300-715 practice questions 261–270

1. Question 261 · 355 in bank

   A company manager is hosting a conference. Conference participants must connect to an open guest SSID and only use a preassigned code that they enter into the guest portal prior to gaining access to the network. How should the manager configure Cisco ISE to accomplish this goal?

   • ACreate logins for each participant to give them sponsored access.
   • BCreate entries in the guest identity group for all participants.
   • CCreate an access code to be entered in the AUP mode.
   • DCreate a registration code to be entered on the portal splash page.

   Show answer

   Answer: C

   Explanation

   https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_guest.html#concept_BAD85F54F1B9404B9913DC050D8D5B1D Access code: Optional. Applies to guests using the Hotspot Guest and Credentialed Guest portals. An access code is primarily a locally known code that is given to physically present guests (either visually via a whiteboard or verbally by a lobby ambassador). It would not be known and used by someone outside the premises to gain access to the network. If the Access code setting is enabled: *** Sponsored guests are prompted to enter it on the Login page (along with a username and password). *** Guests using the Hotspot Guest portal are prompted to enter it on the Acceptable Use Policy (AUP) page.

   Source: Adapted from community discussion — tliz

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

2. Question 262 · 355 in bank

   An organization has a fully distributed Cisco ISE deployment. When implementing probes, an administrator must scan for unknown endpoints to learn the IP-to- MAC address bindings. The scan is complete on one PSN, but the information is not available on the others. What must be done to make the information available?

   • ACisco ISE must be configured to learn the IP-MAC binding of unknown endpoints via RADIUS authentication, not via scanning.
   • BCisco ISE must learn the IP-MAC binding of unknown endpoints via DHCP profiling, not via scanning.
   • CScanning must be initiated from the MnT node to centrally gather the information.
   • DScanning must be initiated from the PSN that last authenticated the endpoint.

   Show answer

   Answer: D

   Explanation

   Question is about scanning unknown endpoints. https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/reorg/b_endpoint_profiling_2_4.html#concept_57A4A7ADE3DA429A821900C5CBEA8BF0 Given below is additional information related to the manual NMAP scan results: • To detect unknown endpoints, NMAP should be able to learn the IP/MAC binding via NMAP or a supporting SNMP scan. • ISE learns IP/MAC binding of known endpoints via Radius authentication or DHCP profiling. • The IP/MAC bindings are not replicated across PSN nodes in a deployment. Therefore, you must trigger the manual scan from the PSN, which has the IP/MAC binding in its local database (for example, the PSN against which a mac address was last authenticated with). • The NMAP scan results do not display any information related to an endpoint that NMAP had previously scanned, manually or automatically.

   Source: Adapted from community discussion — iceise

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 263 · 355 in bank

   An administrator is configuring a switch port for use with 802.1X. What must be done so that the port will allow voice and multiple data endpoints?

   • AConnect a hub to the switch port to allow multiple devices access after authentication.
   • BConfigure the port with the authentication host-mode multi-auth command.
   • CConnect the data devices to the port, then attach the phone behind them.
   • DUse the command authentication host-mode multi-domain on the port.

   Show answer

   Answer: B

   Explanation

   Multiple Authentication Mode: Multiple Authentication mode (often called multi-auth mode) allows one 802.1X or MAB client on the voice VLAN. It also allows multiple authenticated 802.1X, MAB, or web authorization clients on the data VLAN. When a hub or access point is connected to an 802.1X port, multi-auth mode provides enhanced security over the multi-hosts mode by requiring authentication of each connected client. For non-802.1X devices, MAB, or web-based authentication, can be used as the fallback method for individual host authentications, which allows different hosts to be authenticated through different methods on a single port.

   Source: Adapted from community discussion — redpassion

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 264 · 355 in bank

   An administrator is troubleshooting an endpoint that is supposed to bypass 802.1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB, however the endpoint cannot communicate because it cannot obtain an IP address. What is the problem?

   • AThe endpoint is using the wrong protocol to authenticate with Cisco ISE.
   • BThe 802.1X timeout period is too long.
   • CThe DHCP probe for Cisco ISE is not working as expected.
   • DAn ACL on the port is blocking HTTP traffic.

