Implementing and Configuring Cisco Identity Services Engine (SISE)355 questions across 36 pages are complete and free, with no account or card.
355 questions in this bank
Free access · progress saved on this device
What is the maximum number of PSN nodes supported in a medium-sized deployment?
Answer: C
C is correct. in a medium size deployment the ADMIN & MNT persona are colocated on the same chassis which operationally limits the supported distributed PSN count to 5 (although I like IlPerdan0 comment, remember this is a cisco exam so expect the questions to be on ld revisions mostly!)
Source: Adapted from community discussion — THEODORABLE
What are two differences of TACACS+ compared to RADIUS? (Choose two.)
Answer: BD
TACACS+ encrypts the full packet payload TACACS+ uses a connection-oriented transport protocol (TCP), whereas RADIUS uses a connectionless transport protocol (UDP)
Source: Adapted from community discussion — Hackerock
Which two authentication protocols are supported by RADIUS but not by TACACS+? (Choose two.)
Answer: CE
The supported RADIUS authentication protocols are PAP, CHAP, MSCHAP, MSCHAP2, and EAP-MD5. The supported TACACS+ authentication protocols are ASCII, PAP, CHAP, and MSCHAP.
Source: Adapted from community discussion — Cnoteone
An engineer configured posture assessment for their network access control with the goal of using an agent that supports using service conditions for the assessment. The agent should run as a background process to avoid user interruption, but the user can see it when it is run. What is the problem?
Answer: A
Anyconnect Stealth does not support remediation that requires gui or client/manual interaction. Temporal is not clientless. It must be that hey deployed the wrong agent.
Source: Adapted from community discussion — thol119
An engineer is deploying Cisco ISE to use 802.1X authentication for controlling access to the company's wired network. The request from company management is to minimize the impact on users during the rollout of 802.1X on the company switches. Which mode must be used first in a phased 802.1X deployment to fulfill this request?
Answer: A
I agree with thol119: Although this mode authenticates the end devices and users (supplicants), traffic is not impacted if authentication fails. In monitor mode, IEEE 802.1x and MAB are enabled, but access is open to all users. To allow hosts to gain access to a controlled port, configure multi-authentication host mode and open authentication. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-1/best_practices_guide/BP_Cat3850/BP_wired_security.pdf
Source: Adapted from community discussion — XBfoundX
An engineer needs to create a Self-Registered Guest Portal in Cisco ISE in which guest users receive their passwords via SMS. Which two settings must be configured to accomplish this task? (Choose two.)
Answer: AB
Refer to the exhibit. Which checkbox must be enabled to allow Cisco ISE to publish group membership information for active users that can be shared with Cisco Firepower devices?
Answer: D
To configure BYOD using Cisco ISE. an administrator is considering issuing certificates to the devices connecting to provide a better user experience. External CA servers cannot be used for this purpose because everything must be local to the Cisco ISE. What must be done to accomplish this?
Answer: C
PKI and ISE Internal CA Although issuing signed certificates to the endpoints for BYOD is optional, many customers will consider issuing certificates to the endpoints as it provides better security and user experience for subsequent connections. When ISE is installed the internal CA is installed and enabled by default. Here are the characteristics of ISE internal CA. - Primary Admin node is the root CA - Both primary and Secondary admin node is also Sub-CA of the root called Node_CA. This added layer of hierarchy allows single root hierarchy which simplifies the deployment when new PSNs are added while the primary node is not the active admin node
Source: Adapted from community discussion — XBfoundX
An engineer must configure an HTTP probe on a Cisco ISE virtual appliance running on VMWare using a dedicated interface for profiling. The interface is assigned to the VM Network port group. The engineer is logged into the hypervisor with a user account that only provides access to the Cisco ISE VM and the network settings for the VM. Which security setting must be changed for this interface to accept SPAN traffic?
Answer: C
In VMWare Promiscious mode can be specified at the portgroup level or vSwitch level, it does not inherit. If the user does not have access to all settings then it must be port group, as vSwitch is global settings.
Source: Adapted from community discussion — thol119
An administrator is configuring MAB and needs to create profiling policies to support devices that do not match the built-in profiles. Which two steps must the administrator take in order to use these new profiles in authorization policies? (Choose two.)
Answer: DE
DE should be fine: When you create a new policy for matching specific rule conditions you can also let this policy create a new identity group that is gonna insert the mac-addresses of the profiled endpoint to that group. After that we need to configure a new authorization policy by using the attribute logical profile and the logical profile is just the policy that inside have the set of rules and conditions for profiling endpoints. so In the authorization policy you have the logical profile and the result, after that policy got a match the endpoint will get a result by the NAD device and the mac-address of this endpoint is set into the identity group specified in the policy
Source: Adapted from community discussion — XBfoundX
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-715 practice, question 121. 355 questions available.
Version 1.0.0. How we source questions