Cisco 300-208 Online Practice Questions and Exam Preparation

Cisco 300-208 Online Questions & Answers

• Question 441:

  Which option is the correct redirect-ACL for Wired-CWA, with 10.201.228.76 being the Cisco ISE IP address?

  A. ip access-l ex ACL-WEBAUTH-REDIRECT deny udp any any eq domain deny ip any host 10.201.228.76 permit tcp any any eq 80 permit tcp any any eq 443
  B. ip access-l ex ACL-WEBAUTH-REDIRECT permit udp any any eq domain permit ip any host 10.201.228.76 deny tcp any any eq 80 permit tcp any any eq 443
  C. ip access-l ex ACL-WEBAUTH-REDIRECT deny udp any any eq domain permit tcp any host 10.201.228.76 eq 8443 deny ip any host 10.201.228.76 permit tcp any any eq 80 permit tcp any any eq 443
  D. ip access-l ex ACL-WEBAUTH-REDIRECT permit udp any any eq domain deny ip any host 10.201.228.76 permit tcp any any eq 80 permit tcp any any eq 443
  A. ip access-l ex ACL-WEBAUTH-REDIRECT deny udp any any eq domain deny ip any host 10.201.228.76 permit tcp any any eq 80 permit tcp any any eq 443

• Question 442:

  CORRECT TEXT

  The Secure-X company has recently successfully tested the 802.1X authentication deployment using the Cisco Catalyst switch and the Cisco ISEv1.2 appliance. Currently, each employee desktop is connected to an 802.1X enabled switch

  port and is able to use the Cisco AnyConnect NAM 802.1Xsupplicantto log in and connect to the network.

  Currently, a new testing requirement is to add a network printer to the Fa0/19 switch port and have it connect to the network. The network printer does not support 802.1X supplicant. The Fa0/19 switch port is now configured to use 802.1X

  authentication only.

  To support this network printer, the Fa0/19 switch port configuration needs to be edited to enable the network printer to authenticate using its MAC address. The network printer should also be on VLAN 9.

  Another network security engineer responsible for managing the Cisco ISE has already per-configured all the requirements on the Cisco ISE, including adding the network printer MAC address to the Cisco ISE endpoint database and etc...

  Your task in the simulation is to access the Cisco Catalyst Switch console then use the CLI

  to:

  1.

  Enable only the Cisco Catalyst Switch Fa0/19 switch port to authenticate the network printer using its MAC address and:

  2.

  Ensure that MAC address authentication processing is not delayed until 802.1Xfails

  3.

  Ensure that even if MAC address authentication passes, the switch will still perform 802.1X authentication if requested by a 802.1X supplicant

  4.

  Use the required show command to verify the MAC address authentication on the Fa0/19 is successful

  The switch enable password is Cisco For the purpose of the simulation, to test the network printer, assume the network printer will be unplugged then plugged back into the Fa0/19 switch port after you have finished the required configurations on the Fa0/19 switch port. Note: For this simulation, you will not need and do not have access to the ISE GUI To access the switch CLI, click the Switch icon in the topology diagram

  

  Correct Answer. Review the explanation for full configuration and solution.
  Review the explanation for full configuration and solution.

  ---

  Initial configuration for fa 0/19 that is already done:

  

  AAA configuration has already been done for us. We need to configure mac address bypass on this port to achieve the goal stated in the question. To do this we simply need to add this command under the interface:

  mab

  Then do a shut/no shut on the interface.

  Verification:

  

• Question 443:

  Which three remediation actions are supported by the Web Agent for Windows? (Choose three.)

  A. Automatic Remediation
  B. Message text
  C. URL Link
  D. File Distribution
  E. AV definition update
  F. Launch Program
  B. Message text
  C. URL Link
  D. File Distribution

• Question 444:

  Which definition of "posturing" as it relates to a general network infrastructure and access into the internal network is true?

  A. The process by which an operating system or application running on an endpoint provides critical information about internet activity being used by the endpoint.
  B. The process by which an endpoint device can be monitored while connected to the network to determine if it could contain viruses or potential harmful programs running.
  C. The process by which an operating system or application running on an endpoint provides critical information about the software that is actively running on the device.
  D. The process when software is uploaded to an end device before it is allowed to gain access to a secure network.
  C. The process by which an operating system or application running on an endpoint provides critical information about the software that is actively running on the device.

• Question 445:

  What is the purpose of configuring Native Supplicant Profile on the Cisco ISE?

  A. It provides posture assessments and remediation for devices that are attempting to gain access to the corporate network.
  B. It is used to register personal devices on the network.
  C. It enforces the use of MSCHAPv2 or EAP-TLS for 802 1X authentication
  D. It helps employees add and manage new devices by entering the MAC address for the device.
  C. It enforces the use of MSCHAPv2 or EAP-TLS for 802 1X authentication

• Question 446:

  Which two component are required for creating native supplicant profile? (Choose 2)

  A. Operative System
  B. Connection type wired/wireless
  C. Ios Sutten
  D. BYOD
  A. Operative System
  B. Connection type wired/wireless

• Question 447:

  What is a requirement for posture administration services in Cisco ISE?

  A. at least one Cisco router to store Cisco ISE profiling policies
  B. Cisco NAC Agents that communicate with the Cisco ISE server
  C. an ACL that points traffic to the Cisco ISE deployment
  D. the advanced license package must be installed
  D. the advanced license package must be installed

• Question 448:

  Which CoA type does a Cisco ISE PSN send to a network access device when a NAG agent reports the OS patch status of a noncompliant endpoint?

  A. CoA-Terminate
  B. CoA-PortBounce
  C. CoA-Reauth
  D. CoA-Remediate
  C. CoA-Reauth

• Question 449:

  What implementation must be added to the WLC to enable 802.1X and CoA for wireless endpoints?

  A. the ISE
  B. an ACL
  C. a router
  D. a policy server
  A. the ISE

• Question 450:

  Where must periodic re-authentication be configured to allow a client to come out of the quarantine state and become compliant?

  A. on the switch port
  B. on the router port
  C. on the supplicant
  D. on the controller
  A. on the switch port