4.14 Identity Mapping on Cisco ASA, Cisco ISE, Cisco WSA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company uses Cisco ASA firewalls at branch offices. They want to enforce different access policies based on Active Directory group membership, but they do not have Cisco ISE deployed. The ASA must obtain user identity directly from Active Directory. Which configuration approach should the administrator use on the ASA?

   • ADeploy Cisco ISE as a standalone identity source and configure the ASA to query ISE via RADIUS.
   • BConfigure LDAP attribute mapping on the ASA to pull group membership from Active Directory.
   • CConfigure the ASA to use MAC address authentication to identify users.
   • DUse the ASA's built-in user-identity feature with Active Directory agent or LDAP to map IP addresses to usernames.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security administrator is explaining identity mapping to a junior engineer. The company uses both Cisco ASA and FTD. Which statement correctly describes the fundamental purpose of identity mapping on these devices?

   • AIdentity mapping replaces authentication by allowing users to access the network without credentials.
   • BIdentity mapping is used to encrypt user traffic.
   • CIdentity mapping correlates IP addresses with usernames to enable user-based policies.
   • DIdentity mapping is only applicable to wireless networks.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An organization uses Cisco ASA for remote access VPN. They want to enforce different security policies based on the user's Active Directory group. The ASA is already configured for AAA authentication via RADIUS. What is the best way to incorporate AD group information into the ASA's access policies?

   • AConfigure the ASA to use the local database for group membership.
   • BCreate separate VPN group policies for each AD group and assign users manually.
   • CUse RADIUS attributes to return AD group membership to the ASA.
   • DUse LDAP attribute mapping on the ASA to map AD groups.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is deploying Cisco ISE to provide identity mapping for their network. They have a mix of wired and wireless users. The goal is to enforce consistent access policies based on user identity across all network devices. Which ISE component is responsible for collecting user identity information from the network?

   • AISE Monitoring Node
   • BISE Identity Services Engine (ISE) itself with passive identity and RADIUS
   • CISE Administration Node
   • DISE Policy Service Node (PSN)
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company uses Cisco WSA for web filtering. They have users in multiple AD domains and want to apply different policies based on group membership. The WSA is integrated with AD via the AD agent. However, users from a child domain are not being mapped correctly. What is the most likely cause?

   • AThe AD agent is not configured to query the child domain.
   • BThe WSA does not support multiple domains.
   • CThe users are using a different browser.
   • DThe WSA is not using the correct identity policy.
   Reveal Solution Discussion Select an answer first