6.3 Configure Network Access Control Mechanisms Such as 802.1X and MAB with Cisco Identity Services Engine 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An enterprise has two user groups: employees and contractors. Both authenticate via 802.1X with PEAP-MSCHAPv2. Employees must get full network access, while contractors must be placed in a guest VLAN. The ISE policy set has a single authentication policy that matches all users. What should the administrator configure to differentiate the authorization result?

   • ACreate two authorization profiles, one for each VLAN, and add authorization policy rules that match on the AD user groups.
   • BConfigure the switch to assign VLANs based on the user's MAC address.
   • CUse a single authorization profile that assigns the guest VLAN to all users.
   • DCreate two authentication policies, one for employees and one for contractors, each with a different authorization profile.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A university is configuring ISE as the RADIUS server for 802.1X on its wireless network. The wireless LAN controller (WLC) has been configured with the ISE IP address and shared secret. When a user attempts to connect, authentication fails. The ISE live logs show 'No matching policy set' for the RADIUS request. What is the most likely cause and the correct fix?

   • AThe user's credentials are incorrect; reset the user's password in the identity store.
   • BThe WLC is not configured for RADIUS; enable RADIUS accounting on the WLC.
   • CThe ISE policy set conditions do not match the RADIUS attributes sent by the WLC; adjust the policy set condition to match the WLC's NAS-IP-Address or SSID.
   • DThe WLC is sending the request to the wrong ISE node; verify the RADIUS server IP and shared secret on the WLC.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A user reports that their Windows laptop fails 802.1X authentication on a wired port. The switch shows the port in 'unauthorized' state. ISE live logs show an authentication failure with the reason 'EAP-TLS failed the certificate validation'. The user's certificate is issued by the company CA and is valid. Other users with the same CA can authenticate. What is the most likely cause?

   • AThe user's laptop does not trust the ISE server certificate, so it rejects the server during the TLS handshake.
   • BThe ISE certificate is expired, causing the TLS handshake to fail for all users.
   • CThe user's certificate is missing the Client Authentication extended key usage (EKU) attribute.
   • DThe switch is configured with the wrong RADIUS shared secret for this port.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is deploying 802.1X on its access switches. The switches are configured with 'aaa new-model', 'radius server ISE', and 'aaa authentication dot1x default group radius'. The ISE policy set is configured correctly. Users can authenticate, but the authorization result (VLAN) is not applied. What is the most likely cause?

   • AThe ISE authorization profile is configured with a dACL instead of a VLAN.
   • BThe RADIUS shared secret is incorrect on the switch.
   • CThe switch is missing the 'aaa authorization network default group radius' command.
   • DThe switch ports are not configured with 'authentication port-control auto'.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is deploying 802.1X with EAP-FAST on its wireless network. The ISE policy set is configured for EAP-FAST with PAC provisioning enabled. Users can authenticate, but the process is slow because PAC provisioning happens on every authentication. What should the administrator configure to improve performance?

   • ASet the PAC provisioning to 'Anonymous' and configure the client to use the provisioned PAC for subsequent authentications.
   • BDisable PAC provisioning and require users to authenticate with a username and password each time.
   • CEnable PAC provisioning to allow users to manually download a PAC file.
   • DConfigure the ISE policy to use PEAP instead of EAP-FAST.
   Reveal Solution Discussion Select an answer first