300-715 practice questions 111–120

1. Question 111 · 355 in bank

   A user changes the status of a device to stolen in the My Devices Portal of Cisco ISE. The device was originally onboarded in the BYOD wireless Portal without a certificate. The device is found later, but the user cannot re-onboard the device because Cisco ISE assigned the device to the Blocklist endpoint identity group. What must the user do in the My Devices Portal to resolve this issue?

   • AManually remove the device from the Blocklist endpoint identity group.
   • BChange the device state from Stolen to Not Registered.
   • CChange the BYOD registration attribute of the device to None.
   • DDelete the device, and then re-add the device.

   Show answer

   Answer: D

   Explanation

   The correct answer is D. Delete the device, and then re-add the device. When a device is marked as stolen in the My Devices Portal of Cisco ISE, it is automatically assigned to the Blocklist endpoint identity group. This group is used to prevent unauthorized devices from accessing the network. In order to resolve this issue and re-onboard the device, the user needs to delete the device from the My Devices Portal. This will remove it from the Blocklist endpoint identity group. Once deleted, the user can then re-add the device and go through the onboarding process again. Options A, B, and C are incorrect because they do not address the issue of being assigned to the Blocklist endpoint identity group. Manually removing the device from this group (option A) would require administrative access and may not be possible for a regular user. Changing the device state from stolen to not registered (option B) or changing the BYOD registration attribute of the device to none (option C) would not remove it from the Blocklist endpoint identity group.

   Source: Adapted from community discussion — faridh

   References

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   Next question

2. Question 112 · 355 in bank

   A security administrator is using Cisco ISE to create a BYOD onboarding solution for all employees who use personal devices on the corporate network. The administrator generates a Certificate Signing Request and signs the request using an external Certificate Authority server. Which certificate usage option must be selected when importing the certificate into ISE?

   • ARADIUS
   • BDLTS
   • CPortal
   • DAdmin

   Show answer

   Answer: C

   Explanation

   C - Portal. The certificate that resides on the PSN isn’t issued to the BYOD devices. It is used when setting up the trusted communication between the PSN and the device. Not only will you need to apply It to the portals but you will also need it for EAP https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0110.html#reference_3CE11FC8D0F14A3285E37D197B5646A3 Certificate Usage When you add or import a certificate in to Cisco ISE, you should specify the purpose for which the certificate is to be used: · Admin: For internode communication and authenticating the Admin portal · EAP: For TLS-based EAP authentication · RADIUS DTLS: For RADIUS DTLS server authentication · Portal: For communicating with all Cisco ISE end-user portals · xGrid: For communicating with the pxGrid controller

   Source: Adapted from community discussion — rhylos

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 113 · 355 in bank

   A network administrator must configure Cisco ISE Personas in the company to share session information via syslog. Which Cisco ISE personas must be added to syslog receivers to accomplish this goal?

   • Aadmin
   • Bpolicy services
   • Cmonitor
   • DpxGrid

   Show answer

   Answer: C

   Explanation

   C is correct-- all devices push event data to the Monitoring Persona database for event logging. This is temporary though, used for real time analysis & troubleshooting live sessions- the Monitoring Persona needs to push to the corporate syslog for long term storage & trend analysis as the monitoring database info wil eventually be overwritten.

   Source: Adapted from community discussion — THEODORABLE

   References

   • Cisco documentation

   Next question

4. Question 114 · 355 in bank

   DRAG DROP - An engineer needs to configure a compliance policy on Cisco ISE to ensure that the latest encryption software is running on the C drive of all endpoints. Drag and drop the configuration steps from the left into the sequence on the right to accomplish this task.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

5. Question 115 · 355 in bank

   What is a valid status of an endpoint attribute during the device registration process?

   • Ablock listed
   • Bpending
   • Cunknown
   • DDenyAccess

   Show answer

   Answer: B

   Explanation

   Device Registration Status Endpoint Attribute The state of the endpoint attribute DeviceRegistrationStatus changes during device registration to the following states. Registered: The device has been through BYOD flow, and it is registered. There is a 20-minute delay before the attribute changes from pending to registered. Pending: The device has been through BYOD flow, and it is registered. But, Cisco ISE has not seen it on the network. Not Registered: The device has not been through BYOD flow. Not Registered is the default state of the DeviceRegistrationStatus attribute. Stolen: The user logs onto the My Devices portal, and marks a currently onboarded device as Stolen.

