4.7 Cisco ISE Integration with External Identity Sources CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company uses Cisco ISE with Active Directory for wireless authentication. They want to grant different access levels based on AD group membership. Which of the following is the correct way to use AD groups in authorization policies?

   • ARetrieve directory groups in the AD identity source and use them as conditions in authorization policies.
   • BCreate separate authorization profiles for each AD group and assign them manually.
   • CMap AD groups to internal ISE user groups and use those in policies.
   • DUse the 'memberOf' attribute from LDAP to determine group membership.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A managed service provider (MSP) uses Cisco ISE to provide network access for multiple clients. One client has an existing RADIUS server that already handles authentication for their legacy systems. The MSP wants to use that RADIUS server as an identity source in ISE. What is the appropriate approach?

   • ACreate local user accounts in ISE for all client users.
   • BConfigure an external RADIUS identity source in ISE pointing to the client's RADIUS server.
   • CUse LDAP integration to connect to the RADIUS server's underlying directory.
   • DJoin ISE to the client's Active Directory domain.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   You need to configure an external RADIUS identity source in ISE. The RADIUS server is at 192.168.10.5 and uses the shared secret 'SecureKey123'. The RADIUS server listens on the default authentication port. What configuration should you use?

   • ASet the server IP to 192.168.10.5, shared secret to 'SecureKey123', and port to 1812.
   • BSet the server IP to 192.168.10.5, shared secret to 'SecureKey123', and port to 636.
   • CSet the server IP to 192.168.10.5, shared secret to 'SecureKey123', and port to 389.
   • DSet the server IP to 192.168.10.5, shared secret to 'SecureKey123', and port to 1645.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   Cisco ISE is configured to use an external RADIUS server for authentication. A user attempts to authenticate. What happens when ISE receives the authentication request?

   • AISE authenticates the user locally and then sends a RADIUS accounting request to the external server.
   • BISE checks its internal database first and only uses RADIUS if the user is not found.
   • CISE queries the external RADIUS server's LDAP backend directly.
   • DISE forwards the request to the external RADIUS server and relays the response back to the network device.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A university uses an existing OpenLDAP directory for student accounts. The network team is integrating Cisco ISE for 802.1X wireless authentication. They want to authenticate students against LDAP but also need to retrieve the 'department' attribute to enforce different authorization policies for engineering vs. liberal arts students. The LDAP server is at ldap.university.edu, base DN is dc=university,dc=edu. What should the administrator configure in the LDAP identity source to meet these requirements?

   • ASet the base DN to dc=university,dc=edu and configure the 'department' attribute as a directory attribute to be retrieved for use in authorization policies.
   • BSet the base DN to ou=students,dc=university,dc=edu and use the 'department' attribute as the authentication password.
   • CJoin ISE to the LDAP domain and use AD groups for authorization.
   • DConfigure the LDAP server as an external RADIUS server to allow attribute retrieval.
   Reveal Solution Discussion Select an answer first