300-715 practice questions 321–330

1. Question 321 · 355 in bank

   An administrator must provide wired network access to unidentified Cisco devices that fail 802.1X authentication. Cisco ISE profiling services must be configured to gather Cisco Discovery Protocol and LLDP endpoint information from a Cisco switch. These configurations were performed: • configured switches to accept SNMP queries from Cisco ISE • enabled Cisco Discovery Protocol and LLDP on the switches • added the switch as a NAD to Cisco ISE What must be enabled to complete the configuration?

   • ASNMP traps on the switch
   • BSNMP Trap probe in Cisco ISE
   • CSNMP MIBs in Cisco ISE
   • DSNMP Query probe in Cisco ISE

   Show answer

   Answer: D

   Next question

2. Question 322 · 355 in bank

   An engineer must use Cisco ISE to provide network access to endpoints that cannot support 802.1X. The endpoint MAC addresses must be allowlisted by configuring an endpoint identity group. These configurations were performed: • configured an identity group named allowlist • configured the endpoints to use the MAC address of incompatible 802.1X devices • added the endpoints to the allowlist identity group • configured an authentication policy for MAB users What must be configured?

   • Alogical profile that matches the allowlist identity group based on the configured policy
   • Bauthorization profile that has the PermitAccess permission and matches the allowlist identity group
   • Cauthorization policy that has the PermitAccess permission and matches the allowlist identity group
   • Dauthentication profile that has the PermitAccess permission and matches the allowlist identity group

   Show answer

   Answer: C

   Next question

3. Question 323 · 355 in bank

   What is an advantage of TACACS+ versus RADIUS authentication when reviewing reports in Cisco ISE?

   • ATACACS+ performs secure communication with IPsec, and RADIUS uses DTLS encryption.
   • BTACACS+ reduces authentication latency, and RADIUS increases latency by adding additional packet headers.
   • CTACACS+ provides command accounting, and RADIUS combines authentication and authorization.
   • DTACACS+ uses SSL certificates, and RADIUS does not have encryption.

   Show answer

   Answer: C

   Next question

4. Question 324 · 355 in bank

   A network security administrator wants to integrate Cisco ISE with Active Directory. Which configuration action must the security administrator take to accomplish the task?

   • ASearch Active Directory to see if admin user account exists.
   • BRemove the ISE machine account from the domain.
   • CRemove Cisco ISE user account from the domain.
   • DJoin Cisco ISE to the Active Directory domain.

   Show answer

   Answer: D

   Next question

5. Question 325 · 355 in bank

   What is a difference between RADIUS versus TACACS+ with regards to packet encryption?

   • ARADIUS encrypts the entire body of the packet, and TACACS+ encrypts the username and password in the access-request packet.
   • BTACACS+ encrypts the entire body of the packet, and RADIUS encrypts the username and password in the access-request packet.
   • CRADIUS encrypts the entire body of the packet, and TACACS+ encrypts only the password in the access-request packet.
   • DTACACS+ encrypts the entire body of the packet, and RADIUS encrypts only the password in the access-request packet.

   Show answer

   Answer: D

   Next question

6. Question 326 · 355 in bank

   On which port does Cisco ISE present the Admin certificate for posture and client provisioning?

   • ATCP/8000
   • BTCP/8080
   • CTCP/8905
   • DTCP/8999

   Show answer

   Answer: C

   Next question

7. Question 327 · 355 in bank

   Select 2

   

   Refer to the exhibit. An engineer must configure BYOD in Cisco ISE. A single SSID must be used to allow BYOD devices to connect to the network. These configurations have been performed on Wireless LAN Controller already: • RADIUS server • BYOD-Dot1x SSID Which two configurations must be done in Cisco ISE to meet the requirement? (Choose two.)

   • Aprofiling policy
   • Bexternal identity source
   • CFlexConnect ACL
   • Dauthentication policy
   • Eredirect ACL

   Show answer

   Answer: BD

   Next question

8. Question 328 · 355 in bank

   A user misplaces a personal phone and wants to blacklist the device from accessing the company network. The company uses Cisco ISE for corporate and BYOD device authentication. Which action must the user take in Cisco ISE?

   • ASign in to the My Devices portal and mark the device as irrecoverable.
   • BSign in to the BYOD portal and mark the device as irrecoverable.
   • CSign in to the BYOD portal and mark the device as Lost.
   • DSign in to the My Devices portal and mark the device as Lost.

   Show answer

   Answer: D

   Next question

9. Question 329 · 355 in bank

   Which action must be taken before configuring the Secure Client Agent profile when creating the Secure Client configuration for ISE posture services?

   • AConfigure the posture policy for Secure Client posturing module.
   • BCreate a posture remediation condition policy for the Agent profile.
   • CCreate a posture condition that references the Secure Client package.
   • DUpload the Secure Client packages and the Secure Client compliance modules.

   Show answer

   Answer: D

   Next question

10. Question 330 · 355 in bank

    An administrator must provide network access to legacy Windows endpoints with a specific device type and operating system version using Cisco ISE profiler services. The ISE profiler services and access switches must be configured to identify endpoints using the dhcp-class-identifier and parameters-request-list attributes from the DHCP traffic. These configurations were performed: • enabled the DHCP probe in Cisco ISE • configured the Cisco ISE PSN interface to receive DHCP packets • configured the attributes in custom profiling conditions • configured a custom profiling policy • configured an authorization rule with permit access Which action completes the configuration?

    • AConfigure the Cisco ISE PSN interface to receive SPAN DHCP traffic.
    • BConfigure the switches to send copies of the DHCP traffic to the Cisco ISE PSN.
    • CEnable the DHCP SPAN probe in Cisco ISE primary server.
    • DConfigure the switches to relay DHCP packets to the Cisco ISE PSN.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 321. 355 questions available.