300-715 practice questions 21–30

1. Question 21 · 355 in bank

   Select 2

   A network engineer has been tasked with enabling a switch to support standard web authentication for Cisco ISE. This must include the ability to provision for URL redirection on authentication. Which two commands must be entered to meet this requirement? (Choose two.)

   • Aip http secure-server
   • Bip http authentication
   • Cip http server
   • Dip http redirection
   • Eip http secure-authentication

   Show answer

   Answer: AC

   Explanation

   Ensure you include the following command lines in your switch configuration to enable standard Web Authenticating functions for Cisco ISE, including provisions for URL redirection upon authentication. ip classless ip route 0.0.0.0 0.0.0.0 10.1.2.3 ip http server ! Must enable HTTP/HTTPS for URL-redirection on port 80/443 ip http secure-server https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_sw_cnfg.pdf

   Source: Adapted from community discussion — colla

   References

   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 22 · 355 in bank

   In a Cisco ISE split deployment model, which load is split between the nodes?

   • Alog collection
   • Bdevice admission
   • CAAA
   • Dnetwork admission

   Show answer

   Answer: C

   Explanation

   CORRECT IS C Split Deployments Split Deployments In split Cisco ISE deployments, you continue to maintain primary and secondary nodes as described in a small Cisco ISE deployment. However, the AAA load is split between the two Cisco ISE nodes to optimize the AAA workflow. Each Cisco ISE appliance (primary or secondary) needs to be able to handle the full workload if there are any problems with AAA connectivity. Neither the primary node nor the secondary nodes handles all AAA requests during normal network operations because this workload is distributed between the two nodes. The ability to split the load in this way directly reduces the stress on each Cisco ISE node in the system. In addition, splitting the load provides better loading while the functional status of the secondary node is maintained during the course of normal network operations. In split Cisco ISE deployments, each node can perform its own specific operations, such as network admission or device administration, and still perform all the AAA functions in the event of a failure. If you have two Cisco ISE nodes that process authentication requests and collect accounting data from AAA clients, we recommend that you set up one of the Cisco ISE nodes to act as a log collector

   Source: Adapted from community discussion — MrCalifornia

   References

   • Cisco documentation

   Next question

3. Question 23 · 355 in bank

   A network administrator notices that after a company-wide shut down, many users cannot connect their laptops to the corporate SSID. What must be done to permit access in a timely manner?

   • AConnect this system as a guest user and then redirect the web auth protocol to log in to the network.
   • BAllow authentication for expired certificates within the EAP-TLS section under the allowed protocols.
   • CAdd a certificate issue from the CA server, revoke the expired certificate, and add the new certificate in system.
   • DAuthenticate the user's system to the secondary Cisco ISE node and move this user to the primary with the renewed certificate.

   Show answer

   Answer: B

   Explanation

   Only Answer that makes sense is B. Company Wide shutdown indicates there could be expired certs. ISE > Policy > Policy Elements > Results > Authentication > Allowed Protocols > Default Network Access. Check under EAP-TLS section, Allow Authentication of expired certificates to allow certificate renewal in Authorization Policy [Note that by enabling this feature, ISE will treat expired certificates as valid which will reduce your overall ISE security. It is recommended to configure a specific rule in the Authorization Policy using the reusable condition CertRenewalRequired in order to control the overall authorization response to the NAD. When an expired certificate is detected the condition result will be true and you need to configure an Authorization Profile that will re-direct to the CWA portal]

   Source: Adapted from community discussion — tliz

   Next question

4. Question 24 · 355 in bank

   Select 2

   Which two endpoint compliance statuses are possible? (Choose two.)

   • Acompliant
   • Bvalid
   • Cunknown
   • Dknown
   • Einvalid

   Show answer

   Answer: AC

   References

   • Cisco documentation

   Next question

5. Question 25 · 355 in bank

   Select 2

   Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two.)

   • ATCP 80
   • BTCP 8905
   • CTCP 8443
   • DTCP 8906
   • ETCP 443

   Show answer

   Answer: BC

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/installation_guide/b_ise_InstallationGuide20/ Cisco_SNS_3400_Series_Appliance_Ports_Reference.html

   References

   • Cisco documentation

   Next question

6. Question 26 · 355 in bank

   Select 2

   What are two components of the posture requirement when configuring Cisco ISE posture? (Choose two.)

   • AClient Provisioning portal
   • Bremediation actions
   • Cupdates
   • Daccess policy
   • Econditions

   Show answer

   Answer: BE

   Explanation

   https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_compliance.html#task_52F2E45628EF43C889B5559AF657B884 Create Client Posture Requirements You can create a requirement in the Requirements window where you can associate user-defined conditions and Cisco defined conditions, and remediation actions. Once created and saved in the Requirements window, user-defined conditions and remediation actions can be viewed from their respective list windows.

   Source: Adapted from community discussion — iceise

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

7. Question 27 · 355 in bank

   Which term refers to an endpoint agent that tries to join an 802.1X-enabled network?

   • AEAP server
   • Bauthenticator
   • Csupplicant
   • Dclient

   Show answer

   Answer: C

   Next question

8. Question 28 · 355 in bank

   Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

   • ATCP 8905
   • BTCP 8909
   • CTCP 443
   • DUDP 1812

   Show answer

   Answer: A

   Explanation

   The answer is -TCP 8905. Cisco ISE uses TCP port 8905 for native supplicant provisioning of a Windows laptop. This port is used to communicate with the supplicant on the laptop and to provision it with the necessary settings to connect to the network. The other ports are not used for native supplicant provisioning. TCP port 8909 is used for posture assessment, TCP port 443 is used for the Cisco ISE web interface, and UDP port 1812 is used for RADIUS authentication.

   Source: Adapted from community discussion — denverfly

   References

   • cisco.com documentation

   Next question

9. Question 29 · 355 in bank

   What must match between Cisco ISE and the network access device to successfully authenticate endpoints?

   • Ashared secret
   • Bprofile
   • Ccertificate
   • DSNMP version

   Show answer

   Answer: A

   Explanation

   Reference: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_network_devices.html

   Next question

10. Question 30 · 355 in bank

    What is the deployment mode when two Cisco ISE nodes are configured in an environment?

    • Astandalone
    • Bdistributed
    • Cstandard
    • Dactive

    Show answer

    Answer: B

    Explanation

    You cannot have 2 Nodes in a deployment with the Standalone role, it needs to be Primary and Secondary => B) Distributed

    Source: Adapted from community discussion — NoMoreMrWifi

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 21. 355 questions available.