4.17 Access Control and Single Sign-On Using Cisco DUO Security Technology CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which administrative role in Cisco Duo is limited to viewing reports and authentication logs without the ability to modify configurations?

   • AAdministrator
   • BHelp Desk
   • CAuditor
   • DBilling
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of the 'Authentication Log' report in Cisco Duo?

   • ATo generate a summary of billing usage for the Duo subscription
   • BTo configure authentication policies for different applications
   • CTo display a real-time feed of all authentication attempts with details such as user, application, and result
   • DTo manage user enrollments and device registrations
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's security team is configuring Duo access policies for a group of remote employees who access a critical application. The policy must require a higher level of assurance when users are accessing from an unmanaged device outside the corporate network, but allow a simpler authentication experience when they are on a trusted corporate device. Which Duo policy configuration best meets this requirement?

   • ACreate separate access policies based on device platform and location, with the off-network/unmanaged device policy requiring a hardware token and the on-network/managed device policy allowing Duo Push.
   • BCreate separate access policies for 'Corporate Network' and 'Off-Network' locations, with the off-network policy requiring a hardware token and the corporate policy allowing phone callback.
   • CCreate a single access policy that requires Duo Push for all users, regardless of device or location.
   • DCreate a single access policy that requires Duo Push and a device health check for all users, ensuring consistent security regardless of context.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network administrator wants to protect administrative access to a network switch that supports RADIUS authentication. The switch is in a secure data center and can reach the corporate network. The administrator wants to use Duo MFA for all admin logins. What is the simplest way to achieve this?

   • AUse the Duo Web SDK to add a Duo prompt to the switch's web interface.
   • BConfigure the switch to use Duo's cloud RADIUS service directly.
   • CInstall the Duo Unix application on the switch.
   • DConfigure the switch to use the Duo Authentication Proxy as its RADIUS server.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large enterprise is deploying Duo to protect multiple RADIUS-based services, including a Cisco ASA VPN and a wireless LAN controller (WLC). They have two data centers (DC1 and DC2) and want to ensure high availability. They plan to deploy two Authentication Proxies in each data center. The VPN concentrator in DC1 is configured with a primary RADIUS server pointing to the proxy in DC1 and a secondary pointing to the proxy in DC2. The WLC in DC1 is configured similarly. What is a critical consideration for this design?

   • AThe RADIUS clients (VPN concentrator and WLC) must be configured with the same shared secret for both the primary and secondary RADIUS servers.
   • BThe Authentication Proxies must be configured to use the same service account for Active Directory authentication.
   • CThe Authentication Proxies in DC1 and DC2 must be configured with the same failmode and the same primary and secondary Duo API hosts.
   • DThe Authentication Proxies in DC1 and DC2 must be able to reach the same primary authentication source (e.g., Active Directory) for user lookup.
   Reveal Solution Discussion Select an answer first