4.4 AAA for Network Access with 802.1X and MAB Using Cisco ISE CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In Cisco ISE, what is the purpose of exception rules in a policy set?

   • ATo configure RADIUS accounting attributes.
   • BTo specify which VLAN to assign for each user.
   • CTo handle authentication failures or special cases that do not match normal authentication or authorization rules.
   • DTo define the order of authentication methods.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary function of an authorization profile in Cisco ISE?

   • ATo specify the EAP method used for authentication.
   • BTo define the set of attributes (e.g., VLAN, ACL) that are returned to the network device after successful authentication.
   • CTo store user credentials for authentication.
   • DTo configure the RADIUS server's IP address.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital is deploying 802.1X for wired nurse stations. The network team notices that some Windows PCs fail authentication intermittently, while others succeed. The ISE live logs show 'RADIUS Request' but no 'RADIUS Accept' for the failing PCs. The switch shows the port in 'unauthorized' state. Which two-step troubleshooting approach should the team take first to isolate the issue?

   • AReboot the switch and re-enable 802.1X on the affected ports.
   • BDisable 802.1X and enable MAB on the affected ports.
   • CCheck the supplicant's EAP method and credentials, then verify the ISE authentication policy matches the identity source.
   • DReplace the network cables and check for physical layer issues.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A user's role changes from employee to contractor, and the admin needs to update the user's network access to a more restrictive VLAN and dACL. The user is currently online. What is the most efficient way to apply the new policy?

   • ADisable the user's account and wait for re-authentication.
   • BAsk the user to log off and log back in.
   • CManually change the VLAN and ACL on the switch port.
   • DUpdate the authorization profile and send a CoA to the switch.
   Reveal Solution Discussion Select an answer first
6. 25application · easy

   A user reports that they cannot connect to the network via 802.1X. The switch shows the port in 'unauthorized' state. ISE logs show 'Authentication failed' for the user. What should the admin check first?

   • ACheck the switch's RADIUS server configuration.
   • BVerify the user's credentials and the identity source configuration in ISE.
   • CCheck the dACL configuration on the switch.
   • DVerify the supplicant's EAP method is supported by ISE.
   Reveal Solution Discussion Select an answer first