After receiving an alert about a rogue AP, a network engineer logs into Cisco Prime Infrastructure and looks at the floor map where the AP that…

The fastest way to disable a rogue AP from the Cisco Prime Infrastructure (PI) console is to initiate containment. This action instructs nearby managed access points to actively disrupt the rogue AP's operation by sending deauthentication frames to its clients. This immediately stops the rogue from providing service on the enterprise network. While classifying the rogue as malicious is a prerequisite, the containment action itself is what disables the device's functionality. Physically locating and powering off the device is time-consuming and not the fastest method available through the management system.

A. Go to the location where the rogue device is indicated to be and disable the power.

This is a physical, manual process that requires travel time and searching, making it significantly slower than initiating a software-based containment action from the management console.

B. Create an SSID similar to the rogue to disable clients from connecting to it.

This technique, known as a honeypot, does not disable the rogue AP. It only attempts to lure clients away and can create additional network confusion and security risks.

D. Classify the rogue as malicious in Cisco Prime Infrastructure.

This is a necessary classification step before containment can be applied, but it is not the action that disables the rogue. It is a prerequisite, not the final disabling command.

1. Cisco Prime Infrastructure 3.8 User Guide: In the section "Managing Rogue Access Points and Clients

" the procedure is outlined. It states

"After you classify a rogue AP as Malicious

you can contain it." The direct action is containment. The guide details the steps: "Select the check box of the rogue AP that you want to contain. From the Select a command drop-down list

choose Change Status > Contained." This confirms that changing the status to "Contained" is the specific action to disable the rogue. (Reference: Chapter: "Monitoring Network Security"

Section: "Managing Rogue Access Points and Clients").

2. Cisco Wireless LAN Controller Configuration Guide

Release 8.5: The "Rogue Management" chapter explains the mechanism. "You can configure the controller to use local-mode and monitor-mode access points to send deauthentication packets to clients that are associated to a rogue access point. This feature is called rogue AP containment." This defines containment as the disabling action. (Reference: Chapter: "Rogue Management"

Section: "Rogue AP Containment").

3. Designing and Deploying 802.11 Wireless Networks: A-Practical Guide to Implementing-Cisco Wireless Solutions (2nd Edition): This official Cisco Press book

relevant to the ENWLSD exam (a precursor and related domain to 300-430)

describes rogue mitigation. It clarifies that after a rogue is identified and classified as malicious

the next step is containment

which actively disrupts the rogue's ability to serve clients. (Reference: Chapter 11

"Wireless Security"

Section: "Rogue AP Detection and Mitigation").