300-430 Practice Questions

The Network Mobility Services Protocol (NMSP) is a Cisco-proprietary protocol that facilitates communication between a Cisco Wireless LAN Controller (WLC) and a Cisco Mobility Services Engine (MSE). This protocol is essential for the MSE to receive data for services such as wIPS (Wireless Intrusion Prevention System) and Context-Aware Services (CMX). The WLC collects security event information from its managed access points and forwards this data, including wIPS alarms and rogue device information, to the MSE over an NMSP connection. If this protocol is blocked by a firewall or an access control list, the MSE will not receive any alarm data.

A. SOAP/XML: This is a messaging protocol used for API integrations, often with management platforms like Cisco Prime Infrastructure, not for the primary, real-time wIPS data stream between a WLC and MSE.

C. CAPWAP: The Control and Provisioning of Wireless Access Points protocol is used for communication between access points and the WLC, not between the WLC and the MSE.

D. SNMP: While WLCs can send SNMP traps for general network monitoring, NMSP is the specific, stateful protocol required for the continuous exchange of detailed information needed by the wIPS service on the MSE.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.10

"Mobility Services Engine" Chapter: "The controller communicates with the mobility services engine using the Network Mobility Services Protocol (NMSP)." It further specifies

"The controller and mobility services engine must be able to reach each other through the network. For this reason

you must ensure that any firewalls or access control lists between them are configured to allow NMSP traffic."

2. Enterprise Mobility 8.5 Design Guide

"Cisco MSE and Cisco CMX Design" Chapter: "The communication between the Cisco WLC and the Cisco MSE is based on the Cisco proprietary Network Mobility Services Protocol (NMSP). The Cisco WLC acts as a proxy for the information sent by the APs and forwards it to the Cisco MSE using the NMSP protocol."

3. Cisco Connected Mobile Experiences (CMX) Configuration Guide

Release 10.6

"Adding Controllers" Section: "The Network Mobility Services Protocol (NMSP) is used for communication between Cisco WLC and Cisco CMX. The NMSP connection must be enabled on the Cisco WLC before adding it to Cisco CMX." (Note: CMX is the evolution of MSE services

and the underlying protocol remains NMSP).

For a Cisco OfficeExtend Access Point (OEAP) to establish a connection with a Wireless LAN Controller (WLC) across the public internet, two fundamental network configurations are required. First, the WLC, which resides on the private corporate network, must be reachable from the AP at the remote location. This is accomplished by configuring Network Address Translation (NAT) on the firewall to map a public, internet-routable IP address to the WLC's AP-Manager interface. The WLC must also be configured with this public NAT IP. Second, the firewall must be configured to permit the Control and Provisioning of Wireless Access Points (CAPWAP) protocol traffic. CAPWAP uses UDP port 5246 for control plane communication and UDP port 5247 for data plane traffic, both of which must be allowed inbound to the WLC.

A. Block UDP ports 1812 and 1813 on the firewall.

These are RADIUS ports. Blocking them is unrelated to the AP joining the controller and would likely break 802.1X authentication services.

C. Configure a static IP on the OEAP 1810.

OEAPs are designed for zero-touch deployment and typically obtain an IP address via DHCP from the teleworker's home router. A static IP is not a requirement.

E. Allow UDP ports 12222 and 12223 on the firewall.

These ports are used by the legacy Lightweight Access Point Protocol (LWAPP). The 1810 AP and 5520 WLC use the modern CAPWAP protocol.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5

"Configuring OfficeExtend Access Points" chapter

"Firewall and Access Control List Configuration" section. This document states

"The following ports need to be opened on the firewall: ... For CAPWAP traffic: UDP 5246 and 5247." It also specifies

"If the controller is behind a firewall that is performing Network Address Translation (NAT)

you must configure the controller with the IP address of the firewall." This directly supports options B and D.

