4.12 Certification-Based Authentication Using Cisco ISE CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization wants to use EAP-FAST for wireless authentication. They want to use certificates for server-side authentication but do not want to deploy client certificates. Which EAP-FAST configuration should be used?

   • AUse EAP-FAST with server certificate authentication and PAC provisioning.
   • BUse EAP-FAST with anonymous PAC provisioning.
   • CUse PEAP with client certificates.
   • DUse EAP-FAST with client certificates.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is deploying Cisco ISE for wireless network access. They want to use certificate-based authentication with EAP-TLS for all corporate laptops. The laptops have certificates issued by an internal CA. The ISE admin needs to configure the authentication policy to accept only these certificates and reject all others. What should the admin configure in the authentication policy?

   • ACreate an authentication rule that uses the 'Guest Accounts' identity source and set the condition to check the certificate serial number.
   • BCreate an authentication rule that uses the 'Internal Endpoints' identity source and set the condition to check the certificate subject matches the laptop's hostname.
   • CCreate an authentication rule that uses the 'All_User_IDs' identity source and set the condition to check the certificate validity period.
   • DCreate an authentication rule that uses the 'Certificate Authentication' identity source and set the condition to check the certificate issuer matches the internal CA.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company uses EAP-FAST with PAC files for wireless authentication. They want to enhance security by using certificates for the server-side authentication. What is the required configuration in Cisco ISE?

   • AUse EAP-TLS instead of EAP-FAST to support certificates.
   • BDisable PAC files and use only certificates for authentication.
   • CConfigure the EAP-FAST method to use a server certificate for the TLS tunnel and optionally require client certificates.
   • DConfigure the authentication policy to use 'Certificate Authentication' for EAP-FAST.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An ISE admin is troubleshooting a certificate-based authentication issue. The logs show 'Authentication failed: Certificate validation failed - Certificate is not yet valid'. The client certificate was just issued. What is the most likely cause?

   • AThe client's system clock is set to a time before the certificate's validity period begins.
   • BThe ISE server's clock is set to a time after the certificate's validity period ends.
   • CThe certificate was revoked.
   • DThe certificate chain is incomplete.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An ISE admin is configuring EAP-TLS and wants to ensure that only certificates with a specific Extended Key Usage (EKU) of 'Client Authentication' are accepted. The admin has imported the CA certificate and configured the authentication policy to use 'Certificate Authentication'. What additional configuration is needed to enforce the EKU requirement?

   • AUse the 'Certificate Authentication' identity source, which automatically enforces EKU.
   • BAdd a condition in the authentication policy that checks the certificate's EKU attribute.
   • CConfigure the CA certificate to only issue certificates with the Client Authentication EKU.
   • DSet the authorization policy to check the EKU.
   Reveal Solution Discussion Select an answer first