4.18 Cisco IBNS 2.0 (C3PL) for Authentication, Access Control, and User Policy Enforcement CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An enterprise is integrating IBNS 2.0 with LDAP for user authentication. The LDAP server contains user attributes such as department and clearance level. The network team wants to use these attributes to assign different VLANs. They are using Cisco ISE as the RADIUS server. What is the best way to achieve this?

   • AUse RADIUS to proxy LDAP attributes
   • BUse a static mapping of users to VLANs on the switch
   • CConfigure the switch to query LDAP directly
   • DConfigure ISE to query LDAP and use the returned attributes in authorization policies
   Reveal Solution Discussion Select an answer first
2. 37expert · hard · select all that apply

   A network architect is designing a C3PL policy for a campus network. The policy must support multiple authentication methods, dynamic VLAN assignment, and session timeout. Which of the following are valid components of a C3PL policy? (Select all that apply.)

   • AParameter maps to define global parameters
   • BClass maps to match traffic or sessions
   • CAccess lists to define traffic filtering
   • DPolicy maps to define actions for each class
   • EInterface configurations to apply the policy
   Check answers Discussion Select an answer first
4. 38expert · hard · select all that apply

   A company is implementing IBNS 2.0 to enforce access control based on user identity. The RADIUS server returns a downloadable ACL (dACL) for certain users. The switch must apply this dACL. Which of the following are true regarding dACL enforcement? (Select all that apply.)

   • AThe dACL is applied to all users on the same VLAN
   • BThe dACL is applied per session, not per interface
   • CThe dACL is stored in the switch's ACL table
   • DThe dACL is applied only after authentication succeeds
   • EThe dACL can be overridden by a static ACL on the interface
   Check answers Discussion Select an answer first
5. 39expert · hard · select all that apply

   A network admin is troubleshooting an IBNS 2.0 deployment where 802.1X authentication is failing intermittently. The RADIUS server logs show that some Access-Requests are not receiving responses. The admin suspects a RADIUS communication issue. Which of the following could cause this? (Select all that apply.)

   • AThe client is not sending EAPOL
   • BRADIUS server is overloaded
   • CNetwork congestion between switch and server
   • DIncorrect shared secret
   • EThe switch is not configured with aaa new-model
   Check answers Discussion Select an answer first
6. 40expert · hard · select all that apply

   A security team is configuring user policy enforcement in IBNS 2.0. They want to enforce session timeout, reauthentication, and posture assessment. Which of the following are valid methods to enforce these policies? (Select all that apply.)

   • AUse CoA to change authorization when posture changes
   • BSet the session-timeout attribute in the RADIUS Access-Accept
   • CUse RADIUS accounting to track session duration
   • DUse a static ACL to block non-compliant devices
   • EConfigure a periodic reauthentication timer on the switch
   Check answers Discussion Select an answer first