Free 300-715 Exam Dumps Preview

Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

Which two default endpoint identity groups does Cisco ISE create? (Choose two )

Refer to the exhibit.

Which component must be configured to apply the SGACL?

What happens when an internal user is configured with an external identity store for authentication, but an engineer uses the Cisco ISE admin portal to select an internal identity store as the identity source?

Which two tasks must be completed when configuring the Cisco ISE BYOD Portal? (Choose two.)

The profiling data from network access devices is sent to which Cisco ISE node?

An administrator must restrict access to the IP address of an application based on the browser version of the endpoint. Cisco ISE profiling services and quest portal access must be configured to capture the user-agent. Information of the endpoint from a Cisco switch using the Device Sensor feature. These configurations were performed:

1. added the switch to Cisco ISE
2. configured device sensor on the switch
3. enabled Cisco ISE portal access
4. configured the user endpoint to connect to the Cisco ISE portal

Which type of probe must be enabled next to complete the configuration?

Wireless network users authenticate to Cisco ISE using 802.1X through a Cisco Catalyst switch. An engineer must create an updated configuration to assign a security group tag to the user's traffic using inline tagging to prevent unauthenticated users from accessing a restricted server. The configurations were performed:

configured Cisco ISE as a Cisco TrustSec AAA server configured the switch as a RADIUS device in Cisco ISE configured the wireless LAN controller as a TrustSec device in Cisco ISE created a security group tag for the wireless users created a certificate authentication profile created an identity source sequence assigned an appropriate security group tag to the wireless users defined security group access control lists to specify an egress policy enforced the access control lists on the TrustSec policy matrix in Cisco ISE configured TrustSec on the switch configured TrustSec on the wireless LAN controller

Which two actions must be taken to complete the configuration? (Choose two.)

An engineer is configuring 802.1X and is testing out their policy sets. After authentication, some endpoints are given an access-reject message but are still allowed onto the network.

What is causing this issue to occur?

Which three default endpoint identity groups does cisco ISE create? (Choose three)

Which deployment mode allows for one or more policy service nodes to be used for session failover?

What is a function of client provisioning?

An administrator is adding a switch to the network that is running cisco ISE and is only for IP phones. the phones do not have the ability to authenticate via 802.1x.

Which command is needed on each switch port for authentication?

Refer to the exhibit.

A network engineers configuring the switch to accept downloadable ACLs from a Cisco ISC server.

Which two commands should be run to complete the configuration? (Choose two)

The IT manager wants to provide different levels of access to network devices when users authenticate using TACACS+. The company needs specific commands to be allowed based on the Active Directory group membership of the different roles within the IT department. The solution must minimize the number of objects created in Cisco ISE.

What must be created to accomplish this task?

Which Cisco ISE component intercepts HTTP and HTTPS requests and redirects them to the Guest User Portal?

An engineer is deploying a new Cisco ISE environment for a company. The company wants the deployment to use TACACS+. The engineer verifies that Cisco ISE has a Device Administration license.

What must be configured to enable TACACS+ operations?

A laptop was stolen and a network engineer added it to the block list endpoint identity group

What must be done on a new Cisco ISE deployment to redirect the laptop and restrict access?

An engineer needs to configure a Cisco ISE server to issue a CoA for endpoints already authenticated to access the network. The CoA option must be enforced on a session, even if there are multiple active sessions on a port.

What must be configured to accomplish this task?

The security team wants to secure the wired network. A legacy printer on the network with the MAC address 00:43:08:50:64:60 does not support 802.1X.

Which setting must be enabled in the Allowed Authentication Protocols list in your Authentication Policy for Cisco ISE to support MAB for this MAC address?

A network engineer must enforce access control using special tags, without re-engineering the network design.

Which feature should be configured to achieve this in a scalable manner?

DRAG DROP

A security engineer configures a Cisco Catalyst switch to use Cisco TrustSec. The engineer must define the PAC key to authenticate the switch to Cisco ISE. Drag and drop the commands from the left into sequence on the right. Not all options are used.

An administrator is configuring the Native Supplicant Profile to be used with the Cisco ISE posture agents and needs to test the connection using wired devices to determine which profile settings are available.

Which two configuration settings should be used to accomplish this task? (Choose two.)

A network engineer has been tasked with enabling a switch to support standard web authentication for Cisco ISE. This must include the ability to provision for URL redirection on authentication.

Which two commands must be entered to meet this requirement? (Choose two.)

An employee must access the internet through the corporate network from a new mobile device that does not support native supplicant provisioning provided by Cisco ISE.

Which portal must the employee use to provision to the device?

DRAG DROP

Drag and drop the configuration steps from the left into the sequence on the right to install two Cisco ISE nodes in a distributed deployment.

A security engineer has a new TrustSec projct and must create a few static security group tag classifications as proof of concept.

Which two classifications must the engineer configure? (Choose two.)

An administrator is configuring a Cisco WLC for web authentication.

Which two client profiling methods are enabled by default if the Apply Cisco ISE Default Settings check box has been selected'? (Choose two.)

What is a difference between TACACS+ and RADIUS protocol traffic?

A security administrator is using Cisco ISE to create a BYOD onboarding solution for all employees who use personal devices on the corporate network. The administrator generates a Certificate Signing Request and signs the request using an external Certificate Authority server.

Which certificate usage option must be selected when importing the certificate into ISE?

An administrator must enable scanning for specific endpoints when they attempt to access the network.
The scanning must be triggered as a result of successful authentication.

Which action accomplishes this task?

An engineer is configuring Cisco ISE to reprofile endpoints based only on new requests of INIT-REBOOT and SELECTING message types.

Which probe should be used to accomplish this task?

Which compliance status is set when a matching posture policy has been defined for that endpomt, but all the mandatory requirements during posture assessment are not met?

