4.7 Cisco ISE Integration with External Identity Sources CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is choosing an external identity source for Cisco ISE. They need to support machine authentication for Windows devices and want to use Kerberos for secure authentication. Which identity source should they choose?

   • AActive Directory
   • BLDAP
   • CExternal RADIUS
   • DInternal user database
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A large enterprise has a complex identity infrastructure. They have an Active Directory forest for employees, an OpenLDAP directory for contractors, and a legacy RADIUS server for a specific legacy network segment. They want to use Cisco ISE to provide a unified access policy. Which approach is most effective?

   • AConfigure all three as separate identity sources and use identity source sequences to try them in order.
   • BMigrate all users to Active Directory and use only AD as the identity source.
   • CUse LDAP for all authentication by pointing to AD and OpenLDAP, and ignore the RADIUS server.
   • DUse external RADIUS as the primary identity source and proxy all authentication to it.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   You are configuring an LDAP identity source in ISE. The LDAP server has a large directory with many users. You notice that authentication is slow. What can you do to improve performance?

   • ASet a more specific base DN to limit the search scope.
   • BDisable TLS for faster connections.
   • CIncrease the LDAP timeout value.
   • DUse the 'subtree' search scope instead of 'one level'.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An organization has multiple Active Directory domains in a forest. They want to use Cisco ISE to authenticate users from any domain. What is the best way to configure AD integration?

   • AUse external RADIUS to proxy to each domain's domain controller.
   • BCreate a separate AD identity source for each domain.
   • CJoin ISE to one domain and configure the forest root as the identity source.
   • DUse LDAP integration to connect to each domain's LDAP server.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   You have configured an external RADIUS identity source in ISE. Users are failing authentication. You check the ISE logs and see that the external RADIUS server is not responding. What is the most likely cause?

   • AThe user's password is incorrect.
   • BThe shared secret is incorrect.
   • CThe RADIUS server is using a different authentication port.
   • DISE is not configured to proxy to that server.
   Reveal Solution Discussion Select an answer first