4.4 AAA for Network Access with 802.1X and MAB Using Cisco ISE CCIE-SECURITY Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   An organization is deploying ISE for 802.1X. They have two ISE nodes in a deployment. The primary node is the policy administration node (PAN), and the secondary is a policy service node (PSN). They want to ensure that if the primary PSN fails, the switch can still authenticate users. What should they configure?

   • AConfigure the switch with both ISE nodes as RADIUS servers, with the primary as the first and the secondary as the second.
   • BConfigure the switch to use the PAN as the RADIUS server.
   • CEnable CoA on the secondary node only.
   • DUse a load balancer in front of the ISE nodes.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company has an authorization profile that assigns a dACL to a group of users. After a policy change, the dACL is updated in ISE. However, existing sessions are still using the old dACL. What is the most efficient way to apply the new dACL to existing sessions?

   • AWait for the sessions to expire and re-authenticate.
   • BUse RADIUS Disconnect-Request to terminate all sessions and hope users reconnect.
   • CManually apply the new dACL on the switch.
   • DSend a CoA 'Reauth' to the affected sessions to force re-authentication and re-authorization.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company uses ISE with Active Directory as the identity source. They want to allow only users who are members of the 'Network_Access' AD group to authenticate via 802.1X. They also have a local guest account for temporary visitors. How should they configure the authentication policy?

   • ACreate an authentication rule that matches AD users with the 'Network_Access' group as a condition, and another rule for the internal guest account.
   • BCreate a local user account for each AD user and use the internal identity store.
   • CConfigure the switch to only send authentication requests for users in the 'Network_Access' group.
   • DUse the same authentication rule for all users and rely on authorization to filter.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A network admin is troubleshooting an issue where a user is not receiving the correct dACL. The user authenticates successfully, but the switch applies a different ACL. The ISE authorization profile includes the Cisco VSA 'ip:inacl#100=Restricted'. The switch has a dACL named 'Restricted' configured. What is the most likely cause?

   • AThe dACL name in the VSA does not match the dACL name defined in ISE.
   • BThe RADIUS shared secret is incorrect.
   • CThe user is not in the correct identity group.
   • DThe switch does not support downloadable ACLs.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A company uses ISE to assign VLANs dynamically. They have a group of users that should be in VLAN 30, but after a recent change, they are getting VLAN 10. The authorization profile for that group is correct. What should you check first?

   • AVerify that the RADIUS shared secret is correct.
   • BCheck the user's device for a supplicant issue.
   • CEnsure that the authorization policy is matching the correct identity group and not a more specific rule that assigns VLAN 10.
   • DCheck the switch's VLAN configuration to ensure VLAN 30 exists.
   Reveal Solution Discussion Select an answer first