4.7 Cisco ISE Integration with External Identity Sources CCIE-SECURITY Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A company is deploying Cisco ISE for wired and wireless access. They have a Windows Active Directory domain 'corp.local'. The security team wants to authenticate all employees using AD credentials and also use AD group membership (e.g., 'VPN-Users') to enforce different access policies. The ISE admin has already joined ISE to the domain. What is the next step to ensure AD groups are available for authorization policies?

   • AConfigure the AD identity source and retrieve directory groups by specifying the group base DN and enabling group retrieval.
   • BCreate a local user group in ISE that mirrors the AD group membership.
   • CUse an external RADIUS server to proxy authentication and group information.
   • DConfigure LDAP as the identity source and use the 'memberOf' attribute.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A managed service provider uses Cisco ISE to provide NAC for multiple clients. Each client has its own RADIUS server. The MSP wants to centralize policy management in ISE but allow each client to authenticate users against their own RADIUS server. They also want to apply different authorization policies per client. What is the best way to achieve this?

   • ACreate a separate external RADIUS identity source for each client and use client-specific authorization policies.
   • BUse AD integration for all clients and ignore their RADIUS servers.
   • CUse LDAP identity sources for all clients.
   • DCreate a single external RADIUS identity source that points to a load balancer for all clients.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A managed service provider (MSP) offers network access control to multiple small clients. Each client has its own RADIUS server that holds user credentials. The MSP wants to use Cisco ISE as a central policy enforcement point, but authentication must be performed by the client's RADIUS server. What should the MSP configure in ISE to achieve this?

   • AConfigure an external RADIUS identity source for each client, specifying the RADIUS server IP, shared secret, and authentication port.
   • BJoin ISE to each client's Active Directory domain.
   • CCreate local user accounts in ISE for all client users.
   • DConfigure an LDAP identity source pointing to each client's RADIUS server.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A hospital uses a legacy LDAP directory (OpenLDAP) to store employee credentials. They are integrating Cisco ISE for network access. The LDAP server supports only simple authentication (bind) and does not support Kerberos. The hospital wants to authenticate employees using their LDAP credentials and also retrieve the 'employeeType' attribute to distinguish doctors from nurses. What should the administrator do in ISE?

   • AUse an external RADIUS server to proxy authentication to the LDAP server.
   • BConfigure an LDAP identity source with the server address, base DN, and add 'employeeType' as a directory attribute for authorization.
   • CCreate local users in ISE and manually assign employeeType.
   • DConfigure an Active Directory identity source and join ISE to the LDAP domain.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A global company wants to use Cisco ISE for wireless access. They have a multi-domain Active Directory forest. The ISE admin needs to authenticate users from any domain in the forest. What is the recommended approach for integrating ISE with AD?

   • AUse LDAP to connect to each domain controller individually.
   • BJoin ISE to the forest root domain and configure the AD identity source to use the forest-wide trust.
   • CCreate a separate AD identity source for each domain in the forest.
   • DConfigure an external RADIUS server in each domain to proxy authentication.
   Reveal Solution Discussion Select an answer first