Exam 300-375 topic 1 question 11 discussion

Actual exam question from Cisco's 300-375

Question #: 11
Topic #: 1

After receiving an alert regarding a rogue AP, a network engineer logs into Cisco Prime and looks at the floor map where the AP that detected the rogue is located.
The map is synchronized with a mobility services engine that determines the rogue device is actually inside the campus. The engineer determines the rogue to be a security threat and decides to stop it from broadcasting inside the enterprise wireless network. What is the fastest way to disable the rogue?

A. Go to the location the rogue device is indicated to be and disable the power.
B. Create an SSID on the WLAN controller resembling the SSID of the rogue to spoof it and disable clients from connecting to it.
C. Classify the rogue as malicious in Cisco Prime.
D. Update the status of the rogue in Cisco Prime to contained.

Show Suggested Answer

Suggested Answer: C 🗳️
Please refer to the step 10 of the topic "Configuring Rouge Detection" of the reference link.
Reference: http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/ b_cg74_CONSOLIDATED_chapter_0111101.pdf

by jeanh101 at Jan. 31, 2020, 12:37 p.m.

Comments

Submit Cancel

mqoltn

2 years, 6 months ago

Selected Answer: A

i would say A. If you contain the rogue you are just sending deauth frames to the clients connected to it. The only way to stop the rogue from broadcasting is to pull the plug :)

upvoted 2 times

twoplanker

2 years, 4 months ago

Literally the only way to stop a device from broadcasting is to turn it off. I agree, I think unplugging it is the correct answer.

upvoted 1 times

javier131313

2 years, 4 months ago

well, the question is asking what is the fastest way, and setting it to contained is faster than going to the campus, search the AP and pull the plug

upvoted 1 times

...

jeanh101

5 years, 2 months ago

Answer is D