4.13 Authentication Methods CCIE-SECURITY Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A large enterprise is planning to deploy a new authentication solution. They require that both the user and the device be authenticated in a single EAP transaction to simplify the user experience and reduce authentication time. The security team is evaluating EAP chaining. Which statement accurately describes a key benefit of using EAP chaining in this scenario?

   • AIt eliminates the need for a TLS tunnel, simplifying the authentication process.
   • BIt allows the user to authenticate without a password if the device is trusted.
   • CIt allows the use of different EAP methods for the user and the device, such as EAP-TLS for the device and EAP-MSCHAPv2 for the user.
   • DIt ensures that the same EAP method is used for both the user and the device.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is deploying TEAP for their wired network authentication. They have a mix of Windows 10 and macOS clients. The network admin is configuring Cisco ISE and the supplicants. Which consideration is most important for a successful TEAP deployment?

   • AConfiguring the supplicants to use EAP-GTC as the inner method.
   • BEnsuring that the RADIUS server certificate is trusted by all supplicants.
   • CDisabling EAP chaining to simplify the configuration.
   • DUsing a shared secret for the TLS tunnel instead of certificates.
   Reveal Solution Discussion Select an answer first
4. 43application · easy

   A company is implementing a new security policy that requires all devices accessing the corporate network to be domain-joined and have a valid machine certificate. They are using Cisco ISE for network access control. The admin is configuring MAR. What is the primary purpose of enabling MAR in this scenario?

   • ATo provide a fallback authentication method if the user's credentials are invalid.
   • BTo allow users to authenticate from any device, including personal devices.
   • CTo restrict network access to only those machines that have successfully authenticated to Active Directory.
   • DTo encrypt all network traffic between the client and the RADIUS server.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company is deploying a new wireless network with Cisco ISE. They want to use TEAP with EAP chaining to authenticate both the machine and the user. The security team is defining the authentication flow. Which sequence correctly describes the MAR authentication process when integrated with EAP chaining in TEAP?

   • AThe machine and user authenticate simultaneously, and network access is granted if either authentication succeeds.
   • BThe machine authenticates first, then the user, and the network access is granted based on the combination of both credentials.
   • CThe machine authenticates, but the user authentication is skipped if the machine is trusted.
   • DThe user authenticates first, then the machine, and the network access is granted based on the user's credentials only.
   Reveal Solution Discussion Select an answer first