   Show answer

   Answer: B

   Explanation

   The only answer that make sense here is B. HTTP traffic is blocked... Who cares, i need to use DHCP ports so that do not matters. What I think is that the switchport have both 802.1x and MAB configured. So the client is sending an DHCP request but because the 802.1x timeout timer is too long the client is not getting the IP address at first, after that timeout time now the user can be authenticate via MAB, so you see that the user is authenticated but is failing to get the ip address.

   Source: Adapted from community discussion — XBfoundX

   Next question

5. Question 265 · 355 in bank

   A Cisco ISE administrator must restrict specific endpoints from accessing the network while in closed mode. The requirement is to have Cisco ISE centrally store the endpoints to restrict access from. What must be done to accomplish this task?

   • ACreate a profiling policy for each endpoint with the cdpCacheDeviceId attribute.
   • BCreate a logical profile for each device's profile policy and block that via authorization policies.
   • CAdd each MAC address manually to a blocklist identity group and create a policy denying access.
   • DAdd each IP address to a policy denying access.

   Show answer

   Answer: C

   Explanation

   The correct answer is - Add each MAC address manually to a blocklist identity group and create a policy denying access. To accomplish this task, the Cisco ISE administrator must follow these steps: Create a blocklist identity group. Add each MAC address of the endpoints that must be restricted from accessing the network to the blocklist identity group. Create a policy that denies access to the blocklist identity group. Apply the policy to the network access devices.

   Source: Adapted from community discussion — denverfly

   Next question

6. Question 266 · 355 in bank

   Select 2

   An engineer is using profiling to determine what access an endpoint must receive. After configuring both Cisco ISE and the network devices for 802.1X and profiling, the endpoints do not profile prior to authentication. What are two reasons this is happening? (Choose two.)

   • AClosed mode is restricting the collection of the attributes prior to authentication.
   • BThe HTTP probe is malfunctioning due to closed mode being enabled.
   • CThe SNMP probe is not enabled.
   • DNetFlow is not enable on the switch, so the attributes will not be collected.
   • EThe switch is collecting the attributes via RADIUS but the probes are not sending them.

   Show answer

   Answer: AE

   Explanation

   The question states that both devices are configured, so we can assume that A is correct as the device might have not be profiled yet. E seems more correct answer from the list.

   Source: Adapted from community discussion — tururu1496

   Next question

7. Question 267 · 355 in bank

   Select 2

   Which two external identity stores support EAP-TLS and PEAP-TLS? (Choose two.)

   • ARSA SecurID
   • BRADIUS Token
   • CActive Directory
   • DInternal Database
   • ELDAP

   Show answer

   Answer: CE

   Explanation

   Reference: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/214975-configure-eap-tls-authentication-with-is.html

   Next question

8. Question 268 · 355 in bank

   Select 2

   An engineer deploys Cisco ISE and must configure Active Directory to then use information from Active Directory in an authorization policy. Which two components must be configured, in addition to Active Directory groups, to achieve this goal? (Choose two.)

   • AIdentity Source Sequences
   • BLDAP External Identity Sources
   • CActive Directory External Identity Sources
   • DLibrary Condition for Identity Group: User Identity Group
   • ELibrary Condition for External Identity: External Groups

   Show answer

   Answer: CE

   Explanation

   The correct answers are: Active Directory External Identity Sources Library Condition for External Identity: External Groups To achieve the goal of configuring Active Directory to then use information from Active Directory in an authorization policy, the following components must be configured: Active Directory External Identity Sources: This component allows Cisco ISE to authenticate users against an Active Directory domain. Library Condition for External Identity: External Groups: This component allows Cisco ISE to use groups from an external identity source, such as Active Directory, to make authorization decisions. The other options are incorrect

   Source: Adapted from community discussion — denverfly

   Next question

9. Question 269 · 355 in bank

   Which deployment mode allows for one or more policy service nodes to be used for session failover?

   • Acentralized
   • Bsecondary
   • Cstandalone
   • Ddistributed

   Show answer

   Answer: D

   Next question

10. Question 270 · 355 in bank

    A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group. Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?

    • AKeep track of guest user activities.
    • BCreate and manage guest user accounts.
    • CConfigure authorization settings for guest users.
    • DAuthenticate guest users to Cisco ISE.

    Show answer

    Answer: B

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 261. 355 questions available.