Cisco CCNP Security Core (SCOR) 350-701Endpoint Security and Secure Network AccessMedium
A large organization is deploying a new secure network access solution. The security team wants to segment network resources based on user roles and device types, ensuring that a sales laptop has different access privileges than an engineering workstation, even if both are on the same physical network segment. Which Cisco technology should be implemented to achieve this granular level of access control and dynamic policy enforcement?
- ACisco Firepower Threat Defense (FTD)
- BCisco Secure Web Appliance (WSA)
- CCisco Identity Services Engine (ISE)
- DCisco Stealthwatch
Show answer & explanationAnswer & explanation
Correct answer: C. Cisco Identity Services Engine (ISE)
Cisco Identity Services Engine (ISE) is a comprehensive NAC solution that provides identity-based access control, allowing for granular segmentation and dynamic policy enforcement based on user, device, location, and other attributes.
Why the other options are wrong
- A. Cisco FTD is a next-generation firewall primarily focused on threat prevention and network segmentation at a different layer.
- B. Cisco WSA is a secure web gateway for controlling internet access and protecting against web-based threats, not for internal network resource segmentation.
- D. Cisco Stealthwatch (now Cisco Secure Network Analytics) focuses on network visibility and threat detection through flow analysis, not access control enforcement.
Cisco Identity Services Engine (ISE)
Cisco's Network Access Control (NAC) solution that provides centralized identity and access management, policy enforcement, and posture assessment.
- Enforces access based on user, device, location, and other attributes.
- Integrates with other security products for comprehensive protection.
- Supports 802.1X, MAC Authentication Bypass (MAB), and Web Authentication.
Memory trick: ISE is the 'bouncer' that checks your ID and what you can do inside.