4.13 Authentication Methods CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is deploying TEAP for remote access VPN authentication. They want to use an inner method that supports one-time passwords (OTP) from their existing token system, but they are concerned about the security of transmitting the OTP. Which inner method should they use and what is the primary security consideration?

   • AEAP-GTC, and ensure the TLS tunnel is established before sending the OTP
   • BEAP-MD5, and use a secure hash
   • CEAP-MSCHAPv2, and rely on its built-in encryption
   • DEAP-TLS, and use client certificates for OTP
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A global enterprise is standardizing on Cisco ISE for wired and wireless authentication. They need a single EAP method that works across all their supplicants (Windows, macOS, Linux) and supports both user and machine authentication. They also want to avoid the complexity of deploying client certificates. What should they configure?

   • ALEAP
   • BEAP-TLS with machine certificates
   • CPEAP with EAP-MSCHAPv2
   • DTEAP with EAP-MSCHAPv2 as the inner method
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital wants to ensure that only company-issued laptops that are domain-joined and have passed health checks can access the network, even when a user logs in with valid credentials. They want to block access if the machine is not compliant. Which Cisco ISE feature should they enable?

   • AMachine Access Restriction (MAR)
   • BPosture assessment
   • CGuest access
   • DProfiling
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During a MAR deployment, a user logs in to a domain-joined laptop that has not yet authenticated to the network. The user provides valid credentials. What happens in the MAR authentication flow?

   • AThe user is placed in a quarantine VLAN until the machine authenticates.
   • BThe machine must authenticate first, then the user authenticates, and both must succeed for access.
   • CThe user is granted access because the user credentials are valid.
   • DThe machine is authenticated silently using cached credentials.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is configuring MAR on Cisco ISE. They want to ensure that if the machine authentication fails, the user is denied access entirely, but if the machine is authorized, the user can access the network based on their own authorization policies. What is the correct configuration approach?

   • AEnable MAR but do not create any authorization policies.
   • BEnable MAR and create authorization policies that require the MAR condition to be met.
   • CConfigure MAR only on the wireless controller, not on ISE.
   • DUse posture assessment instead of MAR.
   Reveal Solution Discussion Select an answer first