4.7 Cisco ISE Integration with External Identity Sources CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard · select all that apply

   You are integrating Cisco ISE with an LDAP directory. You need to authenticate users and use LDAP attributes in authorization policies. Which of the following are required or recommended? (Select all that apply.)

   • AConfigure the LDAP identity source with the correct base DN.
   • BJoin ISE to the LDAP server's domain.
   • CUse an external RADIUS server to proxy LDAP authentication.
   • DMap LDAP attributes to ISE dictionary attributes.
   • ESet up a directory group retrieval for group-based policies.
   Check answers Discussion Select an answer first
2. 27expert · hard

   A company is deploying Cisco ISE and wants to integrate with Active Directory. They have a security policy that requires all ISE-to-AD communication to be encrypted. What should you do?

   • AConfigure the external RADIUS server to use RADIUS over TLS.
   • BEnsure that the ISE node is joined to the domain and use the default AD integration, which uses Kerberos.
   • CUse LDAPS for the AD identity source.
   • DDisable all unencrypted protocols on the AD server.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   You are configuring an external RADIUS identity source in ISE. The RADIUS server is behind a NAT and uses a non-standard port for authentication. You need to ensure ISE can communicate with it. What should you do?

   • AConfigure a RADIUS proxy on ISE to forward to the non-standard port.
   • BUse the standard port 1812 and rely on NAT to translate it.
   • CConfigure the RADIUS server's IP and the non-standard port in the identity source settings.
   • DUse LDAP integration instead because it supports non-standard ports.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard · select all that apply

   You have integrated Cisco ISE with Active Directory. You need to use AD group membership to enforce different access policies for different departments. Which of the following are true? (Select all that apply.)

   • AYou can use AD groups directly in authorization policy conditions.
   • BYou need to map AD groups to internal ISE user groups.
   • CYou must create a separate authorization profile for each group.
   • DYou can use the 'memberOf' attribute from LDAP to get group membership.
   • EYou must retrieve the directory groups in the AD identity source configuration.
   Check answers Discussion Select an answer first
6. 30expert · hard

   A company uses an LDAP directory that supports both simple bind and SASL authentication. They want to use Cisco ISE to authenticate users. Which authentication method should they choose in ISE?

   • ASASL
   • BRADIUS
   • CSimple bind
   • DKerberos
   Reveal Solution Discussion Select an answer first