Implementing and Configuring Cisco Identity Services Engine (SISE)355 questions across 36 pages are complete and free, with no account or card.
355 questions in this bank
Free access · progress saved on this device
What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?
Answer: A
primary keep working tested on my LAB in eve--ng read the question its say deregisters Answer is: A Secondary Restart pls correct the answer
Source: Adapted from community discussion — Cybersec1989
An organization wants to split their Cisco ISE deployment to separate the device administration functionalities from the main deployment. For this to work, the administrator must deregister any nodes that will become a part of the new deployment, but the button for this option is grayed out. Which configuration is causing this behavior?
Answer: D
D is correct-- you cannot de-register the Primary PAN. It is the persona you are currently configuring with the portal and it orchestrates the entire deployment.
Source: Adapted from community discussion — THEODORABLE
An engineer must configure Cisco ISE to provide internet access for guests in which guests are required to enter a code to gain network access. Which action accomplishes the goal?
Answer: A
Which two actions must be verified to confirm that the internet is accessible via guest access when configuring a guest portal? (Choose two.)
Answer: BE
but "guest user gets redirected to the authentication page when opening a browser" means that user has not registered yet...Am I wrong?
Source: Adapted from community discussion — leostor
An administrator made changes in Cisco ISE and needs to apply new permissions for endpoints that have already been authenticated by sending a CoA packet to the network devices. Which IOS command must be configured on the devices to accomplish this goal?
Answer: A
Enters dynamic authorization local server configuration mode and specifies a RADIUS client from which a device accepts Change of Authorization (CoA) and disconnect Configures the device as a AAA server to facilitate interaction with an external policy server. aaa server radius dynamic-author https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/xe-16-10/sec-usr-aaa-xe-16-10-book/sec-rad-coa.pdf
Source: Adapted from community discussion — XBfoundX
An engineer needs to configure Cisco ISE Profiling Services to authorize network access for IP speakers that require access to the intercom system. This traffic needs to be identified if the ToS bit is set to 5 and the destination IP address is the intercom system. What must be configured to accomplish this goal?
Answer: B
An engineer needs to configure a Cisco ISE server to issue a CoA for endpoints already authenticated to access the network. The CoA option must be enforced on a session, even if there are multiple active sessions on a port. What must be configured to accomplish this task?
Answer: A
I think A. "The profiler service issues a CoA with the Reauth option even though you have configured CoA with the Port Bounce option when you have multiple active sessions on a single port. This function potentially avoids disconnecting other sessions as might occur with the Port Bounce option." https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_prof_pol.html
Source: Adapted from community discussion — JimboOh
An administrator replaced a PSN in the distributed Cisco ISE environment. When endpoints authenticate to it, the devices are not getting the right profiles or attributes and as a result, are not hitting the correct policies. This was working correctly on the previous PSN. Which action must be taken to ensure the endpoints get identified?
Answer: C
An administrator must block access to BYOD endpoints that were onboarded without a certificate and have been reported as stolen in the Cisco ISE My Devices Portal. Which condition must be used when configuring an authorization policy that sets DenyAccess permission?
Answer: A
According to this documentation Lost and Stolen are different as Nonce have reported Stolen: The user logs onto the My Devices portal, and marks a currently onboarded device as Stolen. This happens: If the device was onboarded by provisioning a certificate and a profile, Cisco ISE revokes the certificate that was provisioned to the device, and assigns the device’s MAC address to the Blacklist endpoint identity group. That device no longer has network access. If the device was onboarded by provisioning a profile (no certificate), Cisco ISE assigns the device to the Blacklist endpoint identity group. The device still has network access, unless you create an authorization policy for this situation. For example, IF Endpoint Identity Group is Blacklist AND BYOD_is_Registered THEN DenyAccess. https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_byod.html
Source: Adapted from community discussion — XBfoundX
An engineer needs to configure a new certificate template in the Cisco ISE Internal Certificate Authority to prevent BYOD devices from needing to re-enroll when their MAC address changes. Which option must be selected in the Subject Alternative Name field?
Answer: B
Prior to Cisco Identity Services Engine (ISE) 3.1, ISE provisions the certificates to endpoints with MAC Addresses seen by ISE under SAN field. Because of Randomized MAC Address, Cisco ISE sees different MAC Address when on-boarding these endpoints through BYOD flow. So, there is going to be mismatch in MAC Address imprinted under Certificate’s SAN field, seen by ISE and actual MAC Address. From Cisco Identity Services Engine (ISE) 3.1 onwards, ISE can provision the Certificates with GUID along with MAC Address under SAN field so that administrator can track the endpoint through unique parameter (GUID) from Context Visibility .
Source: Adapted from community discussion — redpassion
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-715 practice, question 101. 355 questions available.
Version 1.0.0. How we source questions