A CPU Access Control List (ACL) on a Cisco Wireless LAN Controller (WLC) is designed to protect the controller's central processing unit by filtering traffic destined for the controller itself. This includes management traffic (such as SSH, HTTPS, Telnet, SNMP) and control plane traffic. Such traffic can originate from devices on the wired network (e.g., a network administrator's workstation, a RADIUS server, or Access Points) as well as from wireless clients (e.g., for authentication or management purposes). Therefore, enabling a CPU ACL affects both wired and wireless traffic that is addressed to the WLC's IP addresses.

A. wireless traffic only: This is incorrect because CPU ACLs also filter traffic from wired sources, such as management stations or network infrastructure devices communicating with the controller.

B. wired traffic only: This is incorrect because CPU ACLs also filter traffic originating from wireless clients, particularly traffic that needs to be processed directly by the controller.

C. VPN traffic: This is too specific and incomplete. While some VPN traffic terminating on the WLC would be subject to the CPU ACL, the ACL's scope is much broader.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5: In the "Configuring ACLs" chapter

the section "CPU ACLs" states

"CPU ACLs are configured to prevent or allow certain traffic from either the wired or wireless clients from reaching the controller CPU." This explicitly confirms the ACL applies to both traffic types.

2. Cisco AireOS 8.10 - CPU ACLs Configuration Example: The introduction of this document states

"CPU ACLs are an ACL that is applied to traffic that is destined for the controller's CPU. This can be traffic from wireless clients or from the wired side." This directly supports that both wired and wireless traffic are affected.

3. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide

IOS-XE Amsterdam 17.3.x: While the question's menu path points to AireOS

the principle is identical on modern controllers. In the "System Management Guide > Configuring CPU ACLs" section

it describes applying ACLs to the control plane

which processes traffic from both wired and wireless sources destined for the controller.

In a typical enterprise BYOD (Bring Your Own Device) or guest wireless implementation using Cisco Identity Services Engine (ISE), policies are configured to control network access. While the self-registration portal allows a user to register multiple personal devices, a common security and resource management policy is to limit the number of concurrent active sessions. This means that although an employee might have four devices registered in the "My Devices Portal," the authorization policy can be set to permit only one active network connection at a time. When the user connects a second device, ISE can issue a Change of Authorization (CoA) to terminate the session of the first device, thus enforcing the "one-at-a-time" access rule.

A. The last device is removed and the newly added device is updated as active device.

This describes a device replacement policy for registration, not a policy for managing concurrent active network connections. Standard ISE behavior is to deny, not replace, registrations beyond the configured limit.

C. All devices are allowed on the network simultaneously.

This is only true if no limiting policies are configured. In a properly designed enterprise network, limits on guest/BYOD devices are standard practice for security and resource management.

D. Purge time dictates how long a device is registered to the portal.

The endpoint purge policy concerns the removal of inactive device records from the ISE database after a set period; it does not control the number of active simultaneous connections.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Session Management" Chapter: This chapter details how ISE tracks network sessions. It explains that authorization policies can be configured to act based on active session counts for a user. The mechanism to enforce a single session is to configure an authorization profile to send a Re-authentication or Port Bounce/Shutdown CoA request to the network access device (NAD) hosting the older session when a new session is detected for the same user. This directly results in the outcome described in option B.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Configure My Devices Portal Settings" Section: This section describes the "Maximum devices per user" setting. The documentation states

"When this limit is reached

the user cannot register any more devices." This confirms that the default behavior for exceeding a registration limit is denial

not replacement (as in option A) or allowing only one active session. This highlights the distinction between registration limits and session limits.

3. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Endpoint Purge Policy" Section: This section defines the purge policy as a mechanism to "delete endpoints that are inactive for a specified number of days from the ISE database." This confirms that purging is related to the lifecycle of inactive endpoints

not the control of concurrent active sessions (as in option D).

