Exam 300-425 topic 1 question 141 discussion

Actual exam question from Cisco's 300-425

Question #: 141
Topic #: 1

An engineer designs a new wireless network that uses a Cisco Catalyst 9800 Series wireless controller. The controller must be in a DMZ. The internal network is to be at the main on-premises data center of the customer. In addition, the customer wants to establish an EoIP tunnel to a Cisco 5520 WLC that is in a regional office. How must this requirement be incorporated into the design?

A. Use Cisco IOS-XE code that supports encryption of the data plane on the Catalyst 9800 WLC.
B. Use AirOS code that supports encryption of the control plane on the 5520 WLC.
C. Use Cisco IOS-XE code that supports encryption of the control plane on the Catalyst 9800 WLC.
D. Use AirOS code that supports encryption of the data plane on the 5520 WLC.

Show Suggested Answer

Suggested Answer: B 🗳️

by Bandito at Feb. 7, 2024, 5 a.m.

Comments

Submit Cancel

Bandito

Highly Voted 1 year, 4 months ago

Selected Answer: B

On the 9800 WLC, control plane encryption is always enabled, which means that you need to have secure mobility enabled on the AireOS side. However, data link encryption is optional. If you enable it on the 9800 side, enable it on AireOS with: config mobility group member data-dtls enable https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213913-building-mobility-tunnels-on-catalyst-98.html

upvoted 7 times

abam_

1 year ago

B is correct

upvoted 1 times

...

Abbribas

Most Recent 1 month, 1 week ago

Selected Answer: B

A and D both refer to data-plane encryption—so they don’t address the CAPWAP/EoIP control-plane, which is what you need to secure in a controller-to-controller tunnel. C would require the Catalyst 9800 (IOS-XE) to support control-plane DTLS—and no IOS-XE release currently offers that capability. B is the only choice that lines up: it leverages the AireOS-5520’s ability to encrypt the control-plane over the EoIP tunnel.

upvoted 1 times

...

Farhad123

4 months, 1 week ago

Selected Answer: A

Need to correct my previous answer , A is correct .

upvoted 1 times

...

Love2Cod3

5 months, 1 week ago

Selected Answer: B

Provided answer is correct. "AireOS uses EoIP tunnels for mobility. Support for CAPWAP based encrypted mobility (Secure Mobility) was brought in in 8.5. However the support for IRCM with Catalyst 9800 wireless controller is present only in 8.8.111 and above and in the 8.5 IRCM supported release." https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-8/b_c9800_wireless_controller-aireos_ircm_dg.html#id_85243

upvoted 1 times

...

Jonycici

8 months ago

Question is tricky because 9800s don't support EoIP tunnel, only UDP 16667 for data.

upvoted 1 times

...

Farhad123

8 months ago

B is correct , encryption of the control plane regarding 5520 is required. for 9800 we dont need to enable encryption for control plan as it is enabled by default

upvoted 1 times

...