4.6 BYOD On-Boarding and Network Access Flows CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard · select all that apply

   A company is designing BYOD onboarding for a mixed environment with corporate laptops, personal smartphones, and guest devices. They want to use a single SSID and dynamically assign policies. Which methods should they combine? (Select all that apply.)

   • ACaptive portal for guest access
   • B802.1X with EAP-TLS for corporate devices
   • CStatic VLAN assignment for all devices
   • DMAC authentication bypass (MAB) for devices that do not support 802.1X
   Check answers Discussion Select an answer first
2. 37expert · hard

   A university is implementing BYOD for students and staff. They want to enforce different access policies based on the user's role (student vs. staff) and the device's compliance status. They also want to support both wired and wireless access. Which architecture should they use?

   • AUse only wireless NAC and rely on physical security for wired
   • BDeploy a centralized NAC with RADIUS and posture assessment for both wired and wireless
   • CUse separate NAC solutions for wired and wireless
   • DUse a firewall-based solution without RADIUS
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is planning BYOD onboarding for a workforce that uses a variety of devices, including some that do not support 802.1X. They want to ensure that all devices are authenticated and authorized before gaining network access. Which approach should they take?

   • AUse only 802.1X and require all devices to support it
   • BUse a combination of 802.1X and MAB, with MAB devices placed in a separate VLAN for additional authentication via captive portal
   • CUse a guest network for all devices
   • DUse only MAB for all devices
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A financial institution is implementing BYOD with strict security requirements. They want to enforce that only devices with a corporate certificate and a compliant posture can access the production network. They also want to provide a remediation network for non-compliant devices. Which policy enforcement mechanism should be used?

   • AUse a captive portal that requires a certificate and then grants full access
   • BUse a firewall rule that blocks non-compliant devices based on IP address
   • CUse a NAC that performs certificate validation and posture assessment, and assigns a remediation VLAN for non-compliant devices
   • DUse a VPN that requires a certificate but does not check posture
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A hospital is implementing BYOD for its physicians. They use a mix of iPads and Android tablets. The network must authenticate users against Active Directory and then assign different VLANs based on the device type. Which AAA flow should be configured to achieve this?

   • ARADIUS with EAP-TLS using machine certificates only
   • BRADIUS with PEAP-MSCHAPv2 and RADIUS attributes for VLAN assignment
   • CLocal authentication on the switch with static VLANs
   • DTACACS+ for network device administration
   Reveal Solution Discussion Select an answer first