When an external LDAP directory is unavailable, the most direct alternative that provides the same security and user experience for Local Web Authentication (LWA) is to use the internal user database of the RADIUS server, which is Cisco ISE in this scenario. This solution meets the requirement for user-based authentication, providing security comparable to LDAP (individual credentials). The user experience is identical, as the LWA captive portal presents the same username and password fields regardless of whether the back-end identity store is an external LDAP server or the ISE internal database. This is a self-contained, straightforward solution for a startup without existing directory infrastructure.

A. Use SAML: This involves redirecting the user to an external Identity Provider for authentication. While a valid authentication method, this redirection creates a different user experience than the direct login portal of LWA with LDAP.

C. Use a preshared key on the corporate WLAN: A PSK provides device-level authentication, not user-level authentication. All users share the same key, which does not meet the security requirement of authenticating individual users against a directory.

D. Use Novell eDirectory: Novell eDirectory is a directory service that is accessed using the LDAP protocol. Proposing this solution contradicts the fundamental constraint of the question that "LDAP is unavailable."

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Identity Sources" Chapter: This guide lists the "Cisco ISE Internal User Database" as a primary type of identity source. It states

"You can create users and user groups in the internal database and use them for authentication and authorization." This confirms the viability of using the internal database as a directory for authentication.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Configure Guest Access" Chapter: This chapter details the configuration of web portals for guest services

including LWA. The user flow described involves a redirection to a login page where credentials are entered. This user-facing experience remains consistent whether the backend is the internal database or an external one like LDAP.

3. Cisco Identity Services Engine Administrator Guide

Release 3.1

"SAML SSO" Chapter: The guide describes the SAML flow: "When a user tries to access a protected service provider resource

the service provider redirects the user to the Cisco ISE portal for authentication. Cisco ISE

in turn

redirects the user to the configured external IdP." This confirms the different user experience involving redirection.

4. Micro Focus eDirectory 9.2.7 Administration Guide

"eDirectory and LDAP" Section: The official documentation for Novell eDirectory (now Micro Focus eDirectory) explicitly states

"eDirectory is a full-service

secure directory service that provides your network with centralized identity management... eDirectory supports LDAP." This confirms that eDirectory relies on the LDAP protocol

making it an invalid choice given the question's constraints.

To assess different client types directly on a Cisco Catalyst 9800 Series Wireless Controller without external servers, the administrator must use the device classification feature. This native capability allows the controller to identify connecting devices by examining specific protocol attributes, primarily from DHCP and HTTP traffic (such as DHCP options and HTTP User-Agent strings). The controller then matches this information against its built-in device profiles to classify the client type (e.g., Apple iPhone, Windows 10). This process is performed locally on the controller, fulfilling the stated requirement.

A. native profile: This is a generic term. "Device classification" is the specific and official name for the feature that performs this function on the Catalyst 9800.

B. MAC classification: This is only one technique (using the OUI) within the broader device classification feature and is not sufficient on its own for comprehensive client-type assessment.

C. local profile: This term is not used to describe the client-type identification feature on the Catalyst 9800. The feature is called "device classification," even though it runs locally.

1. Cisco Systems

"Security Configuration Guide

Cisco IOS XE Bengaluru 17.6.x (Catalyst 9800 Series Wireless Controllers)".

Reference: Chapter: "Device Profiling and Classification"

Section: "Information About Device Profiling and Classification".

Content: "Device profiling and classification enables the Cisco Catalyst 9800 Series Wireless Controller to identify the type of device that is connecting to the network... The controller uses protocols such as HTTP

DHCP

and so on

to identify the end devices. The controller has a default built-in device profile for most of the common device types." This confirms the feature is native and its name is "Device Classification".

2. Cisco Systems

"Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide

Cisco IOS XE Cupertino 17.9.x".

Reference: Chapter: "Device Profiling and Classification"

Section: "Device Profiling and Classification".

Content: "The device profiling and classification feature on the controller allows you to identify the end devices by using protocols

such as HTTP

DHCP

and so on... The controller uses the DHCP and HTTP protocols to classify a device." This reinforces that the feature is built-in and details the primary protocols used for local classification.

