Cisco 300-715 Online Practice Questions and Exam Preparation

Cisco 300-715 Online Questions & Answers

• Question 231:

  A network security engineer needs to configure 802.1X port authentication to allow a single host to be authenticated for data and another single host to be authenticated for voice. Which command should the engineer run on the interface to accomplish this goal?

  A. authentication host-mode single-host
  B. authentication host-mode multi-auth
  C. authentication host-mode multi-host
  D. authentication host-mode multi-domain
  D. authentication host-mode multi-domain

• Question 232:

  Which deployment mode allows for one or more policy service nodes to be used for session failover?

  A. centralized
  B. secondary
  C. standalone
  D. distributed
  D. distributed

• Question 233:

  A user reports that the RADIUS accounting packets are not being seen on the Cisco ISE server. Which command is the user missing in the switch's configuration?

  A. radius-server vsa send accounting
  B. aaa accounting network default start-stop group radius
  C. aaa accounting resource default start-stop group radius
  D. aaa accounting exec default start-stop group radios
  B. aaa accounting network default start-stop group radius

• Question 234:

  The security team identified a rogue endpoint with MAC address 00:47:44:40:54:1A attached to the network. Which action must security engineer take within Cisco ISE to effectively restrict network access for this endpoint?

  A. Create authentication policy to force reauthentication.
  B. Configure access control list on network switches to block traffic.
  C. Add MAC address to the endpoint quarantine list.
  D. Implement authentication policy to deny access.
  C. Add MAC address to the endpoint quarantine list.

• Question 235:

  An administrator must change the authentication method from local accounts to SAMIL for wireless guest users in a Cisco ISE deployment. Using the SAML protocol, the guest portal must be configured to authenticate employees with an external identity provider server. These configurations were performed:

  1. created a secondary self-registered guest portal for SAML integration

  2. created a primary guest portal for wireless guest users

  3. configured all the required settings on the SAML identity provider server

  4. imported IdP metadata to the Cisco ISE SAML identity provider profile

  Which two actions must be taken? (Choose two.)

  A. Create employee accounts in the Sponsor portal.
  B. Create a SAML identity provider in ISE.
  C. Configure the Sponsor portal
  D. Configure the SAML identity provider in authentication method for the secondary guest portal.
  E. Configure the SAML identity provider in authentication method for the primary guest portal.
  D. Configure the SAML identity provider in authentication method for the secondary guest portal.
  E. Configure the SAML identity provider in authentication method for the primary guest portal.

• Question 236:

  An engineer is configuring sponsored guest access and needs to limit each sponsored guest to a maximum of two devices. There are other guest services in production that rely on the default guest types.

  How should this configuration change be made without disrupting the other guest services currently offering three or more guest devices per user?

  A. Create an ISE identity group to add users to and limit the number of logins via the group configuration.
  B. Create a new guest type and set the maximum number of devices sponsored guests can register
  C. Create an LDAP login for each guest and tag that in the guest portal for authentication.
  D. Create a new sponsor group and adjust the settings to limit the devices for each guest.
  B. Create a new guest type and set the maximum number of devices sponsored guests can register

• Question 237:

  An engineer is enabling a newly configured wireless SSID for tablets and needs visibility into which other types of devices are connecting to it.

  What must be done on the Cisco WLC to provide this information to Cisco ISE?

  A. enable IP Device Tracking
  B. enable MAC filtering
  C. enable Fast Transition
  D. enable mDNS snooping
  A. enable IP Device Tracking

• Question 238:

  An engineer is starting to implement a wired 802.1X project throughout the campus. The task is for failed authentication to be logged to Cisco ISE and also have a minimal impact on the users. Which command must the engineer configure?

  A. authentication open
  B. pae dot1x enabled
  C. authentication host-mode multi-auth
  D. monitor-mode enabled
  D. monitor-mode enabled

  ---

  In the context of a wired 802.1X deployment with Cisco ISE, the requirement is to log failed authentications while minimizing user impact. Let's analyze each option: A. authentication open - This command configures the port to allow network access regardless of the authentication state. It's useful in situations where specific devices can't perform 802.1X authentication but should still be allowed network access. However, it doesn't specifically address the logging of failed authentications. B. pae dot1x enabled - PAE (Port Access Entity) refers to the entity on a network device that enforces access control. This command enables 802.1X on the port, which is a prerequisite for implementing 802.1X, but doesn't directly relate to logging failed authentication attempts. C. authentication host-mode multi-auth - This command configures the port to allow multiple authenticated sessions. This mode is used when multiple devices are connected to the same port (like in a conference room). While it's relevant for 802.1X environments, it doesn't specifically cater to logging failed authentications or minimizing user impact. D. monitor-mode enabled - This command is used in the context of 802.1X to enable Monitor Mode on a port. Monitor Mode allows a port to grant limited network access to endpoints without 802.1X capabilities. It's often used to ease the deployment of 802.1X by monitoring the authentication status without fully enforcing access control, thereby minimizing user impact. It also helps in logging authentication attempts, including failures. Given these options, the most appropriate command for logging failed authentications while having minimal impact on users would be D. monitor-mode enabled. This command ensures that authentication attempts are monitored and logged, including failures, without fully restricting access, thus minimizing the impact on users who might face issues with the authentication process.

• Question 239:

  What happens when an internal user is configured with an external identity store for authentication, but an engineer uses the Cisco ISE admin portal to select an internal identity store as the identity source?

  A. Authentication is redirected to the internal identity source.
  B. Authentication is redirected to the external identity source.
  C. Authentication is granted.
  D. Authentication fails.
  D. Authentication fails.

• Question 240:

  A network engineer must create a guest portal for wireless guests on Cisco ISE. The guest users must not be able to create accounts; however, the portal should require a username and password to connect. Which portal type must be created in Cisco ISE to meet the requirements?

  A. Custom Guest Portal
  B. Sponsored Guest Access
  C. Self Registered Guest Access D. Hotspot Guest Access
  B. Sponsored Guest Access