Cisco 300-715 Online Practice Questions and Exam Preparation

Cisco 300-715 Online Questions & Answers

• Question 71:

  A customer is concerned with the use of the issued laptops even when devices are not on the corporate network. Which agent continues to be operational even when the host is not on the Cisco ISE network?

  A. Cisco ISE Agent
  B. Cisco NAC Agent
  C. Cisco Custom Agent
  D. Cisco NAC Web Agent
  B. Cisco NAC Agent

• Question 72:

  What is a valid guest portal type?

  A. Sponsored-Guest
  B. My Devices
  C. Sponsor
  D. Captive-Guest
  A. Sponsored-Guest

  ---

  https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_01111.html

• Question 73:

  A network is going through major hardware upgrades and is using Cisco ISE for network access control. Network devices are being added and removed regularly and the Cisco ISE administrators want to track new network devices. Which probe must be enabled to provide this visibility for Cisco ISE?

  A. DHCP SPAN
  B. SNMP query
  C. SNMP trap
  D. NetFlow
  C. SNMP trap

• Question 74:

  A client with MAC address 04:77:10:14:67:AB connects to the network. The client does not support 802.1X. Which setting must be enabled in the Allowed Authentication Protocols list in your Authentication Policy for Cisco ISE Server to support MAB authentication for this MAC address?

  A. Process Host Lookup
  B. EAP-FAST
  C. EAP-TTLS
  D. MS-CHAPv2
  A. Process Host Lookup

• Question 75:

  An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE. but the devices do not change their access due to the new profile. What is the problem?

  A. In closed mode, profiling does not work unless CDP is enabled.
  B. The profiling probes are not able to collect enough information to change the device profile
  C. The profiler feed is not downloading new information so the profiler is inactive
  D. The default profiler configuration is set to No CoA for the reauthentication setting
  D. The default profiler configuration is set to No CoA for the reauthentication setting

• Question 76:

  An administrator must onboard MacOS endpoints that connect to Cisco switches using the BYOD portal in Cisco ISE. The authentication method must be configured to meet these requirements:

  1.

  Cisco ISE identifies itself by providing its identity certificate to the endpoint.

  2.

  The endpoint validates the Cisco ISE identity certificate.

  3.

  The endpoint provides its endpoint identity certificate, signed by Cisco ISE, to Cisco ISE.

  4.

  Cisco ISE confirms the endpoint certificate validity, and the endpoint is authorized onto the network.

  Which protocol must be configured?

  A. EAP-TLS
  B. EAP-GTC
  C. EAP-FAST
  D. EAP-TTLS
  A. EAP-TLS

  ---

  The described onboarding process requires mutual authentication between the endpoint and Cisco ISE using certificates. The Extensible Authentication Protocol - Transport Layer Security (EAP-TLS) protocol is the best choice because it supports: 1. Mutual Authentication: Cisco ISE presents its identity certificate to the endpoint, which validates it. The endpoint presents its identity certificate, signed by Cisco ISE, to the Cisco ISE server. 2. Certificate-Based Authentication: EAP-TLS relies on X.509 certificates for both the client and server, meeting the requirements outlined in the scenario. 3. Secure Communication: TLS ensures that communication between the client and server is encrypted and secure.

• Question 77:

  A network administrator is configuring authorization policies on Cisco ISE. There is a requirement to use AD group assignments to control access to network resources. After a recent power failure and Cisco ISE rebooting itself, the AD group assignments no longer work.

  What is the cause of this issue?

  A. The AD join point is no longer connected.
  B. The AD DNS response is slow.
  C. The certificate checks are not being conducted.
  D. The network devices ports are shut down.
  A. The AD join point is no longer connected.

  ---

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_2x.html#ID612

• Question 78:

  A network administrator is setting up wireless guest access and has been unsuccessful in testing client access. The endpoint is able to connect to the SSID but is unable to grant access to the guest network through the guest portal. What must be done to identify the problem?

  A. Use context visibility to verify posture status.
  B. Use the endpoint ID to execute a session trace.
  C. Use the identity group to validate the authorization rules.
  D. Use traceroute to ensure connectivity.
  B. Use the endpoint ID to execute a session trace.

  ---

  Explanation Explanation/Reference:https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_011001.html#concept _87916A77E8774545B36D0BB422429596

• Question 79:

  Which Cisco ISE solution ensures endpoints have the latest version of antivirus updates installed before being allowed access to the corporate network?

  A. Threat Services
  B. Profiling Services
  C. Provisioning Services
  D. Posture Services
  D. Posture Services

• Question 80:

  An engineer is migrating users from MAB to 802.1X on the network. This must be done during normal business hours with minimal impact to users. Which CoA method should be used?

  A. Port Bounce
  B. Port Shutdown
  C. Session Termination
  D. Session Reauthentication
  D. Session Reauthentication