4.2 Cisco Switches and Cisco Wireless LAN Controllers for Network Access AAA with Cisco ISE CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A switch is configured for 802.1X with ISE. The administrator notices that some users are getting the wrong VLAN assigned. The ISE policy is correct, and the RADIUS attributes are being sent. What could be the issue on the switch?

   • AThe VLAN does not exist on the switch.
   • BThe switch port is in trunk mode.
   • CThe RADIUS server is sending the wrong VLAN ID.
   • DThe switch is not configured to accept VLAN assignment from RADIUS.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is implementing CWA on their switches. They have a mix of Windows and macOS clients. After CWA redirect, some clients are not redirected to the portal, but instead get an error page. The ISE logs show that the client was successfully authenticated via MAB, but the redirect URL is not being sent. What is the most likely cause?

   • AThe client's browser is blocking the redirect.
   • BThe switch is not configured to support CWA (e.g., missing `ip http server` or `ip radius source-interface`).
   • CThe client is using a static IP address.
   • DThe switch is not configured with the correct ISE URL for CWA.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A network admin is troubleshooting missing accounting records in ISE for a switch. The switch is sending authentication requests successfully, but no accounting records are appearing. The admin has verified that `aaa accounting dot1x default start-stop group radius` is configured. What else should be checked?

   • ACheck if the switch is using TACACS+ for accounting.
   • BVerify that the client is using 802.1X and not MAB.
   • CEnsure the switch has a route to the ISE server.
   • DEnsure the switch's RADIUS server is configured for accounting (port 1813).
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security architect is designing AAA for a new network. They want to use RADIUS for network access and TACACS+ for device administration. They also want to ensure that if the TACACS+ server is unreachable, the switch still allows local fallback for management. What should be configured?

   • AUse RADIUS for both network access and management.
   • BSet the TACACS+ server as the only method and rely on it being always available.
   • CConfigure the switch to use TACACS+ only for authentication and not authorization.
   • DConfigure `aaa authentication login default group tacacs+ local` and `aaa authorization exec default group tacacs+ local`
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A university is adding a new building with Cisco switches to their existing Cisco ISE deployment. The network team has configured RADIUS on the switches, but authentication fails. The ISE live logs show 'No matching network device found'. What is the most likely cause and fix?

   • AThe RADIUS shared secret on the switch does not match the one configured in ISE.
   • BThe switch's IP address is not added as a network device in ISE.
   • CThe RADIUS accounting port is blocked by a firewall.
   • DThe switch is not configured with the correct RADIUS server IP address.
   Reveal Solution Discussion Select an answer first