4.14 Identity Mapping on Cisco ASA, Cisco ISE, Cisco WSA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company has deployed Cisco FTD with identity mapping using Active Directory. They are experiencing performance issues on the FTD when many users are active. The security team suspects that the identity mapping is causing excessive LDAP queries. What is the best way to reduce the LDAP query load while maintaining accurate identity mapping?

   • AUse Cisco ISE as an identity source instead of direct AD integration.
   • BIncrease the number of LDAP servers in the identity source.
   • CIncrease the identity cache timeout on the FTD.
   • DDisable identity mapping for users who are not in any security group.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security architect is designing a solution for a multi-site company. They need to enforce user-based web filtering and firewall policies. They have a central Active Directory and want to minimize latency for identity lookups. Which design is most effective?

   • AUse a central AD server for all sites to ensure consistency.
   • BConfigure all devices to use a single RADIUS server for identity.
   • CUse Cisco ISE at each site to provide identity mapping.
   • DDeploy a local AD domain controller at each site and configure each device to use the local DC for identity mapping.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A university uses Cisco ISE to enforce network access control. They want to allow faculty members to access a research database only when they are on the campus network, while students are blocked. The ISE is integrated with Active Directory. Which ISE feature should be used to achieve this user-based access control?

   • ACreate a downloadable ACL (dACL) that is assigned based on the user's AD group membership.
   • BConfigure a RADIUS server group to forward authentication requests to AD and use the returned attributes.
   • CDefine an authorization profile that uses identity groups from AD and assign it to a policy set.
   • DEnable the 'identity mapping' feature on the network devices and point them to ISE.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company uses Cisco WSA to filter web traffic. They want to block social media sites for employees in the 'Marketing' AD group but allow them for the 'Social Media Team' group. The WSA is already integrated with Active Directory. What is the most efficient way to apply these user-based policies?

   • AUse the WSA's 'identity mapping' feature to map IP addresses to usernames and then apply a global policy.
   • BConfigure a single access policy that applies to all users and use URL filtering to block social media for everyone.
   • CEnable Active Directory authentication on the WSA and use the 'user' field in the access policy.
   • DCreate two separate access policies: one for the Marketing group and one for the Social Media Team, each with appropriate URL filtering settings.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is migrating from Cisco ASA to Cisco Firepower Threat Defense (FTD) for their perimeter firewall. They need to enforce user-based access control based on Active Directory groups. The FTD is managed by FMC. What is the required configuration on FMC to enable identity-based policies?

   • ACreate an identity source (e.g., AD) and add it to an identity policy, then use identity-based access control rules.
   • BUse the FTD's built-in user database to create local users and assign them to groups.
   • CConfigure the FTD to use RADIUS for authentication and then use the returned user attributes in access rules.
   • DEnable the 'identity firewall' feature on the FTD and use the 'user' object in access rules.
   Reveal Solution Discussion Select an answer first