A government agency requires that BYOD devices be compliant with a mobile device management (MDM) policy before accessing email and internal apps. They also want to segment access based on the user's security clearance. Which policy enforcement approach is best?

Use a single VLAN for all BYOD devices and rely on application-level security

Use only certificate-based authentication without MDM checks

Use a guest network for all BYOD devices

Use MDM integration with the NAC to check compliance and assign VLANs based on user group

During 802.1X authentication for BYOD, users with valid credentials are being rejected. The RADIUS logs show 'Access-Reject' with reason 'user not found'. What is the most likely cause?

The RADIUS server is using the wrong identity store or domain

The RADIUS shared secret is incorrect

The user's device is not compliant with posture policy

The user's account is locked in Active Directory

A hospital is deploying BYOD for doctors and nurses. They have a mix of corporate-owned and personal devices. The security team wants to enforce different policies: corporate devices get full access, personal devices get limited access. They also want to support both certificate-based and username/password authentication. Which design should be implemented?

Use two SSIDs: one for corporate devices with certificates, one for personal devices with username/password

Use MAC address-based VLAN assignment for all devices

Use a single SSID with 802.1X and RADIUS that returns different VLANs based on certificate presence and user group

Use a single SSID with open authentication and a captive portal for all devices

A multinational company uses Azure AD for identity and wants to implement BYOD with conditional access. They require that only devices that are compliant with Intune can access the network. They also want to support legacy devices that do not support 802.1X. Which solution should they choose?

Use a captive portal for all devices and rely on Azure AD authentication only

Deploy a cloud NAC that integrates with Azure AD and Intune, and use MAC authentication bypass (MAB) for legacy devices

Use a VPN for all BYOD access and bypass the network

Use only 802.1X with certificate authentication and ignore legacy devices

A company is troubleshooting BYOD onboarding. Users can authenticate via 802.1X but are not getting the correct VLAN. The RADIUS server is configured to return VLAN 10 for employees and VLAN 20 for guests, but all users are getting VLAN 10. What is the most likely cause?

The RADIUS server is using a different shared secret for each group

The RADIUS server is not receiving the user's group information

The switch is configured with a static VLAN for all ports

The user's device is not sending the correct EAP type

CCIE Security

Domain 4Objective 6

4.6 BYOD On-Boarding and Network Access Flows CCIE-SECURITY Practice Questions (Page 7)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

25%of the exam

Questions 31–35

31application · medium
A government agency requires that BYOD devices be compliant with a mobile device management (MDM) policy before accessing email and internal apps. They also want to segment access based on the user's security clearance. Which policy enforcement approach is best?
Select an answer first
32application · medium
During 802.1X authentication for BYOD, users with valid credentials are being rejected. The RADIUS logs show 'Access-Reject' with reason 'user not found'. What is the most likely cause?
Select an answer first
33expert · hard
A hospital is deploying BYOD for doctors and nurses. They have a mix of corporate-owned and personal devices. The security team wants to enforce different policies: corporate devices get full access, personal devices get limited access. They also want to support both certificate-based and username/password authentication. Which design should be implemented?
Select an answer first
34expert · hard
A multinational company uses Azure AD for identity and wants to implement BYOD with conditional access. They require that only devices that are compliant with Intune can access the network. They also want to support legacy devices that do not support 802.1X. Which solution should they choose?
Select an answer first
35expert · hard
A company is troubleshooting BYOD onboarding. Users can authenticate via 802.1X but are not getting the correct VLAN. The RADIUS server is configured to return VLAN 10 for employees and VLAN 20 for guests, but all users are getting VLAN 10. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.