Question 1 · 355 in bank
Which personas can a Cisco ISE node assume?
Show answer
Answer: C
Implementing and Configuring Cisco Identity Services Engine (SISE)355 questions across 36 pages are complete and free, with no account or card.
355 questions in this bank
Free access · progress saved on this device
Which personas can a Cisco ISE node assume?
Answer: C
A network engineer must enforce access control using special tags, without re-engineering the network design. Which feature should be configured to achieve this in a scalable manner?
Answer: C
C is correct. SGT= Scalable (Security) Group Tags using SGACL. The key in the question is: must enforce access control using special tags. If you paid attention in the training class you would know this!
Source: Adapted from community discussion — THEODORABLE
An engineer is configuring Cisco ISE and needs to dynamically identify the network endpoints and ensure that endpoint access is protected. Which service should be used to accomplish this task?
Answer: B
The answer is profiling. The profiling service in Cisco ISE dynamically identifies network endpoints and collects information about them, such as their IP address, MAC address, operating system, and applications. This information is then used to create a profile for each endpoint. The profile is used by Cisco ISE to make decisions about how to authenticate, authorize, and account for the endpoint. The profiling service can be used to protect endpoint access in a variety of ways. For example, the profiling service can be used to: Block access to the network for endpoints that are not known or that are not compliant with security policies. Restrict access to the network for endpoints that are running unapproved applications. Monitor the behavior of endpoints on the network and take action if an endpoint is behaving in a suspicious manner.
Source: Adapted from community discussion — denverfly
A Cisco ISE server sends a CoA to a NAD after a user logs in successfully using CWA. Which action does the CoA perform?
Answer: C
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html On the WLC this can be seen in AAA all debugs. *radiusCoASupportTransportThread: audit session ID recieved in CoA = 0a6a207a0000000b5fe90410 *radiusCoASupportTransportThread: Received a 'CoA-Request' from 10.106.32.25 port 23974 *radiusCoASupportTransportThread: CoA - Received IP Address : 10.106.32.122, Vlan ID: (received 0) *radiusCoASupportTransportThread: d0:37:45:89:ef:64 Calling-Station-Id ---> d0:37:45:89:ef:64 *radiusCoASupportTransportThread: Handling a valid 'CoA-Request' regarding station d0:37:45:89:ef:64 *radiusCoASupportTransportThread: Sending Radius CoA Response packet on srcPort: 1700, dpPort: 2, tx Port: 23974 *radiusCoASupportTransportThread: Sent a 'CoA-Ack' to 10.106.32.25 (port:23974) After this the client is reauthenticated and granted access to the network.
Source: Adapted from community discussion — johndelorien
A new employee just connected their workstation to a Cisco IP phone. The network administrator wants to ensure that the Cisco IP phone remains online when the user disconnects their workstation from the corporate network. Which CoA configuration meets this requirement?
Answer: A
"The Reauth option may be sufficient for cases where no VLAN or address change is expected following reauthorization of the current session. If multiple endpoints are detected on a wired switchport, ISE will automatically revert to using the Reauth option to avoid service disruption of other connected devices. A common example is a workstation connected to an IP phone where a port bounce would interrupt communications for both workstation and phone." https://community.cisco.com/t5/security-knowledge-base/ise-profiling-design-guide/ta-p/3739456
Source: Adapted from community discussion — IlPerdan0
An organization is adding new profiling probes to the system to improve profiling on Cisco ISE. The probes must support a common network management protocol to receive information about the endpoints and the ports to which they are connected. What must be configured on the network device to accomplish this goal?
Answer: D
Reference: https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
An administrator is trying to collect metadata information about the traffic going across the network to gain added visibility into the hosts. This information will be used to create profiling policies for devices using Cisco ISE so that network access policies can be used. What must be done to accomplish this task?
Answer: B
The answer is - Configure NetFlow to be sent to the Cisco ISE appliance. NetFlow is a network protocol that allows network devices to collect and export flow data. This data can be used to gain insights into network traffic, such as the source and destination IP addresses, the ports used, and the amount of traffic. Cisco ISE can be configured to receive NetFlow data. This data can then be used to create profiling policies for devices. These policies can be used to control access to the network, such as which devices are allowed to access certain resources.
Source: Adapted from community discussion — denverfly
There are several devices on a network that are considered critical and need to be placed into the ISE database and a policy used for them. The organization does not want to use profiling. What must be done to accomplish this goal?
Answer: A
An administrator is configuring a new profiling policy within Cisco ISE. The organization has several endpoints that are the same device type, and all have the same Block ID in their MAC address. The profiler does not currently have a profiling policy created to categorize these endpoints, therefore a custom profiling policy must be created. Which condition must the administrator use in order to properly profile an ACME AI Connector endpoint for network access with MAC address 01:41:14:65:50:AB?
Answer: D
They are surely talking about the EndPoints here, called station id was for the WLC (NAD). In this case, since they mentioned all the endpoints are same type and make, it makes more sense to go with option D.
Source: Adapted from community discussion — Hereim
Users in an organization report issues about having to remember multiple usernames and passwords. The network administrator wants the existing Cisco ISE deployment to utilize an external identity source to alleviate this issue. Which two requirements must be met to implement this change? (Choose two.)
Answer: AC
Here the administrator will use AD as the third party identity source. Here there are the prerequisite asked for this: Join ISE to AD Prerequisites for Active Directory and ISE integration Verify that you have the privileges of a Super Admin or System Admin in ISE. Use the Network Time Protocol (NTP) server settings to synchronize the time between the Cisco server and Active Directory. The maximum allowed time difference between ISE and AD is 5 minutes The configured DNS on ISE must be able to answer SRV queries for DCs, GCs, and KDCs with or without additional Site information. Ensure that all the DNS servers can answer forward and reverse DNS queries for any possible Active Directory DNS domain. AD must have at least one global catalog server operational and accessible by Cisco, in the domain to which you join Cisco. Below the link: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215233-identity-service-engine-ise-and-active.html
Source: Adapted from community discussion — XBfoundX
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-715 practice, question 1. 355 questions available.
Version 1.0.0. How we source questions