QoS Prioritization Strategy for Enterprise vs Guest Voice Traffic
Short answer
C Use GPO and set the DSCP tags on endpoint devices to ensure only managed employee laptops receive prioritization while excluding unmanaged guest devices.
Question
Key Takeaways
The main trap is assuming deep packet inspection (NBAR) is always better; however, managing trust boundaries via endpoint tagging (GPO) is more secure and efficient for separating employee vs. guest traffic.
Learn how to prioritize WebEx calls for employees while excluding guests in a Cisco enterprise network using GPO-based DSCP tagging instead of NBAR or ACLs.
Common mistake: Choosing NBAR (Option D) is a common mistake because it classifies applications accurately but fails to address the 'guest' exclusion requirement efficiently and adds unnecessary processing load on access switches.
Expert Analysis
The question requires prioritizing WebEx calls from employee laptops while explicitly excluding guest third-party voice solutions. The constraint that AF31 cannot be used eliminates a common DiffServ Code Point (DSCP) value for standard voice, but does not prohibit other values like EF or CS5.
Option C is the correct choice because Group Policy Objects (GPO) allow an enterprise administrator to enforce DSCP tagging on managed endpoint devices (employee laptops). Since guests use their own unmanaged third-party solutions, they are excluded from GPO management, ensuring only corporate traffic receives priority. This aligns with the principle of trusting internal endpoints while ignoring external ones.
Option A and Option D suggest using Network-Based Application Recognition (NBAR). While NBAR can classify applications, it operates by inspecting packet payloads at Layer 7. On access layer devices (Option D), this introduces significant CPU overhead and latency, which is generally avoided for high-priority real-time traffic classification where header-based methods are preferred. Furthermore, NBAR might struggle to distinguish between employee and guest traffic if they share the same SSID or VLAN without additional context, whereas GPO provides a clear boundary based on device ownership.
Option B suggests using Access Control Lists (ACLs) on distribution layer devices. ACLs typically match source/destination IPs or ports. While possible, it is less precise for application-level prioritization than GPO tagging at the source. Additionally, relying on downstream classification rather than upstream marking is often less effective for end-to-end QoS consistency. The key insight is that "guest" devices cannot be managed via GPO, making C the only scalable and secure method to prioritize specific user groups.
Exam Strategy
When questions involve mixed environments (employees vs. guests), look for solutions that leverage management boundaries (like GPOs or AAA) rather than just traffic classification techniques. Always check if the proposed classification method can realistically distinguish between trusted and untrusted sources without excessive overhead.
Frequently Asked Questions
Why not use NBAR on access layer devices?
Can guests be prioritized using ACLs?
Community Votes
50% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
G_Singh12 👍 1 Answered CThe primary constraint is that the QoS solution must prioritize voice traffic only from the company users' laptops, while keeping third-party voice solutions used by guests completely unprioritized. 2. Because the enterprise has full administrative control over internal employees' laptops via Active Directory, a GPO (Group Policy Object) can be used to inject specific Quality of Service (QoS) settings at the operating system level. This ensures that when a corporate device runs WebEx, it automatically marks the IP packets with the correct DSCP tags. Since guest devices are not joined to the company's Active Directory domain, they do not receive or process the GPO settings. As a result, any voice traffic or applications originating from a guest laptop will remain completely untagged, satisfying the requirement to avoid prioritizing guest solutions.
-
bp3t3r_ 👍 1 Answered DDefinitely D is the correct answer. How could you apply GPO on guest devices? Also, you shouldn't trust DSCP markings coming from end devices (except for a few ones: APs, phones)
-
_MaGIC_13 👍 1 Answered CI agree with provided solution = C. NBAR is for application classification, etc. B is wrong as stating ACL's on distro's etc. C uses GPO and DSCP
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 300-420 Questions
Access 150 questions with complete answers and detailed explanations.
View Full 300-420 Practice Test →