Implementing and Configuring Cisco Identity Services Engine (300-715 SISE) Exam Question & Answer: Traffic is denied when a host tries to connect

Question

An engineer is testing low-impact mode for a phased deployment of Cisco ISE. Which type of traffic is denied when a host tries to connect to the network prior to authentication?

A. DNS
B. EAP
C. DHCP
D. HTTP

Answer

D. HTTP

Explanation 1

When an engineer is testing low-impact mode for a phased deployment of Cisco ISE, the type of traffic that is denied when a host tries to connect to the network prior to authentication is HTTP.

Explanation 2

Answer: D. HTTP

Explanation: Low-impact mode is a variation of open mode that allows network access before authentication, but with some restrictions. In low-impact mode, the switch port is configured with an ACL that permits only certain types of traffic, such as DNS, DHCP, and EAP, before authentication. All other traffic is denied until the host is authenticated by Cisco ISE. This allows the host to obtain an IP address and communicate with the ISE server, but prevents unauthorized access to other network resources. HTTP traffic is one of the types of traffic that is denied by default in low-impact mode, unless it is explicitly allowed by the ACL.

Explanation 3

The question you asked is about how to test low-impact mode for a phased deployment of Cisco ISE. Low-impact mode is a deployment mode that allows you to gradually transition from an open network to a closed network by enforcing authentication and authorization policies on network devices. In low-impact mode, users are allowed to access the network before authentication but only certain types of traffic are permitted.

The type of traffic that is denied when a host tries to connect to the network prior to authentication in low-impact mode is D. HTTP. HTTP stands for Hypertext Transfer Protocol and it is a protocol that is used for accessing web pages or web applications on the internet. HTTP traffic is denied in low-impact mode because it may contain sensitive or malicious data that could compromise the security or performance of the network. HTTP traffic is also denied in low-impact mode because it can be used to redirect users to a web portal for authentication or notification purposes.

The other options are not correct because:

A. DNS: This is a type of traffic that is allowed in low-impact mode before authentication. DNS stands for Domain Name System and it is a service that translates domain names into IP addresses. DNS traffic is allowed in low-impact mode because it is required for resolving host names and accessing network resources.

B. EAP: This is a type of traffic that is allowed in low-impact mode before authentication. EAP stands for Extensible Authentication Protocol and it is a framework that provides various methods for authenticating users or devices on a network. EAP traffic is allowed in low-impact mode because it is used for performing authentication and authorization processes.

C. DHCP: This is a type of traffic that is allowed in low-impact mode before authentication. DHCP stands for Dynamic Host Configuration Protocol and it is a protocol that assigns IP addresses and other network parameters to hosts on a network. DHCP traffic is allowed in low-impact mode because it is required for obtaining network configuration and connectivity.

Explanation 4

B. EAP

In a Cisco ISE (Identity Services Engine) environment, when an engineer is testing the low-impact mode for a phased deployment, the type of traffic that is denied when a host tries to connect to the network prior to authentication is EAP (Extensible Authentication Protocol) traffic.

Low-impact mode is a deployment model that provides a gradual approach to implementing network access control. It allows for minimal disruption to the existing network while providing baseline security.

In low-impact mode, the initial pre-authentication ACL (Access Control List) allows specific types of traffic to be permitted or denied before the device is authenticated. This includes allowing protocols like DNS (Domain Name System) and DHCP (Dynamic Host Configuration Protocol) to facilitate the authentication process. However, EAP traffic is denied until the host is successfully authenticated.

EAP is an authentication framework that supports multiple authentication methods. It is used in network access control scenarios, such as 802.1X port-based authentication, to provide a secure communication channel for exchanging authentication credentials and messages. By denying EAP traffic prior to authentication, the low-impact mode ensures that unauthorized hosts cannot access network resources or communicate with other devices on the network.

In summary, during the testing of low-impact mode in a Cisco ISE deployment, EAP traffic is denied when a host tries to connect to the network prior to authentication to prevent unauthorized access and secure the network environment.

Explanation 5

The correct answer is C. DHCP.

In low-impact mode, all traffic is denied prior to authentication, except for DHCP. This allows devices to obtain an IP address from the DHCP server before they can authenticate with Cisco ISE.

The other options are incorrect:

• DNS. DNS is a network service that translates domain names into IP addresses. In low-impact mode, DNS traffic is denied because devices cannot obtain an IP address from the DHCP server before they can authenticate with Cisco ISE.
• EAP. EAP is a protocol that is used to authenticate users to a network. In low-impact mode, EAP traffic is denied because devices cannot authenticate with Cisco ISE before they can obtain an IP address from the DHCP server.
• HTTP. HTTP is a protocol that is used to transfer hypertext documents over the internet. In low-impact mode, HTTP traffic is denied because devices cannot access the internet before they can obtain an IP address from the DHCP server.

Here are some additional details about low-impact mode:

Low-impact mode is a deployment mode for Cisco ISE that allows you to test the functionality of Cisco ISE without disrupting your existing network. In low-impact mode, all traffic is denied prior to authentication, except for DHCP. This allows devices to obtain an IP address from the DHCP server before they can authenticate with Cisco ISE.

Benefits of low-impact mode

• You can test the functionality of Cisco ISE without disrupting your existing network.
• You can identify any potential issues with your deployment before you move to a production environment.
• You can get feedback from users on the usability of the Cisco ISE portal.

Drawbacks of low-impact mode

• All traffic is denied prior to authentication, which can impact the performance of your network.
• You cannot use Cisco ISE to enforce access policies.
• You cannot use Cisco ISE to collect telemetry data.

