4.12 Certification-Based Authentication Using Cisco ISE CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · hard

   A company uses PEAP with MSCHAPv2 for wireless authentication. They want to add certificate-based authentication for users without changing the client configuration. They have an internal CA and want to use the same PEAP method but with client certificates. What is the best way to achieve this in Cisco ISE?

   • AUse EAP-FAST with PAC files instead of certificates.
   • BConfigure a new authentication policy that uses PEAP with EAP-MSCHAPv2 and set the identity source to 'Certificate Authentication'.
   • CSwitch to EAP-TLS, which is the only method that supports client certificates.
   • DKeep the existing PEAP policy and add a condition to check the certificate in the authorization policy.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An ISE admin is troubleshooting a certificate-based authentication failure. The logs show 'Authentication failed: Certificate validation failed - OCSP check failed'. The client certificate is valid and the trust chain is correct. What is the most likely cause?

   • AThe authentication policy is misconfigured.
   • BThe client certificate is expired.
   • CThe client does not trust the ISE server certificate.
   • DThe OCSP responder is unreachable from ISE.
   Reveal Solution Discussion Select an answer first
4. 43application · easy

   A company is considering moving from username/password authentication to certificate-based authentication for their VPN remote access. They want to reduce the risk of credential theft and phishing. They also want to ensure that only company-managed devices can connect. What is the primary benefit of using certificate-based authentication in this scenario?

   • ACertificates automatically renew without any user interaction.
   • BCertificates provide stronger authentication because they are tied to the device and are difficult to steal remotely.
   • CCertificates eliminate the need for a RADIUS server.
   • DCertificates allow the use of the same password for multiple services.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An organization wants to automatically enroll certificates to Windows laptops using SCEP. They have a Microsoft NDES server. The ISE admin needs to configure the certificate provisioning profile in ISE. What is a required configuration step?

   • ASet the authorization policy to allow all devices after enrollment.
   • BSpecify the SCEP server URL and the CA certificate to be used for enrollment.
   • CEnable the 'Guest' portal for certificate enrollment.
   • DConfigure the authentication policy to use the 'Certificate Authentication' identity source.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   During EAP-TLS authentication, ISE receives a client certificate. The admin has configured the authentication policy to use 'Certificate Authentication' and has imported the root CA certificate. However, authentication fails with 'Certificate chain validation failed'. What should the admin check first?

   • AWhether the authentication policy is set to 'Reject' for certificate authentication.
   • BWhether the client certificate is in the correct format (e.g., PEM vs DER).
   • CWhether the client has the ISE server certificate in its trust store.
   • DWhether the intermediate CA certificates are imported into ISE's trusted certificate store.
   Reveal Solution Discussion Select an answer first