4.16 Integration of Cisco ISE with Multifactor Authentication CCIE-SECURITY Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following best describes the role of Cisco ISE in a multifactor authentication (MFA) deployment?

   • AISE acts as a policy decision point that enforces MFA by integrating with external MFA providers.
   • BISE only supports MFA for VPN access and cannot be used for other network access scenarios.
   • CISE acts as the MFA server that generates and validates one-time passwords.
   • DISE replaces the need for an external MFA server by using its internal certificate store for all MFA challenges.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In a Cisco ISE MFA deployment model, which component is typically responsible for presenting the authentication prompt to the end user and collecting the second factor?

   • AIdentity Services Engine (ISE) Policy Service Node
   • BCisco ISE pxGrid client
   • CExternal MFA server (e.g., RSA SecurID or Duo)
   • DNetwork Access Device (NAD) such as a switch or wireless LAN controller
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Cisco ISE MFA deployment model uses a RADIUS proxy to forward authentication requests to an external MFA server, without requiring the end user to interact with a separate portal?

   • ADevice administration model
   • BInline posture
   • CRADIUS proxy model
   • DExternal identity source model
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a Cisco ISE MFA deployment using an external MFA server, which protocol is commonly used between ISE and the MFA server to validate the second factor?

   • ATACACS+
   • BLDAP
   • CRADIUS
   • DSNMP
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a Cisco ISE MFA authentication flow, what is the typical sequence after the user submits their primary credentials?

   • AISE sends the user's credentials to a third-party identity provider for authorization, but no authentication is performed.
   • BISE validates the primary credentials and then triggers a secondary authentication factor, such as a one-time password (OTP) or push notification.
   • CThe user is immediately granted access without further checks.
   • DISE only checks the user's certificate and skips password validation.
   Reveal Solution Discussion Select an answer first