300-715 practice questions 161–170

1. Question 161 · 355 in bank

   Select 2

   Which two tasks must be completed when configuring the Cisco ISE BYOD Portal? (Choose two.)

   • AEnable policy services.
   • BCreate endpoint identity groups.
   • CCustomize device portal.
   • DProvision external identity sources.
   • EDeploy client provisioning portal.

   Show answer

   Answer: AB

   Explanation

   Answer for me is A and D. B is not needed: Employees can add and manage new devices by entering the MAC address for the device. When employees add devices using the My Devices portal, Cisco ISE adds the devices to the Endpoints window (Administration > Context Visibility > Endpoints) as members of the RegisteredDevices endpoint identity group (unless already statically assigned to a different endpoint identity group). The devices are profiled like any other endpoint in Cisco ISE and go through a registration process for network access. C is not a must you don't need to customize the BYOD portal for let it work properly. D is not a must, you only need to use .exe provisioned by ISE for automatically download the certificate E for me is a must because you need to configure the client provisioning portal correctly without it the clients will not get the certificate having pushed down the file that can be downloaded to the BYOD portal.

   Source: Adapted from community discussion — XBfoundX

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

2. Question 162 · 355 in bank

   Select 2

   An administrator is configuring posture assessment in Cisco ISE for the first time. Which two components must be uploaded to Cisco ISE to use Secure Client for the agent configuration in a client provisioning policy? (Choose two.)

   • ASecureClientProtie.xsd file
   • BSecure Client compliance module
   • CSecure Client agent image
   • DSecureClientProfie.xml file
   • ESecure Client network visibility module

   Show answer

   Answer: BC

   Explanation

   actually, "An administrator can choose to use the standalone editor to create the posture profile and then upload it to ISE"

   Source: Adapted from community discussion — leostor

   Next question

3. Question 163 · 355 in bank

   Which Cisco ISE module contains a list of vendor names, product names, and attributes provided by OPSWAT?

   • ACompliance Module
   • BClient Provisioning Module
   • CEndpoint Security Module
   • DPosture Module

   Show answer

   Answer: A

   Explanation

   The compliance module contains a list of fields, such as vendor name, product version, product name, and attributes provided by OPSWAT that supports Cisco ISE posture conditions. https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010001.html#:~:text=The%20compliance%20module%20contains%20a,supports%20Cisco%20ISE%20posture%20conditions.

   Source: Adapted from community discussion — G0909

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 164 · 355 in bank

   Select 2

   Which two statements are correct regarding the differences between RADIUS and TACACS+? (Choose two.)

   • ARADIUS encrypts the entire packet, whereas TACACS+ only encrypts the password field.
   • BRADIUS primary use is for network access, whereas TACACS+ primary use is for device administration.
   • CRADIUS combines the authentication and authorization functions, whereas TACACS+ separates them.
   • DRADIUS uses TCP as the transmission protocol, whereas TACACS+ uses both UDP and TCP protocols.
   • ERADIUS supports full command logging, whereas TACACS+ does not provide any command logging.

   Show answer

   Answer: BC

   Next question

5. Question 165 · 355 in bank

   A new Cisco ISE infrastructure is being built to provide network access control. If Cisco Discovery Protocol is used, what information is being gathered in relation to profiling with Cisco ISE?

   • AIdentityGroup
   • Bdevice ID
   • CRADIUS session attributes
   • DDHCP session attributes

   Show answer

   Answer: B

   Explanation

   Answer: B – device ID SISE ebook: When querying a NAD, ISE looks for interface data (such as which interface or which VLAN), session data (if the interface is Ethernet), and Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP) data (if these protocols are enabled). CDP and LLDP data can be very useful in identifying a device type by its registered capabilities and similar attributes. Cisco ISE uses !!! SNMP !!! to query NAD for CDP and LLDP data. Device sensor config for CDP usage: --- Create a list for CDP and configure the device name, version type, capabilities type, and platform type, as demonstrated here: CAT9300(config)#device-sensor filter-list cdp list CAT9300(config-sensor-cdplist)#tlv name device-name CAT9300(config-sensor-cdplist)#tlv name platform-type CAT9300(config-sensor-cdplist)#tlv name version-type CAT9300(config-sensor-cdplist)#tlv name capabilities-type

   Source: Adapted from community discussion — NikoTomas

   Next question

6. Question 166 · 355 in bank

   When configuring Active Directory groups, what does the Cisco ISE use to resolve ambiguous group names?

   • AMIB
   • BSID
   • CMAB
   • DTGT

   Show answer

   Answer: B

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/ise_active_directory_integration/b_ISE_AD_integration_2x.html

   Source: Adapted from community discussion — THEODORABLE

   Next question

7. Question 167 · 355 in bank

   Select 2

   A security engineer has a new TrustSec projct and must create a few static security group tag classifications as proof of concept. Which two classifications must the engineer configure? (Choose two.)

   • Aswitch ID
   • BMAC address
   • CVLAN
   • Duser ID
   • Einterface

   Show answer

   Answer: CE

   Next question

8. Question 168 · 355 in bank

   Which file setup method is supported by ZTP on physical appliances?

   • Acfg
   • Biso
   • Cimg
   • Dova

   Show answer

   Answer: C

   References

   • cisco.com documentation

   Next question

9. Question 169 · 355 in bank

   What is configured to enforce the blocklist permissions and deny access to clients in the blocklist to protect against a lost or stolen device obtaining access to the network?

   • AMy Devices portal
   • Bblocklist portal
   • CAuthentication rule
   • DAuthorization rule

   Show answer

   Answer: D

   Explanation

   According to the Cisco Identity Services Engine Administrator Guide, the option that is configured to enforce the blocklist permissions and deny access to clients in the blocklist to protect against a lost or stolen device obtaining access to the network is - Authorization rule. An authorization rule is a component of an authorization policy that defines the conditions and permissions for granting network access to a user or endpoint. A blocklist permission is a type of permission that denies access to a specific endpoint based on its MAC address.

   Source: Adapted from community discussion — denverfly

   Next question

10. Question 170 · 355 in bank

    An administrator in a health facility must assign a medical device to a static profiling policy. Under which settings group must it be configured?

    • Auser-defined exception actions
    • BCoA under global settings
    • Cglobal profiling settings
    • Dsystem-defined exceptions actions

    Show answer

    Answer: A

    Explanation

    A: is correct User-defined Exception Actions are appropriate for statically assigning endpoints to a preferred policy assignment once a specific condition is met and optionally for preventing a CoA being sent on policy assignment. An example use case would be a critical network device such as a process control endpoint in a manufacturing facility, or a networked medical device in a healthcare facility. In these examples, the administrator may want to statically assign the endpoint to a policy. A static assignment through exception can prevent the risk that spurious profile data reverts and endpoint’s profile and affects its network connectivity. https://community.cisco.com/t5/security-knowledge-base/ise-profiling-design-guide/ta-p/3739456

    Source: Adapted from community discussion — Tom1417

    References

    • cisco.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 161. 355 questions available.