   Source: Adapted from community discussion — XBfoundX

   References

   • Cisco documentation

   Next question

6. Question 116 · 355 in bank

   Select 2

   An administrator is configuring the Native Supplicant Profile to be used with the Cisco ISE posture agents and needs to test the connection using wired devices to determine which profile settings are available. Which two configuration settings should be used to accomplish this task? (Choose two.)

   • Aauthentication mode
   • Bproxy host/IP
   • Ccertificate template
   • Dsecurity
   • Eallowed protocol

   Show answer

   Answer: CE

   Explanation

   Create a Native Supplicant Profile to be Used in Client-Provisioning Policy You can create native supplicant profiles to enable users to bring personal devices to your Corporate network. Cisco ISE uses different policy rules for different operating systems. Each client provisioning policy rule contains a native supplicant profile, which specifies which provisioning wizard is to be used for which operating system. Before you begin Configure the CA certificate template in Cisco ISE. Open up TCP port 8905 and UDP port 8905 to enable client agents and supplicant provisioning wizard installation. For more information about port usage, see the "Cisco ISE Appliance Ports Reference" appendix in the Cisco Identity Services Engine Hardware Installation Guide. https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_basic_setup.html?bookSearch=true#task_EC5F388E5EEF47F3B5EAA20E00C26B90

   Source: Adapted from community discussion — Leogxn

   References

   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 117 · 355 in bank

   Which Cisco ISE solution ensures endpoints have the latest version of antivirus updates installed before being allowed access to the corporate network?

   • AThreat Services
   • BProfiling Services
   • CProvisioning Services
   • DPosture Services

   Show answer

   Answer: D

   Next question

8. Question 118 · 355 in bank

   Select 2

   An administrator is configuring posture assessment in Cisco ISE for the first time. Which two components must be uploaded to Cisco ISE to use Anyconnect for the agent configuration in a client provisioning policy? (Choose two.)

   • AAnyconnect network visibility module
   • BAnyconnect compliance module
   • CAnyConnectProfile.xml file
   • DAnyConnectProfile.xsd file
   • EAnyconnect agent image

   Show answer

   Answer: BE

   Explanation

   . **AnyConnect Compliance Module:** This module is responsible for performing posture assessment on the endpoint device. The Compliance Module checks for specific installation status of software and files on the endpoint devices, and provides a pass/fail status based on the predefined posture rules provided by the administrator. 👉 2. **AnyConnect Agent Image:** This software package contains the necessary files required for the Cisco AnyConnect Secure Mobility Client to connect to a VPN server. This software package enables users to connect to the VPN server for secure access to corporate resources. Different versions of the AnyConnect agent image may be required depending on the operating systems and versions of the client devices accessing the VPN server. Both of these components are required for posture assessment in Cisco ISE using AnyConnect agent configuration in a client provisioning policy

   Source: Adapted from community discussion — denverfly

   References

   • Cisco documentation

   Next question

9. Question 119 · 355 in bank

   An engineer is unable to use SSH to connect to a switch after adding the required CLI commands to the device to enable TACACS+. The device administration license has been added to Cisco ISE, and the required policies have been created. Which action is needed to enable access to the switch?

   • AThe ip ssh source-interface command needs to be set on the switch
   • B802.1X authentication needs to be configured on the switch.
   • CThe RSA keypair used for SSH must be regenerated after enabling TACACS+.
   • DThe switch needs to be added as a network device in Cisco ISE and set to use TACACS+.

   Show answer

   Answer: D

   Explanation

   Nope, you will not use tacacs for 802.1x authentication, only radius is used. In this case only scenario here that we got it that the switch is configured, policy are done but the Network Device is not added to the list of devices so ISE cannot communicate via tacacs for validating the sessions for that specific NAD.

   Source: Adapted from community discussion — XBfoundX

   References

   • Cisco documentation

   Next question

10. Question 120 · 355 in bank

    The IT manager wants to provide different levels of access to network devices when users authenticate using TACACS+. The company needs specific commands to be allowed based on the Active Directory group membership of the different roles within the IT department. The solution must minimize the number of objects created in Cisco ISE. What must be created to accomplish this task?

    • Aone shell profile and one command set
    • Bmultiple shell profiles and one command set
    • Cone shell profile and multiple command sets
    • Dmultiple shell profiles and multiple command sets

    Show answer

    Answer: C

    Explanation

    The last words of the questions are asking for minimize the object as mush as possible, I will go for C because I will give to the IT Departement one shell profile with privilage set to 15, and then I will create different commands set that will specify the commands that the IT Group can do based on who they are

    Source: Adapted from community discussion — XBfoundX

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 111. 355 questions available.