (4)
  • E
    12% (3)

Why each option

Excessive Minor rogue AP alarms can be reduced by creating intelligent rogue classification rules and raising the minimum detection RSSI threshold to filter out distant, non-threatening devices.

ACreate and install configuration templates to establish rogue rules that use specific criteria toCorrect

Creating rogue rules with specific criteria such as SSID, vendor OUI, or signal strength allows Prime Infrastructure to automatically classify and suppress alarms for known-benign rogues, directly reducing alarm noise without sacrificing security visibility.

BDisable rogue detection on the infrastructure APs that are detecting the rogue APs.

Disabling rogue detection on infrastructure APs removes the security visibility required to identify actual rogue devices, which defeats the purpose of the feature entirely.

CCreate and install a configuration template that modifies the minimum rogue detection RSSI of theCorrect

Raising the minimum rogue detection RSSI threshold ensures that only rogues with a strong enough signal to pose a realistic threat generate alarms, filtering out weak distant signals that are the most common source of Minor-severity alarm floods.

DDelete the alarms. They do not return even if the same rogue AP is detected again.

Deleting rogue AP alarms does not prevent recurrence - a new alarm is generated each time the same rogue is detected again.

EClear the alarms. They do not return even if the same rogue AP is detected again.

Clearing rogue AP alarms similarly does not stop them from returning - the alarm regenerates upon each subsequent detection of the same rogue AP.

Concept tested: Rogue AP alarm filtering and classification in Prime Infrastructure

Source: https://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-10/user/guide/bk_CiscoPrimeInfrastructure_3_10_UserGuide/m_detect_and_contain_rogue_aps.html

Topics

#rogue AP alarms#rogue detection rules#RSSI threshold#Prime Infrastructure

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-430 Practice