2. Enterprise Mobility 8.5 Design Guide

"FlexConnect and OfficeExtend AP" chapter

"OfficeExtend AP" section. This guide details deployment considerations: "CAPWAP control and data (UDP 5246 and 5247) must be permitted from the Internet to the WLC AP-Manager interface." Regarding NAT

it states

"When the WLC is located behind a NAT device... the public IP address that maps to the WLC must be configured on the WLC." This confirms the necessity of both chosen configurations.

3. Cisco Aironet 1810 OfficeExtend Access Point Deployment Guide

"Prerequisites" section. This guide explicitly lists the required open ports for a successful deployment: "Ensure that the following ports are open on the firewall... CAPWAP control port - UDP 5246... CAPWAP data port - UDP 5247." It also notes

"If the controller is behind a Network Address Translation (NAT) device

you must configure the NAT IP address on the controller."

The Cisco FlexConnect AP Upgrade feature is designed to conserve WAN bandwidth by having only one "master" AP per model within a FlexConnect group download the new software image from the controller. The other "slave" APs then download the image from the master AP over the local network. The controller automatically selects the AP with the lowest MAC address as the master. An administrator has the option to manually override this and set a specific AP as the master. To ensure the default behavior occurs (where the AP with the lowest MAC is chosen), the administrator should simply enable the feature and not manually configure any master AP.

A. Remove the APs from the group: This action is incorrect because the FlexConnect AP Upgrade feature operates on a group basis. Removing APs from the group would defeat the purpose of the feature.

B. Reboot all APs before the upgrade: Rebooting APs is not a required configuration step to enable the FlexConnect upgrade process; the upgrade itself will trigger a reboot after the image transfer.

C. Allocate the master APs to different groups: This is incorrect and counterproductive. Moving the designated master AP to a different group would break the master-slave relationship for the original group's upgrade process.

1. Cisco Wireless Controller Configuration Guide

Release 8.10

"FlexConnect" Chapter

"Configuring FlexConnect AP Upgrade (GUI)" section: "When you enable FlexConnect AP upgrade

the controller chooses one AP of each model as the master AP. The master AP downloads the image from the controller and the slave APs download the image from the master AP. The controller selects the AP with the lowest MAC address as the master AP. You can also manually configure a specific AP as the master AP for a FlexConnect group. If you do not want to configure a master AP

the controller automatically chooses a master AP." This directly supports that not setting a master AP results in the desired default behavior.

2. Cisco AireOS Command Reference

Release 8.10

config flexconnect group command description: The command config flexconnect group master-ap add is used to manually set a master AP. The absence of this configuration invokes the automatic selection process

which aligns with the correct answer.

The core requirement is to perform location analytics using Cisco CMX but to limit the tracking to only clients that are actively connected to the network. By default, CMX processes location data for both associated clients and unassociated (probing) clients. To meet the requirement of tracking only associated clients, the administrator must configure CMX to ignore the data from probing devices. The "Exclude probing clients" setting (or unchecking "Include Probing Clients") is the specific function designed for this purpose, ensuring analytics are based solely on devices that have completed the association process with an AP.

B. Duty Cycle Cutoff: This setting is used in Hyperlocation to filter out non-Wi-Fi interference sources based on their transmission patterns, not to distinguish between associated and probing clients.

C. Enable Locally Administered MAC Filtering: This filters devices that use randomized MAC addresses. It does not filter based on the client's association state with the network.

D. Enable Location MAC Filtering: This feature is used to manually create a list of specific MAC addresses to either include or exclude from location calculations, not to filter all clients based on their state.

1. Cisco Connected Mobile Experiences (CMX) 10.6 Configuration Guide: In the "Configuring Analytics Service" section

it states

"By default

CMX includes both associated and probing clients in the analytics. To exclude probing clients

you must uncheck the Include Probing Clients check box." This directly corresponds to the action described in option A. (Reference: System > Settings > Analytics page description).

2. Cisco Wireless Controller Configuration Guide

Release 8.10: The section on "Configuring CMX" details the Network Mobility Services Protocol (NMSP) which the controller uses to send client information to CMX. This information includes the client's MAC address and association status

which allows CMX to differentiate between associated and probing clients for features like analytics. (Reference: Chapter: Mobility Services

Section: Configuring CMX).

