4.14 Identity Mapping on Cisco ASA, Cisco ISE, Cisco WSA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A network engineer is comparing identity mapping capabilities between Cisco ASA and Cisco FTD for a new deployment. The company requires integration with Cisco ISE for centralized policy management. Which statement accurately describes a key difference between ASA and FTD in this context?

   • AASA can use ISE for identity mapping, but FTD cannot.
   • BASA supports identity mapping only with local AD, while FTD supports only ISE.
   • CFTD requires a separate identity firewall module, while ASA has it built-in.
   • DFTD uses FMC for identity policy configuration, while ASA uses CLI or ASDM.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security administrator is designing a solution to enforce user-based web filtering and network access control across multiple devices. They want to use a single identity source to avoid duplicate user databases. Which approach best leverages identity mapping to achieve this?

   • AUse Active Directory as the identity source and integrate it with Cisco ISE, which then provides identity to ASA, WSA, and FTD.
   • BConfigure each device (ASA, WSA, FTD) to directly query Active Directory independently.
   • CUse a RADIUS server as the identity source and have all devices authenticate against it.
   • DCreate local user accounts on each device and synchronize them manually.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company uses Cisco WSA for web security. They have a mix of authenticated users (via AD) and unauthenticated guest users. They want to apply a stricter web filter for guests. What is the best way to achieve this using identity mapping?

   • AApply a single policy to all traffic and rely on the URL filter to block inappropriate content.
   • BUse the WSA's 'identity mapping' feature to assign all users to the same group.
   • CDisable authentication and use IP-based policies.
   • DCreate an access policy for 'Authenticated Users' and another for 'Guest Users' (unauthenticated).
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A Cisco ASA is used as a VPN concentrator. The security team wants to restrict access to internal servers based on the user's AD group. They have configured AAA authentication against AD. What additional configuration is needed on the ASA to use AD group membership in access rules?

   • AUse the 'aaa-server' command to specify the AD server and then use the 'user' keyword in access rules.
   • BCreate a dynamic access policy (DAP) that references AD groups.
   • CEnable the 'user-identity' feature and configure the ASA to query AD for group membership.
   • DConfigure an LDAP attribute map to map AD groups to local ASA user groups.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company uses Cisco ISE to enforce access control on their wired network. They also have a Cisco FTD firewall. They want the FTD to use ISE for identity mapping so that firewall rules can be user-based. Which integration method is appropriate?

   • AUse ISE as an identity source in FMC and enable the ISE/pxGrid integration.
   • BConfigure FTD to query AD directly for user identity.
   • CConfigure ISE as a RADIUS server and have FTD authenticate users via RADIUS.
   • DUse ISE to send syslog messages to FTD with user identity information.
   Reveal Solution Discussion Select an answer first