Cisco 300-715 Online Practice Questions and Exam Preparation

Cisco 300-715 Online Questions & Answers

• Question 61:

  An administrator is troubleshooting an endpoint that is supposed to bypass 802.1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB, however the endpoint cannot communicate because it cannot obtain an IP address.

  What is the problem?

  A. The endpoint is using the wrong protocol to authenticate with Cisco ISE.
  B. The 802.1X timeout period is too long.
  C. The DHCP probe for Cisco ISE is not working as expected.
  D. An ACL on the port is blocking HTTP traffic.
  B. The 802.1X timeout period is too long.

• Question 62:

  A network administrator must restrict sponsor account privileges for managing guest accounts on Cisco ISE for a new account that is being created. Sponsor groups currently exist for each business unit. The new sponsor that is being added must be restricted to only managing guest accounts created by sponsors from the same sponsor group. In which group must the new sponsor account be configured?

  A. GROUP_ACCOUNTS
  B. OWN_ACCOUNTS
  C. ALL_ ACCOUNTS
  D. ALL_EMPLOYEES
  B. OWN_ACCOUNTS

• Question 63:

  An administrator is configuring TACACS+ on a Cisco switch but cannot authenticate users with Cisco ISE. The configuration contains the correct key of Cisc039712287. but the switch is not receiving a response from the Cisco ISE instance What must be done to validate the AAA configuration and identify the problem with the TACACS+ servers?

  A. Check for server reachability using the test aaa group tacacs+ admin legacy command.
  B. Test the user account on the server using the test aaa group radius server CUCS user admin pass legacy command.
  C. Validate that the key value is correct using the test aaa authentication admin legacy command.
  D. Confirm the authorization policies are correct using the test aaa authorization admin drop legacy command.
  A. Check for server reachability using the test aaa group tacacs+ admin legacy command.

  ---

  Explanation Explanation/Reference:https://medium.com/training-course-ccna-security-210-260/ccna-security-part-3-implementing-aaa-in-cisco-ios-4b13ab285f51

• Question 64:

  Which three default endpoint identity groups does cisco ISE create? (Choose three)

  A. Unknown
  B. whitelist
  C. end point
  D. profiled
  E. block list
  A. Unknown
  D. profiled
  E. block list

  ---

  Default Endpoint Identity Groups Created for Endpoints Cisco ISE creates the following five endpoint identity groups by default: Blacklist, GuestEndpoints, Profiled, RegisteredDevices, and Unknown. In addition, it creates two more identity groups, such as Cisco-IP-Phone and Workstation, which are associated to the Profiled (parent) identity group. A parent group is the default identity group that exists in the system. https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_010101.html#ID1678

• Question 65:

  In which scenario does Cisco ISE allocate an Advanced license?

  A. guest services with dACL enforcement
  B. endpoint authorization using SGA enforcement
  C. dynamic device profiling
  D. high availability Administrator nodes
  C. dynamic device profiling

• Question 66:

  Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?

  A. DHCP server
  B. static IP tunneling
  C. override Interface ACL
  D. AAA override
  D. AAA override

• Question 67:

  A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed interface. Which command should be used to accomplish this task?

  A. cts authorization list
  B. cts role-based enforcement
  C. cts cache enable
  D. cts role-based policy priority-static
  B. cts role-based enforcement

• Question 68:

  What is a primary function of RADIUS compared to TACACS?

  A. RADIUS provides AAA for network access, whereas TACACS provides AAA for device administration.
  B. RADIUS supports command accounting, whereas TACACS supports only start/stop accounting.
  C. RADIUS supports multiple privilege levels, whereas TACACS supports only one privilege level.
  D. RADIUS supports command authorization, whereas TACACS provides no support for commands.
  A. RADIUS provides AAA for network access, whereas TACACS provides AAA for device administration.

• Question 69:

  Which term refers to an endpoint agent that tries to join an 802 1X-enabled network?

  A. EAP server
  B. supplicant
  C. client
  D. authenticator
  B. supplicant

  ---

  Explanation Explanation/Reference:https://www.oreilly.com/library/view/cisco-ise-for/9780133103632/ch16.html#:~:text=What%20is%20a%20supplicant%3F,networks%2C%20both%20wired%20and%20wireless.andtext=The%20802.1X%20transactions%20are,Identity% 20Services%20Engine%20(ISE).

• Question 70:

  A network engineer is implementing cisco ISE and needs to configure 802.1x. the ports settings are configured for port-based authentication. Which command should be used to complete this configuration?

  A. aaa authentication dot1x default group radius
  B. dot1x system-auth-control
  C. authentication port-control auto
  D. dot1x pae authenticator
  B. dot1x system-auth-control

  ---

  https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12- 2/31sg/configuration/guide/conf/dot1x.html#wp1133395