4.12 Certification-Based Authentication Using Cisco ISE CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company wants to use EAP-TLS for both machine and user authentication, but they have a constraint: they cannot issue separate certificates for machines and users. Instead, they want to use a single certificate that contains both the machine hostname and the user's email in the Subject Alternative Name (SAN). How can ISE be configured to authenticate both identities?

   • AUse EAP-FAST with PAC files.
   • BUse a single authentication policy that matches on the SAN containing both the hostname and email, and then use authorization policies to grant appropriate access.
   • CUse PEAP with machine certificates only.
   • DCreate two separate authentication policies: one for machine and one for user, but both using the same certificate.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An administrator is configuring PEAP in ISE. They want to ensure that clients validate the server certificate. They have imported the server certificate into ISE, but clients are still getting a certificate validation warning. What is the most likely cause?

   • AThe ISE server certificate is expired.
   • BThe server certificate is not imported into ISE.
   • CThe clients are using EAP-TLS instead of PEAP.
   • DThe root CA of the server certificate is not in the clients' trusted root store.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company wants to automate certificate enrollment for their Windows laptops using SCEP. They have set up the SCEP service in ISE and configured the laptops to use SCEP. However, the laptops are not receiving certificates. The ISE logs show that the SCEP requests are being rejected. What is the most likely cause?

   • AThe SCEP shared secret is incorrect or not configured on the clients.
   • BThe laptops are using the wrong SSID.
   • CThe laptops are not domain-joined.
   • DThe ISE server certificate is not trusted by the laptops.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company wants to use Cisco ISE to authenticate both company-issued laptops and personal smartphones on the corporate Wi-Fi. The laptops have machine certificates enrolled via SCEP, while the smartphones will use user certificates. The authentication policy must differentiate between the two. What is the most efficient way to configure this in ISE?

   • AUse a single authentication policy that accepts any certificate from the internal CA, and rely on authorization policies to differentiate access.
   • BUse PEAP with machine certificates for both laptops and smartphones.
   • CConfigure the wireless controller to assign different VLANs based on the device's MAC address.
   • DCreate two separate authentication policies: one that matches on the Subject Alternative Name (SAN) containing the machine's hostname and another that matches on the SAN containing the user's email address.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   Users report that they cannot connect to the corporate Wi-Fi using EAP-TLS. The ISE logs show 'Certificate validation failed' for multiple users. The certificates are issued by an internal CA, and the CA certificate is imported into ISE's trust store. What is the most likely cause of this failure?

   • AThe certificate revocation list (CRL) is not reachable from ISE, so revocation status cannot be checked.
   • BThe client certificates are not installed in the user's personal certificate store.
   • CThe wireless controller is not configured with the correct SSID.
   • DThe users are using the wrong username and password.
   Reveal Solution Discussion Select an answer first