Cisco 300-715 Online Practice Questions and Exam Preparation

Cisco 300-715 Online Questions & Answers

• Question 31:

  Which statement is true?

  A. A Cisco ISE Advanced license is perpetual in nature.
  B. A Cisco ISE Advanced license can be installed on top of a Base and/or Wireless license.
  C. A Cisco ISE Wireless license can be installed on top of a Base and/or Advanced license.
  D. A Cisco ISE Advanced license can be used without any Base licenses.
  B. A Cisco ISE Advanced license can be installed on top of a Base and/or Wireless license.

• Question 32:

  A Cisco ISE engineer is creating certificate authentication profile to be used with machine authentication for the network. The engineer wants to be able to compare the user-presented certificate with a certificate stored in Active Directory. What must be done to accomplish this?

  A. Add the subject alternative name and the common name to the CAP
  B. Use MS-CHAPv2 since it provides machine credentials and matches them to credentials stored in Active Directory.
  C. Configure the user-presented password hash and a hash stored in Active Directory for comparison.
  D. Enable the option for performing binary comparison.
  D. Enable the option for performing binary comparison.

• Question 33:

  Which profiling probe collects the user-agent string?

  A. DHCP
  B. AD
  C. HTTP
  D. NMAP
  C. HTTP

  ---

  Explanation

• Question 34:

  A company is deploying new Cisco switches on a local network. The network engineer must configure TACACS+ between the switches and Cisco ISE.

  What configuration value is mandatory on the switch and Cisco ISE?

  A. Authentication Profile
  B. CoA Port
  C. Shared Secret
  D. Key Encryption Key
  C. Shared Secret

• Question 35:

  Refer to the exhibit.

  

  An engineer needs to configure central web authentication on the Cisco Wireless LAN Controller to use Cisco ISE for all guests connected to the wireless network. The components are configured:

  1.

  Cisco Wireless LAN Controller

  2.

  authorization profile on the Cisco ISE

  3.

  authentication rule on the Cisco IS

  What must be configured next on the Cisco ISE?

  A. authorization rule
  B. authorization policy
  C. accounting profile
  D. authentication profile
  A. authorization rule

• Question 36:

  The security team identified a rogue endpoint with MAC address 00:46:91:02:28:4A attached to the network. Which action must security engineer take within Cisco ISE to effectively restrict network access for this endpoint?

  A. Configure access control list on network switches to block traffic.
  B. Create authentication policy to force reauthentication.
  C. Add MAC address to the endpoint quarantine list.
  D. Implement authentication policy to deny access.
  C. Add MAC address to the endpoint quarantine list.

  ---

  Cisco ISE provides a feature called Adaptive Network Control (ANC) that allows administrators to apply policies to endpoints based on their behavior or status1. One of the ANC policies is Quarantine, which restricts network access for an endpoint by assigning it to a limited-access VLAN or applying an access control list (ACL) on the switch port2. To use the Quarantine policy, the administrator must add the MAC address of the rogue endpoint to the endpoint quarantine list in ISE2. This will trigger a change of authorization (CoA) for the endpoint and apply the Quarantine policy. The other options are not effective for restricting network access for a rogue endpoint, as they do not use the ANC feature of ISE.

• Question 37:

  Which portal is used to customize the settings for a user to log in and download the compliance module?

  A. Client Profiling
  B. Client Endpoint
  C. Client Provisioning
  D. Client Guest
  C. Client Provisioning

• Question 38:

  Which two probes must be enabled for the ARP cache to function in the Cisco ISE profile service so that a user can reliably bind the IP address and MAC addresses of endpoints? (Choose two.)

  A. NetFlow
  B. SNMP
  C. HTTP
  D. DHCP
  E. RADIUS
  D. DHCP
  E. RADIUS

  ---

  Cisco ISE implements an ARP cache in the profiling service, so that you can reliably map the IP addresses and the MAC addresses of endpoints. For the ARP cache to function, you must enable either the DHCP probe or the RADIUS probe. The DHCP and RADIUS probes carry the IP addresses and the MAC addresses of endpoints in the payload data. The dhcp-requested address attribute in the DHCP probe and the Framed-IP-address attribute in the RADIUS probe carry the IP addresses of endpoints, along with their MAC addresses, which can be mapped and stored in the ARP cache. https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html

• Question 39:

  When configuring Active Directory groups, what does the Cisco ISE use to resolve ambiguous group names?

  A. MIB
  B. TGT
  C. OMAB
  D. SID
  D. SID

• Question 40:

  An employee logs on to the My Devices portal and marks a currently on-boarded device as `Lost'.

  A. Certificates provisioned to the device are not revoked
  B. BYOD Registration status is updated to No
  C. The device access has been denied
  D. BYOD Registration status is updated to Unknown.
  E. The device status is updated to Stolen
  A. Certificates provisioned to the device are not revoked
  C. The device access has been denied

  ---

  Explanation Explanation/Reference:https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01111.html