300-715 practice questions 51–60

1. Question 51 · 355 in bank

   An administrator is migrating device administration access to Cisco ISE from the legacy TACACS+ solution that used only privilege 1 and 15 access levels. The organization requires more granular controls of the privileges and wants to customize access levels 2-5 to correspond with different roles and access needs. Besides defining a new shell profile in Cisco ISE, what must be done to accomplish this configuration?

   • AEnable the privilege levels in Cisco ISE.
   • BEnable the privilege levels in the IOS devices.
   • CDefine the command privileges for levels 2-5 in Cisco ISE.
   • DDefine the command privileges for levels 2-5 in the IOS devices.

   Show answer

   Answer: C

   Explanation

   Correct is D: „Define the command privileges for levels 2-5 in the IOS devices”. --- - Privilege level under which NAD sends commands to ISE for authorization IS NOT specified by privilege level of USER but by privilege level of COMMAND - i. e. level to which particular COMMAND belongs. https://community.cisco.com/t5/network-access-control/command-authorization-by-ise/td-p/3577202 - Commands by default belongs to level 1 or 15. Question states another levels. - "When you set a command to a privilege level, all commands whose syntax is a subset of that command are also set to that level. ..." https://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3se/consolidated_guide/b_consolidated_3850_3se_cg_chapter_0110010.html#ref_1352530 - We for sure need to configure IOS device privilege levels with desired commands. - Answer B: “Enable the privilege levels in the IOS devices.” - not correct, as levels are not disabled, just not configured

   Source: Adapted from community discussion — NikoTomas

   References

   • cisco.com documentation
   • Cisco documentation
   • cisco.com documentation

   Next question

2. Question 52 · 355 in bank

   An administrator is configuring RADIUS on a Cisco switch with a key set to Cisc407294634 but is receiving the error `Authentication failed: 22040 Wrong password or invalid shared secret.` What must be done to address this issue?

   • AAdd the network device as a NAD inside Cisco ISE using the existing key.
   • BConfigure the key on the Cisco ISE instead of the Cisco switch.
   • CValidate that the key is correct on both the Cisco switch as well as Cisco ISE.
   • DUse a key that is between eight and ten characters.

   Show answer

   Answer: C

   Explanation

   The correct answer is Validate that the key is correct on both the Cisco switch as well as Cisco ISE-Подтвердите правильность ключа как на коммутаторе Cisco, так и на Cisco ISE. The error message Authentication failed: 22040 Wrong password or invalid shared secret. indicates that the RADIUS server is not able to authenticate the user because the shared secret is not correct. The shared secret is a string of characters that is used to encrypt the communication between the RADIUS client and the RADIUS server. It is important to make sure that the shared secret is the same on both the client and the server.

   Source: Adapted from community discussion — denverfly

   References

   • Cisco documentation

   Next question

3. Question 53 · 355 in bank

   An administrator needs to give the same level of access to the network devices when users are logging into them using TACACS+. However, the administrator must restrict certain commands based on one of three user roles that require different commands. How is this accomplished without creating too many objects using Cisco ISE?

   • ACreate one shell profile and one command set.
   • BCreate multiple shell profiles and one command set.
   • CCreate multiple shell profiles and multiple command sets.
   • DCreate one shell profile and multiple command sets.

   Show answer

   Answer: D

   Explanation

   it should be one shell profile to all NADs in same level ... and one command set for the one who needs restrict commands if others does not need command set (blank in policy set page) or multiple command sets if the other two rules need command set to be set.. so the answer is ; A or D . and D is the nearest correct answer

   Source: Adapted from community discussion — hisho72

   Next question

4. Question 54 · 355 in bank

   Select 2

   What are two differences between the RADIUS and TACACS+ protocols? (Choose two.)

   • ARADIUS offers multiprotocol support, whereas TACACS+ does not.
   • BRADIUS is a Cisco proprietary protocol, whereas TACACS+ is an open standard protocol.
   • CRADIUS enables encryption of all the packets, whereas with TACACS+, only the password is encrypted.
   • DRADIUS combines authentication and authorization, whereas TACACS+ does not.
   • ETACACS+ uses TCP port 49, whereas RADIUS uses UDP ports 1812 and 1813.

   Show answer

   Answer: DE

   Explanation

   Authentication and Authorization RADIUS combines authentication and authorization. The access-accept packets sent by the RADIUS server to the client contain authorization information. This makes it difficult to decouple authentication and authorization. TACACS+ uses the AAA architecture, which separates AAA. This allows separate authentication solutions that can still use TACACS+ for authorization and accounting. https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.html#anc0

   Source: Adapted from community discussion — colla

   References

   • Cisco documentation

   Next question

5. Question 55 · 355 in bank

   An administrator adds a new network device to the Cisco ISE configuration to authenticate endpoints to the network. The RADIUS test fails after the administrator configures all of the settings in Cisco ISE and adds the proper configurations to the switch. What is the issue?

   • AThe endpoint profile is showing as ''unknown"
   • BThe endpoint does not have the appropriate credentials for network access
   • CThe certificate on the switch is self-signed, not a CA-provided certificate
   • DThe shared secret is incorrect on the switch or on Cisco ISE

   Show answer

   Answer: D

   Explanation

   I believe D is the correct answer. RADIUS test is called out in the question. Im assuming the CLI *test aaa group radius server ise-psn fake-user fake-pass new-code* is used. In this example when the 'RADIUS test' fails it is due to an incorrect shared secret. Endpoint has nothing to do with RADIUS test. Nothing in the question refers to RADIUS / DTLS so C is not the answer.

