4.13 Authentication Methods CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is evaluating TEAP for their network authentication. They have a requirement to support both password-based and certificate-based authentication for users. The security team is considering using EAP chaining with two inner methods. However, they are concerned about the complexity of managing multiple inner methods. What is a key advantage of using TEAP with EAP chaining in this scenario?

   • AIt simplifies the configuration by using a single inner method for all users.
   • BIt eliminates the need for a TLS tunnel, reducing complexity.
   • CIt enables the use of different inner methods for different users, based on the user's credentials.
   • DIt allows the use of a single inner method that supports both password and certificate authentication.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A financial services firm is implementing TEAP on Cisco ISE for their remote access VPN. The security policy mandates that user passwords must never be transmitted over the network in a form that could be replayed or captured. The network admin is configuring the inner methods for TEAP. Which inner method combination should the admin choose to best satisfy the password security requirement?

   • AEAP-GTC only
   • BEAP-MSCHAPv2 and EAP-GTC chained
   • CEAP-MSCHAPv2 only
   • DEAP-MSCHAPv2 for user and EAP-TLS for machine
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A hospital is deploying a new BYOD policy. They want to allow personal devices to access the guest network, but they want to ensure that only devices that are domain-joined and have successfully authenticated to Active Directory can access the internal medical records network. The network admin is configuring Cisco ISE. What feature should the admin enable to enforce this policy?

   • AMachine Access Restriction (MAR)
   • BGuest portal with sponsored access
   • CRADIUS accounting
   • DPosture assessment
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A corporation is implementing a secure wireless network. They want to use TEAP with EAP chaining to authenticate both the machine and the user. The security team is defining the authentication flow. Which sequence correctly describes the MAR authentication process when integrated with EAP chaining in TEAP?

   • AThe machine and user authenticate simultaneously, and network access is granted if either authentication succeeds.
   • BThe machine authenticates, but the user authentication is skipped if the machine is trusted.
   • CThe user authenticates first, then the machine, and the network access is granted based on the user's credentials only.
   • DThe machine authenticates first, then the user, and the network access is granted based on the combination of both credentials.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is using Cisco ISE to enforce network access policies. They have configured MAR to restrict access to the finance department's network. The policy states that only domain-joined machines that have authenticated to Active Directory can access this network. However, the admin notices that a user with a non-domain-joined laptop is able to access the finance network after authenticating with their user credentials. What is the most likely reason for this?

   • AThe user is a member of the finance department's AD group.
   • BThe finance network is not configured for 802.1X.
   • CThe user's credentials are cached on the laptop.
   • DMAR is not enabled on the network access device (NAD).
   Reveal Solution Discussion Select an answer first