Refer to the exhibit. An engineer must implement a remote access VPN solution that provides user and device verification. The company uses Active Directory for user authentication and ID…

Question

Exhibit

Options

• Aldap-attribute-map PolicyAllow
• Bwebvpn authorize-device
• Cauthentication mfa
• Dauthentication aaa certificate

• A
  3% (1)
• B
  91% (29)
• D
  6% (2)

Explanation

webvpn authorize-device is the correct command because it explicitly enforces device authorization within the WebVPN tunnel-group, requiring a valid device identity certificate before a session is permitted - closing the gap where users could previously connect with credentials alone. This directly targets the device verification requirement while preserving the existing AD-based user authentication.

Why the distractors are wrong:

• A (ldap-attribute-map PolicyAllow) - LDAP attribute maps translate Active Directory attributes into ASA group-policy assignments; they control authorization policies, not device certificate verification.
• C (authentication mfa) - MFA adds a second factor to user authentication (e.g., OTP or push notification); it does nothing to verify the device's identity certificate.
• D (authentication aaa certificate) - While this command does combine AAA and certificate requirements, it applies to user certificate authentication, not dedicated device-identity verification. The scenario specifically calls for device identity via ID certificates as a separate check from user credentials.

Memory tip: The word "device" is right in the command - authorize-**device**. On the exam, if the question asks about verifying device identity, look for the word "device" in the answer. Any command scoped to aaa, ldap, or mfa is operating on the user plane, not the device plane.

No community discussion yet for this question.