nerdexam
Cisco

300-430 · Question #95

Refer to the exhibit. An engineer tries to manage the rogues on the Cisco WLC. Based on the configuration, which AP is marked as malicious by the controller?

The correct answer is A. rogue AP with SSlD admin seen for 4000 seconds and heard at -60 dBm. The WLC marks a rogue AP as malicious only when it satisfies both the configured minimum time-seen threshold and the minimum RSSI threshold simultaneously.

Monitoring and Troubleshooting

Question

Refer to the exhibit. An engineer tries to manage the rogues on the Cisco WLC. Based on the configuration, which AP is marked as malicious by the controller?

Exhibit

300-430 question #95 exhibit

Options

  • Arogue AP with SSlD admin seen for 4000 seconds and heard at -60 dBm
  • Brogue AP with SSID admin seen for 3000 seconds and heard at -70 dBm
  • Crogue AP with SSlD admin seen for 4000 seconds and heard at -70 dBm
  • Drogue AP with SSID admin seen for 3000 seconds and heard at -60 dBm

How the community answered

(30 responses)
  • A
    60% (18)
  • B
    13% (4)
  • C
    23% (7)
  • D
    3% (1)

Why each option

The WLC marks a rogue AP as malicious only when it satisfies both the configured minimum time-seen threshold and the minimum RSSI threshold simultaneously.

Arogue AP with SSlD admin seen for 4000 seconds and heard at -60 dBmCorrect

This AP has been seen for 4000 seconds, exceeding the configured time-seen threshold, and is heard at -60 dBm, which is a strong enough signal to meet the minimum RSSI requirement - satisfying both conditions required for the WLC to apply the malicious classification.

Brogue AP with SSID admin seen for 3000 seconds and heard at -70 dBm

With only 3000 seconds seen and a weak -70 dBm signal, this AP fails both the time threshold and the minimum RSSI threshold, so the WLC does not classify it as malicious.

Crogue AP with SSlD admin seen for 4000 seconds and heard at -70 dBm

Although seen for 4000 seconds, the -70 dBm signal is too weak to meet the minimum RSSI threshold configured on the WLC, so only one of the two required conditions is satisfied.

Drogue AP with SSID admin seen for 3000 seconds and heard at -60 dBm

Although heard at -60 dBm, this AP has only been seen for 3000 seconds, which is insufficient to meet the minimum time-seen threshold, so only one of the two required conditions is satisfied.

Concept tested: Cisco WLC rogue AP malicious classification thresholds

Source: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/rogue_detection.html

Topics

#rogue AP#malicious classification#RSSI threshold#rogue management

Community Discussion

No community discussion yet for this question.

Full 300-430 Practice