300-715 practice questions 11–20

1. Question 11 · 355 in bank

   What should be considered when configuring certificates for BYOD?

   • AThe SAN field is populated with the end user name.
   • BThe CN field is populated with the endpoint host name.
   • CAn endpoint certificate is mandatory for the Cisco ISE BYOD.
   • DAn Android endpoint uses EST, whereas other operating systems use SCEP for enrollment.

   Show answer

   Answer: B

   Explanation

   It should be B. When configuring certificates for Bring Your Own Device (BYOD), it is important to consider populating the CN (Common Name) field with the endpoint host name. The CN field should contain the host name or FQDN (Fully Qualified Domain Name) of the endpoint device. This allows the certificate to be properly validated when the device connects to the network. The CN field helps ensure that the device is correctly identified and authorized for network access.

   Source: Adapted from community discussion — TomMarvolo

   References

   • cisco.com documentation
   • Microsoft Learn
   • Cisco documentation

   Next question

2. Question 12 · 355 in bank

   A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed interface. Which command should be used to accomplish this task?

   • Acts role-based policy priority-static
   • Bcts cache enable
   • Ccts authorization list
   • Dcts role-based enforcement

   Show answer

   Answer: D

   Explanation

   How to Configure CTS SGACL Support Enabling SGACL Policy Enforcement Globally To enable SGACL policy enforcement on Cisco TrustSec-enabled routed interfaces, perform this task: enable configure terminal cts role-based enforcement Enabling SGACL Policy Enforcement Per Interface You can enable SGACL enforcement globally and disable on a specific interface with cts role-based enforcement command. SGACL enforcement can also be enabled on specific interfaces without enabling it globally. To enable SGACL policy enforcement on interfaces, perform this task: enable configure terminal interface GigabitEthernet 0/1/1 cts role-based enforcement

   Source: Adapted from community discussion — ed81044

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 13 · 355 in bank

   During BYOD flow, where does a Microsoft Windows PC download the Network Setup Assistant?

   • AMicrosoft App Store
   • BCisco App Store
   • CCisco ISE directly
   • DNative OTA functionality

   Show answer

   Answer: C

   Explanation

   Correct, notice the following statement from the provided link: "For Windows and macOS, the NSA is located on the ISE PSN itself."

   Source: Adapted from community discussion — YmerG

   Next question

4. Question 14 · 355 in bank

   What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?

   • AApplication Visibility and Control
   • BSupplicant Provisioning Wizard
   • CMy Devices Portal
   • DNetwork Access Control

   Show answer

   Answer: B

   Explanation

   The correct answer is - Supplicant Provisioning Wizard. The Supplicant Provisioning Wizard is a tool that is used to provision digital certificates on endpoints that are participating in a BYOD flow. The wizard allows the user to enter their credentials and to download the certificate to their device. The other options are not correct. Application Visibility and Control (AVC) is a feature of Cisco ISE that is used to control the use of applications on endpoints. AVC does not allow endpoints to obtain digital certificates. My Devices Portal is a portal that is used by users to manage their devices that are enrolled in Cisco ISE. My Devices Portal does not allow users to obtain digital certificates. Network Access Control (NAC) is a feature of Cisco ISE that is used to control the access of endpoints to the network. NAC does not allow endpoints to obtain digital certificates.

   Source: Adapted from community discussion — denverfly

   References

   • cisco.com documentation

   Next question

5. Question 15 · 355 in bank

   Select 2

   Which two components are required for creating a Native Supplicant Profile within a BYOD flow? (Choose two.)

   • ARedirect ACL
   • BConnection Type
   • COperating System
   • DWindows Settings
   • EiOS Settings

   Show answer

   Answer: BC

   Explanation

   The two components required for creating a Native Supplicant Profile within a BYOD flow are - Connection Type and - Operating System. The Connection Type specifies the type of connection that the supplicant will use to connect to the network. The Operating System specifies the operating system that the supplicant is running on. The other options are not required for creating a Native Supplicant Profile. The Redirect ACL is used to redirect users to a specific URL after they have authenticated. The Windows Settings and iOS Settings are used to configure the supplicant for Windows and iOS devices, respectively.

   Source: Adapted from community discussion — denverfly

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 16 · 355 in bank

   If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

   • AClient Provisioning
   • BBYOD
   • CGuest
   • DBlock list

   Show answer

   Answer: D

   Explanation

   The correct answer is - Block list. The Block List portal is used to prevent devices from accessing the network. When a device is added to the Block List, it will be denied access to the network. The Block List portal also provides information about why the device is blocked. The other options are not correct. The Client Provisioning portal is used to provision devices with certificates and other settings. It cannot be used to block devices from accessing the network. The BYOD portal is used by users to manage their devices that are enrolled in Cisco ISE. It cannot be used to block devices from accessing the network. The Guest portal is used to allow guests to access the network. It cannot be used to block devices from accessing the network.

