4.4 AAA for Network Access with 802.1X and MAB Using Cisco ISE CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An admin needs to change the VLAN for a group of users from VLAN 10 to VLAN 20. The users are currently online. The admin updates the authorization profile in ISE. However, the users remain on VLAN 10. What is the most likely reason?

   • AThe switch does not support VLAN changes via CoA.
   • BThe authorization profile is not correctly linked to the policy.
   • CThe users need to re-authenticate manually.
   • DThe admin did not send a CoA to the switches to update the active sessions.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A user is unable to authenticate via 802.1X. The switch logs show 'RADIUS request timed out'. ISE logs show no RADIUS request received. What is the most likely cause?

   • AThe authorization profile is misconfigured.
   • BThe switch cannot reach ISE due to a network connectivity issue.
   • CThe user's credentials are incorrect.
   • DThe supplicant is not configured with the correct EAP method.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A manufacturing plant has IP cameras that do not support 802.1X. The network admin wants to use MAB to authenticate these cameras and place them in a separate VLAN with limited access. The cameras' MAC addresses are known. What is the most efficient way to configure this in Cisco ISE?

   • AUse a single authorization profile for all MAB devices and assign the same VLAN.
   • BCreate an identity group for the cameras, add their MAC addresses as endpoints, and configure an authorization profile that assigns the camera VLAN.
   • CConfigure the switch ports with static VLAN assignment and disable 802.1X.
   • DCreate a separate SSID for the cameras and use WPA2-PSK.
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   A university is configuring Cisco ISE as the RADIUS server for network access. They have multiple network devices (switches and wireless controllers) that need to authenticate users. The admin wants to ensure that only authorized network devices can send RADIUS requests to ISE. What should be configured on ISE?

   • AUse a downloadable ACL to restrict which devices can send RADIUS packets.
   • BConfigure a network access policy that allows all devices from the management subnet.
   • CAdd each network device as a RADIUS client with a shared secret.
   • DEnable RADIUS accounting and use the accounting logs to filter requests.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company wants to implement 802.1X for employees and MAB for printers. They have an existing Active Directory for user authentication. In ISE, they have created an internal identity group for printers. What is the correct order of authentication policy rules to ensure employees are authenticated via AD and printers via MAB?

   • AFirst rule: if Device:Device Type equals Printer, use MAB; Second rule: if Network Access:EAPMethod equals EAP-PEAP, use AD.
   • BFirst rule: if Network Access:EAPMethod equals EAP-PEAP, use AD; Second rule: if Device:Device Type equals Printer, use MAB.
   • CUse MAB for all devices, including employees.
   • DUse a single rule that authenticates all devices against AD.
   Reveal Solution Discussion Select an answer first