4.7 Cisco ISE Integration with External Identity Sources CCIE-SECURITY Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A company is evaluating identity source options for Cisco ISE. They have a mix of Windows AD and legacy Unix systems that use LDAP. They also have a RADIUS server for a legacy VPN. They want a single ISE deployment to support all three. What is the most efficient way to configure ISE?

   • AUse only external RADIUS for all sources.
   • BUse only LDAP for all sources, including AD.
   • CUse only AD integration and migrate all users to AD.
   • DConfigure an AD identity source, an LDAP identity source, and an external RADIUS identity source, and use identity source sequences as needed.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard · select all that apply

   A company is integrating an external RADIUS server with Cisco ISE. They want to ensure that authentication requests are sent securely and that responses are handled correctly. Which of the following are important considerations when configuring the external RADIUS identity source? (Select all that apply.)

   • AThe external RADIUS server must be joined to the same Active Directory domain as ISE.
   • BThe authentication port must be set to the port the external RADIUS server is listening on.
   • CISE will always use the external RADIUS server's response for authorization decisions.
   • DISE can be configured to use a different accounting port for RADIUS accounting.
   • EThe shared secret must match between ISE and the external RADIUS server.
   Check answers Discussion Select an answer first
4. 48expert · hard

   An administrator has joined Cisco ISE to the Active Directory domain 'corp.local'. They have configured the AD identity source and enabled group retrieval. However, when testing authentication, users are authenticated but the AD group conditions in authorization policies are not matching. What is the most likely cause?

   • AThe users are not members of the groups in AD.
   • BThe group retrieval is not configured to retrieve the specific groups used in the policies.
   • CISE is not joined to the correct domain.
   • DThe authorization policy is using the wrong attribute.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company uses a non-standard LDAP directory that does not support the standard LDAP bind operation for authentication. Instead, it requires a custom authentication method. What is the best way to integrate this directory with Cisco ISE?

   • AUse an external RADIUS server that can authenticate against the custom directory and proxy to ISE.
   • BConfigure the LDAP identity source with the custom authentication method.
   • CJoin ISE to the directory as if it were Active Directory.
   • DCreate local users in ISE and sync them from the directory.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A company has integrated Cisco ISE with Active Directory. They want to use AD attributes, such as 'department', in authorization policies. However, the 'department' attribute is not available in the policy conditions. What should the administrator do?

   • AUse an LDAP identity source to retrieve the attribute.
   • BCreate a custom dictionary attribute and map it to AD.
   • CAdd the 'department' attribute to the AD identity source's directory attributes list.
   • DUse an external RADIUS server to provide the attribute.
   Reveal Solution Discussion Select an answer first