4.7 Cisco ISE Integration with External Identity Sources CCIE-SECURITY Practice Questions (Page 12)

Questions 56–59

1. 56application · medium

   A company uses a third-party RADIUS server for VPN authentication. They want to integrate it with Cisco ISE so that ISE can enforce posturing policies after authentication. The RADIUS server is at 192.168.1.10 and uses a shared secret 'Secret123'. The authentication port is 1812. What configuration is needed in ISE?

   • AUse the RADIUS server as a network device in ISE.
   • BCreate an external RADIUS identity source with IP 192.168.1.10, shared secret 'Secret123', and port 1812.
   • CJoin ISE to the RADIUS server's domain.
   • DCreate an LDAP identity source with IP 192.168.1.10 and base DN.
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   An organization uses an LDAP directory for employee authentication. They want to use the 'mail' attribute from LDAP in their authorization policies to grant different levels of access. How should the administrator configure ISE to make this attribute available?

   • AJoin ISE to the LDAP directory as if it were Active Directory.
   • BIn the LDAP identity source, add 'mail' to the list of directory attributes to be retrieved.
   • CUse an external RADIUS server to retrieve the 'mail' attribute.
   • DCreate a custom dictionary attribute in ISE and map it manually.
   Reveal Solution Discussion Select an answer first
4. 58application · medium

   A service provider uses Cisco ISE as a RADIUS proxy to a legacy RADIUS server for subscriber authentication. When a subscriber authenticates, ISE forwards the request to the external RADIUS server. The external server responds with Access-Accept and a Class attribute. What does ISE do with this response?

   • AISE uses the Access-Accept to allow the session and can include the Class attribute in the RADIUS response to the network device.
   • BISE re-authenticates the user against its local database before allowing access.
   • CISE drops the Access-Accept and sends its own Access-Reject.
   • DISE ignores the Class attribute and only uses the Access-Accept for authorization.
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A small business is choosing an identity source for Cisco ISE. They have a cloud-based directory that supports LDAP but not Active Directory join. They also have a legacy RADIUS server for VPN. They want to authenticate employees using the cloud directory and also use group membership for authorization. What should they use?

   • ACreate local users in ISE and manually assign groups.
   • BUse an LDAP identity source pointing to the cloud directory, and retrieve group membership via LDAP attributes.
   • CUse an external RADIUS identity source to proxy to the cloud directory.
   • DJoin ISE to the cloud directory as if it were Active Directory.
   Reveal Solution Discussion Select an answer first