Cisco 300-208 Online Practice Questions and Exam Preparation

Cisco 300-208 Online Questions & Answers

• Question 11:

  Which Cisco ISE feature can you configure to allow employees of your organization to add devices on which native supplicant provisioning is not supported to their user profiles?

  A. BYOD portal
  B. Guest portal
  C. Self-Registered Guest portal
  D. My Devices portal
  D. My Devices portal

• Question 12:

  Which type of SGT classification method is required when authentication is unavailable?

  A. Bypass
  B. Dynamic
  C. Static
  D. Inline
  C. Static

• Question 13:

  Which devices support download of environmental data and IP from Cisco ISE to SGT bindings in their SGFW implementation?

  A. Cisco ASA devices
  B. Cisco ISR G2 and later devices with ZBFW
  C. Cisco ISR G3 devices with ZBFW
  D. Cisco ASR devices with ZBFW
  A. Cisco ASA devices

• Question 14:

  Which identity store option allows you to modify the directory services that run on TCP/IP?

  A. Lightweight Directory Access Protocol
  B. RSA SecurID server
  C. RADIUS
  D. Active Directory
  A. Lightweight Directory Access Protocol

• Question 15:

  What is a required configuration step for an 802.1X capable switch to support dynamic VLAN and ACL assignments?

  A. Configure the VLAN assignment.
  B. Configure the ACL assignment.
  C. Configure 802.1X authenticator authorization.
  D. Configure port security on the switch port.
  C. Configure 802.1X authenticator authorization.

• Question 16:

  After an endpoint has completed authentication with MAB, a security violation is triggered because a different MAC address was detected. Which host mode must be active on the port?

  A. single-host mode
  B. multidomain authentication host mode
  C. multiauthentication host mode
  D. multihost mode
  A. single-host mode

• Question 17:

  Which feature must you configure on a switch to allow it to redirect wired endpoints to Cisco ISE?

  A. the http secure-server command
  B. RADIUS Attribute 29
  C. the RADIUS VSA for accounting
  D. the RADIUS VSA for URL-REDIRECT
  A. the http secure-server command

• Question 18:

  Scenario:

  Currently, many users are expehecing problems using their AnyConnect NAM supplicant to login to the network. The rr desktop support staff have already examined and vehfed the AnyConnect NAM configuration is correct. In this simulation,

  you are tasked to examine the various ISE GUI screens to determine the ISE current configurations to help isolate the problems. Based on the current ISE configurations, you will need to answer three multiple choice questions.

  To access the ISE GUI, click on the ISE icon in the topology diagram to access the ISE GUI. Not all the ISE GUI screen are operational in this simulation and some of the ISE GUI operations have been reduced in this simulation. Not all the

  links on each of the ISE GUI screen works, if some of the links are not working on a screen, click Home to go back to the Home page first. From the Home page, you can access all the required screens. To view some larger GUI screens, use

  the simulation window scroll bars. Some of the larger GUI screens only shows partially but will include all information required to complete this simulation.

  

  Determine which can be two reasons why many users like the Sales and fT users are not able to authenticate and access the network using their AnyConnect NAM client with EAP- FAST.(Choose two.)

  A. The DotlX authentication policy is not allowing the EAP-FAST protocol.
  B. The rr_Corp authorization profile has the wrong Access Type configured.
  C. The authorization profile used for the Sales users is misconfigured.
  D. The order for the MAB authentication policy and the DotlX authentication policy should be reversed.
  E. Many of the fT Sales and fT user machines are not passing the ISE posture accessment.
  F. he PERMrr_ALL_TRAFFIC DACL is missing the permit ip any any statement it the end.
  G. The Employee_FullAccess_DACL DACL is missing the permit ip any any statement in the end.
  A. The DotlX authentication policy is not allowing the EAP-FAST protocol.
  D. The order for the MAB authentication policy and the DotlX authentication policy should be reversed.

• Question 19:

  Whic type of SGT propegation does a WLC in a datacenter require?

  A. SXP
  B. inline
  C. Trut
  D. Inherit
  A. SXP

• Question 20:

  What steps must you perform to deploy a CA-signed identify certificate on an ISE device?

  A. 1. Download the CA server certificate. 2. Generate a signing request and save it as a file. 3. Access the CA server and submit the ISE request. 4. Install the issued certificate on the ISE.
  B. 1. Download the CA server certificate. 2. Generate a signing request and save it as a file. 3. Access the CA server and submit the ISE request. 4. Install the issued certificate on the CA server.
  C. 1. Generate a signing request and save it as a file. 2. Download the CA server certificate. 3. Access the ISE server and submit the CA request. 4.Install the issued certificate on the CA server.
  D. 1. Generate a signing request and save it as a file. 2. Download the CA server certificate. 3. Access the CA server and submit the ISE request. 4. Install the issued certificate on the ISE.
  D. 1. Generate a signing request and save it as a file. 2. Download the CA server certificate. 3. Access the CA server and submit the ISE request. 4. Install the issued certificate on the ISE.