3. Cisco CMX Configuration Guide

Release 10.5: Under the "Configuring System Settings" chapter

the Analytics tab settings are described. The guide explains that the "Include Probing Clients" checkbox controls whether unassociated clients are used in analytics calculations. Unchecking it achieves the goal of only tracking associated clients. (Reference: System Settings > Analytics Tab).

Cisco Media Stream (also called VideoStream) achieves reliable video delivery by having the AP convert the multicast stream to independent unicast frames that are acknowledged by every client. On a WLC this behaviour is activated through the Media Stream option “Multicast Direct.” FlexConnect APs inherit this setting from the controller; when Multicast Direct is enabled, the FlexConnect APs replicate the stream per-client, guaranteeing delivery and preventing the loss normally associated with multicast over 802.11.

A. Unicast Direct – governs admission-controlled unicast flows, not multicast video streams; does not enable per-client replication of multicast.

B. IGMP Direct – not a WLC/FlexConnect feature name; IGMP snooping alone cannot provide reliable wireless delivery.

D. Multicast-to-Unicast Direct – descriptive phrase but not the actual configurable feature; the controller GUI/CLI and documentation use “Multicast Direct.”

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5

“Configuring Media Stream – Enabling Multicast Direct” (Section: Media Stream Configuration)

2. Cisco FlexConnect Deployment Guide

Release 8.x

“Media Stream (Multicast Direct) Support in FlexConnect” (p. 25–27)

3. Cisco White Paper “Cisco VideoStream Technology” (2012)

p. 5–6

DOI:10.1145/2348676.2348680

4. Cisco Live Session BRKEWN-2020

“Optimizing Video over Wi-Fi

” slide 34 “Multicast Direct = Reliable VideoStream”

The scenario requires a solution where client traffic is either switched locally at a remote site or tunneled to the central WLC, with the decision based on the VLAN assigned by ISE. This functionality is explicitly provided by the VLAN-based central switching feature within a FlexConnect architecture. This feature allows an administrator to define which VLANs are tunneled (centrally switched). When a client associates, and ISE assigns it to a VLAN, the FlexConnect AP checks its configuration. If the assigned VLAN is not on the central switching list, its traffic is switched locally. Otherwise, it is tunneled to the WLC, perfectly matching the requirements.

A. learn client IP address: This is a sub-feature of FlexConnect local switching where the WLC learns a client's IP address from the AP, not the mechanism that determines the switching path.

B. FlexConnect local authentication: This feature provides authentication services at the remote site during a WAN outage, which is unrelated to dynamically selecting a traffic switching path.

D. central DHCP processing: This defines where DHCP services are handled (at the WLC), not how client data traffic is switched (locally or centrally) based on its assigned VLAN.

1. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide

Cisco IOS XE Cupertino 17.9.x: In the "FlexConnect" chapter

the section "FlexConnect - VLAN Central Switching" states

"FlexConnect - VLAN Central Switching feature enables you to control the switching path of VLANs (that is

local or central) on a FlexConnect AP. You can specify the VLANs that you want to be centrally switched. The VLANs that are not specified as centrally switched are locally switched."

2. FlexConnect Deployment Guide: In the section "VLAN-based Central Switching

" it details the process: "When a client connects to a centrally switched VLAN

its traffic is tunneled to the controller. When a client connects to a locally switched VLAN

its traffic is switched locally at the AP. This decision is based on the VLAN ID assigned by the RADIUS server (ISE)." This directly aligns with the question's scenario involving ISE.

3. Cisco Identity-Based Networking Services (IBNS) 2.0 Deployment Guide: The guide explains how ISE provides authorization results

including VLAN assignment. In a FlexConnect context

it notes

"The access point then determines whether the VLAN is configured for local switching or central switching... If the VLAN is not configured for local switching... its traffic is tunneled back to the WLC." This confirms the interaction between ISE and the FlexConnect feature.

