4.14 Identity Mapping on Cisco ASA, Cisco ISE, Cisco WSA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a common method for Cisco WSA to obtain user identity information?

   • AAnalyzing DNS queries to determine usernames.
   • BUsing SNMP to query user information from switches.
   • CIntegrating with Active Directory via LDAP or Kerberos.
   • DReading the User-Agent header in HTTP requests.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   On Cisco FTD, what is required to enable identity mapping for user-aware access control?

   • AConfiguration of a VPN tunnel to the identity server.
   • BA local user database on the FTD device.
   • CEnabling the identity firewall feature in the FTD CLI.
   • DIntegration with an external identity source such as Active Directory or Cisco ISE.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company runs a Cisco ASA 5506-X as its internet gateway. They need to enforce different VPN access policies based on the Active Directory group membership of remote users. The ASA is already joined to the AD domain and can resolve user identities. Which configuration step is essential to enable user-based access control on the ASA?

   • ACreate an LDAP attribute map to map AD groups to local ASA user groups.
   • BEnable the 'identity' firewall feature and define a security policy that matches on the 'user' attribute.
   • CConfigure a AAA server group for AD and use the 'user-identity' feature to map authenticated users to AD groups.
   • DInstall the AnyConnect client on all remote users and configure dynamic access policies (DAP).
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network architect is choosing between Cisco ASA and Cisco WSA for a new branch office. The requirement is to enforce user-based web filtering and also provide VPN access. Which statement correctly compares the identity mapping capabilities of these two devices?

   • ANeither device can integrate with Active Directory.
   • BASA can do both VPN and web filtering, while WSA can only do web filtering.
   • CWSA can do VPN and web filtering, while ASA can only do firewall.
   • DBoth devices have identical identity mapping features.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company has deployed Cisco FTD in a high-availability pair. They want to enforce user-based access control using Active Directory. The FTDs are managed by FMC. What is the best practice for configuring identity mapping in this scenario?

   • AConfigure identity mapping on only one FTD and rely on failover.
   • BUse a RADIUS server to provide identity to both FTDs.
   • CConfigure the identity source on FMC and deploy the identity policy to both FTDs.
   • DConfigure identity mapping separately on each FTD via CLI.
   Reveal Solution Discussion Select an answer first