300-715 · Question #263
An engineer is deploying Cisco ISE to use 802.1X authentication for controlling access to the company's wired network. The request from company management is to minimize the impact on users during the
The correct answer is A. Monitor. To minimize user impact during a phased 802.1X deployment with Cisco ISE, the Monitor mode should be used first, as it allows network access while collecting authentication data for analysis without enforcing policies.
Question
An engineer is deploying Cisco ISE to use 802.1X authentication for controlling access to the company's wired network. The request from company management is to minimize the impact on users during the rollout of 802.1X on the company switches. Which mode must be used first in a phased 802.1X deployment to fulfill this request?
Options
- AMonitor
- BOpen
- CLow-impact
- DClosed
How the community answered
(39 responses)- A95% (37)
- C3% (1)
- D3% (1)
Why each option
To minimize user impact during a phased 802.1X deployment with Cisco ISE, the Monitor mode should be used first, as it allows network access while collecting authentication data for analysis without enforcing policies.
To minimize the impact on users during the initial rollout of 802.1X, the Monitor mode should be used first. In Monitor mode, all network access is permitted without enforcement, allowing the administrator to gather extensive authentication and authorization data, identify potential issues, and refine policies without disrupting user connectivity.
Open mode permits access for all devices by default and allows 802.1X authentication to proceed, but it doesn't offer the same level of passive data collection and policy testing as Monitor mode without enforcing rules.
Low-impact mode restricts general user traffic before authentication, which would cause significant impact and interruption for users during an initial rollout, contrary to the requirement.
Closed mode strictly denies all network access until successful 802.1X authentication, leading to maximum user impact and is unsuitable for a phased rollout aiming to minimize disruption.
Concept tested: Cisco ISE 802.1X deployment modes
Source: https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_admin_guide_27/b_ise_admin_guide_27_chapter_01100.html#concept_AC4E8D725E5048AE8180E45494161C02
Topics
Community Discussion
No community discussion yet for this question.