4.12 Certification-Based Authentication Using Cisco ISE CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization uses Cisco ISE for wired authentication. They want to use PEAP-MSCHAPv2 for user authentication, but they also want to ensure that the server certificate is trusted by clients. What must be configured on the clients to achieve this?

   • ASet the authentication method to EAP-TLS instead of PEAP.
   • BConfigure the client to disable certificate validation.
   • CInstall a client certificate on each user's device.
   • DInstall the ISE server certificate's root CA certificate in the client's trusted root store.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A financial firm is planning to replace their current password-based Wi-Fi authentication with a more secure method. They want to eliminate the risk of password phishing and ensure that only company-managed devices can access the network. Which authentication method should they implement?

   • ALEAP with user credentials.
   • BEAP-TLS with machine certificates issued by the company's internal CA.
   • CEAP-FAST with PAC files.
   • DPEAP-MSCHAPv2 with user passwords.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A university wants to deploy certificate-based authentication for both students and faculty. Students will use personal devices, while faculty will use university-issued laptops. The university wants to automate certificate enrollment for faculty devices but not for student devices. What is the best approach?

   • AUse manual enrollment for both groups.
   • BUse EAP-FAST with PAC files for both groups.
   • CUse SCEP for faculty devices and manual enrollment for student devices.
   • DUse SCEP for both faculty and student devices.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During a pilot of EAP-TLS, some users can authenticate successfully while others cannot. The failing users have certificates issued by a different subordinate CA under the same root CA. ISE has the root CA and one subordinate CA in its trust store. What is the most likely issue?

   • AThe users' certificates are expired.
   • BThe users are entering the wrong password.
   • CThe other subordinate CA certificate is not imported into ISE's trust store.
   • DThe wireless controller is not configured correctly.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company uses Cisco ISE for 802.1X authentication. They want to allow only devices that have a certificate with the Organizational Unit (OU) 'Engineering' to access the network. Which ISE policy component should be used to enforce this?

   • AA profiling policy that identifies the device type.
   • BAn authentication policy that matches on the certificate attribute 'OU=Engineering' in the Subject.
   • CAn authorization policy that checks the certificate's OU.
   • DA network access policy on the switch.
   Reveal Solution Discussion Select an answer first