4.18 Cisco IBNS 2.0 (C3PL) for Authentication, Access Control, and User Policy Enforcement CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A company is integrating IBNS 2.0 with Cisco ISE and using LDAP as the identity source. They want to use the LDAP attribute 'department' to assign different VLANs. They have configured ISE to return the department attribute in the RADIUS response. On the switch, they have created a class map that matches on the RADIUS attribute 'department' with value 'engineering'. However, when an engineering user authenticates, they are not getting the correct VLAN. What is the most likely cause?

   • AThe switch does not support matching on RADIUS attributes.
   • BThe VLAN is not defined on the switch.
   • CThe RADIUS attribute name used in the class map does not match the attribute name returned by ISE.
   • DThe LDAP server is not returning the department attribute to ISE.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A network administrator is troubleshooting an IBNS 2.0 deployment where 802.1X authentication is failing for some users. The RADIUS server logs show that the authentication request is being sent, but the response is not being received by the switch. The switch's RADIUS server configuration is correct. What is the most likely cause?

   • AA firewall between the switch and RADIUS server is blocking UDP port 1812 or 1645.
   • BThe client's supplicant is not configured correctly.
   • CThe RADIUS server is not configured with the correct shared secret.
   • DThe switch is not configured with the correct VLAN for the user.
   Reveal Solution Discussion Select an answer first
4. 23expert · medium · select all that apply

   A company is deploying IBNS 2.0 and wants to support a variety of devices. They have a mix of 802.1X-capable devices, legacy devices that only support MAB, and guest devices that need web authentication. They want to ensure that all devices are authenticated and that guests are placed in a restricted VLAN. Which of the following configurations are necessary to achieve this? (Select all that apply.)

   • AEnable 802.1X globally on all ports and rely on the RADIUS server to fall back to MAB and WebAuth.
   • BConfigure a parameter map to define the authentication methods and VLAN assignments.
   • CConfigure the RADIUS server to return the appropriate VLAN for each user.
   • DCreate a separate VLAN for guests and configure a static ACL to restrict access.
   • ECreate a C3PL policy with class maps for each device type and a policy map that specifies the authentication method and VLAN assignment for each class.
   Check answers Discussion Select an answer first
5. 24application · medium

   A company is implementing IBNS 2.0 to enforce different access policies for employees and contractors. They want to use Cisco ISE as the RADIUS server and assign different VLANs based on user role. The network team is designing the C3PL policy on the switch. What is the correct way to structure the policy to achieve role-based VLAN assignment?

   • AConfigure the VLAN assignment directly in the RADIUS server and do not configure any policy on the switch.
   • BUse a single policy map that assigns a static VLAN to all users, and rely on the RADIUS server to change the VLAN after authentication.
   • CCreate a class map that matches on RADIUS attributes (e.g., user role) and a policy map that assigns the appropriate VLAN based on the class.
   • DUse a parameter map to define VLANs and then apply it globally to all ports.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A hospital is deploying IBNS 2.0 for its wired network. They have a mix of devices: IP phones (which do not support 802.1X), Windows laptops (which do), and guest devices that need web authentication. The network team wants to ensure that IP phones are authenticated using their MAC address, while laptops use 802.1X. What configuration approach should they use?

   • AConfigure a C3PL policy with a class map that matches on device type (e.g., IP phone) and use MAB for that class, while using 802.1X for other classes.
   • BUse MAB for all devices to simplify the configuration.
   • CEnable 802.1X on all ports and configure the RADIUS server to fall back to MAB when 802.1X fails.
   • DConfigure a single global authentication method of 802.1X and rely on the phone's MAC address being passed through.
   Reveal Solution Discussion Select an answer first