4.4 AAA for Network Access with 802.1X and MAB Using Cisco ISE CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A hospital is deploying 802.1X for wired access. During a pilot, a nurse's Windows laptop fails authentication. The switch shows EAP packets but no RADIUS response. ISE logs show no authentication attempt. Which configuration should you verify first?

   • AThe ISE policy set has an exception rule for the nurse's identity group.
   • BThe switch port is in the correct VLAN for the nurse's office.
   • CThe switch's RADIUS server IP and shared secret match ISE.
   • DThe laptop's supplicant is set to 'Validate server certificate'.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An administrator needs to terminate a specific user's network session immediately because of a security threat. The user is connected via 802.1X to a Cisco switch. What should the administrator do?

   • ADelete the user's account from AD.
   • BChange the user's authorization profile to deny access and wait for the next re-authentication.
   • CUse ISE's 'Disconnect' CoA to send a RADIUS Disconnect-Request to the switch for that session.
   • DShut down the switch port manually.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A user reports that their device cannot connect to the network. The switch port shows 'Unauthorized' in the 802.1X state. ISE logs show 'Authentication failed' for the user's MAC address. What is the most likely cause?

   • AThe RADIUS server is unreachable.
   • BThe user's password is incorrect.
   • CThe device is using MAB and the MAC address is not in the allowed identity group.
   • DThe switch port is administratively down.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A large enterprise is rolling out 802.1X. They have a mix of Windows and macOS devices. Windows devices authenticate successfully, but macOS devices fail. The switch shows EAPOL start from the Mac, but no EAP response after the identity request. ISE logs show the authentication attempt but no response from the supplicant. What is the most likely issue?

   • AISE is not configured with a policy for macOS devices.
   • BThe switch port is in the wrong VLAN for macOS devices.
   • CThe RADIUS shared secret is incorrect for the switch.
   • DThe macOS supplicant is not configured to use the correct EAP method (e.g., PEAP or EAP-TLS) that ISE expects.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company has a mix of 802.1X-capable devices and legacy devices that only support MAB. They want to ensure that legacy devices are placed in a 'Legacy' VLAN with limited access, while 802.1X devices get full access. The switch is configured with 802.1X and MAB as fallback. What is the best way to differentiate the authorization?

   • ACreate two authorization profiles: one for 802.1X (full access) and one for MAB (Legacy VLAN). Use the 'Authentication Method' condition in the authorization policy to match MAB vs 802.1X.
   • BUse RADIUS VSAs to differentiate based on the MAC address format.
   • CConfigure the switch to assign the Legacy VLAN to MAB devices using a static VLAN on the port.
   • DUse the same authorization profile for both, but assign the Legacy VLAN to all devices.
   Reveal Solution Discussion Select an answer first