The "override global credentials" feature is specifically designed for this scenario. On a Cisco Wireless LAN Controller (WLC), an administrator can define global credentials that all associated Access Points (APs) use for administrative access by default. To meet the requirement of having unique credentials for specific APs, such as those in a secure area like a CEO's office, the administrator can navigate to the individual AP's configuration on the WLC and enable the "override global credentials" option. This allows setting a unique username and password for that specific AP, which takes precedence over the global settings.

A. local management users: These are user accounts created on the WLC for administrative access to the WLC itself, not for individual APs.

B. HTTPS access: This is a protocol to secure web-based management traffic to the WLC and does not relate to setting AP-specific credentials.

C. 802.1X supplicant credentials: These are used by the AP to authenticate itself to the wired network infrastructure (e.g., a switch), not for administrative login to the AP.

1. Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide

Cisco IOS XE Bengaluru 17.6.x: In the "Configuring Access Points" chapter

the section "Configuring AP Credentials" states

"By default

all the APs connected to the controller are configured with the global username and password. You can override the global credentials and configure a unique username and password for a specific AP." This directly describes the feature required by the question.

2. Cisco Wireless LAN Controller Configuration Guide

Release 8.5: In the chapter "Configuring Access Points

" the section "Configuring an Access Point (GUI)" details the process. On the configuration page for a specific AP

the Credentials tab contains the "Override Global Credentials" checkbox

which

when selected

allows the entry of AP-specific credentials.

The report names within Cisco Prime Infrastructure are descriptive and directly correspond to the data they present. Each report is designed to provide a specific summary related to wireless security events and device states.

• The Rogue AP Count Summary provides a straightforward count of all unauthorized access points detected.
• The Adhoc Rogue Count Summary specifically filters for ad-hoc type rogue devices.
• The Adaptive wIPS Alarm Summary focuses on alarms generated by the Wireless Intrusion Prevention System (wIPS).
• The Security Alarm Trending Summary is used for historical analysis, showing how the frequency and type of security alarms have changed over a specified period.

Cisco Systems, Inc. (2022). Cisco Prime Infrastructure 3.10 User Guide.

Reference: Chapter 35: "Running Reports," Section: "Security Reports," Table 35-23 "Security Reports".

Details: This table explicitly lists each report name and provides a description that matches the correct answer. For example, it defines "Rogue AP Count Summary" as a report that "Displays a summarized count of all rogue access points on your network." and "Security Alarm Trending Summary" as a report that "Displays a summary of security alarm trends over a period of time." This documentation directly validates each match.

The goal is to create a rule that automatically classifies known, non-threatening Access Points (APs) from neighboring businesses.

• Condition: The rule must identify APs whose SSIDs begin with "ATC". The option set substring-ssid to ATC correctly creates a condition that matches any SSID containing "ATC", which includes all the target APs (e.g., ATC302, ATC011). Using "set SSID value to ATC" would only match an SSID that is exactly "ATC".
• Type: The APs belong to coffee shops and are not part of a malicious attack. Therefore, their Type should be set to friendly. This classification acknowledges their presence while flagging them as non-hostile.
• State: The APs are not part of the shopping center's managed network infrastructure. Their correct administrative State is external.

Cisco Systems, Inc. (2024). Cisco Catalyst 9800 Series Wireless Controller Configuration Guide, Cisco IOS XE Cupertino 17.14.x - Rogue Management. In the context of rogue management, Cisco Wireless Controllers allow for the creation of rules to automatically classify rogue APs. A rule condition can be based on the SSID. The classification state for a rogue can be set to 'Friendly', and its status can be defined as 'External' if it is not on the local wired network.

Reference: Section "Configure Rogue Rules". This documentation details creating rules based on conditions like SSID match to set a rogue's classification to "Friendly" and state to "External".

Hucaby, D. (2014). CCNP Wireless IUWVN 642-732 Official Cert Guide. Cisco Press.

