A company wants to assign different VLANs to employees and guests using 802.1X. Employees should get VLAN 10, guests VLAN 20. Additionally, guests should be restricted to internet-only access via a downloadable ACL. What should the admin configure in ISE?

Create two authorization profiles: one for employees with VLAN 10, one for guests with VLAN 20 and a dACL.

Create one authorization profile that assigns VLAN 10 and a dACL for all users.

Configure the switch to assign VLANs based on the MAC address.

Use RADIUS Filter-Id attribute to assign VLANs dynamically.

A company uses Cisco ISE for network access. They have an existing LDAP directory for user authentication. They also have a few local service accounts that need to authenticate. The admin wants to use LDAP for most users, but fall back to internal users for service accounts. How should the identity source be configured in ISE?

Create a separate authentication policy for service accounts using internal users.

Use internal users for all authentication and replicate LDAP data.

Configure LDAP as the primary identity source and add internal users as a secondary identity source in the authentication policy.

Use only LDAP and create the service accounts in LDAP.

A network admin is configuring an authorization profile in ISE to assign a VLAN to authenticated users. The switch expects the VLAN ID in a specific RADIUS attribute. Which RADIUS attribute should be used in the authorization profile?

Tunnel-Private-Group-ID (attribute 81)

Acct-Interim-Interval (attribute 85)

A user is currently authenticated via 802.1X and assigned to VLAN 10. The admin needs to move the user to VLAN 20 immediately without requiring the user to re-authenticate. What should the admin do?

Manually change the VLAN on the switch port.

Ask the user to disconnect and reconnect the network cable.

Change the authorization profile in ISE and send a CoA request to the switch.

Wait for the session to time out and re-authenticate.

An organization wants to enforce a per-session ACL for guest users that allows only HTTP/HTTPS traffic. They want to manage the ACL centrally in ISE. What should be configured?

Use a CoA to push the ACL to the switch.

Configure the ACL directly on the switch and apply it to the guest VLAN.

Use the RADIUS Filter-Id attribute to send the ACL name.

Create a downloadable ACL in ISE and reference it in the guest authorization profile.

CCIE Security

Domain 4Objective 4

4.4 AAA for Network Access with 802.1X and MAB Using Cisco ISE CCIE-SECURITY Practice Questions (Page 8)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

11concepts

25%of the exam

Questions 36–40

36application · medium
A company wants to assign different VLANs to employees and guests using 802.1X. Employees should get VLAN 10, guests VLAN 20. Additionally, guests should be restricted to internet-only access via a downloadable ACL. What should the admin configure in ISE?
Select an answer first
37application · medium
A company uses Cisco ISE for network access. They have an existing LDAP directory for user authentication. They also have a few local service accounts that need to authenticate. The admin wants to use LDAP for most users, but fall back to internal users for service accounts. How should the identity source be configured in ISE?
Select an answer first
38application · easy
A network admin is configuring an authorization profile in ISE to assign a VLAN to authenticated users. The switch expects the VLAN ID in a specific RADIUS attribute. Which RADIUS attribute should be used in the authorization profile?
Select an answer first
39application · medium
A user is currently authenticated via 802.1X and assigned to VLAN 10. The admin needs to move the user to VLAN 20 immediately without requiring the user to re-authenticate. What should the admin do?
Select an answer first
40application · medium
An organization wants to enforce a per-session ACL for guest users that allows only HTTP/HTTPS traffic. They want to manage the ACL centrally in ISE. What should be configured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.