A network engineer is implementing cisco ISE and needs to configure 802.1x. the ports settings are configured for port-based authentication.

Which command should be used to complete this configuration?

An organization is adding nodes to their Cisco ISE deployment and has two nodes designated as primary and secondary PAN and MnT nodes.

The organization also has four PSNs An administrator is adding two more PSNs to this deployment but is having problems adding one of them What is the problem?

What are two benefits of TACACS+ versus RADIUS for device administration? (Choose two )

Refer to the exhibit

Which switch configuration change will allow only one voice and one data endpoint on each port?

An administrator connects an HP printer to a dot1x enable port, but the printer in not accessible.

Which feature must the administrator enable to access the printer?

A network administrator must configura endpoints using an 802 1X authentication method with EAP identity certificates that are provided by the Cisco ISE When the endpoint presents the identity certificate to Cisco ISE to validate the certificate, endpoints must be authorized to connect to the network

Which EAP type must be configured by the network administrator to complete this task?

Which two ports do network devices typically use for CoA? (Choose two )

Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

The security team identified a rogue endpoint with MAC address 00:46:91:02:28:4A attached to the network.

Which action must security engineer take within Cisco ISE to effectively restrict network access for this endpoint?

An administrator must onboard MacOS endpoints that connect to Cisco switches using the BYOD portal in Cisco ISE. The authentication method must be configured to meet these requirements:

1. Cisco ISE identifies itself by providing its identity certificate to the endpoint.
2. The endpoint validates the Cisco ISE identity certificate.
3. The endpoint provides its endpoint identity certificate, signed by Cisco ISE, to Cisco ISE.
4. Cisco ISE confirms the endpoint certificate validity, and the endpoint is authorized onto the network.

Which protocol must be configured?

What is the Cisco ISE default admin login name and password?

A network administrator is configuring a secondary Cisco ISE node from the backup configuration of the primary Cisco ISE node to create a high availability pair. The Cisco ISE CA certificates and keys must be manually backed up from the primary Cisco ISE and copied into the secondary Cisco ISE.

Which command must be issued for this to work?

An administrator is configuring a Cisco ISE posture agent in the client provisioning policy and needs to ensure that the posture policies that interact with clients are monitored, and end users are required to comply with network usage rules

Which two resources must be added in Cisco ISE to accomplish this goal? (Choose two)

Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose 2)

A network engineer needs to ensure that the access credentials are not exposed during the 802.1x authentication among components.

Which two protocols should complete this task? (Choose two.)

A policy is being created in order to provide device administration access to the switches on a network.
There is a requirement to ensure that if the session is not actively being used, after 10 minutes, it will be disconnected.

Which task must be configured in order to meet this requirement?

An enterprise uses a separate PSN for each of its four remote sites. Recently, a user reported receiving an "EAP-TLS authentication failed" message when moving between remote sites.

Which configuration must be applied on Cisco ISE?

Which statement is true?

Which two endpoint compliance statuses are possible? (Choose two.)

An engineer is using profiling to determine what access an endpoint must receive. After configuring both Cisco ISE and the network devices for 802.1X and profiling, the endpoints do not profile prior to authentication.

What are two reasons this is happening? (Choose two.)

An engineer is starting to implement a wired 802.1X project throughout the campus. The task is for failed authentication to be logged to Cisco ISE and also have a minimal impact on the users.

Which command must the engineer configure?

An engineer must use certificate authentication for endpoints that connect to a wired network with a Cisco ISE deployment. The engineer must define the certificate field used as the principal username.

What is needed to complete the configuration?

An administrator is adding network devices for a new medical building into Cisco ISE. These devices must be in a network device group that is identifying them as "Medical Switch" so that the policies can be made separately for the endpoints connecting through them.

Which configuration item must be changed in the network device within Cisco ISE to accomplish this goal?

Which valid external identity source can be used with Cisco ISE?

A user reports that the RADIUS accounting packets are not being seen on the Cisco ISE server.

Which command is the user missing in the switch's configuration?

Which file extension is required when deploying Cisco ISE using a ZTP configuration file in Microsoft Hyper-V?

What is a difference between TACACS+ and RADIUS in regards to encryption?

Which of these is not a method to obtain Cisco ISE profiling data?

A Cisco ISE server sends a CoA to a NAD after a user logs in successfully using CWA

Which action does the CoA perform?

An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened.
From which Cisco ISE persona should this traffic be originating?

An administrator must configure Cisco ISE to authenticate a user accessing a Cisco Adaptive Security Appliance firewall using SSH. The solution must meet these requirements:

1. The local Cisco ISE database must be used for user authentication
2. ASA commands run by users must be validated

The configurations were performed:
1. added the Cisco Adaptive Security Appliance firewall
2. configured user accounts
3. enabled Device Admin Service in Cisco ISE
4. configured a TACACS profile
5. configured an authorization policy
6. configured the Cisco Adaptive Security Appliance firewall for authentication and authorization

Which two actions must be taken in Cisco ISE? (Choose two.)

DRAG DROP

Drag the steps to configure a Cisco ISE node as a primary administration node from the left into the correct order on the night.

A network engineer is configuring a new certificate template on the internal CA within Cisco ISE to provision certificates to BYOD devices that must be enrolled in the network.

What must be configured in the SAN field of the certificate to identify the devices after enrollment?

Which scenario does not support Cisco ISE guest services?

An administrator must configure Cisco ISE to send CoA requests to a Cisco switch using SNMP. These configurations were performed:

1. enabled SNMP on the switch
2. added the switch to Cisco ISE
3. configured a network device profile
4. configured the NAD port detection method
5. configured the operation to be performed on the switch port
6. configured an authorization profile

Which two configurations must be performed to send the CoA requests? (Choose two.)