300-715 practice questions 131–140

1. Question 131 · 355 in bank

   An administrator must enable scanning for specific endpoints when they attempt to access the network. The scanning must be triggered as a result of successful authentication. Which action accomplishes this task?

   • AModify the authorization policy to send init_endpoint_scan as a result to the authenticator.
   • BCreate an authorization profile with scanning enabled and add it to the authorization policy that the endpoints will hit.
   • CAdd an entry in the authentication conditions to allow only scanned endpoints access, then redirect everything else to the portal to initiate the scan.
   • DConfigure the endpoint scanning probe to profile the endpoint correctly and assign it a risk score.

   Show answer

   Answer: A

   Explanation

   In this case the answer B may be fine: The authorization profile in Cisco ISE now includes an option to scan endpoints for vulnerabilities. You can choose to run the scan periodically and also specify the time interval for these scans. https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_21_chapter_0100011.html.xml#:~:text=The%20authorization%20profile%20in%20Cisco,time%20interval%20for%20these%20scans.

   Source: Adapted from community discussion — XBfoundX

   References

   • cisco.com documentation

   Next question

2. Question 132 · 355 in bank

   How is policy services node redundancy achieved in a deployment?

   • Aby creating a node group
   • Bby deploying both primary and secondary node
   • Cby enabling VIP
   • Dby utilizing RADIUS server list on the NAD

   Show answer

   Answer: A

   Explanation

   Hello yes, the answer is D. Node groups don't necessarily provide HA for your NADs, they just share extra information about endpoints with other nodes on the same L2 domain. They have a basic monitor role of their peers so that they can help client authentication recover when a node fails mid web redirect. The HA and impact of an upgrade is dependent on how you have the radius servers configured on the NAD, not the node groups. If you want HA during an upgrade you still need to make sure you have at least two radius servers configured on each NAD, and at least one of those servers is online and able to authenticate endpoints. If you go look up the CiscoLive.com library session BRKSEC-3699, there is a detailed section on the function of node groups in the reference slide deck.

   Source: Adapted from community discussion — kapplejacks

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 133 · 355 in bank

   What is a function of client provisioning?

   • AIt checks the existence, date, and versions of the file on a client.
   • BIt checks a dictionary attribute with a value.
   • CIt ensures that endpoints receive the appropriate posture agents.
   • DIt ensures an application process is running on the endpoint.

   Show answer

   Answer: C

   Next question

4. Question 134 · 355 in bank

   A network engineer responsible for the switching environment must provision a new switch to properly propagate security group tags within the TrustSec inline method. Which CLI command must the network engineer enter on the switch to globally enable the tagging of SGTs?

   • Acts sxp enable
   • Bcts manual
   • Ccts role-based sgt-map
   • Dcts role-based enforcement

   Show answer

   Answer: B

   Explanation

   Correct is D: "cts role-based enforcement" Ebook SISE: "Configuring Manual SGT Propagation on Cisco IOS XE Switches This section discusses the configuration of SGT propagation on access-layer switches such as the Catalyst 9300 and 9500 switches that have the ability to use native tags. Step 1. Enable Cisco TrustSec role-based enforcement on the switch: CAT9300(config)# cts role-based enforcement This GLOBALLY ENABLES THE TAGGING of frames. It also makes it possible to enforce SGACLs... Without this command in the global configuration, the switch does not tag the Layer 2 traffic." Example 17-4 Enabling Tagging on a 9300 Series Access Switch C9300(config)# cts role-based enforcement C9300(config)# interface g1/0/1 C9300(config-if)# cts manual C9300(config-if-cts-manual)# policy static sgt 2 trusted --- Confusing is that Cisco do not mention a word regarding tagging activation in the command reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/17-3/command_reference/b_173_9500_cr/cisco_trustsec_commands.html#wp2692401855

   Source: Adapted from community discussion — NikoTomas

   References

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   Next question

5. Question 135 · 355 in bank

   Due to a recent network incident, all access to network devices must be centrally logged and tracked in Cisco ISE. On which nodes must the Device Admin service be enabled?

