A financial firm uses 802.1X for wired access. The security team wants to restrict a specific group of users to only access the finance server (10.1.1.10) and block all other traffic. They also want these users to be placed in a separate VLAN. What should you configure in the authorization profile?

Set the VLAN ID and attach a downloadable ACL that permits only traffic to 10.1.1.10.

Set the VLAN ID and configure the switch port with a static ACL.

Use a RADIUS VSA to specify the server IP and let the switch filter automatically.

Assign a different VLAN and rely on VLAN segmentation to block traffic.

A company uses ISE for 802.1X. They have an existing LDAP directory for employees and a separate guest database in ISE. They want to authenticate employees against LDAP and guests against the internal identity store. How should they configure ISE?

Migrate all LDAP users into the internal identity store and use one authentication rule.

Create two separate ISE deployments, one for employees and one for guests.

Add LDAP as an external identity source and use the internal identity store for guests, then create authentication rules that select the appropriate source based on the user's domain or identity group.

Use RADIUS VSAs to tell ISE which identity source to use.

A network admin is configuring an authorization profile for a group of users that need to be placed in VLAN 100 and also receive a dACL named 'Restricted'. The switch is a Cisco Catalyst. Which RADIUS attributes should be included in the profile?

Tunnel-Type=VLAN, Tunnel-Medium-Type=802, Tunnel-Private-Group-ID=100, and Cisco-AVPair=ip:inacl#100=Restricted

Tunnel-Type=VLAN and Tunnel-Private-Group-ID=Restricted

Filter-Id=Restricted and Session-Timeout=100

Cisco-AVPair=ip:inacl#100=Restricted and Service-Type=Call-Check

A company uses ISE for 802.1X. They want to move a group of users from VLAN 10 to VLAN 20 immediately after a security incident, without requiring users to re-authenticate. What is the best approach?

Ask users to disconnect and reconnect their devices.

Update the authorization profile for that group to assign VLAN 20, then send a CoA 'Reauth' to the affected sessions.

Change the VLAN on the switch ports manually.

Use RADIUS Disconnect-Request to terminate the session and hope the device reconnects.

A company wants to enforce a per-session ACL that blocks access to a specific server (192.168.5.10) for a group of contractors. They have ISE and Cisco switches. What is the recommended way to implement this?

Assign a different VLAN to contractors and use inter-VLAN ACLs on the router.

Configure a static ACL on the switch and apply it to the contractor VLAN.

Create a downloadable ACL in ISE that denies traffic to 192.168.5.10, and reference it in the authorization profile for the contractor group.

Use RADIUS Filter-Id attribute with the ACL name and configure the ACL on the switch.

CCIE Security

Domain 4Objective 4

4.4 AAA for Network Access with 802.1X and MAB Using Cisco ISE CCIE-SECURITY Practice Questions (Page 12)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

11concepts

25%of the exam

Questions 56–60

56application · medium
A financial firm uses 802.1X for wired access. The security team wants to restrict a specific group of users to only access the finance server (10.1.1.10) and block all other traffic. They also want these users to be placed in a separate VLAN. What should you configure in the authorization profile?
Select an answer first
57application · medium
A company uses ISE for 802.1X. They have an existing LDAP directory for employees and a separate guest database in ISE. They want to authenticate employees against LDAP and guests against the internal identity store. How should they configure ISE?
Select an answer first
58application · medium
A network admin is configuring an authorization profile for a group of users that need to be placed in VLAN 100 and also receive a dACL named 'Restricted'. The switch is a Cisco Catalyst. Which RADIUS attributes should be included in the profile?
Select an answer first
59application · medium
A company uses ISE for 802.1X. They want to move a group of users from VLAN 10 to VLAN 20 immediately after a security incident, without requiring users to re-authenticate. What is the best approach?
Select an answer first
60application · medium
A company wants to enforce a per-session ACL that blocks access to a specific server (192.168.5.10) for a group of contractors. They have ISE and Cisco switches. What is the recommended way to implement this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.