4.4 AAA for Network Access with 802.1X and MAB Using Cisco ISE CCIE-SECURITY Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A user is authenticated via 802.1X and receives a dACL that should permit only HTTP and HTTPS. However, the user can also access other ports. The dACL is correctly defined in ISE. What is the most likely cause?

   • AThe switch has a static ACL that overrides the dACL.
   • BThe switch is not applying the dACL because the session is not using the correct authorization profile.
   • CThe RADIUS VSA is using the wrong ACL name.
   • DThe dACL is missing the 'permit' statements for HTTP and HTTPS.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A manufacturing plant has IP phones and barcode scanners that lack 802.1X supplicants. You configure MAB on the switch ports. The devices authenticate successfully, but they all receive the default 'voice' VLAN instead of being split into separate VLANs for phones and scanners. What should you do to assign different VLANs?

   • AEnable 802.1X on the scanner ports so they authenticate with a certificate.
   • BUse the same authorization profile for all MAB devices but change the RADIUS attribute to 'VLAN name' instead of VLAN ID.
   • CConfigure the switch ports with different VLANs manually and disable MAB on the scanner ports.
   • DCreate separate identity groups for the MAC addresses of phones and scanners, and use authorization profiles that assign the appropriate VLAN.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   An administrator sends a CoA 'Reauth' to a session, but the switch does not re-authenticate the user. The switch logs show 'CoA ACK' but no re-authentication. What is the most likely cause?

   • AISE is not configured to send CoA.
   • BThe switch is configured to ignore CoA Reauth requests.
   • CThe RADIUS shared secret is incorrect.
   • DThe user's session is already in the correct state.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A university is implementing ISE as the RADIUS server for 802.1X on campus switches. They need to ensure that only users from the Active Directory domain 'ad.university.edu' can authenticate, and they must receive a specific downloadable ACL. Which ISE configuration is required?

   • AAdd Active Directory as an identity source, create an authentication rule that references it, and define an authorization profile with the dACL.
   • BCreate a local user account for every AD user and use the internal identity store.
   • CUse RADIUS VSAs to define the AD domain in the authentication policy.
   • DConfigure the switch to send the dACL in the RADIUS Access-Request.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A company wants to enforce different access policies for employees and contractors. Both groups authenticate via 802.1X. The contractor policy should place them in a restricted VLAN and also apply a dACL. Employees get full access. What is the most efficient way to implement this in ISE?

   • ACreate two authorization profiles (Employee and Contractor) and use identity groups in the authorization policy to match each group.
   • BUse CoA to change the VLAN after authentication based on the user's IP address.
   • CConfigure the switch to assign VLANs based on the MAC address of the device.
   • DCreate a single authorization profile that includes both VLAN and dACL, and assign it to all users.
   Reveal Solution Discussion Select an answer first