   Source: Adapted from community discussion — tliz

   Next question

6. Question 56 · 355 in bank

   An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE, but the devices do not change their access due to the new profile. What is the problem?

   • AThe default profiler configuration is set to No CoA for the reauthentication setting.
   • BIn closed mode, profiling does not work unless CDP is enabled.
   • CThe profiler feed is not downloading new information, so the profiler is inactive.
   • DThe profiling probes are not able to collect enough information to change the device profile.

   Show answer

   Answer: A

   Explanation

   The correct answer is: A. The default profiler configuration is set to No CoA for the reauthentication setting. When the profiler is set to No CoA, it will not send a Change of Authorization (CoA) request to the network device when the endpoint's profile changes. This means that the endpoint will not be granted access to the network based on its new profile. To fix this problem, the administrator needs to change the profiler configuration to send a CoA request when the endpoint's profile changes. This can be done by going to the Profiling tab in the Cisco ISE GUI and selecting the Reauthentication setting. The administrator then needs to select the Send CoA option. Once this is done, the endpoints will be granted access to the network based on their new profile.

   Source: Adapted from community discussion — denverfly

   Next question

7. Question 57 · 355 in bank

   An engineer is configuring 802.1X and is testing out their policy sets. After authentication, some endpoints are given an access-reject message but are still allowed onto the network. What is causing this issue to occur?

   • AThe authorization results for the endpoints include the Trusted security group tag.
   • BThe authorization results for the endpoints include a dACL allowing access.
   • CThe switch port is configured with authentication event server dead action authorize vlan.
   • DThe switch port is configured with authentication open.

   Show answer

   Answer: D

   Explanation

   In Monitor Mode 802.1X-enabled ports do not block traffic before successful authentication and authorization, as they would normally. This feature allows you to create an initial Cisco ISE deployment and learn about your network without having to worry about blocking access unintentionally.Monitor mode is enabled through 802.1X with the open access and multi-auth mode features of Cisco IOS. Monitor mode is configured with the authentication open and authentication host-mode multi-auth interface commands.

   Source: Adapted from community discussion — rhylos

   Next question

8. Question 58 · 355 in bank

   An organization is adding nodes to their Cisco ISE deployment and has two nodes designated as primary and secondary PAN and MnT nodes. The organization also has four PSNs. An administrator is adding two more PSNs to this deployment but is having problems adding one of them. What is the problem?

   • AOnly five PSNs are allowed to be in the Cisco ISE cube if configured this way.
   • BOne of the new nodes must be designated as a pxGrid node.
   • CThe new nodes must be set to primary prior to being added to the deployment.
   • DThe current PAN is only able to track a max of four nodes.

   Show answer

   Answer: A

   Explanation

   A. This is a poorly worded question. I am guessing the issue with one of them not able to join is because of certificate error of additional node not being trusted when joining. You can have 6 PSN nodes in a Medium deployment. 2 Primary/Secondary with PAN/MNT running on same node and 6 PSN. It isnt 5 node limit but only can have 5 becuase the 6th one having certificate error. Tricky qn!!! https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html#Cisco_Concept.dita_67b428f0-2240-4383-bd49-5eb7a7b98a35

   Source: Adapted from community discussion — rhylos

   References

   • Cisco documentation

   Next question

9. Question 59 · 355 in bank

   Select 2

   Which two Cisco ISE deployment models require two nodes configured with dedicated PAN and MnT personas? (Choose two.)

   • Aseven PSN nodes with one PxGrid node
   • Btwo PSN nodes with one PxGrid node
   • Cfive PSN nodes with one PxGrid node
   • Dsix PSN nodes:
   • Ethree PSN nodes

   Show answer

   Answer: BE

   Explanation

   The questions says: dedicated PAN and MnT personas. So 1 PAN and 1 MnT. That means A and D are correct. If you read it like dedicated combined PAN and MnT nodes (1 node with prim. PAN and prim. MnT, and 1 node with sec. PAN and sec. Mnt) it would be B, C and E. But we need to select just 2 options so I would go for A and D. Nice those clear Cisco questions…

   Source: Adapted from community discussion — kornalt

   References

   • Cisco documentation
   • Cisco documentation

   Next question

10. Question 60 · 355 in bank

    An engineer is configuring 802.1X and wants it to be transparent from the users' point of view. The implementation should provide open authentication on the switch ports while providing strong levels of security for non-authenticated devices. Which deployment mode should be used to achieve this?

    • Aclosed
    • Bhigh-impact
    • Clow-impact
    • Dopen

    Show answer

    Answer: C

    Explanation

    C is correct--Low Impact mode deployment phase allows for suspension of the controlled port behavior (authentication open command) allowing for 802.1X auth to occur but no restriction due to the normal "closed mode" restriction of EAP only packets. It further allows for a Pre-authentication ACL to be used that can be customized to permit or deny any specific traffic--during the pre-authentication status. Once authenticated, this Pre-auth ACL will continue to apply restriction unless augmented with a DACL bearing the approved access permission as per policy.

    Source: Adapted from community discussion — THEODORABLE

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 51. 355 questions available.