Users in an organization report issues about having to remember multiple usernames and passwords. The network administrator wants the existing Cisco ISE deployment to utilize an external identity source to alleviate this issue. Which two requirements must be met to implement this change? (Choose two.)

To integrate Cisco ISE with an external identity source like Active Directory (AD) to centralize user credentials, the ISE node must join the AD domain. This process has two fundamental requirements. First, ISE needs network connectivity to a Domain Controller that also functions as a Global Catalog (GC) server. The GC is essential for ISE to perform efficient lookups of users, groups, and computer objects, especially in multi-domain environments. Second, the join operation requires an AD account with sufficient privileges to create a computer object for the ISE node within the Active Directory. A domain administrator account has these permissions.

A. Enable IPC access over port 80. AD integration does not use Inter-Process Communication (IPC) over port 80 (HTTP). It relies on protocols like Kerberos, LDAP/LDAPS, DNS, and RPC over their standard, designated ports.
B. Ensure that the NAT address is properly configured. While network connectivity is required, Network Address Translation (NAT) is a network implementation detail, not a direct prerequisite for the ISE-AD integration process itself.
E. Configure a secure LDAP connection. While using AD as an LDAP identity source is possible (and securing it is a best practice), the standard and more feature-rich integration method is a full domain join, which uses multiple protocols, not just LDAP.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Prerequisites for Joining a Cisco ISE Node to an Active Directory Domain" section.

This document states: "You must have the credentials (username and password) of an Active Directory user who has permissions to add a computer to the domain." This directly supports option D.

The guide's "Ports Used for Cisco ISE to Active Directory Communication" table lists TCP/UDP 3268 (LDAP-GC) and TCP/UDP 3269 (LDAP-GC-SSL)

confirming the requirement for Global Catalog access. This supports option C.

2. Cisco Press

CCNP Security Identity Management SISE 300-715 Official Cert Guide

1st Edition

Chapter 10

"Configuring External Identity Sources".

In the section "Joining Active Directory

" the text explains

"To join the domain

you must provide the credentials of an Active Directory user who has the permissions to add computer accounts to the domain." This validates option D.

The chapter also details how ISE uses DNS SRV records to discover services

including the Global Catalog (gc.tcp)

underscoring the necessity of access to a GC server for proper operation

which validates option C.