In Cisco's wireless architecture, Quality of Service (QoS) is managed through predefined profiles. The Bronze profile is specifically designed for background or low-priority traffic. Guest services are considered non-critical, and their traffic should not impede essential enterprise applications like voice or video. Assigning guest services to the Bronze profile ensures they receive the lowest priority handling, aligning with best practices for network resource management. This prevents guest traffic from consuming bandwidth that may be needed for business-critical operations.

A. gold: Incorrect. The Gold profile is designed for high-priority video application traffic, which is inappropriate for guest services.

C. platinum: Incorrect. The Platinum profile is reserved for the highest-priority, latency-sensitive traffic, such as Voice over IP (VoIP).

D. silver: Incorrect. The Silver profile is for best-effort traffic and is often the default for general user data, which has a higher priority than guest traffic.

1. Cisco Wireless LAN Controller Configuration Guide

Release 8.5: In the "Configuring QoS" chapter

under the "Information About QoS Profiles" section

the guide defines the four default profiles. It specifies that the Bronze profile is for "Background" traffic

mapping to User Priority (UP) values 1 and 2

which represents the lowest priority class above scavenger.

Reference: Cisco Wireless LAN Controller Configuration Guide

Release 8.5

Chapter: Configuring QoS

Section: Information About QoS Profiles.

2. Enterprise Mobility 8.5 Design Guide: This guide discusses WLAN design principles

including QoS. In the "WLAN QoS Design" section

it reinforces the mapping of QoS profiles to traffic types. It recommends that guest SSIDs be configured with a lower QoS profile

such as Bronze

to ensure that corporate traffic is prioritized.

Reference: Enterprise Mobility 8.5 Design Guide

Chapter: WLAN QoS

Section: WLAN QoS Design.

3. Cisco Catalyst 9800 Series Wireless Controller Configuration Guide

Cisco IOS XE Amsterdam 17.3.x: In the "QoS for Wireless" chapter

the section "QoS Profiles" details the default profiles. It states

"Bronze (background)—This profile is for background traffic

" confirming its role for the lowest-priority data.

Reference: Cisco Catalyst 9800 Series Wireless Controller Configuration Guide

Cisco IOS XE Amsterdam 17.3.x

Chapter: QoS for Wireless

Section: QoS Profiles.

Angle-of-Arrival (AoA) location systems compute a client’s position by measuring the angle at which the RF signal reaches a multi-element antenna array on each access point; this measured angle is the signal’s angle of incidence and is then intersected from two or more APs to pinpoint the device. No RSSI values or time-difference metrics are required—only the incident angle.

A. Received signal strength: AoA algorithms do not use RSSI power levels; RSSI underpins trilateration, not angle measurements.

B. Triangulation: Generic term; AoA is the specific technique of using incident angles, not the broader geometric process.

C. Time distance of arrival: Involves measuring propagation time differences (TDoA) rather than angles; unrelated to AoA computations.

1. Cisco Systems

“Cisco Hyperlocation Solution Design Guide

” v2

§2.2 “Angle-of-Arrival (AoA) Fundamentals

” pp. 11-12.

2. Cisco Systems

“Cisco CMX Configuration Guide

Release 10.x

” Ch. 2 “Location Algorithms

” para. ‘Angle of Arrival’

p. 2-4.

3. Cisco Systems

“Location Architecture for Wi-Fi and RFID

” white paper

2013

§3.1 “AoA—Incident Angle Measurement

” p. 7.

To establish a connection between a Cisco Wireless LAN Controller (WLC) and a Cisco Connected Mobile Experiences (CMX) server, the Network Mobility Services Protocol (NMSP) is used. This requires two primary configuration steps. First, NMSP must be explicitly enabled on the WLC, and the CMX server must be added to the WLC's list of mobility service engines. Second, if a firewall or access control list exists between the WLC and the CMX server, it must be configured to permit NMSP traffic. NMSP uses TCP port 16113 for communication initiated from the WLC to the CMX server. Failure in either of these steps will prevent connectivity.

