Question 151 · 355 in bank
Select 2Which two probes provide IP-to-MAC address binding information to the ARP cache in Cisco ISE? (Choose two.)
Show answer
Answer: BC
Implementing and Configuring Cisco Identity Services Engine (SISE)355 questions across 36 pages are complete and free, with no account or card.
355 questions in this bank
Free access · progress saved on this device
Which two probes provide IP-to-MAC address binding information to the ARP cache in Cisco ISE? (Choose two.)
Answer: BC
When configuring Active Directory groups, an administrator is attempting to retrieve a group that has a name that is ambiguous with another group. What must be done so that the correct group is returned?
Answer: A
An administrator has manually added the MAC address of a wireless device to the Blocklist Identity Group for testing. When the device connects to the wireless network it triggers the Wireless Block List Default rule, but the device is still allowed to access the wireless network. What additional step must be taken to resolve tissue?
Answer: B
The additional step that must be taken to resolve the issue of the wireless device being allowed to access the wireless network despite being in the Blocklist Identity Group is B. Enable SNMP with read and write access on the Cisco WLC. This is because the Wireless Block List Default rule uses the ANC (Adaptive Network Control) action of QUARANTINE, which requires SNMP communication between the ISE and the WLC to apply the ACL named BLACKHOLE to the wireless device. If SNMP is not enabled or configured correctly on the WLC, the ISE will not be able to send the CoA (Change of Authorization) request to the WLC and the wireless device will not be blocked. The other options are not correct. Option A is not relevant because URL redirection is not used for the Wireless Block List Default rule. Option C is not necessary because the ACL named BLACKHOLE is automatically created on the WLC when the ANC service is enabled on the ISE. Option D is not effective because the Access Type under the Authorization Profile only applies to wired devices, not wireless devices
Source: Adapted from community discussion — denverfly
What is the difference between how RADIUS and TACACS+ handle encryption?
Answer: B
In which two ways can users and endpoints be classified for TrustSec? (Choose two.)
Answer: AB
A & B Because "Static" and "Dynamic" are the two ways. VLAN = STATIC 802.1x, MAB, or web authentication = DYNAMIC Classification In order to use SGTs within your infrastructure, your devices must support SGTs. All Cisco switches and wireless controllers embedded with Cisco TrustSec technology support the assignment of SGTs. An SGT can be assigned dynamically or statically. Dynamic classification occurs via an authentication sequence, via 802.1x, MAB, or web authentication. When authentication isn’t available, static classification methods are necessary. In static classification the tag maps to some thing (an IP, subnet, VLAN, or interface) rather than relying on an authorization from the Cisco ISE. This process of assigning the SGT is defined as “classification.” These classifications are then transported deeper into the network for policy enforcement. https://www.cisco.com/c/dam/en/us/solutions/collateral/borderless networks/trustsec/C07-730151-00_overview_of_trustSec_og.pdf
Source: Adapted from community discussion — aaInman
Which CLI command must be configured on the switchport to immediately run the MAB process if a non-802 1X capable endpoint connects to the port?
Answer: A
The security engineer for a company has recently deployed Cisco ISE to perform centralized authentication of all network device logins using TACACSs+ against the local AD domain. Some of the other network engineers are having a hard time remembering to enter their AD account password instead of the local admin password that they have used for years. The security engineer wants to change the password prompt to “Use Local AD Password:” as a way of providing a hint to the network engineers when logging in. Under which page in Cisco ISE would this change be made?
Answer: D
You can change the TACACS+ Password Prompt sent by ISE on the Work Centers > Device Administration > Settings > Connection Settings page. You can change the TACACS+ Password Prompt sent by ISE on the Work Centers > Device Administration > Settings > Connection Settings page. https://community.cisco.com/t5/network-access-control/ise-device-management-tacacs-ssh-prompt/td-p/4158190#:~:text=You%20can%20change%20the%20TACACS%2B,%3E%20Settings%20%3E%20Connection%20Settings%20page.&text=07%3A57%20PM-,You%20can%20change%20the%20TACACS%2B%20Password%20Prompt%20sent%20by%20ISE,%3E%20Settings%20%3E%20Connection%20Settings%20page.
Source: Adapted from community discussion — XBfoundX
The 300 GB OVA templates for VMs are sufficient for which two dedicated Cisco ISE node types? (Choose two.)
Answer: CD
C:D / The 300 GB OVA templates are sufficient for Cisco ISE nodes that serve as dedicated Policy Service or pxGrid nodes
Source: Adapted from community discussion — IETF1
A network engineer has recently configured a remote branch router to authenticate to a centralized Cisco ISE server behind the corporate firewall using TACACS+. After making this configuration change, the engineer opened another SSH session to the router in order to verity that login attempts are now being sent to Cisco ISE, however that login attempt was unsuccessful. There are no connection attempts showing in the TACACS live log in Cisco ISE and the firewall administrator has verified that they see syslog and SNMP traffic destinated for the IP address of Cisco ISE, but no TACACS+ traffic. Which misconfiguration is the cause of the failed login?
Answer: C
Think C is the right answer. Even if the configured source interface is mismatched with IP of NAD in ISE, FW should see TACACS+ traffic. And the traffic should be reached to ISE and ISE just drop it because the source IP is not in its DB.
Source: Adapted from community discussion — daffy11
A user recently had their laptop stolen. IT has ordered a replacement device for the user and was able to obtain the MAC address of the device 04.57:47:34 35 0A from the vendor before it shipped. Which statement regarding adding MAC addresses to Cisco ISE is correct?
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-715 practice, question 151. 355 questions available.
Version 1.0.0. How we source questions