4.1 Cisco ISE Scalability Using Multiple Nodes and Personas CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   An organization has multiple PSNs and wants to ensure that authentication traffic is distributed based on the current load of each PSN. They are considering using a load balancer. What is the best practice for load balancing RADIUS traffic to PSNs?

   • AUse least-connections load balancing with RADIUS health checks
   • BUse source-IP affinity to ensure a user always hits the same PSN
   • CUse round-robin load balancing without health checks
   • DConfigure each network device to use a different PSN as the primary RADIUS server
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A network administrator is troubleshooting why a PSN is not receiving configuration updates from the PAN. The PSN is reachable via ping, and the admin console shows it as 'Registered'. What is the most likely cause?

   • AThe PSN is not configured with the correct persona
   • BThe secondary PAN is not synchronized
   • CThe MNT node is down
   • DThe PSN's clock is not synchronized with the PAN
   Reveal Solution Discussion Select an answer first
4. 43expert · hard · select all that apply

   A company is designing a distributed ISE deployment to support 100,000 users. They want to ensure high availability for all critical services. Which of the following best practices should they follow? (Select all that apply.)

   • ADeploy a secondary MNT node to ensure monitoring data is not lost
   • BDeploy a secondary PAN to provide administrative failover
   • CEnable pxGrid on all nodes to ensure context sharing is always available
   • DUse a single PSN to simplify management
   • EDeploy multiple PSNs to distribute authentication load
   Check answers Discussion Select an answer first
5. 44application · medium

   A university has three PSNs in a distributed ISE deployment. They want to ensure that authentication requests from wireless controllers are evenly distributed across all PSNs and that if one PSN fails, the others take over. What is the best approach?

   • AEnable PAN failover and let the PAN handle authentication when a PSN fails
   • BConfigure each wireless controller to use a different PSN as the primary RADIUS server
   • CUse a load balancer in front of the PSNs to distribute RADIUS traffic and perform health checks
   • DConfigure all wireless controllers to use only one PSN as the RADIUS server
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A large enterprise is experiencing authentication delays during peak hours. They have a distributed ISE deployment with 5 PSNs and a load balancer. The load balancer is configured for round-robin. What is the most likely cause of the delays?

   • AThe MNT node is not collecting logs fast enough
   • BThe load balancer is not performing health checks, so a failed PSN is still receiving traffic
   • CThe PAN is overloaded with authentication requests
   • DThe secondary PAN is not synchronized
   Reveal Solution Discussion Select an answer first