300-715 practice questions 211–220

1. Question 211 · 355 in bank

   What should be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

   • Acontinue
   • Bpass
   • Cdrop
   • Dreject

   Show answer

   Answer: A

   Explanation

   A is correct. a continue is an authentication override option in the authentication policy rule. technically it is an "access-accept" used as an override of negative auth result from database. Used the typical Mab rule config of Web Authentication for unknow devices such as guest or contractors.

   Source: Adapted from community discussion — THEODORABLE

   Next question

2. Question 212 · 355 in bank

   An administrator must deploy the Cisco Secure Client posture agent to employee endpoints that access a wireless network by using URL redirection in Cisco ISE. The compliance module must be downloaded from Cisco and uploaded to the Cisco ISE client provisioning resource. What must be used to upload the compliance module?

   • AClient Provisioning Portal
   • BSecure Client configuration
   • Cagent resources from the local disk
   • DSecure Client posture profile

   Show answer

   Answer: C

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 213 · 355 in bank

   Select 2

   An administrator must configure Cisco ISE to authenticate the administrative superuser to manage a Cisco Adaptive Security Appliance firewall. The solution must meet the requirements: • The user must be authenticated against Microsoft AD. • The user must have full management administrative access to the Cisco Adaptive Security Appliance firewall. • The user must not use the enable command. The configurations were performed: • joined Cisco ISE to AD and retrieved AD groups • added the Cisco Adaptive Security Appliance firewall • enabled Device Admin Service in Cisco ISE • configured TACACS command sets • configured a TACACS profile • configured an authorization policy • configured the Cisco Adaptive Security Appliance firewall for authentication and authorization Which two actions must be performed in Cisco ISE? (Choose two.)

   • AConfigure an authentication profile on Cisco ISE.
   • BSet Default Privilege to 1 and Maximum Privilege to 15 in the TACACS profile.
   • CAdd all authorized admin commands to the TACACS profile.
   • DSet Default Privilege to 15 and Maximum Privilege to 15 in the TACACS profile.
   • ESelect "Permit any command that is not listed below" in the TACACS profile.

   Show answer

   Answer: DE

   Next question

4. Question 214 · 355 in bank

   An engineer configures Cisco ISE and Cisco Catalyst switches to enforce Cisco TrustSec policies. The engineer must use a nondisruptive deployment approach for new devices by deploying TrustSec policies in staging, preproduction, and production. Which action must be taken to complete the configuration?

   • AConfigure Security Group Tag Exchange Protocol on the new devices and integrate the devices in groups with Cisco ISE.
   • BConfigure policy matrices in Cisco ISE and assign the new devices to the policy matrices.
   • CIntegrate the new devices in staging, preproduction, and production network device groups.
   • DConfigure a different security group tag for the new devices in the staging, preproduction, and production stages.

   Show answer

   Answer: C

   Next question

5. Question 215 · 355 in bank

   A network administrator must restrict sponsor account privileges for managing guest accounts on Cisco ISE for a new account that is being created. Sponsor groups currently exist for each business unit. The new sponsor that is being added must be restricted to only managing guest accounts created by sponsors from the same sponsor group. In which group must the new sponsor account be configured?

   • AGROUP_ACCOUNTS
   • BOWN_ACCOUNTS
   • CALL_ ACCOUNTS
   • DALL_EMPLOYEES

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

6. Question 216 · 355 in bank

   Select 2

   An engineer must configure a posture policy with Cisco Temporal Agent workflow. Which two configurations must the engineer apply to meet the requirement? (Choose two.)

   • AConfigure the Secure Client Posture module.
   • BConfigure the client provisioning policy.
   • CCreate the posture requirements.
   • DCreate the posture condition.
   • EConfigure client provisioning resources.

   Show answer

   Answer: CD

   Explanation

   Configure Cisco Temporal Agent Workflow The process of configuring the Cisco temporal agent involves a series of steps. You should perform the following steps in Cisco ISE. Procedure Step 1 Create the posture condition. Step 2 Create posture requirements. Step 3 Create the posture policy. Step 4 Configure the client provisioning policy. Step 5 Configure authorization profile. Step 6 Configure authorization policies. https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_compliance.html#AnyConnect_Temporal_Agent_Workflow_For_Windows

   Source: Adapted from community discussion — TiberiuszSun

   References

   • Cisco documentation

   Next question

7. Question 217 · 355 in bank

   Which command displays all 802.1X/MAB sessions that are active on the switch ports of a Cisco Catalyst switch?

   • Ashow authentication sessions interface Gi1/0/x output
   • Bshow authentication sessions
   • Cshow authentication sessions output
   • Dshow authentication sessions interface Gi 1/0/x

   Show answer

   Answer: B

   Explanation

   I believe the correct answer is B because the answer that is marked here as correct is for a specific interface while the question states ports (plural)

   Source: Adapted from community discussion — Fenstar

   Next question

8. Question 218 · 355 in bank

   An engineer is configuring a new Cisco ISE node. The Cisco ISE must make authorization decisions based on the threat and vulnerability attributes received from the threat and vulnerability adapters. Which persona must be enabled?

   • ApxGrid
   • BPolicy Service
   • CAdministration
   • DMonitoring

   Show answer

   Answer: B

   Explanation

   The PSN is responsible for handling the policy decisions, including evaluating context and attributes such as user identity, device posture, and threat/vulnerability information. It applies the policies to determine access control decisions.

   Source: Adapted from community discussion — kerimeba

   Next question

9. Question 219 · 355 in bank

   An engineer is configuring a new Cisco ISE node. Context-sensitive information must be shared between the Cisco ISE and a Cisco ASA. Which persona must be enabled?

   • ApxGrid
   • BAdministration
   • CPolicy Service
   • DMonitoring

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

10. Question 220 · 355 in bank

    DRAG DROP - A security engineer configures a Cisco Catalyst switch to use Cisco TrustSec. The engineer must define the PAC key to authenticate the switch to Cisco ISE. Drag and drop the commands from the left into sequence on the right. Not all options are used.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Cts import-pac is not a valid command and 1645 and 1646 are the old RADIUS ports Correct Order aaa new-model radius server cisco-ise address ipv4 10.201.214.24 auth-port 1812 acct-port 1813 pac key Cisco123

    Source: Adapted from community discussion — Cachaman

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 211. 355 questions available.