300-715 practice questions 61–70

1. Question 61 · 355 in bank

   Select 2

   An organization wants to enable web-based guest access for both employees and visitors. The goal is to use a single portal for both user types. Which two authentication methods should be used to meet this requirement? (Choose two.)

   • ALDAP
   • BMAC-based
   • CCertificate-based
   • DLOCAL
   • E802.1X

   Show answer

   Answer: AD

   Explanation

   just based on the wording... one web based portal for 802.1x you wouldn´t need a portal for employees MAC doesn´t make sense as Guest would have to register first - no mentioning of a self-reg portal only way for one web portal to work for both would be Local Guest users and a Ldap connection for employees

   Source: Adapted from community discussion — johndelorien

   Next question

2. Question 62 · 355 in bank

   Select 2

   A network administrator is currently using Cisco ISE to authenticate devices and users via 802.1X. There is now a need to also authorize devices and users using EAP-TLS. Which two additional components must be configured in Cisco ISE to accomplish this? (Choose two.)

   • ACertificate Authentication Profile
   • BEAP Authorization Profile
   • CNetwork Device Group
   • DCommon Name attribute that maps to an identity store
   • ESerial Number attribute that maps to a CA Server

   Show answer

   Answer: AB

   Explanation

   A & B A. Certificate Authentication Profile: A Certificate Authentication Profile needs to be configured in Cisco ISE. This profile specifies the requirements for client certificates, such as certificate types, acceptable certificate authorities (CAs), and other certificate validation criteria. B. EAP Authorization Profile: An EAP Authorization Profile must be configured in Cisco ISE. This profile defines the authorization policies and access privileges for devices and users authenticated using EAP-TLS. It specifies the network resources, VLAN assignments, and other attributes that should be applied to the authenticated devices and users.

   Source: Adapted from community discussion — rhylos

   Next question

3. Question 63 · 355 in bank

   

   Refer to the exhibit. An engineer is configuring the remote access VPN to use Cisco ISE for AAA and needs to conduct posture checks on the connecting endpoints. After the endpoint connects, it receives its initial authorization result and continues onto the compliance scan. What must be done for this AAA configuration to allow compliant access to the network?

   • AEnsure that authorization only mode is not enabled.
   • BEnable dynamic authorization within the AAA server group.
   • CFix the CoA port number.
   • DConfigure the posture authorization so it defaults to unknown status

   Show answer

   Answer: B

   Explanation

   When dynamic authorization is enabled in the AAA server group, ISE can interact with the configured AAA servers to perform the following actions: Change Authorization Policy: ISE can dynamically change the authorization policy for a user or device during a session. This allows ISE to modify the access privileges based on factors such as time of day, location, user behavior, or other contextual information. Re-authenticate Users: ISE can trigger a re-authentication process for users to reconfirm their identity and validate their access rights. This can be useful in scenarios where the user's access needs to be re-evaluated periodically or in response to certain events or conditions.

   Source: Adapted from community discussion — rhylos

   Next question

4. Question 64 · 355 in bank

   

   Refer to the exhibit. An engineer is configuring Cisco ISE for guest services. They would like to have any unregistered guests redirected to the guest portal for authentication, then have a CoA provide them with full access to the network that is segmented via firewalls. Why is the given configuration failing to accomplish this goal?

   • AThe Guest Portal and Guest Access policy lines are in the wrong order.
   • BThe PermitAccess result is not set to restricted access in its policy line.
   • CThe Network_Access_Authentication_Passed condition will not work with guest services for portal access.
   • DThe Guest_Flow condition is not in the line that gives access to the guest portal.

   Show answer

   Answer: A

   Explanation

   the lines are in the wrong order. The initial flow is MAB - not guest flow - https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475#toc-hId-1320686318 Guest flow only starts as soon as the user enters his credentials

   Source: Adapted from community discussion — MORTND

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

5. Question 65 · 355 in bank

   

   show authentication sessions Refer to the exhibit. An engineer is configuring a client but cannot authenticate to Cisco ISE. During troubleshooting, the command was issued to display the authentication status of each port. Which command gives additional information to help identify the problem with the authentication?

   • Ashow authentication sessions
   • Bshow authentication sessions output
   • Cshow authentication sessions interface Gi1/0/1 output
   • Dshow authentication sessions interface Gi1/0/1 details

   Show answer

   Answer: D

   Explanation

   the question is: Which command gives additional information not Which command is shown here - because that is already in the question

   Source: Adapted from community discussion — MORTND

   Next question

6. Question 66 · 355 in bank

   Select 2

   An administrator has added a new Cisco ISE PSN to their distributed deployment. Which two features must the administrator enable to accept authentication requests and profile the endpoints correctly, and add them to their respective endpoint identity groups? (Choose two.)

