6.3 Configure Network Access Control Mechanisms Such as 802.1X and MAB with Cisco Identity Services Engine 350-701 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which ISE log or report would you examine to see detailed authentication attempts, including the reason for an Access-Reject?

   • ASystem logs
   • BProfiling logs
   • CRADIUS Live Logs
   • DTACACS+ logs
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which EAP method is commonly used in 802.1X deployments with Cisco ISE to provide mutual authentication using digital certificates on both the client and the server?

   • AEAP-TLS
   • BPEAP-MSCHAPv2
   • CEAP-MD5
   • DLEAP
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hospital is deploying 802.1X for its wired nursing stations. The stations run a legacy medical-records application that does not support EAP-FAST or PEAP. The network team wants to use EAP-TLS with machine certificates, but the application runs in a kiosk mode that prevents user login. The switch ports are configured for multi-auth mode. Which ISE configuration should the team use to authenticate these stations while meeting the application constraint?

   • ACreate an authentication policy that requires EAP-TLS with machine authentication, and place the stations in an identity group that receives a dACL permitting only the medical-records server.
   • BUse PEAP-MSCHAPv2 with a shared machine account and configure the switch to send the same credentials for all stations.
   • CConfigure MAB as the fallback method and add the stations' MAC addresses to an identity group that receives full network access.
   • DDisable 802.1X on those ports and rely on the existing VLAN ACLs to restrict access to the medical-records server.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization is configuring ISE as the RADIUS server for a new 802.1X deployment. The network team has created a policy set that matches the wireless SSID. The authentication policy uses the internal identity store. When a test user attempts to connect, authentication fails with 'Authentication failed' in the live logs. The user's credentials are correct. What should the administrator check first?

   • ACheck the authorization policy to ensure it allows the user.
   • BCheck the RADIUS shared secret on the WLC.
   • CVerify that the user is in the correct identity group.
   • DVerify that the internal identity store is enabled in the authentication policy.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of ISE profiling?

   • ATo configure RADIUS clients
   • BTo manage user passwords
   • CTo encrypt network traffic
   • DTo identify the type of device attempting network access
   Reveal Solution Discussion Select an answer first