Cisco 300-715 Online Practice Questions and Exam Preparation

Cisco 300-715 Online Questions & Answers

• Question 171:

  An administrator must deploy the Cisco Secure Client posture agent to employee endpoints that access a wireless network by using URL redirection in Cisco ISE. The compliance module must be downloaded from Cisco and uploaded to the Cisco ISE client provisioning resource. What must be used to upload the compliance module?

  A. Client Provisioning Portal
  B. Secure Client configuration
  C. agent resources from the local disk
  D. Secure Client posture profile
  A. Client Provisioning Portal

• Question 172:

  What is configured to enforce the blocklist permissions and deny access to clients in the blocklist to protect against a lost or stolen device obtaining access to the network?

  A. My Devices portal
  B. blocklist portal
  C. Authentication rule
  D. Authorization rule
  D. Authorization rule

• Question 173:

  A customer wants to set up the Sponsor portal and delegate the authentication flow to a third party for added security while using Kerberos. Which database should be used to accomplish this goal?

  A. RSA Token Server
  B. Active Directory
  C. Local Database
  D. LDAP
  B. Active Directory

  ---

  Explanation Explanation/Reference:https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_01111.html#concept_srz_ bkb_4db

• Question 174:

  What is the deployment mode when two Cisco ISE nodes are configured in an environment?

  A. distributed
  B. active
  C. standalone
  D. standard
  A. distributed

• Question 175:

  An engineer is deploying Cisco ISE to use 802.1X authentication for controlling access to the company's wired network. The request from company management is to minimize the impact on users during the rollout of 802.1X on the company switches. Which mode must be used first in a phased 802.1X deployment to fulfill this request?

  A. Monitor
  B. Open
  C. Low-impact
  D. Closed
  A. Monitor

  ---

  By using the low-impact mode, the engineer can gradually enable 802.1X authentication on switches and gradually enforce authentication on specific ports or user groups. This approach allows users to continue accessing the network using their existing authentication methods (such as MAC-based authentication) while gradually transitioning to 802.1X authentication.

• Question 176:

  Refer to the exhibit.

  

  An engineer is configuring the remote access VPN to use Cisco ISE for AAA and needs to conduct posture checks on the connecting endpoints After the endpoint connects, it receives its initial authorization result and continues onto the compliance scan

  What must be done for this AAA configuration to allow compliant access to the network?

  A. Configure the posture authorization so it defaults to unknown status
  B. Fix the CoA port number
  C. Ensure that authorization only mode is not enabled
  D. Enable dynamic authorization within the AAA server group
  D. Enable dynamic authorization within the AAA server group

• Question 177:

  The Cisco Wireless LAN Controller and guest portal must be set up in Cisco ISE. These configurations were performed:

  configured all the required Cisco Wireless LAN Controller configurations added the wireless controller to Cisco ISE network devices created an endpoint identity group configured credentials to be sent by email configured the SMTP server configured an authorization profile with redirection to the guest portal and redirected the access control list configured an authentication policy for MAB users created an authorization policy

  Which two components must be created to complete the configuration? (Choose two.)

  A. sponsor group
  B. hotspot guest portal
  C. sponsor portal
  D. self-registered guest portal
  E. guest type
  D. self-registered guest portal
  E. guest type

• Question 178:

  A network security administrator needs a web authentication configuration when a guest user connects to the network with a wireless connection using these steps:

  An initial MAB request is sent to the Cisco ISE node.

  Cisco ISE responds with a URL redirection authorization profile if the user's MAC address is unknown in the endpoint identity store.

  The URL redirection presents the user with an AUP acceptance page when the user attempts to go to any URL.

  Which authentication must the administrator configure on Cisco ISE?

  A. device registration WebAuth
  B. WLC with local WebAuth
  C. wired NAD with local WebAuth
  D. NAD with central WebAuth
  D. NAD with central WebAuth

  ---

  Central Web Authentication (CWA) is a feature that allows the network access device (NAD) to redirect the web traffic of a guest user to a web portal hosted by Cisco ISE1. The NAD acts as a proxy between the guest user and the ISE node, and performs the authentication and authorization based on the RADIUS attributes returned by ISE1. To configure CWA on ISE, the administrator must create an authorization profile that contains the URL redirection attribute and assign it to the guest user1. The other options are not correct because they do not use CWA. Device registration WebAuth is a feature that allows users to register their devices on ISE before they can access the network2. WLC with local WebAuth is a feature that allows the wireless LAN controller (WLC) to host the web portal and authenticate the guest user locally3. Wired NAD with local WebAuth is a feature that allows the switch to host the web portal and authenticate the guest user locally.

• Question 179:

  Which types of design are required in the Cisco ISE ATP program?

  A. schematic and detailed
  B. preliminary and final
  C. high-level and low-level designs
  D. top down and bottom up
  C. high-level and low-level designs

• Question 180:

  An administrator is configuring a new profiling policy within Cisco ISE. The organization has several endpoints that are the same device type, and all have the same Block ID in their MAC address. The profiler does not currently have a profiling policy created to categorize these endpoints, therefore a custom profiling policy must be created.

  Which condition must the administrator use in order to properly profile an ACME AI Connector endpoint for network access with MAC address 01:41:14:65:50:AB?

  A. CDP_cdpCacheDeviceID_CONTAINS_
  B. MAC_MACAddress_CONTAINS_
  C. Radius_Called_Station-ID_STARTSWITH_
  D. MAC_OUI_STARTSWITH_
  B. MAC_MACAddress_CONTAINS_