nerdexam
Cisco

300-715 · Question #282

A Cisco ISE engineer is creating certificate authentication profile to be used with machine authentication for the network. The engineer wants to be able to compare the user-presented certificate…

The correct answer is D. Enable the option for performing binary comparison. To compare a user-presented machine certificate with a certificate stored in Active Directory, the engineer must enable the option for performing binary comparison within the certificate authentication profile in Cisco ISE.

Policy Enforcement

Question

A Cisco ISE engineer is creating certificate authentication profile to be used with machine authentication for the network. The engineer wants to be able to compare the user-presented certificate with a certificate stored in Active Directory. What must be done to accomplish this?

Options

  • AAdd the subject alternative name and the common name to the CAP
  • BUse MS-CHAPv2 since it provides machine credentials and matches them to credentials stored in
  • CConfigure the user-presented password hash and a hash stored in Active Directory for
  • DEnable the option for performing binary comparison.

How the community answered

(25 responses)
  • A
    16% (4)
  • B
    8% (2)
  • C
    4% (1)
  • D
    72% (18)

Why each option

To compare a user-presented machine certificate with a certificate stored in Active Directory, the engineer must enable the option for performing binary comparison within the certificate authentication profile in Cisco ISE.

AAdd the subject alternative name and the common name to the CAP

Adding SAN and CN specifies which fields to extract from the certificate, but it does not enable the mechanism for comparing the entire certificate with an AD-stored one.

BUse MS-CHAPv2 since it provides machine credentials and matches them to credentials stored in

MS-CHAPv2 is a password-based authentication protocol and is not used for comparing certificates stored in Active Directory for machine authentication.

CConfigure the user-presented password hash and a hash stored in Active Directory for

Configuring a password hash comparison is irrelevant for certificate-based authentication, which relies on public key cryptography, not shared secrets or password hashes.

DEnable the option for performing binary comparison.Correct

When using certificate authentication, Cisco ISE can be configured to perform a binary comparison of the client certificate's content against a certificate stored in Active Directory. This option ensures a precise match between the presented certificate and the one registered in AD for machine authentication.

Concept tested: Cisco ISE certificate binary comparison with Active Directory

Source: https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ISE_admin_guide_27/b_ISE_admin_guide_27_chapter_0100.html#concept_09F3971F277B41B79555C08933279140

Topics

#Certificate Authentication#Machine Authentication#Active Directory Integration#Binary Comparison

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-715 Practice