Exam 300-715 topic 1 question 248 discussion

D, I didn't found any explanation describing B

shloud be D

For me, correct is D: "Change the Access Type under the Authorization Profile lo ACCESS_REJECT." - - Access Type = drop-down list in Authorization Profile with options ACCESS_ACCEPT or ACCESS_REJECT. https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_authz_polprfls.html#wp1082564 - Question states “device connects to the wireless network it triggers the Wireless Block List Default rule”, which means that authorization policy (and Authorization Profile) is used but apparently with incorrect authorization settings.

In this case for me is not B, I do not see any document mentioned by denverfly (maybe I'm wrong, in case please share the link to the documentation). For logic in this case cause I don't see nothing about this I would say that we need to create an ACL to the WLC that will be used as an airspace ACL for the users that are inside the blacklist portal. Let's discuss this in case I'm wrong guys

The additional step that must be taken to resolve the issue of the wireless device being allowed to access the wireless network despite being in the Blocklist Identity Group is B. Enable SNMP with read and write access on the Cisco WLC. This is because the Wireless Block List Default rule uses the ANC (Adaptive Network Control) action of QUARANTINE, which requires SNMP communication between the ISE and the WLC to apply the ACL named BLACKHOLE to the wireless device. If SNMP is not enabled or configured correctly on the WLC, the ISE will not be able to send the CoA (Change of Authorization) request to the WLC and the wireless device will not be blocked. The other options are not correct. Option A is not relevant because URL redirection is not used for the Wireless Block List Default rule. Option C is not necessary because the ACL named BLACKHOLE is automatically created on the WLC when the ANC service is enabled on the ISE. Option D is not effective because the Access Type under the Authorization Profile only applies to wired devices, not wireless devices