Implementing and Configuring Cisco Identity Services Engine (SISE)355 questions across 36 pages are complete and free, with no account or card.
355 questions in this bank
Free access · progress saved on this device
A network engineer received alerts from the monitoring platform that a switch port exists with multiple sessions. RADIUS CoA using Cisco ISE must be used to address the issue. Which RADIUS CoA configuration must be used?
Answer: A
The security team identified a rogue endpoint with MAC address 00:47:44:40:54:1A attached to the network. Which action must security engineer take within Cisco ISE to effectively restrict network access for this endpoint?
Answer: D
The term “quarantine” in ISE is a little misleading. Quarantine is just an internal label that can be assigned to endpoints. What ISE does with an endpoint that has been labeled with “quarantine” varies depending on how a corresponding security policy is configured. Therefore the answer would be D.
Source: Adapted from community discussion — wowako
An administrator must configure Cisco ISE to authenticate a user accessing a Cisco Adaptive Security Appliance firewall using SSH. The solution must meet these requirements: • The local Cisco ISE database must be used for user authentication • ASA commands run by users must be validated The configurations were performed: • added the Cisco Adaptive Security Appliance firewall • configured user accounts • enabled Device Admin Service in Cisco ISE • configured a TACACS profile • configured an authorization policy • configured the Cisco Adaptive Security Appliance firewall for authentication and authorization Which two actions must be taken in Cisco ISE? (Choose two.)
Answer: BD
Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?
Answer: D
D is correct The inactivity timer for MAB can be statically configured on the switch port, or it can be dynamically assigned using the RADIUS Idle-Timeout attribute (Attribute 28). Cisco recommends setting the timer using the RADIUS attribute because this approach lets gives you control over which endpoints are subject to this timer and the length of the timer for each class of endpoints. For example, endpoints that are known to be quiet for long periods of time can be assigned a longer inactivity timer value than chatty endpoints. Do not confuse it with session timeout!
Source: Adapted from community discussion — THEODORABLE
Wireless network users authenticate to Cisco ISE using 802.1X through a Cisco Catalyst switch. An engineer must create an updated configuration to assign a security group tag to the user’s traffic using inline tagging to prevent unauthenticated users from accessing a restricted server. The configurations were performed: • configured Cisco ISE as a Cisco TrustSec AAA server • configured the switch as a RADIUS device in Cisco ISE • configured the wireless LAN controller as a TrustSec device in Cisco ISE • created a security group tag for the wireless users • created a certificate authentication profile • created an identity source sequence • assigned an appropriate security group tag to the wireless users • defined security group access control lists to specify an egress policy • enforced the access control lists on the TrustSec policy matrix in Cisco ISE • configured TrustSec on the switch • configured TrustSec on the wireless LAN controller Which two actions must be taken to complete the configuration? (Choose two.)
Answer: BD
An engineer is starting to implement a wired 802.1X project throughout the campus. The task is to ensure that the authentication procedure is disabled on the ports but still allows all endpoints to connect to the network. Which port-control option must the engineer configure?
Answer: C
force-authorized: Use this when you want to disable 802.1X authentication and allow all devices to connect to the network without requiring authentication. force-unauthorized: Use this when you want to prevent any device from accessing the network through a specific port, effectively disabling network access on that port.
Source: Adapted from community discussion — factmrojas
An engineer wants to ease the management of endpoint identity groups from the Cisco ISE GUI. From the Identity Management menu in Cisco ISE, the engineer must be able to list the endpoint identity groups with a name that contains Android. Which task must the engineer perform?
Answer: C
Which controller option allows a user to switch from the provisioning SSID to the employee SSID after registration?
Answer: C
C is correct. This is needed for Dual-SSID flow for better user experience. Enabling this feature allows wireless clients to transition from Open SSID to Secured SSID without delay: https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867
Source: Adapted from community discussion — 4004aa3
An engineer must use Cisco ISE profiler services to provide network access to Cisco IP phones that cannot support 802.1X. Cisco ISE is configured to use the access switch device sensor information system-description and platform-type to profile Cisco IP phones and allow access. Which two protocols must be configured on the switch to complete the configuration? (Choose two.)
Answer: CE
A network administrator is configuring a new access switch to use with Cisco ISE for network access control. There is a need to use a centralized server for the reauthentication timers. What must be configured in order to accomplish this task?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-715 practice, question 191. 355 questions available.
Version 1.0.0. How we source questions