300-715 · Question #257
An engineer is testing low-impact mode for a phased deployment of Cisco ISE. Which type of traffic is denied when a host tries to connect to the network prior to authentication?
The correct answer is D. HTTP. In Cisco ISE's low-impact deployment mode, general user traffic like HTTP is typically denied before successful authentication, while essential network services remain accessible.
Question
An engineer is testing low-impact mode for a phased deployment of Cisco ISE. Which type of traffic is denied when a host tries to connect to the network prior to authentication?
Options
- ADNS
- BEAP
- CDHCP
- DHTTP
How the community answered
(26 responses)- B8% (2)
- C4% (1)
- D88% (23)
Why each option
In Cisco ISE's low-impact deployment mode, general user traffic like HTTP is typically denied before successful authentication, while essential network services remain accessible.
DNS traffic is usually permitted in low-impact mode to allow endpoints to resolve authentication servers and other necessary services.
EAP (Extensible Authentication Protocol) traffic is fundamental for 802.1X authentication and must be allowed for endpoints to even attempt to authenticate.
DHCP traffic is essential for endpoints to obtain an IP address and network configuration, so it is typically allowed in low-impact mode.
Cisco ISE's low-impact mode is designed to allow critical network services such as DNS, DHCP, and EAP to function for endpoint reachability and authentication purposes, but it denies general application traffic like HTTP until the endpoint successfully authenticates. This design allows endpoints to obtain an IP address and attempt authentication without full network access.
Concept tested: Cisco ISE low-impact mode traffic restrictions
Source: https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_admin_guide_27/b_ise_admin_guide_27_chapter_01100.html#concept_AC4E8D725E5048AE8180E45494161C02
Topics
Community Discussion
No community discussion yet for this question.