4.7 Cisco ISE Integration with External Identity Sources CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company has integrated Cisco ISE with Active Directory. They want to grant different network access based on AD group membership, such as 'Finance' and 'Engineering'. The AD identity source is configured and groups are retrieved. What is the next step to enforce this?

   • ACreate authorization policies that use AD group conditions (e.g., IdentityGroup:AD-External:Finance).
   • BUse LDAP to retrieve group membership instead.
   • CCreate separate AD identity sources for each group.
   • DAssign static IP addresses to users based on group.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An enterprise is migrating from a legacy LDAP directory to Active Directory. They have a pilot group of users still in LDAP, while the rest are in AD. The ISE administrator wants to authenticate users from both sources without changing the user experience. They have configured an LDAP identity source and an AD identity source. What is the best way to handle authentication for both groups?

   • ACreate a single AD identity source and migrate all LDAP users manually.
   • BUse an external RADIUS server to proxy authentication to both sources.
   • CCreate an identity source sequence that tries AD first, then LDAP, and use it in the authentication policy.
   • DConfigure the LDAP identity source to point to the AD domain controller.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company has multiple Active Directory domains in a forest. They want to use Cisco ISE for wireless authentication. The ISE server is joined to Domain A. Users in Domain B are failing authentication. The trust between Domain A and Domain B is bidirectional. What is the most likely cause and solution?

   • AISE must be joined to every domain in the forest.
   • BThe trust is not working; you need to re-establish the trust.
   • CISE cannot authenticate users from other domains unless the AD identity source is configured with the correct domain and group retrieval settings.
   • DUsers in Domain B must be migrated to Domain A.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A service provider uses Cisco ISE as a RADIUS proxy to multiple external RADIUS servers. They need to load-balance authentication requests across two RADIUS servers. They also need to ensure that if one server is down, requests are sent to the other. What should they configure in ISE?

   • AUse a network device configuration to load-balance RADIUS requests.
   • BCreate two external RADIUS identity sources and use an identity source sequence with both, enabling failover.
   • CConfigure both RADIUS servers as LDAP identity sources.
   • DConfigure a single external RADIUS identity source with a virtual IP that load-balances.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   An organization uses an LDAP directory that stores user group membership in the 'memberOf' attribute. They want to use these groups in Cisco ISE authorization policies. However, the LDAP server does not support the 'memberOf' attribute in search results. What is the best alternative?

   • AUse an external RADIUS server to provide group information.
   • BCreate local groups in ISE and manually assign users.
   • CSwitch to Active Directory integration.
   • DUse the 'groupMembership' attribute or perform a reverse lookup using the group's 'member' attribute.
   Reveal Solution Discussion Select an answer first