300-715 practice questions 91–100

1. Question 91 · 355 in bank

   An administrator is adding network devices for a new medical building into Cisco ISE. These devices must be in a network device group that is identifying them as `Medical Switch` so that the policies can be made separately for the endpoints connecting through them. Which configuration item must be changed in the network device within Cisco ISE to accomplish this goal?

   • AChange the device profile to Medical Switch.
   • BChange the device type to Medical Switch.
   • CChange the device location to Medical Switch.
   • DChange the model name to Medical Switch.

   Show answer

   Answer: B

   Explanation

   INCORRECT! As I can see the style of your answers, you are probably using ChatGPT, which is connecting and mixing different things. DEVICE PROFILE (like Cisco, ArubaWireless, BrocadeWired, etc..) is used for definition of vendor specific parameters of the network device (NAD), so ISE can seamlessly cooperate with it (for ex. specifies how particular vendor treats MAB, CWA redirection, etc...). https://community.cisco.com/t5/security-knowledge-base/how-to-create-ise-network-access-device-profiles/ta-p/3631103 In this question, we just need to use "Device Type" (which is Network Device Group, like Location, etc...). - SISE ebook, page 192

   Source: Adapted from community discussion — NikoTomas

   References

   • cisco.com documentation

   Next question

2. Question 92 · 355 in bank

   An administrator is attempting to join a new node to the primary Cisco ISE node, but receives the error message "Node is Unreachable". What is causing this error?

   • AThe second node is a PAN node.
   • BNo administrative certificate is available for the second node.
   • CThe second node is in standalone mode.
   • DNo admin privileges are available on the second node.

   Show answer

   Answer: B

   Explanation

   Answer is Clearly B. You can join more than one ISE node together to create a multinode deployment, known commonly in the field as an ISE cube. It is important to understand that before any ISE nodes can be joined together, they must trust each other’s administrative certificate. Without that trust, you will receive a communication error stating that the “node was unreachable,” but the root cause is the lack of trust.

   Source: Adapted from community discussion — matan24

   Next question

3. Question 93 · 355 in bank

   DRAG DROP - Drag and drop the configuration steps from the left into the sequence on the right to install two Cisco ISE nodes in a distributed deployment.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   You configure the first node as "Primary" (from standalone) and then enable the personas (Enable Administration and Monitoring personas on the first node), followed by "Register the secondary node" and "Define personas for the secondary node"

   Source: Adapted from community discussion — Hereim

   

   Next question

4. Question 94 · 355 in bank

   Select 2

   An engineer wants to learn more about Cisco ISE and deployed a new lab with two nodes. Which two persona configurations allow the engineer to successfully test redundancy of a failed node? (Choose two.)

   • AConfigure one of the Cisco ISE nodes as the Health Check node.
   • BConfigure both nodes with the PAN and MnT personas only.
   • CConfigure one of the Cisco ISE nodes as the primary PAN and MnT personas and the other as the secondary.
   • DConfigure both nodes with the PAN, MnT, and PSN personas.
   • EConfigure one of the Cisco ISE nodes as the primary PAN and PSN personas and the other as the secondary.

   Show answer

   Answer: CD

   Explanation

   Another no brain question, this question is not clear at all, which type of redundancy wants to test the engineer? Unfortunally here we need to suppose the correct answer. if the engineer want to test redundancy between PAN node, then health check node for automatic failover is required, if automatic failover is not enabled you need to move to primary manually, entering on the Secondary Admin node gui.... So it really depends on how the """"engineer"""" wants to perform these test. If the engineer desire to test redundancy of PSN then he needs to configure NAD with primary and secondary radius server. If the engineer wants to test redundancy in general, so could be A&D or C&D I refuse to answer this nonsensical question.

   Source: Adapted from community discussion — ElCobra90

   Next question

5. Question 95 · 355 in bank

   Select 2

   

   Refer to the exhibit. Which two configurations are needed on a catalyst switch to add it as a network access device in a Cisco ISE that is being used for 802.1X authentications? (Choose two.)

   • Aradius server ISE1 address ipv4 192.168.255.17 auth-port 1645 acct-port 1646 key 7 0607542D5F4A0213034C1E0A1F0F2E2122733F3429000D12055A5A52
   • Btacacs server ISE1 address ipv4 192.168.255.15 auth-port 1645 acct-port 1646 key 7 0607542D5F4A0213034C1E0A1F0F2E2122733F3429000D12055A5A52
   • Cradius server ISE1 address ipv4 192.168.255.19 auth-port 1645 acct-port 1646 key 7 0607542D5F4A0213034C1E0A1F0F2E2122733F3429000D12055A5A52
   • Dtacacs server ISE1 address ipv4 192.168.255.18 auth-port 1645 acct-port 1646 key 7 0607542D5F4A0213034C1E0A1F0F2E2122733F3429000D12055A5A52
   • Eradius server ISE1 address ipv4 192.168.255.16 auth-port 1645 acct-port 1646 key 7 0607542D5F4A0213034C1E0A1F0F2E2122733F3429000D12055A5A52

   Show answer

   Answer: AC

   Explanation

   A & C are the answers! by the IPs you can tell only a,c,d are relevent (PSNs IPs). And the TACCACS command in D is incorrect, so it leave only A&C.

