WLAN AAA Override for ISE Posture Policy

Configure client management rules and policies on multiple platforms such as WLC, Dashboard, Catalyst Center, ISE, Spaces, and mobile device management Configure authentication mechanisms outside the controller

Refer to the exhibit. exhibit A network administrator must configure a client management parameter for a wireless deployment in a multi-site enterprise. The enterprise is using Cisco ISE as the management platform to oversee wireless access policies. To meet the organization's compliance requirements, all wireless endpoints must be evaluated against a posture policy before gaining access. Which configuration change must be applied on the WLAN level of the WLC to meet the requirement?

config wlan WLAN-staff enable aaa-override Correct Answer
wireless profile policy WLAN-Staffnac
config wlan WLAN-StaffWLAN-staff radius enable
wireless profile policy WLAN-Staff config wlan 5 enable radius

Answer Correct answer: A — Enable AAA override on the WLAN so Cisco ISE can push posture-based dynamic authorizations that gate wireless client access.

Community Insight

The test is whether you know posture enforcement depends on the WLC accepting ISE's dynamic RADIUS authorizations, with the trap being to pick ISE-side profile commands or a plain RADIUS enable instead of the WLAN aaa-override setting.

This 350-101 question asks which WLAN-level WLC command enables Cisco ISE posture evaluation for wireless endpoints. Enabling AAA override on the WLAN is the required change, because it lets ISE return per-session RADIUS attributes that hold or restrict the client until posture passes.

Learners most often choose option C (a radius enable style command) or the ISE-side 'wireless profile policy' options B and D, because ISE is named in the scenario; but posture results reach the WLC only as dynamic authorizations, which the WLAN will ignore unless AAA override is enabled.

Community Discussion (1 comments)

JS2025 👍 1 Selected: A

To implement endpoint posture evaluation and compliance enforcement with Cisco ISE, the Wireless LAN Controller (WLC) must be permitted to accept and apply dynamic access policies received from the RADIUS server. Enabling AAA Override (aaa-override) at the WLAN level allows Cisco ISE to override the default access policies configured on the WLC. This allows ISE to push critical client-specific attributes—such as dynamic VLAN assignments, downloadable ACLs (dACLs), user roles, and posture redirection/state transitions—directly to the connected endpoint based on its current compliance status. Without this configuration, the WLC would ignore the authorization results sent by Cisco ISE and stick to the default WLAN configuration, preventing posture compliance enforcement. The other choices represent invalid syntax or incorrect configuration parameters for this requirement.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option A, config wlan WLAN-staff enable aaa-override, is issued on the WLC WLAN itself, which is exactly the level the question specifies. AAA override permits the controller to accept and apply per-session RADIUS attributes from Cisco ISE instead of only the static WLAN policy. When a client fails or has not yet completed posture, ISE returns authorization attributes (restricted/dynamic ACL or VLAN, or a SGT-style restriction) that block or throttle access until compliance is met. Without this switch, the WLC silently ignores those attributes and the client gains full access regardless of posture results.

Why the Other Options Are Wrong

Options B and D (wireless profile policy...) are ISE-side CLI statements that build a wireless policy profile in ISE, so they fail the question's explicit requirement for a change applied at the WLAN level of the WLC. Option D additionally mixes an ISE profile command with a config wlan 5 enable radius fragment, and option C's config wlan WLAN-Staff... radius enable wording does not correspond to the AAA override behavior needed; merely pointing a WLAN at a RADIUS server lets authentication succeed but does not authorize posture-driven restrictions. Because these options either live on the wrong device or only address authentication rather than dynamic authorization, none can enforce the compliance posture requirement.

Community Comment Notes

JS2025 argued for A, explaining that "the WLC must be permitted to accept and apply dynamic access policies received from the RADIUS server" and that enabling aaa-override "allows ISE to push critical client-specific att…" attributes. That reasoning matches Cisco's documented posture workflow: authentication identifies the user, while AAA override carries the ISE authorization decision that actually enforces posture. No other comment offered a competing rationale, and the vote data is unavailable, so the analysis rests on the WLAN-level requirement in the question stem.

Exam Strategy

Read the stem for the configuration layer first: 'on the WLAN level of the WLC' immediately eliminates ISE-side profile commands. Then ask what posture actually needs — dynamic per-session authorization — and match it to the WLAN feature that accepts RADIUS override attributes.

Frequently Asked Questions

Why is enabling AAA override on the WLAN required for Cisco ISE posture?

AAA override tells the WLC to honor per-session RADIUS attributes from ISE instead of only its static WLAN policy, so ISE can restrict a client until posture passes.

Why don't the 'wireless profile policy' options answer this question?

Those commands configure the ISE side of the policy; the question asks for a change applied at the WLAN level of the WLC, which is option A.

More 350-101 FAQ →

Related Analysis

← Back to 350-101 Study Guide