4.2 Cisco Switches and Cisco Wireless LAN Controllers for Network Access AAA with Cisco ISE CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A hospital is deploying 802.1X for wired nurse stations. Some legacy infusion pumps do not support 802.1X and must be allowed on the network without manual MAC configuration. The security team wants the switch to first attempt 802.1X, then fall back to MAB for non-responsive devices. Which configuration approach on the Cisco switch meets this requirement?

   • AConfigure `authentication order dot1x mab` under the interface.
   • BConfigure `authentication port-control auto` and rely on the default order.
   • CUse `authentication event fail action next-method` to force fallback.
   • DConfigure `authentication priority dot1x mab` under the interface.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company wants to provide guest access on a wired switch port. Guests should be redirected to a web portal for terms acceptance, and after acceptance, they should only have internet access. The switch is already configured for 802.1X for employees. What is the best way to handle guests on the same switch?

   • AUse MAB for guests and then redirect to CWA.
   • BConfigure the port for CWA as a fallback after 802.1X fails.
   • CDisable 802.1X on the port and use only CWA.
   • DConfigure a separate VLAN for guests and use CWA on that VLAN.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A large enterprise has multiple Cisco switches and WLCs integrated with ISE. They recently changed the RADIUS shared secret on ISE for all network devices. After the change, some switches still authenticate successfully, but others fail. The ISE live logs show 'RADIUS shared secret mismatch' for the failing devices. What is the most efficient way to resolve this?

   • AUse ISE's 'Network Device' page to verify the shared secret and then update the switches via a script.
   • BUpdate the shared secret on each failing switch manually.
   • CUse the ISE 'Test' button on the network device page to verify the shared secret, then update the switches accordingly.
   • DCheck if the failing switches have the correct ISE IP address.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a mixed wired/wireless environment. They want to enforce a policy where employees get full access, contractors get internet-only, and guests get web-only. They are using ISE with dACLs. However, the dACL for contractors is not being applied on the switch, and they are getting full access. The ISE live logs show that the dACL was sent. What is the most likely cause?

   • AThe dACL name in ISE does not match the ACL name on the switch.
   • BThe switch's RADIUS attributes are not configured to accept dACLs.
   • CThe dACL is being overridden by a local ACL on the interface.
   • DThe switch does not support downloadable ACLs.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A wireless network uses WLCs with ISE for 802.1X. They are adding a new SSID for IoT devices that only support WPA2-PSK. The security team wants these devices to be authenticated via MAB after the PSK association, and they want to enforce a dACL for these devices. What is the best configuration on the WLC?

   • AConfigure the WLAN for 802.1X and use a pre-shared key for the IoT devices.
   • BUse the same SSID with 802.1X and enable MAB as fallback.
   • CCreate a new SSID with WPA2-PSK and enable MAC filtering with RADIUS authentication.
   • DUse Central Web Authentication for the IoT devices.
   Reveal Solution Discussion Select an answer first