A company is troubleshooting a BYOD onboarding issue where users are able to connect to the Wi-Fi but are not getting an IP address. The DHCP server is on a different VLAN than the wireless network. What is the most likely cause?

The DHCP relay is not configured on the wireless controller

The user's device is not compliant with posture policy

The DNS server is misconfigured

The RADIUS server is not returning a VLAN

A university is rolling out BYOD for students. They use Azure AD as the identity provider and want to enforce conditional access policies that require device compliance before granting network access. Which integration approach should be used?

Use a cloud-based NAC that integrates with Azure AD and device compliance signals

Deploy an on-premises AD and sync with Azure AD, then use LDAP for authentication

Integrate the wireless controller with Azure AD via RADIUS using PEAP-MSCHAPv2

Configure the wireless network as open with a captive portal that redirects to Azure AD

A financial firm allows employees to connect personal laptops to the corporate Wi-Fi. The security policy requires that only devices with up-to-date antivirus and a corporate-issued certificate can access the internal network. Which policy enforcement mechanism should be used?

MAC address filtering on the access point

Posture assessment via NAC agent before granting full access

Static VLAN assignment based on user group

RADIUS-based authentication with certificate validation only

During BYOD onboarding, users report that they can connect to the Wi-Fi but cannot reach the Internet. The network uses a captive portal for guest access and RADIUS for employee authentication. What is the most likely cause?

The RADIUS server is unreachable

The captive portal is not redirecting properly

The user's device is assigned to a VLAN with no Internet access

The DNS server is misconfigured

A retail company wants to offer Wi-Fi to customers (guests) and employees. They want to ensure that guests cannot access internal resources, while employees get full access. Which onboarding method should be used for guests?

Self-registration with a voucher or social login

Active Directory authentication

CCIE Security

Domain 4Objective 6

4.6 BYOD On-Boarding and Network Access Flows CCIE-SECURITY Practice Questions (Page 9)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

25%of the exam

Questions 41–45

41expert · hard
A company is troubleshooting a BYOD onboarding issue where users are able to connect to the Wi-Fi but are not getting an IP address. The DHCP server is on a different VLAN than the wireless network. What is the most likely cause?
Select an answer first
42application · medium
A university is rolling out BYOD for students. They use Azure AD as the identity provider and want to enforce conditional access policies that require device compliance before granting network access. Which integration approach should be used?
Select an answer first
43application · medium
A financial firm allows employees to connect personal laptops to the corporate Wi-Fi. The security policy requires that only devices with up-to-date antivirus and a corporate-issued certificate can access the internal network. Which policy enforcement mechanism should be used?
Select an answer first
44application · medium
During BYOD onboarding, users report that they can connect to the Wi-Fi but cannot reach the Internet. The network uses a captive portal for guest access and RADIUS for employee authentication. What is the most likely cause?
Select an answer first
45application · medium
A retail company wants to offer Wi-Fi to customers (guests) and employees. They want to ensure that guests cannot access internal resources, while employees get full access. Which onboarding method should be used for guests?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.