4.12 Certification-Based Authentication Using Cisco ISE CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An organization wants to use certificate-based authentication for both user and machine authentication. They have a SCEP server that issues certificates. The ISE admin needs to configure the certificate provisioning profile to support both user and machine certificates. What is the best approach?

   • AUse a single provisioning profile that issues the same certificate for both users and machines.
   • BConfigure the provisioning profile to use the 'Certificate Authentication' identity source.
   • CCreate two separate provisioning profiles: one for user certificates and one for machine certificates, each with the appropriate SCEP template.
   • DUse the guest portal for certificate enrollment.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   An ISE admin is configuring EAP-TLS and wants to ensure that the client certificate is validated against a specific trust anchor. The company has multiple CAs, and they want to accept only certificates from a specific CA. What is the best way to achieve this?

   • AUse the 'Certificate Authentication' identity source, which automatically selects the correct CA.
   • BImport all CA certificates and then add a condition to the authentication policy to check the issuer.
   • CImport only the desired CA certificate into ISE's trusted certificate store and use it as the trust anchor for the authentication policy.
   • DConfigure the client to only send certificates from the desired CA.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company wants to use certificate-based authentication for their wireless network. They have a mix of Windows and macOS devices. The certificates are issued by an internal CA. The ISE admin needs to configure the authentication policy to accept certificates from this CA. What is the first step?

   • AImport the CA certificate into ISE's trusted certificate store.
   • BCreate a new authentication rule with 'Certificate Authentication' identity source.
   • CEnable EAP-TLS in the allowed protocols.
   • DConfigure the authorization policy to allow certificate users.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   Users report that EAP-TLS authentication is failing for some laptops. The ISE admin checks the logs and sees 'Certificate validation failed: Certificate is not trusted'. The certificates are issued by the company's internal CA, and the CA root certificate is imported into ISE's trusted certificate store. What is the most likely cause of this failure?

   • AThe ISE server certificate is not trusted by the clients.
   • BThe EAP-TLS method is not enabled in the allowed protocols.
   • CThe client certificates have expired.
   • DThe intermediate CA certificate is missing from the trust chain in ISE.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization wants to use certificate-based authentication for both user and machine authentication on their Windows laptops. They have a Microsoft CA that issues both user and machine certificates. The ISE admin needs to configure authentication policies to differentiate between machine and user authentication. What is the best approach?

   • ACreate two separate authentication rules: one that matches the certificate's Subject Alternative Name (SAN) containing the user principal name (UPN) for user authentication, and another that matches the SAN containing the machine hostname for machine authentication.
   • BConfigure the authentication policy to use the 'Machine Authentication' identity source only, and ignore user certificates.
   • CUse the 'Guest Accounts' identity source for machine authentication and 'Internal Users' for user authentication.
   • DUse the same authentication rule for both, since the certificates are from the same CA.
   Reveal Solution Discussion Select an answer first