   • Aone PAN
   • Beach PSN
   • Ceach PAN
   • Done PSN

   Show answer

   Answer: B

   Next question

6. Question 136 · 355 in bank

   MacOS users are complaining about having to read through wordy instructions when remediating their workstations to gain access to the network. Which alternate method should be used to tell users how to remediate?

   • Afile distribution
   • Bexecutable
   • Cmessage text
   • DURL link

   Show answer

   Answer: D

   Next question

7. Question 137 · 355 in bank

   A client connects to a network and the authenticator device learns the MAC address 04:49:23:86:34:AB of this client. After the MAC address is learned, the 802.1 x authentication process begins on this port. Which ISE deployment mode restricts all traffic initially, applies a rule for access control if 802.1x authentication is successful, and can be configured to grant only limited access if 802.1 x authentication is unsuccessful?

   • Aopen mode
   • Bmonitor mode
   • Cclosed mode
   • Dlow-impact mode

   Show answer

   Answer: C

   Explanation

   C. closed mode Here's why closed mode is the correct choice: Closed Mode: In this mode, the switch port initially restricts all traffic (except EAP and potentially DHCP and CDP/LLDP) until the client successfully completes 802.1X authentication. After successful authentication, access control rules defined in Cisco ISE are applied based on policies configured in the authorization profile. If 802.1X authentication fails, the port can be configured to grant limited access or no access at all, depending on the specific configuration. https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

   Source: Adapted from community discussion — ZoneHacker

   References

   • cisco.com documentation

   Next question

8. Question 138 · 355 in bank

   An organization has a SGACL locally configured on a switch port, but when a user in the Executives group connects to the network, they receive a different level of network access than expected. When Cisco ISE pushes SGACLs to the switch after the authorization phase, how does the switch decide which access to grant the user?

   • ADynamically downloaded policies override local policies in all cases.
   • BLocal policies override dynamically downloaded policies in all cases.
   • CThe policies are merged, but local policies receive priority.
   • DThe policies are merged, but dynamically downloaded policies receive priority.

   Show answer

   Answer: A

   Explanation

   An SGACL policy downloaded dynamically from the Cisco Secure ACS or a Cisco ISE will override any conflicting locally-defined policy. https://content.cisco.com/chapter.sjs?uri=%2Fsearchable%2Fchapter%2Fcontent%2Fen%2Fus%2Ftd%2Fdocs%2Fswitches%2Flan%2Fcatalyst9500%2Fsoftware%2Frelease%2F16-11%2Fconfiguration_guide%2Fcts%2Fb_1611_cts_9500_cg%2Fm9-1611-trustsec-sgacl-policies.html.xml&platform=Cisco%20Catalyst%209500%20Series%20Switches&release=IOS%20XE%20Gibraltar%2016.11.x#concept_wrg_5pl_2gb

   Source: Adapted from community discussion — Jor466077

   References

   • cisco.com documentation

   Next question

9. Question 139 · 355 in bank

   Select 2

   An administrator is configuring endpoint profiling and needs to enable CoA for devices that change profiles. Which two actions must be taken to accomplish this goal? (Choose two.)

   • AEnsure that the firewall is not blocking port 1700
   • BDefine "reauth" in the default CoA action to be used
   • CUse an API to detect when profile changes occur and send instructions to ISE to provide a CoA
   • DModify the RADIUS endpoint attribute filters to send CoA actions as the profiles change
   • EEnable the CoA policy and create rules for each type

   Show answer

   Answer: AB

   Next question

10. Question 140 · 355 in bank

    A Cisco ISE administrator is setting up Central Web Authentication to be used for user endpoint authentication. The client cannot reach the guest portal to log in and gain access, but DNS is functioning properly and the guest portal is enabled. What else must be configured to gain access?

    • AAllow port TCP/8443 on the firewall.
    • BConfigure HTTP to HTTPS redirection.
    • CConfigure the guest portal to listen on TCP/8443.
    • DAllow redirection from any client IP range.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 131. 355 questions available.