QUESTION: 105

An organization has a SGACL locally configured on a switch port, but when a user in the Executives group connects to the network, they receive a different level of network access than expected.
When Cisco ISE pushes SGACLs to the switch after the authorization phase, how does the switch decide which access to grant the user?

Dynamically downloaded policies override local policies in all cases.
Local policies override dynamically downloaded policies in all cases.
The policies are merged, but local policies receive priority.
The policies are merged, but dynamically downloaded policies receive priority.

Answer(s): A

Reveal Solution Next Question

QUESTION: 106

An administrator is configuring an AD domain to be used with authentication for endpoints and users within Cisco ISE.
Which two steps are required to configure this to be used as an external identity store? (Choose two.)

Add an Authentication Joint Point.
Configure Authentication Domains.
Configure Active Directory Schema.
Configure Active Directory Domains.
Add an Active Directory Join Point.

Answer(s): D,E

Reveal Solution Next Question

QUESTION: 107

An engineer is configuring Central Web Authentication in Cisco ISE to provide guest access.
When an authentication rule is configured in the Default Policy Set for the Wired_MAB or Wireless_MAB conditions, what must be selected for the “if user not found” setting?

ACCEPT
DROP
REJECT
CONTINUE

Answer(s): D

Explanation:

Selecting CONTINUE as the "if user not found" setting means that if the user is not found or authenticated by the MAB (MAC Authentication Bypass) process, the authentication flow will continue to the next rule or policy in the sequence. This allows for further authentication methods or conditions to be evaluated, such as web authentication for guest access.
The other options, ACCEPT (option A), DROP (option B), and REJECT (option C), do not provide the desired behavior in this context. ACCEPT would immediately grant access, which is not appropriate if the user is not found. DROP would block or terminate the connection, and REJECT would reject the connection outright. Both DROP and REJECT options would prevent further evaluation of subsequent rules or policies, potentially denying guest access. Therefore, the correct choice is CONTINUE to allow the authentication flow to proceed.

Reveal Solution Next Question