A small business wants to offer BYOD for employees but does not have an on-premises Active Directory. They use Google Workspace for email and identity. They want a simple onboarding process that allows employees to register their devices and get network access, with the ability to revoke access if an employee leaves. Which approach is most suitable?

Set up a local RADIUS server with a database of usernames and passwords, and manually manage device access.

Use a cloud-based NAC solution that integrates with Google Workspace via SAML, and use device registration with the NAC to manage access.

Implement 802.1X with certificates issued by an internal CA, but without any integration with Google Workspace.

Use a shared pre-shared key for all employees and no individual authentication.

A company wants to allow contractors to bring their own devices and access only the internet and a specific web application. They do not want contractors to access the internal corporate network. They also want to track which contractor is using which device. What is the best way to achieve this?

Use a guest access portal with authentication via a temporary account, and place the devices in a guest VLAN with an ACL that only permits internet and the specific web application.

Use a single shared guest password for all contractors, and place them in a guest VLAN.

Give contractors the same network access as employees, but rely on the web application's own authentication.

Allow contractors to connect to the corporate VLAN but use a firewall to block internal resources.

A multinational company uses a hybrid identity model with on-premises Active Directory synced to Azure AD. They want to allow BYOD devices to authenticate using either on-premises or cloud credentials, depending on where the user is connecting from. What should be configured to support this?

Use only Azure AD for all BYOD authentication, ignoring on-premises AD.

Create separate SSIDs for on-premises and cloud users, with different authentication methods.

Use only on-premises AD for all BYOD authentication, regardless of location.

Use a RADIUS proxy that can forward authentication requests to either the on-premises AD or Azure AD, based on the user's domain or location.

A company is deploying BYOD for employees. They want to minimize manual IT involvement while ensuring that only corporate-issued devices can access the internal network. Employees will use their personal smartphones and laptops. Which onboarding method should the network architect recommend?

Self-registration portal with username/password authentication

Guest access with sponsored approval

Certificate-based provisioning via SCEP with device authentication

A startup uses Google Workspace as its identity provider and wants to allow employees to bring their own devices. They want to use SAML-based authentication for the BYOD network. Which solution should they implement?

A captive portal that uses LDAP against Google Workspace

An on-premises RADIUS server with local accounts

A cloud NAC that supports SAML integration with Google Workspace

A certificate-based provisioning using internal CA

CCIE Security

Domain 4Objective 6

4.6 BYOD On-Boarding and Network Access Flows CCIE-SECURITY Practice Questions (Page 6)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

25%of the exam

Questions 26–30

26application · medium
A small business wants to offer BYOD for employees but does not have an on-premises Active Directory. They use Google Workspace for email and identity. They want a simple onboarding process that allows employees to register their devices and get network access, with the ability to revoke access if an employee leaves. Which approach is most suitable?
Select an answer first
27application · medium
A company wants to allow contractors to bring their own devices and access only the internet and a specific web application. They do not want contractors to access the internal corporate network. They also want to track which contractor is using which device. What is the best way to achieve this?
Select an answer first
28application · medium
A multinational company uses a hybrid identity model with on-premises Active Directory synced to Azure AD. They want to allow BYOD devices to authenticate using either on-premises or cloud credentials, depending on where the user is connecting from. What should be configured to support this?
Select an answer first
29application · medium
A company is deploying BYOD for employees. They want to minimize manual IT involvement while ensuring that only corporate-issued devices can access the internal network. Employees will use their personal smartphones and laptops. Which onboarding method should the network architect recommend?
Select an answer first
30application · medium
A startup uses Google Workspace as its identity provider and wants to allow employees to bring their own devices. They want to use SAML-based authentication for the BYOD network. Which solution should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.