An engineer is adding a Cisco DUO solution to the current TACACS+ deployment using Cisco ISE. The engineer wants to authenticate users using their account when they log into network devices. Which action accomplishes this task?
A.
Configure Cisco DUO with the external Active Directory connector and tie it to the policy set within Cisco ISE.
B.
Install and configure the Cisco DUO Authentication Proxy and configure the identity source sequence within Cisco ISE.
C.
Modify the current policy with the condition MFA: SourceSequence:DUO=true in the authorization conditions within Cisco ISE.
D.
Create an identity policy within Cisco ISE to send all authentication requests to Cisco DUO.
B is the correct answer. You would have to authenticate first successfully before DUO is triggered for MFA, DUO would not handle authentication directly.
Yes, B is correct.
Scheme & explanation:
https://community.cisco.com/t5/security-knowledge-base/duo-mfa-integration-with-ise-for-tacacs-device-administration/ta-p/3881767
DUO scheme:
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/214813-configure-duo-two-factor-authentication.html
A - "configure DUO external Active Directory connector + tie it to the policy set within Cisco ISE" - DUO uses own Authentication Proxy server, which connects to AD (not called "AD connector") and more importantly - it is impossible to configure ISE policy with DUO AD connector. Nonsense. In policy can be used only "AD connector", which is ISE connection to AD (i. e. AD Join Point) but it has nothing to do with DUO.
C - not existing condition in ISE
https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_segmentation.html#ID37
D - nonsense, ISE doesn't have any Identity Policy as I know (I also Googled it for sure)
This section is not available anymore. Please use the main Exam Page.350-701 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
nomanlands
Highly Voted 9 months, 3 weeks agoNikoNiko
9 months, 2 weeks agosis_net_sec
Most Recent 6 months, 1 week agowenorex222
10 months, 3 weeks ago