4.13 Authentication Methods CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of Machine Access Restriction (MAR) in a network access control context?

   • ATo restrict network access based on whether the requesting machine is authenticated and authorized.
   • BTo provide a backup authentication method when user authentication fails.
   • CTo restrict network access based on the user's role, regardless of the machine's state.
   • DTo encrypt all traffic between the machine and the network.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A university is deploying 802.1X for Wi-Fi and wired access. They need to support both password-based authentication for students and certificate-based authentication for faculty, while also deriving separate session keys for each authentication. The network team wants to use a single EAP method that can encapsulate both inner methods securely. Which EAP method should they choose?

   • ATEAP with EAP-MSCHAPv2 and EAP-TLS as inner methods
   • BEAP-TLS only
   • CPEAP with EAP-MSCHAPv2 only
   • DLEAP with EAP-MSCHAPv2
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is planning to deploy TEAP with Cisco ISE. They have a mix of Windows and macOS clients. They want to ensure that all clients can authenticate using their existing Active Directory credentials. What is the recommended configuration?

   • AUse PEAP with EAP-MSCHAPv2 instead of TEAP.
   • BUse EAP-FAST with EAP-MSCHAPv2.
   • CUse TEAP with EAP-MSCHAPv2 as the inner method and configure the supplicants to use their AD credentials.
   • DUse TEAP with EAP-TLS and deploy client certificates to all machines.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial firm wants to enforce that only company-managed laptops can access the internal network, even if a user has valid credentials. They are using Cisco ISE with 802.1X. What is the most effective way to achieve this?

   • AUse only user authentication and rely on the user's credentials.
   • BEnable MAR and configure authorization policies to require machine authentication.
   • CUse posture assessment to check for antivirus.
   • DImplement MAC authentication bypass (MAB) for all devices.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A user reports that they cannot access the network even though they have entered valid credentials. The network uses MAR. The machine is domain-joined but has never authenticated to the network before. What is the most likely cause?

   • AThe supplicant is not configured for EAP-TLS.
   • BThe user's password is incorrect.
   • CThe RADIUS server is unreachable.
   • DThe machine has not completed machine authentication, so MAR denies access.
   Reveal Solution Discussion Select an answer first