Explanation 6

A. DNS

In a Cisco ISE low-impact mode for phased deployment, when a host tries to connect to the network prior to authentication, the only type of traffic that is allowed is the traffic required for authentication and identity acquisition. This includes DHCP, EAP, and a limited set of DNS traffic. All other traffic, such as HTTP, is denied until the host is successfully authenticated.

Low-impact mode allows an organization to deploy Cisco ISE gradually, easing the transition by initially providing limited access to the network for unauthenticated hosts. Once the host is authenticated, it is granted full access based on the configured policies.

In this mode, unauthenticated hosts are allowed to receive an IP address via DHCP and perform DNS queries for specific domains (such as those required for authentication). They are also permitted to send EAP packets for 802.1X authentication. However, all other traffic, including HTTP, is denied until the host completes the authentication process. This ensures that only authenticated hosts can access network resources and enforces a basic level of security during the phased deployment.

In summary, during low-impact mode for a phased deployment of Cisco ISE, DNS traffic is allowed for specific domains required for authentication, while HTTP traffic is denied until successful authentication occurs.

Explanation 7

The correct answer is C. DHCP.

In low-impact mode, all traffic is denied to hosts prior to authentication. This includes DNS, EAP, and HTTP traffic. The only traffic that is allowed is DHCP traffic, so that hosts can obtain an IP address and join the network.

Here are some additional details about low-impact mode:

• Low-impact mode is a phased deployment mode for Cisco ISE. It allows you to test Cisco ISE in a production environment without impacting users.
• In low-impact mode, all traffic is denied to hosts prior to authentication. This includes DNS, EAP, and HTTP traffic.
• The only traffic that is allowed is DHCP traffic, so that hosts can obtain an IP address and join the network.
• Once you have tested Cisco ISE in low-impact mode and are satisfied with its performance, you can move to closed mode. In closed mode, all traffic is denied to hosts prior to authentication, except for traffic that is explicitly allowed by Cisco ISE.

Explanation 8

When a host tries to connect to the network prior to authentication, DHCP traffic is denied in low-impact mode for a phased deployment of Cisco ISE. Dynamic Host Configuration Protocol (DHCP) is used to assign IP addresses and other network configuration information to network devices. In low-impact mode, Cisco ISE denies all traffic except for DHCP traffic.

Explanation 9

The correct answer is C. DHCP.

In low-impact mode, all traffic is denied prior to authentication, except for DHCP. This is because DHCP is required for devices to obtain an IP address, which is necessary for them to authenticate with Cisco ISE.

The other options are incorrect:

• DNS. DNS is not required for devices to authenticate with Cisco ISE.
• EAP. EAP is the protocol that is used for authentication with Cisco ISE. It is not allowed prior to authentication, because it would allow devices to authenticate without being properly authenticated.
• HTTP. HTTP is not required for devices to authenticate with Cisco ISE.

Here are some additional details about low-impact mode:

• Low-impact mode is a phased deployment mode for Cisco ISE. In low-impact mode, all traffic is denied prior to authentication, except for DHCP. This allows engineers to test Cisco ISE without disrupting network traffic.
• Once the engineer is satisfied with the configuration of Cisco ISE, they can move to the next phase of deployment, which is closed mode. In closed mode, all traffic is denied prior to authentication, including DHCP. This ensures that only authenticated devices are able to access the network.

Explanation 10

When using low-impact mode for a phased deployment of Cisco ISE, the type of traffic that is denied when a host tries to connect to the network prior to authentication is:

C. DHCP.

Low-impact mode in Cisco ISE is a deployment option that allows organizations to gradually introduce Cisco ISE into their network infrastructure while minimizing disruption. In this mode, the initial network access is typically restricted, and hosts are denied certain types of traffic until they authenticate successfully.

In the context of low-impact mode, when a host tries to connect to the network before authentication, DHCP (Dynamic Host Configuration Protocol) traffic is denied. DHCP is responsible for assigning IP addresses and network configuration parameters to hosts dynamically. By denying DHCP traffic, the hosts are unable to obtain an IP address and the necessary network configuration, effectively preventing network access.

The other options mentioned are not denied when a host tries to connect to the network prior to authentication in low-impact mode:

A. DNS (Domain Name System) traffic: DNS is responsible for translating domain names to IP addresses. DNS traffic is not typically denied in low-impact mode, as it is necessary for hosts to resolve domain names to establish network connections.

B. EAP (Extensible Authentication Protocol) traffic: EAP is the authentication framework used in IEEE 802.1X network access control. EAP traffic is specifically used during the authentication process and is not denied in low-impact mode.

D. HTTP (Hypertext Transfer Protocol) traffic: HTTP is the protocol used for web communication. While access to certain web resources might be restricted until authentication, HTTP traffic itself is not explicitly denied in low-impact mode.

In summary, when using low-impact mode for a phased deployment of Cisco ISE, DHCP traffic is denied when a host tries to connect to the network prior to authentication. Denying DHCP prevents hosts from obtaining IP addresses and network configuration, effectively restricting network access until successful authentication.

Reference

• 300-715 SISE – Cisco
• Implementing and Configuring Cisco Identity Services Engine (SISE) – Cisco
• SISE Exam Overview (cisco.com)
• How To Troubleshoot ISE Failed Authentications & Authorizations – Cisco Community
• Solved: ISE- Low Impact Mode – Cisco Community
• Cisco ISE – General Settings Tips and Tricks for Wired Deployments Part 2 — WIRES AND WI.FI

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE) certification exam practice question and answer (Q&A) dump with detail explanation and reference available free, helpful to pass the Implementing and Configuring Cisco Identity Services Engine (300-715 SISE) exam and earn Implementing and Configuring Cisco Identity Services Engine (300-715 SISE) certification.