4.3 Cisco Devices for Administrative Access with Cisco ISE CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is using ISE for device administration with RADIUS for a set of older switches. They are experiencing intermittent authentication failures. The ISE logs show that the RADIUS requests are being received but sometimes the response is not sent back to the device. The network team suspects a firewall issue. What is the most likely cause?

   • AThe RADIUS shared secret is incorrect
   • BThe RADIUS source port is not fixed
   • CThe firewall is blocking RADIUS responses on port 1812
   • DThe device is using TACACS+ instead of RADIUS
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An organization wants to integrate ISE with Cisco DNA Center for network device management. They want to use ISE for administrative access to the devices managed by DNA Center. The DNA Center uses its own credentials to access devices, but the organization wants to enforce ISE policies for any direct CLI access to the devices. What is the best approach?

   • AUse only API-based access and disable CLI access
   • BConfigure DNA Center to use ISE as a RADIUS/TACACS+ server for device access
   • CUse local authentication on the devices and disable ISE integration
   • DConfigure the devices to use ISE for all administrative access, including CLI, and ensure DNA Center uses a separate service account
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A small enterprise wants to use Cisco ISE to authenticate administrators on their Cisco switches. They only need authentication (no per-command authorization) and they want to use the same RADIUS infrastructure they already have for wireless. The security team is concerned about the lack of encryption for some RADIUS attributes. What should they do to meet the requirement while addressing the concern?

   • AConfigure ISE as a RADIUS server and use MSCHAP for authentication, accepting that RADIUS encrypts only the password
   • BConfigure ISE as a RADIUS server and enable CoA (Change of Authorization) for the switches
   • CUse TACACS+ instead of RADIUS, even though it requires a separate configuration
   • DConfigure ISE as a RADIUS server and use PAP for authentication
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization has multiple Cisco devices and wants to use ISE for device administration. They need to create a policy that allows only senior network engineers to configure devices in the 'core' device group, while junior staff can only view configurations. They also want to ensure that if a user is not in the correct group, they are denied access. What is the most efficient way to implement this in ISE?

   • ACreate one policy set for the core device group, with conditions for user groups, and a default deny for all other access
   • BCreate separate policy sets for each device group and each user group
   • CCreate a single policy set that matches all devices and then use command sets to differentiate permissions
   • DUse RADIUS instead of TACACS+ to simplify the policy structure
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is configuring ISE for device administration on Cisco routers. They want to use Active Directory as the identity source. The network devices are configured with 'aaa authentication login default group tacacs+'. During testing, authentication fails. The ISE logs show that the user exists in AD but the authentication attempt is rejected. What is the most likely cause?

   • AThe device is using RADIUS instead of TACACS+
   • BThe ISE policy set is not matching the device
   • CThe authentication protocol is PAP, and the password is being sent in clear text
   • DThe device is sending CHAP, but ISE is configured to expect PAP
   Reveal Solution Discussion Select an answer first