WLAN AAA Override for ISE Posture Policy
Short answer
A Enable AAA override on the WLAN so Cisco ISE can push posture-based dynamic authorizations that gate wireless client access.
Question
A network administrator must configure a client management parameter for a wireless deployment in a multi-site enterprise. The enterprise is using Cisco ISE as the management platform to oversee wireless access policies. To meet the organization's compliance requirements, all wireless endpoints must be evaluated against a posture policy before gaining access.
Which configuration change must be applied on the WLAN level of the WLC to meet the requirement?
Key Takeaways
The test is whether you know posture enforcement depends on the WLC accepting ISE's dynamic RADIUS authorizations, with the trap being to pick ISE-side profile commands or a plain RADIUS enable instead of the WLAN aaa-override setting.
This 350-101 question asks which WLAN-level WLC command enables Cisco ISE posture evaluation for wireless endpoints. Enabling AAA override on the WLAN is the required change, because it lets ISE return per-session RADIUS attributes that hold or restrict the client until posture passes.
Common mistake: Learners most often choose option C (a radius enable style command) or the ISE-side 'wireless profile policy' options B and D, because ISE is named in the scenario; but posture results reach the WLC only as dynamic authorizations, which the WLAN will ignore unless AAA override is enabled.
Expert Analysis
Why the Answer Is Correct
Option A, config wlan WLAN-staff enable aaa-override, is issued on the WLC WLAN itself, which is exactly the level the question specifies. AAA override permits the controller to accept and apply per-session RADIUS attributes from Cisco ISE instead of only the static WLAN policy. When a client fails or has not yet completed posture, ISE returns authorization attributes (restricted/dynamic ACL or VLAN, or a SGT-style restriction) that block or throttle access until compliance is met. Without this switch, the WLC silently ignores those attributes and the client gains full access regardless of posture results.
Why the Other Options Are Wrong
Options B and D (wireless profile policy...) are ISE-side CLI statements that build a wireless policy profile in ISE, so they fail the question's explicit requirement for a change applied at the WLAN level of the WLC. Option D additionally mixes an ISE profile command with a config wlan 5 enable radius fragment, and option C's config wlan WLAN-Staff... radius enable wording does not correspond to the AAA override behavior needed; merely pointing a WLAN at a RADIUS server lets authentication succeed but does not authorize posture-driven restrictions. Because these options either live on the wrong device or only address authentication rather than dynamic authorization, none can enforce the compliance posture requirement.
Community Comment Notes
JS2025 argued for A, explaining that "the WLC must be permitted to accept and apply dynamic access policies received from the RADIUS server" and that enabling aaa-override "allows ISE to push critical client-specific att…" attributes. That reasoning matches Cisco's documented posture workflow: authentication identifies the user, while AAA override carries the ISE authorization decision that actually enforces posture. No other comment offered a competing rationale, and the vote data is unavailable, so the analysis rests on the WLAN-level requirement in the question stem.
Exam Strategy
Read the stem for the configuration layer first: 'on the WLAN level of the WLC' immediately eliminates ISE-side profile commands. Then ask what posture actually needs — dynamic per-session authorization — and match it to the WLAN feature that accepts RADIUS override attributes.
Frequently Asked Questions
Why is enabling AAA override on the WLAN required for Cisco ISE posture?
Why don't the 'wireless profile policy' options answer this question?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
JS2025 👍 1 Answered ATo implement endpoint posture evaluation and compliance enforcement with Cisco ISE, the Wireless LAN Controller (WLC) must be permitted to accept and apply dynamic access policies received from the RADIUS server. Enabling AAA Override (aaa-override) at the WLAN level allows Cisco ISE to override the default access policies configured on the WLC. This allows ISE to push critical client-specific attributes—such as dynamic VLAN assignments, downloadable ACLs (dACLs), user roles, and posture redirection/state transitions—directly to the connected endpoint based on its current compliance status. Without this configuration, the WLC would ignore the authorization results sent by Cisco ISE and stick to the default WLAN configuration, preventing posture compliance enforcement. The other choices represent invalid syntax or incorrect configuration parameters for this requirement.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.