Reference: Chapter 14, "Implement Cisco Unified Wireless Security," section "Rogue APs." The text explains that rogue APs can be classified as friendly if they are known and determined not to be a threat. Rules can be configured on a Wireless LAN Controller (WLC) to match specific criteria, such as SSIDs of neighboring wireless networks, and automatically assign them a "Friendly" classification. It also distinguishes between internal rogues (connected to the enterprise network) and external rogues (not connected).

Gass, S., & Pellen, R. M. (2007). Implementing a Wireless Intrusion Prevention System. IEEE Security & Privacy, 5(3), 74-77.

Reference: Page 75, section "Rogue-AP Detection and Mitigation." The paper discusses that a key function of a Wireless Intrusion Prevention System (WIPS) is to classify detected APs. It states, "A WIPS should let administrators classify APs as authorized, rogue, or external (neighboring)." The rules for this classification can be based on various parameters, including the SSID. This aligns with setting the State to external and Type to friendly (a synonym for an acknowledged neighbor).

DOI: 10.1109/MSP.2007.64

The WLAN configuration exhibit shows the Quality of Service (QoS) profile set to Platinum (voice) and, most critically, the WMM Policy set to Required. The Required setting mandates that any client device attempting to associate with this WLAN must support and use Wi-Fi Multimedia (WMM). WMM is the Wi-Fi Alliance's interoperability certification for a subset of the features defined in the IEEE 802.11e standard, which provides QoS enhancements to the 802.11 MAC layer. Therefore, for a VoWLAN phone to connect to this network and have its voice traffic prioritized correctly, it must support both the 802.11e standard and its WMM implementation.

A. TSPEC: This admission control mechanism is not required by this configuration, as indicated by the 7920 AP-CAC setting being disabled.

B. SIFS: Short Interframe Space is a fundamental timing interval in the 802.11 protocol used by all devices; it is not a special feature for QoS.

E. APSD: Automatic Power Save Delivery is a power-saving feature within WMM. While beneficial for VoWLAN phones, it is not the core requirement for establishing a QoS-prioritized connection.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5

"Configuring QoS" Chapter

"Configuring QoS per WLAN (GUI)" section. This document states

"From the WMM Policy drop-down list

choose... Required—Clients must support WMM. Clients that do not support WMM are not allowed to associate with the WLAN." This confirms the mandatory nature of WMM support.

2. Cisco Enterprise Mobility 8.5 Design Guide

"Voice over WLAN Design and Deployment Recommendations" Chapter

"QoS for VoWLAN" section. This guide clarifies the relationship between the standards: "WMM is a certification by the Wi-Fi Alliance of a subset of the IEEE 802.11e amendment... Cisco recommends that you configure the voice WLAN for Wi-Fi Multimedia (WMM) and configure the QoS profile to Platinum." This directly links the Platinum profile

WMM

and the underlying 802.11e standard as essential for VoWLAN.

3. IEEE Std 800-4302.11™-2020

"IEEE Standard for Information Technology—Telecommunications and information exchange between systems Local and metropolitan area networks—Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications

" Clause 9.4.2.57 "WMM/WME Parameter Element". This section of the official standard defines the WMM Information Element that WMM-capable stations (clients) use to advertise their QoS capabilities

which is a requirement for associating with a WMM-enabled AP.

A single SSID model for a Bring Your Own Device (BYOD) deployment requires a centralized policy and access control engine to differentiate between various users and device types connecting to the same network name. The Cisco Identity Services Engine (ISE) is the required technology for this function. ISE acts as a RADIUS server and policy decision point, using context such as user identity, device type, and security posture to dynamically assign specific network access policies, such as VLANs or Access Control Lists (ACLs). This allows administrators to securely segment corporate, guest, and personal devices while maintaining a simplified user experience with a single SSID.

A. mobility service engine: The MSE is primarily used for location-based services (CMX) and wireless intrusion prevention (wIPS), not for core identity and policy enforcement for BYOD.

