4.14 Identity Mapping on Cisco ASA, Cisco ISE, Cisco WSA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   An administrator needs to configure identity mapping on a Cisco ASA to enforce different access rules for users in the 'Engineering' and 'Sales' AD groups. The ASA is already integrated with Active Directory via LDAP. What additional configuration is required on the ASA to use group membership in access control lists?

   • ACreate a local user account for each AD user on the ASA.
   • BEnable the ASA's user-identity feature and set the default group to 'Engineering'.
   • CDefine an LDAP attribute map to map AD groups to ASA local group names.
   • DConfigure the ASA to use RADIUS for authentication.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company has deployed Cisco ISE for identity mapping. They have multiple network devices, including switches, wireless controllers, and firewalls. The security team wants to enforce policies based on user identity and also share identity information with other security tools like Cisco WSA and Firepower. Which ISE feature should be used to share identity context with these external systems?

   • AISE TACACS+
   • BISE pxGrid
   • CISE RADIUS accounting
   • DISE NetFlow
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A school district uses Cisco WSA for web filtering. They need to apply different filtering policies for students and teachers based on Active Directory group membership. The WSA is already integrated with AD via the AD agent. What must be configured on the WSA to use group membership in web filtering policies?

   • AConfigure the WSA to use LDAP authentication for proxy authentication.
   • BEnable the WSA's HTTPS proxy to decrypt traffic for user identification.
   • CCreate identity policies that match on AD groups and assign them to the appropriate access policies.
   • DUse the WSA's local user database to define groups.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company is deploying Cisco FTD for user-aware access control. They have a complex Active Directory environment with multiple domains and trusts. The FMC is configured with an AD realm, but user identity mapping is not working for users from a trusted domain. What is the most likely cause and solution?

   • AThe AD realm is not configured to include trusted domains; add the trusted domain to the realm.
   • BThe user's browser is not sending the correct credentials; enable NTLM authentication.
   • CThe FTD is not using the correct identity source; reconfigure the identity policy.
   • DThe FTD does not support multiple domains; use a separate FTD for each domain.
   Reveal Solution Discussion Select an answer first