4.14 Identity Mapping on Cisco ASA, Cisco ISE, Cisco WSA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company uses Cisco WSA to control web access. They have a requirement to block file-sharing sites for all users except the 'Engineering' AD group. The WSA is already integrated with AD. What is the most effective way to implement this?

   • ACreate an access policy for the Engineering group that allows file-sharing, and a default policy that blocks it for everyone else.
   • BUse URL filtering to block file-sharing sites globally and then use a separate proxy for Engineering.
   • CDisable authentication and use IP-based rules to allow Engineering users.
   • DCreate a single policy that blocks file-sharing for all users, and then manually add exceptions for Engineering users.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is consolidating its security infrastructure. They currently have a Cisco ASA running as a firewall and VPN concentrator, and they are planning to replace it with Cisco FTD. They also use Cisco ISE for network access control. The security team wants to maintain user-based access control for both VPN and firewall traffic. They have a limited budget and want to minimize changes to their existing ISE deployment. Which approach best meets these requirements?

   • AMigrate VPN to FTD and use ISE as the identity source for both firewall and VPN policies.
   • BUse the ASA's built-in AD integration for VPN and FTD's direct AD integration for firewall, bypassing ISE.
   • CKeep the ASA for VPN and use FTD for firewall, integrating both with ISE via pxGrid.
   • DDeploy a separate identity mapping solution for each device to avoid dependency on ISE.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A Cisco ASA is configured with identity mapping using Active Directory. The security team notices that some users are not being mapped to the correct AD groups, causing access issues. They have verified that the ASA can reach the AD server and authentication works. What is the most likely cause of the incorrect group mapping?

   • AThe LDAP attribute map is not configured correctly, or the AD group names do not match the local ASA group names.
   • BThe users are not members of the AD groups in Active Directory.
   • CThe ASA's user-identity feature is disabled.
   • DThe ASA is using the wrong AD server for authentication.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company uses Cisco ISE for network access control and has a Cisco FTD firewall. They want to enforce user-based policies on the FTD based on AD groups. They have integrated ISE with FMC via pxGrid. However, the FTD is not receiving identity updates for some users. The ISE shows the users are authenticated and assigned to the correct identity group. What is the most likely issue?

   • AThe FTD is not subscribed to the correct ISE topic in pxGrid.
   • BThe users are not in the correct AD group.
   • CThe ISE is not sending RADIUS accounting to FTD.
   • DThe FTD is not configured with an identity policy.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A Cisco WSA is configured to use Active Directory for authentication. The security team wants to apply different web filtering policies based on AD group membership. They have created the policies, but some users are being matched to the wrong policy. They have verified that the users are in the correct AD groups. What is the most likely cause?

   • AThe WSA is using the wrong AD server.
   • BThe access policies are in the wrong order.
   • CThe users are accessing the web through a proxy that bypasses the WSA.
   • DThe WSA's identity mapping is not correctly mapping users to their AD groups.
   Reveal Solution Discussion Select an answer first