300-715 practice questions 241–250

1. Question 241 · 355 in bank

   An engineer is implementing Cisco ISE and needs to configure 802.1X. The port settings are configured for port-based authentication. Which command should be used to complete this configuration?

   • Aaaa authentication dot1x default group radius
   • Bdot1x system-auth-control
   • Cauthentication port-control auto
   • Ddot1x pae authenticator

   Show answer

   Answer: B

   Explanation

   It say Port settings are configerd. I think if dot1x is globbally not enabled with dot1x system-auth-control you cann't configure the port for 802.1x Can somebody test, if you can or cannot configure the port for 802.1x withot enabling globally and react here. Thanks in advance https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/xe-3se/3850/sec-user-8021x-xe-3se-3850-book/config-ieee-802x-pba.html#GUID-B1C1F75B-45CF-4CA3-A833-43D7C6986249 How to Configure IEEE 802.1X Port-Based Authentication Enabling IEEE 802.1X Authentication and Authorization SUMMARY STEPS 1. enable 2. configure terminal 3. aaa new-model 4. aaa authentication dot1x {default | listname} method1 [method2...] 5. dot1x system-auth-control 6. identity profile default 7. interface type slot/port 8. access-session port-control {auto | force-authorized | force-unauthorized} 9. dot1x pae [supplicant | authenticator | both]

   Source: Adapted from community discussion — iceise

   References

   • Cisco documentation

   Next question

2. Question 242 · 355 in bank

   DRAG DROP - An organization wants to implement 802.1X and is debating whether to use PEAP-MSCHAPv2 or PEAP-EAP-TLS for authentication. Drag the characteristics on the left to the corresponding protocol on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

3. Question 243 · 355 in bank

   DRAG DROP - Drag the descriptions on the left onto the components of 802.1X on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Authenticator ג€" device that controls physical access to the network based on the authentication status Supplicant - software on the endpoint that communicates with EAP at layer 2 Authentication server ג€" device that validates the identity of the endpoint and provides results to another device Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/xe-3se/3850/sec-user-8021x-xe-3se-3850-book/config-ieee-802x- pba.html

   

   Next question

4. Question 244 · 355 in bank

   A network engineer is configuring Cisco TrustSec and needs to ensure that the Security Group Tag is being transmitted between two devices. Where in the Layer 2 frame should this be verified?

   • Apayload
   • B802.1 AE header
   • CCMD field
   • D802.1Q field

   Show answer

   Answer: C

   Next question

5. Question 245 · 355 in bank

   A network administrator must configure endpoints using an 802.1X authentication method with EAP identity certificates that are provided by the Cisco ISE. When the endpoint presents the identity certificate to Cisco ISE to validate the certificate, endpoints must be authorized to connect to the network. Which EAP type must be configured by the network administrator to complete this task?

   • AEAP-TTLS
   • BEAP-TLS
   • CEAP-FAST
   • DEAP-PEAP-MSCHAPv2

   Show answer

   Answer: B

   Explanation

   B is correct--EAP-TLS is used for mutual certificate authentication for both user & device type x509v3 certificates--although EAP FAST can be used with certificates-its not the norm.

   Source: Adapted from community discussion — THEODORABLE

   Next question

6. Question 246 · 355 in bank

   An organization wants to standardize the 802.1X configuration on their switches and remove static ACLs on the switch ports while allowing Cisco ISE to communicate to the switch what access to provide. What must be configured to accomplish this task?

   • Adynamic access list within the authorization profile
   • Bextended access-list on the switch for the client
   • Csecurity group tag within the authorization policy
   • Dport security on the switch based on the client's information

   Show answer

   Answer: A

   Explanation

   SGTs are usable where Trust Sec is deployed, the question simply asks about a better way of handling ACLs, substitute for Static ACLs should be Dynamic ACLs configured on ISE Authorisation Profiles. https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212419-configure-per-user-dynamic-access-contro.html

   Source: Adapted from community discussion — [Removed]

   References

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   Next question

7. Question 247 · 355 in bank

   

   Refer to the exhibit. In which scenario does this switch configuration apply?

   • Awhen allowing a hub with multiple clients connected
   • Bwhen allowing multiple IP phones to be connected
   • Cwhen preventing users with hypervisor
   • Dwhen bypassing IP phone authentication

   Show answer

   Answer: A

   Explanation

   The IEEE 802.1X Multiple Authentication feature provides a means of authenticating multiple hosts on a single port. With both 802.1X and non-802.1X devices, multiple hosts can be authenticated using different methods. Each host is individually authenticated before it can gain access to the network resources.

   Source: Adapted from community discussion — Cnoteone

   Next question

8. Question 248 · 355 in bank

   

   Refer to the exhibit. Which switch configuration change will allow only one voice and one data endpoint on each port?

   • Aauto to manual
   • Bmab to dot1x
   • Cmulti-auth to multi-domain
   • Dmulti-auth to single-auth

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-6/configuration_guide/sec/b_166_sec_9300_cg/ configuring_ieee_802_1x_port_based_authentication.html

   Next question

9. Question 249 · 355 in bank

   Which supplicant(s) and server(s) are capable of supporting EAP-CHAINING?

   • ACisco Secure Services Client and Cisco Access Control Server
   • BCisco AnyConnect NAM and Cisco Identity Service Engine
   • CCisco AnyConnect NAM and Cisco Access Control Server
   • DWindows Native Supplicant and Cisco Identity Service Engine

   Show answer

   Answer: B

   Explanation

   B & D are both correct I think: "Previously, to achieve this you needed the Cisco AnyConnect NAM module and use EAP-FAST on the windows supplicant as the native Windows supplicant did not support this. Now, you can use the Windows Native Supplicant to perform EAP Chaining with ISE 2.7 with the use of TEAP." https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216510-eap-chaining-with-teap.html

   Source: Adapted from community discussion — JimboOh

   References

   • Cisco documentation

   Next question

10. Question 250 · 355 in bank

    A network security engineer needs to configure 802.1X port authentication to allow a single host to be authenticated for data and another single host to be authenticated for voice. Which command should the engineer run on the interface to accomplish this goal?

    • Aauthentication host-mode multi-domain
    • Bauthentication host-mode single-host
    • Cauthentication host-mode multi-auth
    • Dauthentication host-mode multi-host

    Show answer

    Answer: A

    Explanation

    Multi-domain authentication host mode: you can authenticate two source MAC addresses, one in the voice VLAN and another one in the data VLAN. This is for the scenario where you have an IP phone and a PC on a single switchport. Any more source MAC addresses trigger a security violation.

    Source: Adapted from community discussion — Cnoteone

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 241. 355 questions available.