   Source: Adapted from community discussion — matan24

   Next question

6. Question 96 · 355 in bank

   The security team wants to secure the wired network. A legacy printer on the network with the MAC address 00:43:08:50:64:60 does not support 802.1X. Which setting must be enabled in the Allowed Authentication Protocols list in your Authentication Policy for Cisco ISE to support MAB for this MAC address?

   • AMS-CHAPv2
   • BEAP-TLS
   • CPAP
   • DProcess Host Lookup

   Show answer

   Answer: D

   Explanation

   D- https://www.linkedin.com/pulse/mac-authentication-bypass-priyanka-kumari/ When MAB is enabled on the switch interface, then the switch will do the following things The switch takes each new mac address and sends it to Radius Server in case of cisco we use ISE for authentication as radius server. Fills Radius Attributes (Username and Password) with MAC address. Fills Radius Attribute (Calling Station ID) with the MAC address. A ISE can authenticate MAB devices either based upon Calling Station ID or Username and Password. -- If Process Host Lookup is enabled on ISE then Authentication is done based upon Calling Station ID. --If Process Host Lookup Is disabled on ISE then Authentication is done based upon username/ password. In order to enable Process Host Lookup on ISE (Policy > Policy Elements > Results > Authentication > Allowed Protocols).

   Source: Adapted from community discussion — rhylos

   References

   • cisco.com documentation

   Next question

7. Question 97 · 355 in bank

   An organization is using Cisco ISE to provide AAA services to non-Cisco switches with IP phones connected. An engineer needs to use Profiling Services to authorize network access for IP phones that do not support 802.1X. What must be configured to accomplish this goal?

   • ADHCP
   • BSNMPTRAP
   • CSNMPQUERY
   • DRADIUS

   Show answer

   Answer: C

   Explanation

   I really don't know if it is SNMP Query or DHCP one. here there is a question about the DHCP probe not working and asking about the sensor feature. https://community.cisco.com/t5/network-access-control/dhcp-profiling-probe-not-working/td-p/4149653 The only poin that I have not get is that if the sensor feature for DHCP is mandatory or not. If it is then you just configure snmp between the PSN nodes and the NAD devices and you are done. The snmp probe will actually get LLDP/CDP information and some more about the device. You can get also useful informations with DHCP too, but if the sensor feature is mandatory and you do not have a Cisco switch you are not able to do so I think.

   Source: Adapted from community discussion — XBfoundX

   References

   • cisco.com documentation
   • cisco.com documentation

   Next question

8. Question 98 · 355 in bank

   Which type of identity store allows for creating single-use access credentials in Cisco ISE?

   • AOpenLDAP
   • BLocal
   • CPKI
   • DRSA SecurID

   Show answer

   Answer: D

   Explanation

   RSA Identity Sources Cisco ISE supports the RSA SecurID server as an external database. RSA SecurID two-factor authentication consists of the PIN of the user and an individually registered RSA SecurID token that generates single-use token codes based on a time code algorithm. A different token code is generated at fixed intervals (usually each at 30 or 60 seconds). The RSA SecurID server validates this dynamic authentication code. Each RSA SecurID token is unique, and it is not possible to predict the value of a future token based on past tokens. Thus, when a correct token code is supplied together with a PIN, there is a high degree of certainty that the person is a valid user. Therefore, RSA SecurID servers provide a more reliable authentication mechanism than conventional reusable passwords.

   Source: Adapted from community discussion — XBfoundX

   References

   • Cisco documentation

   Next question

9. Question 99 · 355 in bank

   A network engineer needs to deploy 802.1x using Cisco ISE in a wired network environment where thin clients download their system image upon bootup using PXE. For which mode must the switch ports be configured?

   • Aclosed
   • Brestricted
   • Cmonitor
   • Dlow-impact

   Show answer

   Answer: D

   Explanation

   Low-Impact Mode–This mode builds on the monitor mode. With open access in place, IP ACLs are used to control pre-authentication and post-authentication network access. A Pre-Auth ACL on the switch port controls network access before an endpoint can successfully authenticate. A named or downloadable ACL that is received from ISE grants specific level of access upon successful authentication. The Low-Impact mode is ideal for a Preboot Execution Environment (PXE) boot environments where thin clients have to download the operating system from the network before attempting network authentication. Since devices get IP address immediately after they connect to the network, and authentication may take place in parallel or later, we recommend that you do not make VLAN changes in the Low-Impact mode.

   Source: Adapted from community discussion — Cnoteone

   References

   • cisco.com documentation
   • cisco.com documentation

   Next question

10. Question 100 · 355 in bank

    An engineer is configuring static SGT classification. Which configuration should be used when authentication is disabled and third-party switches are in use?

    • AVLAN to SGT mapping
    • BIP Address to SGT mapping
    • CL3IF to SGT mapping
    • DSubnet to SGT mapping

    Show answer

    Answer: A

    Explanation

    B: IP-SGT: https://community.cisco.com/t5/security-knowledge-base/segmentation-strategy/ta-p/3757424: "The method of sending out IP to SGT mappings from ISE is particularly useful if the access switch does not support TrustSec"

    Source: Adapted from community discussion — Frankie_Boy

    References

    • cisco.com documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 91. 355 questions available.