4.14 Identity Mapping on Cisco ASA, Cisco ISE, Cisco WSA, and Cisco FTD CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An enterprise is deploying Cisco ISE to provide identity mapping for multiple network devices, including switches, wireless controllers, and firewalls. The goal is to have a single source of truth for user identity and to enforce consistent access policies. Which ISE feature should be used to distribute identity information to these devices?

   • AISE as an identity source with device-specific identity mapping protocols (e.g., RADIUS, TACACS+, and passive identity)
   • BISE RADIUS authentication
   • CISE pxGrid
   • DISE Security Group Access (SGA)
   Reveal Solution Discussion Select an answer first
2. 42expert · hard · select all that apply

   A security architect is comparing identity mapping implementations across Cisco ASA, ISE, WSA, and FTD. Which of the following statements are correct? (Select all that apply.)

   • AASA can use LDAP attribute maps to map AD groups to local groups.
   • BWSA can use AD agent for transparent identity mapping.
   • CAll four platforms use the same identity mapping configuration method.
   • DFTD requires ISE for identity mapping.
   • EISE can provide identity mapping to multiple device types via pxGrid.
   Check answers Discussion Select an answer first
4. 43application · medium

   A company uses Cisco WSA to enforce web filtering policies. They want to apply different policies based on the user's Active Directory group membership, but they do not have a separate identity service. The WSA should directly integrate with Active Directory to map users to IP addresses. Which configuration is required on the WSA?

   • AConfigure WSA to use LDAP authentication for proxy authentication.
   • BConfigure the WSA to use RADIUS for user authentication.
   • CUse the WSA's built-in Active Directory integration to map IP addresses to usernames via the AD agent.
   • DEnable the WSA's Identity Services Engine (ISE) integration.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A network administrator is configuring a Cisco Firepower Threat Defense (FTD) device for user-aware access control. The FTD is managed by Firepower Management Center (FMC). The organization uses Active Directory for user identity. Which method should the administrator use to enable identity mapping on the FTD?

   • AConfigure an Active Directory realm in FMC and use it for identity policy.
   • BConfigure the FTD to use RADIUS authentication for user login.
   • CDeploy a separate identity agent on each FTD device.
   • DUse the FTD's local user database for identity mapping.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A large enterprise has a mixed environment with Cisco ASA and Cisco FTD devices. They are planning to implement identity mapping for user-based access control. The ASA devices are older and do not support the same identity features as FTD. The organization wants a consistent identity mapping approach across all devices without major hardware upgrades. Which strategy should they adopt?

   • AUse Cisco ISE as a central identity source and integrate both ASA and FTD with ISE.
   • BConfigure each device independently with its own AD integration.
   • CUse only local user accounts on each device.
   • DReplace all ASA devices with FTD to unify the platform.
   Reveal Solution Discussion Select an answer first