4.17 Access Control and Single Sign-On Using Cisco DUO Security Technology CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard · select all that apply

   A company is using Duo Single Sign-On to protect a suite of cloud applications. They have configured a new application that supports both SAML 2.0 and OIDC. The identity team wants to leverage the Duo Universal Prompt and also wants to be able to pass a custom attribute (e.g., 'department') to the application for authorization decisions. Which protocol and configuration should they choose?

   • AUse OIDC and configure the application to request the 'department' claim from Duo's user info endpoint.
   • BUse SAML 2.0 and configure attribute mapping in the Duo application settings to pass the 'department' attribute.
   • CUse OIDC because it is the only protocol that supports custom attributes.
   • DUse SAML 2.0 because it is the only protocol that supports the Universal Prompt.
   Check answers Discussion Select an answer first
2. 17expert · hard

   A security administrator is configuring Duo access policies for a highly sensitive application. The policy must require a hardware token for all users. However, the administrator notices that some users are able to authenticate with Duo Push, even though the policy seems to be configured correctly. What is the most likely cause of this issue?

   • AThe users have not enrolled a hardware token, so Duo is falling back to their other enrolled devices.
   • BThe access policy is not applied to the correct group or application.
   • CThe users are using a browser that does not support the Universal Prompt.
   • DThe Duo Authentication Proxy is not configured to enforce the access policy.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An organization is deploying Duo for AnyConnect VPN. They have two ASA firewalls in an active/standby failover pair. They have deployed a single Duo Authentication Proxy. During a test, they shut down the primary ASA, and the standby ASA takes over. However, VPN users are now unable to authenticate with Duo. What is the most likely cause?

   • AThe Duo Authentication Proxy is not licensed for use with two ASAs.
   • BThe Authentication Proxy is not configured to handle the failover of the ASA pair.
   • CThe Authentication Proxy is not reachable from the standby ASA due to a network routing issue.
   • DThe standby ASA is not configured with the correct RADIUS server settings (IP address and shared secret) for the Authentication Proxy.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is reviewing Duo authentication logs and notices a high number of 'denied' authentication attempts for a specific user account. The attempts are coming from a foreign IP address. The user's primary authentication (e.g., AD password) is succeeding, but the Duo MFA is being denied. What is the best immediate action to take?

   • ADisable the user's account in Duo to prevent further attempts.
   • BReview the user's enrolled devices and recent activity to determine if the authentication attempts are legitimate.
   • CImmediately change the user's access policy to require a hardware token.
   • DIgnore the attempts as they are being denied by Duo MFA.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is integrating Duo with a legacy VPN concentrator that only supports RADIUS. They have deployed the Duo Authentication Proxy. The VPN concentrator is configured to use the proxy as its RADIUS server. Users are able to authenticate with their primary credentials, but the Duo MFA prompt is not appearing. What is the most likely cause?

   • AThe Authentication Proxy is not configured to use the correct Duo API host.
   • BThe VPN concentrator is configured to use PAP instead of MSCHAPv2 for authentication.
   • CThe Authentication Proxy is configured with 'failmode' set to 'safe', which bypasses MFA on errors.
   • DThe VPN concentrator is not configured to send the 'User-Name' attribute in the RADIUS request.
   Reveal Solution Discussion Select an answer first