4.6 BYOD On-Boarding and Network Access Flows CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A hospital allows doctors to bring their own laptops. The network team must ensure that only devices with up-to-date antivirus and a corporate-issued certificate can access the electronic health record (EHR) system. They also want to minimize helpdesk calls. Which onboarding method best meets these requirements?

   • ACertificate-based provisioning with SCEP, integrated with the hospital's identity provider, and posture checks before granting access to the EHR.
   • BManual certificate installation by IT staff for each doctor's laptop, with no automated posture assessment.
   • CGuest access with a sponsored login, where the sponsor approves access but no device certificate is issued.
   • DSelf-registration with username/password only, and no certificate or posture check.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A university is deploying BYOD for students. They want to use 802.1X with PEAP-MSCHAPv2. Students authenticate with their university credentials, and after authentication, the network access device (NAD) must assign different VLANs based on the student's department. What must be configured on the NAD and the RADIUS server to achieve this?

   • AConfigure the NAD to assign VLANs based on the MAC address of the device, without involving the RADIUS server.
   • BHave the RADIUS server only authenticate the user and always return the same VLAN for all students.
   • CConfigure the RADIUS server to return VLAN attributes (e.g., Tunnel-Private-Group-ID) based on the user's group membership, and configure the NAD to accept and apply those attributes.
   • DUse a local database on the NAD to map usernames to VLANs, and bypass the RADIUS server.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company uses Azure AD as its identity provider and wants to allow employees to onboard their personal smartphones for corporate email access. They require that only devices that are compliant with Intune (e.g., passcode enabled, OS up to date) can access email. Which integration approach should be used?

   • AAllow any device to access email after a simple web login, without any device compliance check.
   • BUse a local Active Directory and RADIUS server, ignoring Azure AD and Intune.
   • CUse certificate-based authentication with a public CA, but do not check device compliance.
   • DIntegrate the BYOD onboarding portal with Azure AD and Intune, using conditional access policies to require device compliance before granting access to email.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A law firm allows partners to use personal iPads. The firm's security policy requires that only devices with a jailbreak detection agent and a minimum iOS version can access the internal document management system. The network uses 802.1X with RADIUS. How should the policy be enforced?

   • ABlock all iPads from the network until IT manually approves each one.
   • BUse MAC address filtering to allow only known iPads, without any posture check.
   • CConfigure the RADIUS server to allow all iPads and rely on the document system's own login to enforce security.
   • DUse a posture assessment agent on the iPad that reports compliance to the RADIUS server, which then returns a VLAN or ACL that permits or denies access to the document system.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   Users report that they can connect to the corporate Wi-Fi with their personal laptops, but they cannot reach the internet. The network uses 802.1X with RADIUS and dynamic VLAN assignment. What is the most likely cause and first step to troubleshoot?

   • AThe switch port is in an error-disabled state; check the switch interface status.
   • BThe RADIUS server is rejecting the user's credentials; check the authentication logs.
   • CThe user's laptop has a misconfigured DNS server; check the laptop's network settings.
   • DThe RADIUS server is returning a VLAN that is not routed to the internet; check the RADIUS logs and the VLAN configuration on the switch.
   Reveal Solution Discussion Select an answer first