   Source: Adapted from community discussion — denverfly

   References

   • Cisco documentation

   Next question

7. Question 17 · 355 in bank

   An engineer is configuring a dedicated SSID for onboarding devices. Which SSID type accomplishes this configuration?

   • Ahidden
   • Bguest
   • Cdual
   • Dbroadcast

   Show answer

   Answer: B

   Explanation

   The correct answer is - guest. A guest SSID is a dedicated SSID that is used for onboarding devices. It is typically used for devices that are not owned by the organization, such as devices that are owned by employees or contractors. The guest SSID is typically configured with a lower level of security than the corporate SSID. This is because the devices that connect to the guest SSID are not trusted devices. The other options are not correct. A hidden SSID is an SSID that is not broadcast. This means that devices will not be able to see the SSID when they scan for networks. A dual SSID is a configuration where there are two SSIDs, one for corporate devices and one for guest devices. A broadcast SSID is an SSID that is broadcast. This means that devices will be able to see the SSID when they scan for networks.

   Source: Adapted from community discussion — denverfly

   References

   • cisco.com documentation
   • cisco.com documentation

   Next question

8. Question 18 · 355 in bank

   An engineer is designing a BYOD environment utilizing Cisco ISE for devices that do not support native supplicants. Which portal must the security engineer configure to accomplish this task?

   • ABYOD
   • BClient Provisioning
   • CMy Devices
   • DMDM

   Show answer

   Answer: C

   Explanation

   I will go for B too. the question is about design and put in production a solution for let authenticate devices that do not have native supplicant. The need to log in into the My device portal for add the device is not the right answer for me. In this guide is clear how to configure BYOD without the need of a native supplicant policy configured https://community.cisco.com/t5/security-blogs/ise-byod-registration-only-without-native-supplicant-or/ba-p/3099290 We can also define how many devices that does not support the native supplicant. After that we need to configure the specific authorization policies for these devices. https://www.google.com/search?sca_esv=584485115&sxsrf=AM9HkKl4Nf8vU-mivr0QzBoio-yaTCjJwQ:1700626451946&q=my+devices+portal+cisco+ise&tbm=vid&source=lnms&sa=X&ved=2ahUKEwik_8Cc39aCAxWIhv0HHV3eDxAQ0pQJegQICBAB&cshid=1700626456264194&biw=2400&bih=1138&dpr=0.8

   Source: Adapted from community discussion — XBfoundX

   References

   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 19 · 355 in bank

   Select 2

   An employee logs on to the My Devices portal and marks a currently on-boarded device as `Lost`. Which two actions occur within Cisco ISE as a result of this action? (Choose two.)

   • ABYOD Registration status is updated to No.
   • BBYOD Registration status is updated to Unknown.
   • CThe device access has been denied.
   • DCertificates provisioned to the device are not revoked.
   • EThe device status is updated to Stolen.

   Show answer

   Answer: AD

   Explanation

   Answers are correct https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_byod.html Lost: The user logs on to the My Devices portal, and marks a currently onboarded device as Lost that causes the following actions: The device is assigned to Blacklist identity group. Certificates provisioned to the device are not revoked. The device status is updated to Lost. BYODRegistration status is updated to No. A lost device still has network access unless you create an authorization policy to block lost devices.

   Source: Adapted from community discussion — awhamm

   References

   • Cisco documentation
   • Cisco documentation

   Next question

10. Question 20 · 355 in bank

    A network administrator is configuring a secondary Cisco ISE node from the backup configuration of the primary Cisco ISE node to create a high availability pair. The Cisco ISE CA certificates and keys must be manually backed up from the primary Cisco ISE and copied into the secondary Cisco ISE. Which command must be issued for this to work?

    • Acopy certificate ise
    • Bcertificate configure ise
    • Cimport certificate ise
    • Dapplication configure ise

    Show answer

    Answer: D

    Explanation

    application configure command Use the application configure command in EXEC mode to: - perform M&T operations - refresh and display statistics related to the profiler - export and import options to backup and restore Cisco ISE CA certificates and keys - generate Key Performance Metrics (KPM) statistics - enable or disable the ISE counter attribute data collection - enable or disable wireless setup - reset wireless setup configuration https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/cli_guide/b_ise_CLIReferenceGuide_27/b_ise_CLIReferenceGuide_27_chapter_01.html#wp1286764740

    Source: Adapted from community discussion — IlPerdan0

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 11. 355 questions available.