Implementing and Configuring Cisco Identity Services Engine (SISE)355 questions across 36 pages are complete and free, with no account or card.
355 questions in this bank
Free access · progress saved on this device
An administrator is configuring an AD domain to be used with authentication for endpoints and users within Cisco ISE. Which two steps are required to configure this to be used as an external identity store? (Choose two.)
Answer: DE
A network engineer is attempting to terminate and reinitialize wireless user sessions individually by using the Live Sessions tab in Cisco ISE. Cisco ISE and the Cisco WLC are separated by a firewall. Which port must be allowed on the firewall so that the network engineer can perform this function from Cisco ISE?
Answer: C
An engineer is configuring Central Web Authentication in Cisco ISE to provide guest access. When an authentication rule is configured in the Default Policy Set for the Wired_MAB or Wireless_MAB conditions, what must be selected for the “if user not found” setting?
Answer: D
Which two fields are available when creating an endpoint on the context visibility page of Cisco ISE? (Choose two.)
Answer: CD
Looking at my production environment I see 'Static assignment - Policy Assignment' and 'Static group assignment - Identity Group Assignment.
Source: Adapted from community discussion — Cnoteone
A network engineer is configuring a new certificate template on the internal CA within Cisco ISE to provision certificates to BYOD devices that must be enrolled in the network. What must be configured in the SAN field of the certificate to identify the devices after enrollment?
Answer: A
ISE also auto populates endpoint MAC address in to the certificate SAN field. The endpoint MAC address is collected during initial authentication of the endpoint either via MAB or 802.1X and embedded in to the certificate for security purpose. By doing so, ISE policy can be crafted to match the actual endpoint MAC address and the certificate MAC address to prevent BYOD issued certificates from being used for other endpoint other than the one that was issued for. https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867
Source: Adapted from community discussion — XBfoundX
An engineer is configuring a new Cisco ISE node. The Device Admin service must run on this node to handle authentication requests for network device access via TACACS+. Which persona must be enabled on this node to perform this function?
Answer: C
Answer C: Enable Device Admin persona on PSN nodes Navigate to Work Centers > Administration > System > Deployment and select your PSN node(s)
Source: Adapted from community discussion — Japski
An engineer has been tasked with using Cisco ISE to restrict network access at the switchport level using 802.1X authentication. Users who fail 802.1X authentication should e redirected via web redirection and have their access restricted via an ACL. What must be configured in Cisco ISE to accomplish this task?
Answer: A
As mentioned below in the authorization profile in the common task you mention the guest portal/BYOD portal/Hotspot portal ecc... In this case you just choose hotspot or guest portal, in the common task specifying the ACL in the NAD device WLC/Switch. After that you also specify a dACL created before that give access only to ISE for the web authentication so permit DHCP/DNS/TFTP (in some cases tftp) and redirect http
Source: Adapted from community discussion — XBfoundX
A Cisco ISE engineer is creating certificate authentication profile to be used with machine authentication for the network. The engineer wants to be able to compare the user-presented certificate with a certificate stored in Active Directory. What must be done to accomplish this?
Answer: D
Which two statements regarding Zero Touch Provisioning (ZTP) on Cisco ISE are correct? (Choose two.)
Answer: DE
E) - Linux needed: "Creating the ISE Zero Touch Provisioning (ZTP) Image File --> This requires Access to a Linux system with sudo or root permissions. " https://community.cisco.com/t5/security-knowledge-base/ise-zero-touch-provisioning-ztp/ta-p/4541606 --- INCORRECT for sure: A) - All passwords must be encrypted... "Only Plain password type is supported in the configuration file. Encrypted/hashed password in the key-value pair file for the ‘admin’ account is not supported." (community link above) "As a security measure, since the ZTP configuration is PLAIN TEXT and contains the ISE Administrator level password, when using ZTP on ISE 3.2 and newer, you will be required to change your password the first time you log in to the Web Interface (GUI)." https://www.cisco.com/c/en/us/td/docs/security/ise/3-2/install_guide/b_ise_installationGuide32/b_ise_InstallationGuide32_chapter_4.html#first-login-password-change --- C) – ZTP is supported on many virtualization platforms (community link above) D) – ZTP is supported on physical SNS appliances as well (community link above)
Source: Adapted from community discussion — NikoTomas
An administrator needs to add a new third party network device to be used with Cisco ISE for Guest and BYOD authorizations. Which two features must be configured under Network Device Profile to achieve this? (Choose two.)
Answer: CE
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-715 practice, question 141. 355 questions available.
Version 1.0.0. How we source questions