Cisco 300-715 Online Practice Questions and Exam Preparation

Cisco 300-715 Online Questions & Answers

• Question 11:

  Which two external identity stores support EAP-TLS and PEAP-TLS? (Choose two.)

  A. RSA SecurID
  B. RADIUS Token
  C. Active Directory
  D. Internal Database
  E. LDAP
  C. Active Directory
  E. LDAP

  ---

  https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/214975-configure-eap-tls-authentication-with-is.html

• Question 12:

  Which two features must be used on Cisco ISE to enable the TACACS feature? (Choose two)

  A. Command Sets
  B. Server Sequence
  C. Device Administration License
  D. External TACACS Servers
  E. Device Admin Service
  C. Device Administration License
  E. Device Admin Service

• Question 13:

  Refer to the exhibit.

  

  An engineer is configuring a client but cannot authenticate to Cisco ISE During troubleshooting, the show authentication sessions command was issued to display the authentication status of each port

  Which command gives additional information to help identify the problem with the authentication?

  A. show authentication sessions
  B. show authentication sessions Interface Gil/0/1 output
  C. show authentication sessions interface Gi1/0/1 details
  D. show authentication sessions output
  C. show authentication sessions interface Gi1/0/1 details

• Question 14:

  An engineer must configure web redirection for guests to a portal where no authentication is required and an Acceptable Use Policy must be accepted by the guest before network access is allowed. Which type of guest portal must be configured in Cisco ISE to meet the requirement?

  A. Sponsored
  B. Self Registered
  C. Hotspot
  D. Custom
  C. Hotspot

• Question 15:

  An administrator has added a new Cisco ISE PSN to their distributed deployment. Which two features must the administrator enable to accept authentication requests and profile the endpoints correctly, and add them to their respective endpoint identity groups? (Choose two )

  A. Session Services
  B. Endpoint Attribute Filter
  C. Posture Services
  D. Profiling Services
  E. Radius Service
  A. Session Services
  D. Profiling Services

• Question 16:

  An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network.

  Which node should be used to accomplish this task?

  A. PSN
  B. primary PAN
  C. pxGrid
  D. MnT
  A. PSN

• Question 17:

  An engineer is tasked with placing a guest access anchor controller in the DMZ. Which two ports or port sets must be opened up on the firewall to accomplish this task? (Choose two.)

  A. UDP port 1812 RADIUS
  B. TCP port 161
  C. TCP port 514
  D. UDP port 79
  E. UDP port 16666
  B. TCP port 161
  C. TCP port 514

• Question 18:

  Which statement is not correct about the Cisco ISE Monitoring node?

  A. The local collector agent collects logs locally from itself and from any NAD that is configured to send logs to the Policy Service node.
  B. Cisco ISE supports distributed log collection across all nodes to optimize local data collection, aggregation, and centralized correlation and storage.
  C. The local collector agent process runs only the Inline Posture node.
  D. The local collector buffers transport the collected data to designated Cisco ISE Monitoring nodes as syslog; once Monitoring nodes are globally defined via Administration, ISE nodes automatically send logs to one or both of the configured Monitoring nodes.
  C. The local collector agent process runs only the Inline Posture node.

• Question 19:

  Which radius attribute can be used to dynamically assign the inactivity active timer for MAB users from the Cisco ISE node?

  A. radius-server timeout
  B. idle-timeout attribute
  C. termination-action attribute
  D. session-timeout attribute
  B. idle-timeout attribute

  ---

  When the inactivity timer is enabled, the switch monitors the activity from authenticated endpoints. When the inactivity timer expires, the switch removes the authenticated session. The inactivity timer for MAB can be statically configured on the switch port, or it can be dynamically assigned using the RADIUS Idle-Timeout attribute (Attribute 28)

• Question 20:

  A network security administrator needs a web authentication configuration when a guest user connects to the network with a wireless connection using these steps:

  1.

  An initial MAB request is sent to the Cisco ISE node.

  2.

  Cisco ISE responds with a URL redirection authorization profile if the user's MAC address is unknown in the endpoint identity store.

  3.

  The URL redirection presents the user with an AUP acceptance page when the user attempts to go to any URL.

  Which authentication must the administrator configure on Cisco ISE?

  A. wired NAD with local WebAuth
  B. WLC with local WebAuth
  C. NAD with central WebAuth
  D. device registration WebAuth
  D. device registration WebAuth