4.6 BYOD On-Boarding and Network Access Flows CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a common integration point between BYOD onboarding and a cloud identity provider (IdP) such as Azure AD or Okta?

   • AThe cloud IdP stores the device's posture assessment results.
   • BThe network access device uses SAML or RADIUS to authenticate users against the cloud IdP.
   • CThe device is enrolled in the cloud IdP's MDM service automatically.
   • DThe cloud IdP assigns the device's IP address.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In BYOD policy enforcement, what is the role of device posture assessment?

   • ATo identify the user's role and group membership.
   • BTo assign a static IP address to the device.
   • CTo authenticate the device using certificates.
   • DTo check the device's compliance with security requirements such as OS version, antivirus, and encryption.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to allow employees to connect personal tablets to the corporate Wi-Fi. They require that each device be associated with the user's Active Directory account and that only devices with a compliant OS version get full network access. The onboarding process must be as automated as possible. Which approach should the network team implement?

   • ASelf-registration portal with user authentication via Active Directory, followed by device posture assessment and dynamic VLAN assignment.
   • BCertificate-based provisioning using SCEP, but without any user authentication or posture check.
   • CGuest access with a simple captive portal that only requires an email address and provides internet-only access.
   • DManual IT provisioning where each tablet is configured with a pre-shared key and assigned to a static VLAN.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to allow employees to use personal Android devices for email and calendar. They require that devices must have a screen lock and encryption enabled. The network uses 802.1X with EAP-TLS. How can the company enforce these device requirements?

   • ABlock all Android devices from the network, as they cannot be secured.
   • BRely on the user to manually configure screen lock and encryption, and trust that they will do so.
   • CUse a captive portal that asks the user to confirm they have enabled screen lock and encryption.
   • DUse an MDM solution that pushes a compliance policy to the device, and integrate the MDM compliance status with the RADIUS server to allow or deny network access.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has deployed 802.1X for BYOD with EAP-PEAP-MSCHAPv2. Users report that some devices fail authentication intermittently, while others work fine. The RADIUS logs show 'MSCHAPv2 authentication failed' for the failing devices. The helpdesk has confirmed that the usernames and passwords are correct. What is the most likely cause of the intermittent failures?

   • AThe devices have incorrect EAP configuration, such as not validating the server certificate.
   • BThe devices are using a cached password that has expired.
   • CThe RADIUS server is configured with multiple Active Directory domains, and the user's account is in a domain that is not reachable at the time of authentication.
   • DThe RADIUS server's shared secret is incorrect for some access points.
   Reveal Solution Discussion Select an answer first