B. wireless control system: WCS is an obsolete network management platform that has been replaced by Cisco Prime Infrastructure and lacks the advanced policy capabilities of ISE.

D. Prime Infrastructure: This is a network management tool for configuration, monitoring, and troubleshooting. It does not perform the dynamic, context-aware policy enforcement, which is the role of ISE.

1. Cisco

"BYOD Design Guide (CVD)": In the chapter on BYOD Architecture

the guide states

"Cisco Identity Services Engine (ISE)—A context-aware security policy platform that enables an enterprise to enforce security policy for all users and devices that are seeking access to the network." It further explains that for a single-SSID design

ISE is used to differentiate devices and apply the appropriate policy. (Reference: BYOD Design Guide

Chapter 2

"BYOD Architecture

" section "Solution Components").

2. Cisco

"Identity Services Engine (ISE) Administrator Guide": The documentation details how ISE is the central component for creating and enforcing security and access policies for endpoints connecting to the organization's network. This is the fundamental requirement for a single-SSID BYOD model. (Reference: Cisco Identity Services Engine Administrator Guide

Release 3.0

Chapter: "Cisco ISE Overview

" section "Cisco ISE Functions").

3. Cisco

"Enterprise Mobility 4.1 Design Guide": This guide explicitly recommends the single-SSID design for BYOD and identifies ISE as the key component. It states

"The single SSID design is the recommended design for BYOD... The Cisco ISE is able to differentiate between a corporate-owned device and a personal device and apply the appropriate policy." (Reference: Enterprise Mobility 4.1 Design Guide

Chapter: "Solution Components

" section "Cisco Identity Services Engine").

The scenario describes a classic FlexConnect configuration issue. When an AP is in FlexConnect mode and a WLAN is configured for local switching, the AP must know which VLAN to place client traffic on at the remote site. This is accomplished by creating a FlexConnect group on the WLC, adding the APs to this group, and then defining a specific WLAN-to-VLAN mapping within the group's configuration. The failure of WLAN B in FlexConnect mode indicates it is configured for local switching but lacks this required VLAN mapping. Creating a FlexConnect group with the proper mapping will provide this information to the APs, allowing WLAN B to function correctly.

B. Disable local switching on the WLANs: This is a design change, not a configuration fix. It would force all traffic centrally, which may not meet the network requirements and doesn't correct the underlying local switching misconfiguration.

C. Map the AP group to the WLAN interface: This describes a non-existent configuration step. AP groups determine which WLANs are broadcast by APs, while WLANs are mapped to interfaces on the WLC for central switching.

D. Join the APs to a Cisco FlexConnect group: This action is incomplete. Simply joining a group is insufficient if the group has not been configured with the necessary WLAN-VLAN mappings, which is the crucial step described in option A.

1. Cisco Wireless Controller Configuration Guide

Release 8.5

"FlexConnect" Chapter

"Configuring FlexConnect Groups" section: "You can use FlexConnect groups to push the VLAN-specific configurations on the FlexConnect APs... You can create a FlexConnect group and assign a specific AP to the FlexConnect group. The APs in the group will inherit the VLAN and ACL configurations of the FlexConnect group." This document explicitly states that FlexConnect groups are used to configure VLANs for APs.

2. FlexConnect Configuration Guide

Cisco IOS XE Gibraltar 16.12.x

"Configuring FlexConnect Groups" section: "You can use FlexConnect groups to do the following: ... Efficiently configure WLAN-VLAN mapping for a group of FlexConnect APs." This confirms that the primary method for assigning VLANs to WLANs in a FlexConnect deployment is through FlexConnect groups.

3. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide

IOS XE Dublin 17.12.x

"Configure FlexConnect" Chapter

"WLAN-VLAN Mapping" section: "For locally switched WLANs

traffic from the clients is switched to a local VLAN at the AP's location... To configure VLANs on FlexConnect APs

you must configure FlexConnect Groups." This directly links the requirement for VLANs in local switching to the configuration of FlexConnect Groups.