Cisco 300-208 Online Practice Questions and Exam Preparation

Cisco 300-208 Online Questions & Answers

• Question 31:

  By default, how many days does Cisco ISE wait before it purges the expired guest accounts?

  A. 1
  B. 10
  C. 15
  D. 20
  C. 15

• Question 32:

  An organization has recently deployed ISE with the latest models of Cisco switches, and it plans to deploy Trustsec to secure its infrastructure. The company also wants to allow different network access policies for different user groups (e.g., administrators). Which solution is needed to achieve these goals?

  A. Cisco Security Group Access Policies in order to use SGACLs to control access based on SGTs assigned to different users
  B. MACsec in Multiple-Host Mode in order to open or close a portbased on a single authentication
  C. Identity-based ACLs on the switches with user identities provided by ISE
  D. Cisco Threat Defense for user group control by leveraging Netflow exported from the switches and login information from ISE
  A. Cisco Security Group Access Policies in order to use SGACLs to control access based on SGTs assigned to different users

• Question 33:

  Which description of the use of low-impact mode in a Cisco ISE deployment is correct?

  A. It continues to use the authentication open capabilities of the switch port, which allows traffic to enter theswitch before an authorization result.
  B. Low-impact mode must be the final phase in deploying Cisco ISE into a network environment using thephased approach.
  C. It enables authentication (with authentication open), sees exactly which devices fail and which succeed, andcorrects the failed authentications before they
  D. The port does not allow any traffic before the authentication (except for EAP, Cisco Discovery Protocol, andLLDP), and then the port is assigned to specific authorization results after the authentication
  C. It enables authentication (with authentication open), sees exactly which devices fail and which succeed, andcorrects the failed authentications before they

• Question 34:

  Which authorization method is the Cisco best practice to allow endpoints access to the Apple App store or Google Play store with Cisco WLC software version 7.6 or newer?

  A. dACL
  B. DNS ACL
  C. DNS ACL defined in Cisco ISE
  D. redirect ACL
  B. DNS ACL

• Question 35:

  A security engineer has configured a switch port in 802. 1X closed mode. Which protocol is allowed to pass through before a device is authenticated?

  A. Bootps
  B. HTTP
  C. PXE
  D. EAPoL
  E. ARP
  D. EAPoL

• Question 36:

  Which error in a redirect ACL can cause the redirection of an endpoint to the provisioning portal to fail?

  A. The redirect ACL is blocking access to ports 80 and 443.
  B. The redirect ACL is applied to an incorrect SVI.
  C. The redirect ACL is blocking access to the client provisioning portal.
  D. The redirect ACL is blocking access to Cisco ISE port 8905.
  A. The redirect ACL is blocking access to ports 80 and 443.

• Question 37:

  In Cisco ISE, which probe must be enabled to collect profiling data using Device Sensor?

  A. RADIUS
  B. SNMPQuery
  C. SNMPTrap
  D. Network Scan
  E. Syslog
  A. RADIUS

• Question 38:

  Which two attributes must match between two Cisco ASA devices to properly enable high availability? (Choose two.)

  A. model, interface configuration, and RAM
  B. major and minor software release
  C. tcp dead-peer detection protocol
  D. 802.1x authentication identity
  A. model, interface configuration, and RAM
  B. major and minor software release

• Question 39:

  Which NAC agents support remediation (chose 3)?

  A. Windows NAC
  B. Windows web-based NAC
  C. MAC NAC
  D. MAC web-based NAC
  A. Windows NAC
  B. Windows web-based NAC
  C. MAC NAC

• Question 40:

  Dual SSID, provision and employs, what L2 security for the provisioning SSID?

  A. 802.1x
  B. Mac filter disable
  C. Open
  D. WPA2
  C. Open