4.2 Cisco Switches and Cisco Wireless LAN Controllers for Network Access AAA with Cisco ISE CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's wireless network uses Cisco WLCs with ISE for 802.1X authentication. They now need to support a legacy barcode scanner that does not support 802.1X. The scanner must be authenticated via MAB, and all wireless client sessions must be reported to ISE for auditing. What should the administrator configure on the WLC?

   • AUse Central Web Authentication (CWA) for the scanner instead of MAB.
   • BSet the WLAN's Layer 2 security to 'WPA2+802.1X' and add the scanner's MAC to the local MAC filter list.
   • CConfigure the WLAN for 'MAC Filtering' and point the authentication server to ISE.
   • DEnable AAA override and configure the WLAN for MAC filtering.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A hotel offers guest Wi-Fi. When a guest connects, they should be redirected to a captive portal hosted by ISE for social login. After successful authentication, the guest should only have internet access, not access to the internal network. Which configuration on the WLC and switch is appropriate?

   • AEnable MAB for all guests and skip the portal.
   • BConfigure the WLAN for Central Web Authentication (CWA) and use a dACL from ISE to restrict access.
   • CConfigure a local VLAN on the switch for guests and use no authentication.
   • DUse 802.1X with PEAP for guest authentication.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A corporation needs to track user login/logout times and data usage for compliance. They have Cisco switches using ISE for 802.1X. The security team notices that ISE reports are missing session start/stop records. What should be verified on the switch configuration?

   • AVerify that the switch has a route to the ISE server.
   • BCheck that the shared secret is correct.
   • CEnsure `aaa accounting dot1x default start-stop group radius` is configured.
   • DConfirm that the switch port is in access mode.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A switch is configured for 802.1X with ISE, but clients fail authentication. The ISE live logs show 'Authentication failed' with reason 'User not found'. The client is using the correct credentials. What is the most likely issue?

   • AThe client's certificate is expired.
   • BThe RADIUS shared secret is incorrect.
   • CThe switch is sending the wrong username to ISE.
   • DThe switch is not configured with the correct ISE IP address.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An enterprise wants to enforce different access policies for employees and contractors on the same wired switch. Employees should get full access, while contractors should only access the internet. They are using 802.1X with ISE. Which mechanism should be used to dynamically apply the correct access policy?

   • AConfigure static ACLs on the switch for each port.
   • BUse MAC authentication bypass with different MAC addresses.
   • CUse RADIUS attributes to assign a VLAN per user group.
   • DUse downloadable ACLs (dACLs) returned by ISE.
   Reveal Solution Discussion Select an answer first