4.1 Cisco ISE Scalability Using Multiple Nodes and Personas CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A network administrator notices that after making a policy change on the primary PAN, the change is not reflected on a secondary PSN. The PSN is in the same deployment and shows as 'Connected' in the admin console. What is the most likely cause?

   • AThe PSN is in a different deployment and is not part of the same administrative domain.
   • BThe PSN is not subscribed to the 'Policy Service' persona and thus ignores policy updates.
   • CThe secondary PAN is down, so the PSN cannot receive the configuration.
   • DThe PSN has been placed in 'Maintenance Mode' and is not receiving updates.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A hospital is adding a new wing with 500 additional wireless devices. The current ISE deployment has two PSNs that are each running at 70% CPU during peak hours. The administrator wants to add capacity without affecting existing services. What is the best approach?

   • AEnable 'High Availability' on the existing PSNs so they share the load automatically.
   • BUpgrade the existing PSNs to a larger virtual machine size to handle the additional load.
   • CAdd a third PSN and configure the network access devices to use all three PSNs in a round-robin fashion.
   • DMove the MNT persona to a separate node to free up resources on the PSNs.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company has a distributed ISE deployment with a primary PAN and a secondary PAN. The primary PAN fails. Which statement is true about the failover process?

   • AThe MNT node takes over as the PAN if the primary PAN fails.
   • BThe secondary PAN becomes active only if the primary PAN is down for more than 24 hours.
   • CThe secondary PAN automatically becomes active and takes over all administrative functions.
   • DThe PSNs continue to enforce policies but no new policy changes can be made until the primary PAN is restored.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization wants to deploy Cisco ISE to provide both RADIUS authentication and to share contextual data with a third-party security analytics tool. They plan to use a dedicated node for the data sharing function. Which persona should this node have?

   • ApxGrid Persona
   • BPolicy Administration Node (PAN)
   • CMonitoring and Troubleshooting Node (MNT)
   • DPolicy Service Node (PSN) with pxGrid enabled
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A retail chain has multiple stores, each with its own wireless controller. They are deploying ISE with four PSNs. They want to ensure that if one PSN fails, the other PSNs can take over the authentication load. Which configuration should they use?

   • AUse a load balancer to distribute traffic, but do not configure any failover on the controllers.
   • BConfigure all wireless controllers to use the same PSN as the primary RADIUS server.
   • CEnable the PAN to act as a backup RADIUS server for all PSNs.
   • DConfigure each wireless controller with a primary and secondary RADIUS server pointing to different PSNs.
   Reveal Solution Discussion Select an answer first