A company uses a custom LDAP directory for employee authentication. The directory has a flat structure with users in the 'ou=People' container. You need to configure ISE to authenticate users and then use the 'department' attribute to enforce network access policies. What should you do?

Use the 'sAMAccountName' attribute for authentication and map 'department' to an internal user attribute.

Configure the LDAP server as an external RADIUS server and use RADIUS attributes for authorization.

Set the base DN to 'ou=People,dc=company,dc=com' and map the 'department' attribute to an ISE dictionary attribute.

Set the base DN to 'dc=company,dc=com' and use the 'cn' attribute for authentication.

An organization has a legacy RADIUS server that is being decommissioned. They are migrating to Cisco ISE. During the transition, they want to use the legacy RADIUS server as an identity source for a specific user group. What is the best approach?

Use LDAP integration to connect to the RADIUS server's backend.

Ignore the legacy server and use AD for all users.

Migrate all users to ISE's internal database immediately.

Configure an external RADIUS identity source and use identity source sequences to try it for that group.

An organization uses Cisco ISE with an LDAP identity source. They want to authenticate users against LDAP but also need to retrieve group membership to apply different access policies. The LDAP server supports group membership via the 'memberOf' attribute. What is the best way to achieve this?

Configure the LDAP identity source and add a directory group retrieval that uses the 'memberOf' attribute.

Use the LDAP server's built-in 'group' attribute and map it to an ISE internal user group.

Create a separate LDAP identity source for each group and assign users to them manually.

Use external RADIUS to proxy authentication and retrieve group membership from RADIUS attributes.

A company wants to integrate Cisco ISE with their existing Active Directory to authenticate employees for VPN access. They have a single AD domain and want to use AD group membership for authorization. What is the first step you should take in ISE?

Join the ISE node to the AD domain using the Active Directory identity source configuration.

Configure an external RADIUS server to proxy authentication to AD.

Create an LDAP identity source pointing to the AD server.

Manually create AD user accounts in ISE's internal database.

You are configuring an Active Directory identity source in ISE. The AD domain is 'corp.example.com'. You need to ensure that ISE can authenticate users and retrieve group memberships for authorization. What configuration is required?

Join the domain, specify the domain name, and configure the directory groups to retrieve.

Set up an external RADIUS server with the AD server's IP and shared secret.

Configure the AD server as an LDAP server and use the 'userPrincipalName' attribute.

Provide the base DN and LDAP bind credentials.

CCIE Security

Domain 4Objective 7

4.7 Cisco ISE Integration with External Identity Sources CCIE-SECURITY Practice Questions (Page 7)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

10concepts

25%of the exam

Questions 31–35

31application · medium
A company uses a custom LDAP directory for employee authentication. The directory has a flat structure with users in the 'ou=People' container. You need to configure ISE to authenticate users and then use the 'department' attribute to enforce network access policies. What should you do?
Select an answer first
32expert · hard
An organization has a legacy RADIUS server that is being decommissioned. They are migrating to Cisco ISE. During the transition, they want to use the legacy RADIUS server as an identity source for a specific user group. What is the best approach?
Select an answer first
33application · medium
An organization uses Cisco ISE with an LDAP identity source. They want to authenticate users against LDAP but also need to retrieve group membership to apply different access policies. The LDAP server supports group membership via the 'memberOf' attribute. What is the best way to achieve this?
Select an answer first
34application · medium
A company wants to integrate Cisco ISE with their existing Active Directory to authenticate employees for VPN access. They have a single AD domain and want to use AD group membership for authorization. What is the first step you should take in ISE?
Select an answer first
35application · medium
You are configuring an Active Directory identity source in ISE. The AD domain is 'corp.example.com'. You need to ensure that ISE can authenticate users and retrieve group memberships for authorization. What configuration is required?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.