4.4 AAA for Network Access with 802.1X and MAB Using Cisco ISE CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A printer fails MAB authentication. The switch sends the MAC address to ISE, but ISE returns 'Authentication failed'. The printer's MAC is correctly listed in the endpoint database. What is the most likely cause?

   • AThe authentication policy does not have a rule for MAB or the identity group is not correctly referenced.
   • BThe switch port is in the wrong VLAN.
   • CThe printer is not powered on.
   • DThe printer's MAC address is not in the correct format.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large enterprise is rolling out 802.1X across multiple sites. They have a mix of Windows and macOS devices. Some macOS users report that they can authenticate but are placed in the wrong VLAN. The ISE logs show successful authentication, but the authorization result is not what is expected. The admin suspects the issue is with the authorization policy. What is the best approach to diagnose the issue?

   • AReboot the switch to clear any cached authorization results.
   • BExamine the ISE live logs to see which authorization profile was selected and what attributes were returned.
   • CCheck the macOS supplicant configuration for EAP method.
   • DVerify the switch's RADIUS shared secret.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has a complex authorization policy with multiple rules. They want to ensure that a specific group of users (e.g., 'Contractors') always gets a restricted dACL, regardless of other conditions. However, they also have a rule that assigns a 'Full Access' profile to users in the 'Employees' group. A contractor who is also in the 'Employees' group is currently getting 'Full Access'. What is the best way to fix this?

   • ACreate a new authorization profile that combines both dACLs.
   • BUse CoA to manually change the authorization for the contractor.
   • CRemove the contractor from the 'Employees' group.
   • DReorder the authorization policy so the 'Contractors' rule is evaluated before the 'Employees' rule.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A network admin is configuring an authorization profile for a new network device that uses a vendor-specific attribute (VSA) for VLAN assignment. The device does not support the standard Tunnel-Private-Group-ID attribute. The admin needs to ensure the correct VSA is sent. What should the admin do in ISE?

   • AUse the standard Tunnel-Private-Group-ID attribute and hope the device accepts it.
   • BUse a downloadable ACL instead of VLAN assignment.
   • CUse a dictionary in ISE to define the vendor-specific attribute and include it in the authorization profile.
   • DConfigure the switch to translate the standard attribute to the VSA.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company uses downloadable ACLs for guest access. They update the dACL in ISE to block a new malicious website. However, existing guest sessions are still able to access the website. What is the most likely reason and what should be done?

   • AThe dACL is not effective because it's not applied to the correct VLAN.
   • BThe dACL is only applied at authentication; existing sessions need a CoA to refresh the dACL.
   • CThe dACL is too long and the switch truncated it.
   • DThe dACL is cached on the switch and will update automatically.
   Reveal Solution Discussion Select an answer first