4.6 BYOD On-Boarding and Network Access Flows CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An enterprise wants to support BYOD for both corporate-owned and personal devices. Corporate-owned devices must have full access, while personal devices should only have internet access. They also want to use certificate-based authentication for corporate devices and username/password for personal devices. The network uses a single SSID. What is the best way to differentiate the access?

   • ACreate two SSIDs: one for corporate devices with certificate authentication, and one for personal devices with username/password.
   • BUse a single SSID with a captive portal that asks the user to choose device type, and then assign VLANs accordingly.
   • CUse MAC address-based authentication to identify corporate devices and assign them to a privileged VLAN.
   • DUse a single SSID with 802.1X, and configure the RADIUS server to assign different VLANs based on the authentication method (certificate vs. username/password).
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is deploying BYOD with 802.1X and uses a RADIUS server that integrates with Active Directory. They want to enforce a policy that only allows devices with a specific certificate issuer (the corporate CA) to access the corporate network. Personal devices without a certificate should be redirected to a guest network. How can this be achieved?

   • AUse a captive portal that asks the user to upload their certificate, and then manually verify the issuer.
   • BConfigure the RADIUS server to validate the certificate issuer and, if it is not the corporate CA, return a RADIUS Access-Accept with a VLAN that points to the guest network.
   • CUse MAC address filtering to allow only devices with corporate certificates, and block all others.
   • DConfigure the RADIUS server to reject authentication for devices without a corporate certificate, and rely on the user to connect to a separate guest SSID.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A hospital allows doctors to use personal tablets for accessing patient records. The security team wants to enforce that only devices with a compliant posture (e.g., no jailbreak, up-to-date OS) can access the records. They also want to allow non-compliant devices to access the internet for general use. The network uses 802.1X with RADIUS and dynamic VLANs. What is the best way to implement this?

   • AAllow all devices to access the patient records, but log the device posture for auditing.
   • BUse a posture assessment agent that reports compliance to the RADIUS server, which then assigns a VLAN for compliant devices and a separate VLAN for non-compliant devices with internet-only access.
   • CBlock non-compliant devices from the network entirely.
   • DUse a captive portal that asks the user to confirm their device is compliant before granting access.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company uses a third-party cloud identity provider (IdP) for SSO. They want to allow BYOD devices to authenticate to the network using the same credentials. The network uses 802.1X with RADIUS. However, the IdP does not support RADIUS directly. What is the best way to integrate the IdP with the network access flow?

   • AUse a RADIUS proxy that can translate RADIUS authentication requests to SAML or OIDC calls to the IdP.
   • BUse a VPN for BYOD access instead of 802.1X.
   • CCreate a local user database on the RADIUS server and manually sync passwords from the IdP.
   • DUse a captive portal that redirects to the IdP for authentication, and then use the session to grant network access.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A university has a BYOD network using 802.1X with EAP-TLS. Students are issued certificates from the university CA. Recently, some students report that they cannot connect, and the RADIUS logs show 'certificate validation failed'. The certificates are not expired, and the CA is trusted. What is the most likely cause?

   • AThe wireless controller is configured with the wrong SSID.
   • BThe students are using the wrong username in the EAP-TLS identity.
   • CThe RADIUS server's certificate trust store does not include the university CA's root certificate, or the certificate revocation list (CRL) is not accessible.
   • DThe students' devices have a time synchronization issue, causing the certificate to appear expired.
   Reveal Solution Discussion Select an answer first