A. Add permanent licenses on the Cisco CMX server.

Licensing enables specific CMX features and capacity but is not required to establish the initial NMSP network connectivity itself.

D. Reboot Cisco CMX after adding the WLC for the first time.

Rebooting the CMX server is not a standard or required configuration step for adding a WLC and establishing an NMSP session.

E. Add to the WLC the MAC address and SSC key for the Cisco CMX server.

The WLC is configured with the CMX server's IP address, not its MAC address. The SSC key is an outdated authentication method.

1. Cisco Connected Mobile Experiences (CMX) Configuration Guide

Release 10.6

"Setting Up and Configuring Cisco CMX" chapter

"Firewall Settings" section. This document explicitly states

"NMSP—TCP Port 16113 (Controller to CMX)." This validates that the firewall must permit this port.

2. Cisco Wireless Controller Configuration Guide

Release 8.10

"Mobility Services Engine" chapter

"Configuring Mobility Services Engines" section. This guide details the procedure for enabling NMSP on the controller: "Step 1: To enable NMSP on the controller

enter this command: config nmsp enable." This confirms that NMSP must be enabled on the WLC.

3. Cisco Connected Mobile Experiences (CMX) Configuration Guide

Release 10.6

"Adding Controllers to Cisco CMX" chapter

"Adding a Controller" section. The guide notes

"You must enable Network Mobility Services Protocol (NMSP) on the Cisco WLC to allow it to communicate with Cisco CMX." This reinforces the necessity of enabling NMSP on the WLC.

The fastest way to disable a rogue AP from the Cisco Prime Infrastructure (PI) console is to initiate containment. This action instructs nearby managed access points to actively disrupt the rogue AP's operation by sending deauthentication frames to its clients. This immediately stops the rogue from providing service on the enterprise network. While classifying the rogue as malicious is a prerequisite, the containment action itself is what disables the device's functionality. Physically locating and powering off the device is time-consuming and not the fastest method available through the management system.

A. Go to the location where the rogue device is indicated to be and disable the power.

This is a physical, manual process that requires travel time and searching, making it significantly slower than initiating a software-based containment action from the management console.

B. Create an SSID similar to the rogue to disable clients from connecting to it.

This technique, known as a honeypot, does not disable the rogue AP. It only attempts to lure clients away and can create additional network confusion and security risks.

D. Classify the rogue as malicious in Cisco Prime Infrastructure.

This is a necessary classification step before containment can be applied, but it is not the action that disables the rogue. It is a prerequisite, not the final disabling command.

1. Cisco Prime Infrastructure 3.8 User Guide: In the section "Managing Rogue Access Points and Clients

" the procedure is outlined. It states

"After you classify a rogue AP as Malicious

you can contain it." The direct action is containment. The guide details the steps: "Select the check box of the rogue AP that you want to contain. From the Select a command drop-down list

choose Change Status > Contained." This confirms that changing the status to "Contained" is the specific action to disable the rogue. (Reference: Chapter: "Monitoring Network Security"

Section: "Managing Rogue Access Points and Clients").

2. Cisco Wireless LAN Controller Configuration Guide

Release 8.5: The "Rogue Management" chapter explains the mechanism. "You can configure the controller to use local-mode and monitor-mode access points to send deauthentication packets to clients that are associated to a rogue access point. This feature is called rogue AP containment." This defines containment as the disabling action. (Reference: Chapter: "Rogue Management"

Section: "Rogue AP Containment").

3. Designing and Deploying 802.11 Wireless Networks: A-Practical Guide to Implementing-Cisco Wireless Solutions (2nd Edition): This official Cisco Press book

relevant to the ENWLSD exam (a precursor and related domain to 300-430)

describes rogue mitigation. It clarifies that after a rogue is identified and classified as malicious

the next step is containment

which actively disrupts the rogue's ability to serve clients. (Reference: Chapter 11

"Wireless Security"

Section: "Rogue AP Detection and Mitigation").