4.13 Authentication Methods CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A network administrator is troubleshooting a MAR issue on Cisco ISE. Users on domain-joined machines can authenticate successfully, but they are not being granted the expected network access. The admin has verified that the machines are domain-joined and that the user credentials are correct. What is the most likely cause of this issue?

   • AThe MAR policy is configured to require both machine and user authentication, but the machine authentication is failing silently.
   • BThe user is not a member of the correct Active Directory group.
   • CThe network access device is not configured to send the machine authentication information to ISE.
   • DThe MAR policy is configured to allow access only if the machine authentication succeeds, but the user authentication is being skipped.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A large enterprise is planning to migrate from PEAP to TEAP to support EAP chaining. The network has a mix of Windows 7, Windows 10, and macOS clients. The security team is concerned about the migration impact. Which strategy best addresses the compatibility concerns during the migration?

   • AConfigure TEAP as the primary method and PEAP as a fallback for clients that do not support TEAP.
   • BRequire all clients to use EAP-TLS with machine certificates, eliminating the need for EAP chaining.
   • CDeploy TEAP on all clients simultaneously and disable PEAP.
   • DUse EAP-FAST instead of TEAP, as it is more compatible with older clients.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security analyst is investigating an authentication failure on a Cisco ISE deployment. The user is on a domain-joined machine and is using TEAP with EAP chaining. The machine authentication (EAP-TLS) succeeds, but the user authentication (EAP-MSCHAPv2) fails. The analyst notices that the user is able to authenticate from other machines. What is the most likely cause of this specific failure?

   • AThe machine's certificate is not trusted by the RADIUS server.
   • BThe user is not allowed to authenticate from this specific machine due to a MAR policy.
   • CThe TEAP tunnel is not established correctly.
   • DThe user's password has expired.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard · select all that apply

   A network architect is planning a TEAP deployment for a multi-vendor environment. The environment includes Windows, macOS, and Linux clients. The architect needs to ensure that the deployment is successful across all platforms. Which of the following are important considerations for this deployment? (Select all that apply.)

   • AConfigure the same inner method for all clients to simplify management.
   • BEnsure that the RADIUS server certificate is trusted by all supplicants.
   • CVerify that the supplicant on each platform supports TEAP.
   • DTest the deployment with each client platform before rolling out to the entire network.
   • EUse EAP-GTC as the inner method for all clients to avoid password complexity issues.
   Check answers Discussion Select an answer first
6. 35expert · hard

   A security administrator is configuring MAR on Cisco ISE. The requirement is to allow only domain-joined machines to access the corporate network. However, the administrator also needs to allow a small group of users to access the network from non-domain-joined machines for a specific project. How should the administrator configure MAR to meet this requirement?

   • AEnable MAR globally and create an exception policy for the specific users.
   • BDisable MAR and rely on user authentication only.
   • CConfigure MAR to allow access if either machine or user authentication succeeds.
   • DEnable MAR and require all users to use EAP-TLS with machine certificates.
   Reveal Solution Discussion Select an answer first