Exam 300-430 topic 1 question 2 discussion

This is on the Guide Chapter 14. aWIPS can work but is inefficient in this case, and attack detection may be slow. However, if you are primarily concerned about on-channel attacks (that is, incidents where attackers attempt to spoof your APs, act as relays, or perform other attacks while operating on the same channels as your active APs), then this mode is perfectly sufficient.

Both B and D would enable Intrusion protection. However, D is the best answer because the question states that the building is historic and adding APs is difficult. Therefore you would not want to switch existing client serving local access points to monitor mode as this would create coverage holes not easily filled by adding coverage. D keeps the access point client serving as well as implementing intrusion protection.

B is correct

B is correct

https://www.cisco.com/c/en/us/td/docs/wireless/technology/wips/deployment/guide/WiPS_deployment_guide.html On-Channel vs. Off-Channel Scanning per wIPS Mode The figure below explains the radio’s behavior. When a radio is on its serving channel it is considered “on-channel”, when the radio is scanning other channels, it is considered “off-channel”. An AP in local mode is mostly “on-channel”, making it difficult to detect attackers “off-channel”. A monitor mode AP is always “off-channel”, but cannot server clients, the WSM module provides a great combination of both.

B is coreect

correct, the on-channel says no need to scan other channels.

provided answer is correct