4.14 Identity Mapping on Cisco ASA, Cisco ISE, Cisco WSA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A network administrator is configuring Cisco FTD for user-aware access control. They have already configured an Active Directory realm in FMC. What additional step is required to enable identity mapping on the FTD?

   • ACreate an identity policy in FMC and assign it to the FTD.
   • BInstall a separate identity agent on the FTD.
   • CEnable the FTD's local user authentication.
   • DConfigure the FTD to use RADIUS for device administration.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard · select all that apply

   A large enterprise is evaluating identity mapping solutions across Cisco ASA, ISE, and FTD. They want to implement a solution that provides centralized identity management and consistent policy enforcement. Which of the following statements are true regarding identity mapping on these platforms? (Select all that apply.)

   • AFTD requires ISE for identity mapping.
   • BASA and FTD can both use Active Directory directly for identity mapping without ISE.
   • CWSA can use ISE for identity mapping, but it cannot use AD directly.
   • DASA and FTD have identical identity mapping configuration methods.
   • ECisco ISE can serve as a central identity source for both ASA and FTD.
   Check answers Discussion Select an answer first
4. 38application · medium

   A security team is designing a user-based access control strategy. They have both Cisco ASA and FTD devices. They want to ensure that user identity is consistently available across all devices. Which approach best achieves this goal?

   • AUse MAC address-based identification.
   • BUse only local user accounts on each device.
   • CUse a centralized identity source like Cisco ISE to distribute identity to all devices.
   • DConfigure each device with its own AD integration.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company uses Cisco WSA for web filtering. They want to apply different policies for users based on their Active Directory group membership. The WSA is integrated with AD via the AD agent. Which WSA feature is used to map users to policies?

   • ADecryption policies
   • BRouting policies
   • CAccess policies
   • DIdentity policies
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company has deployed Cisco FTD and is using FMC for management. They have configured an AD realm and an identity policy. However, user-based access control is not working for users who authenticate via a VPN. What is the most likely cause?

   • AThe FTD does not support identity mapping for VPN users.
   • BThe user's browser is not sending the correct credentials.
   • CThe VPN traffic is not being inspected by the identity policy.
   • DThe AD realm is not configured correctly.
   Reveal Solution Discussion Select an answer first