4.17 Access Control and Single Sign-On Using Cisco DUO Security Technology CCIE-SECURITY Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A company has an on-premises web application that uses a legacy form-based login. They want to add Duo MFA without changing the application's source code. Which Duo solution is best suited for this scenario?

   • AUse the Duo Authentication Proxy to protect the application with RADIUS.
   • BUse the Duo Web SDK to add a Duo prompt to the application's login page.
   • CInstall the Duo Device Health application on all client machines and use it to verify device trust.
   • DDeploy the Duo Single Sign-On service and configure the application as a SAML service provider.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A development team is building a custom internal tool and wants to integrate Duo MFA directly into their application's login flow. They want to support both Duo Push and hardware tokens. They also want to use the modern Duo prompt. Which Duo integration method should they use?

   • AUse the Duo Web SDK (v4+) and configure the application to use the Universal Prompt.
   • BUse the Duo Admin API to programmatically send push notifications to users.
   • CUse the Duo Single Sign-On service and configure the application as a SAML service provider.
   • DUse the Duo Authentication Proxy with a RADIUS integration.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An organization is deploying the Duo Authentication Proxy to protect a RADIUS-based network access server. They require high availability for the authentication service. What is the recommended approach to ensure the Authentication Proxy is not a single point of failure?

   • AInstall a single Authentication Proxy on a high-performance server with redundant power supplies.
   • BConfigure the Authentication Proxy to use multiple Duo API hosts.
   • CUse a load balancer in front of a single Authentication Proxy.
   • DDeploy two Authentication Proxies in a failover configuration and configure the RADIUS client to use both.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is onboarding 200 new employees and needs to enroll them in Duo. They have already synchronized all users from Active Directory. The employees will be issued hardware tokens. What is the most efficient way to enroll these users and assign the tokens?

   • AUse the Duo Admin API to bulk-activate the tokens and assign them to users.
   • BAsk users to install the Duo Mobile app and use the QR code enrollment process.
   • CManually activate each token in the Duo admin console and assign it to the user.
   • DSend each user a self-enrollment email and have them activate their hardware token themselves.
   Reveal Solution Discussion Select an answer first