   • ASession Services
   • BProfiling Services
   • CRadius Service
   • DPosture Services
   • EEndpoint Attribute Filter

   Show answer

   Answer: AB

   Explanation

   https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_setup_cisco_ise.html#reference_94D3872F7DED4522909A3FF3ECFCDB23 Policy Service Check this check box to enable any one or all of the following services: Enable Session Services: Check this check box to enable network access, posture, guest, and client-provisioning services. Enable Profiling Service: Check this check box to enable the Profiling service.

   Source: Adapted from community discussion — iceise

   References

   • Cisco documentation

   Next question

7. Question 67 · 355 in bank

   While configuring Cisco TrustSec on Cisco IOS devices, the engineer must set the CTS device ID and password in order for the devices to authenticate with each other. However, after this is complete, the devices are not able to properly authenticate. What issue would cause this to happen even if the device ID and passwords are correct?

   • AEAP-FAST is not enabled.
   • BThe SGT mappings have not been defined.
   • CThe device aliases are not matching.
   • DThe devices are missing the configuration cts credentials trustsec verify 1.

   Show answer

   Answer: A

   Explanation

   I believe A is the correct answer. This question appears to be calling out NDAC which uses EAP-FAST. It's not B because SGT mappings don't have anything to do with devices authenticating to each other. It's not C because I don't think there is a device alias concept in TrustSec It's not D because this command doesn't exist as far as I can tell.

   Source: Adapted from community discussion — tliz

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 68 · 355 in bank

   An engineer is configuring Cisco ISE policies to support MAB for devices that do not have 802.1X capabilities. The engineer is configuring new endpoint identity groups as conditions to be used in the AuthZ policies, but noticed that the endpoints are not hitting the correct policies. What must be done in order to get the devices into the right policies?

   • ACreate an AuthZ policy to identify Unknown devices and provide partial network access prior to profiling.
   • BAdd an identity policy to dynamically add the IP address of the devices to their endpoint identity groups.
   • CIdentify the non 802.1X supported device types and create custom profiles for them to profile into.
   • DManually add the MAC addresses of the devices to endpoint ID groups in the context visibility database.

   Show answer

   Answer: D

   Explanation

   The correct answer is Manually add the MAC addresses of the devices to endpoint ID groups in the context visibility database. When an endpoint connects to a network that is using MAB, the switch will learn the MAC address of the endpoint and send it to ISE. ISE will then look up the MAC address in the context visibility database to determine which endpoint ID group the endpoint belongs to. If the endpoint is not found in the database, it will be assigned to the default endpoint ID group. To ensure that the endpoints are hitting the correct policies, the engineer needs to manually add the MAC addresses of the devices to the appropriate endpoint ID groups in the context visibility database. This can be done using the Cisco ISE GUI or the CLI. Once the MAC addresses have been added to the database, the endpoints will be assigned to the correct endpoint ID groups and will be subject to the appropriate policies.

   Source: Adapted from community discussion — denverfly

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

9. Question 69 · 355 in bank

   An engineer is configuring sponsored guest access and needs to limit each sponsored guest to a maximum of two devices. There are other guest services in production that rely on the default guest types. How should this configuration change be made without disrupting the other guest services currently offering three or more guest devices per user?

   • ACreate a Cisco ISE identity group to add users to and limit the number of logins via the group configuration.
   • BCreate an LDAP login for each guest and tag that in the guest portal for authentication.
   • CCreate a new sponsor group and adjust the settings to limit the devices for each guest.
   • DCreate a new guest type and set the maximum number of devices sponsored guests can register.

   Show answer

   Answer: D

   Next question

10. Question 70 · 355 in bank

    

    Refer to the exhibit. An administrator is manually adding a device to a Cisco ISE identity group to ensure that it is able to access the network when needed without authentication. Upon testing, the administrator notices that the device never hits the correct authorization policy line using the condition EndPoints-LogicalProfile EQUALS static_list. Why is this occurring?

    • AThe dynamic logical profile is overriding the statically assigned profile.
    • BThe logical profile is being statically assigned instead of the identity group.
    • CThe identity group is being assigned instead of the logical profile.
    • DThe device is changing identity groups after profiling instead of remaining static.

    Show answer

    Answer: B

    Explanation

    CORRECT is C) "The identity group is being assigned instead of the logical profile". 1. reason (pure logical): Both B) and C) answers are formulated as "group is being ASSIGNED", which of course means assigned to ENDPOINT, not to Authorization Policy (how could it be?). And screenshot in the question shows, that identity group really "is being assigned instead of the logical profile", which is answer C). 2. reason (eBook SISE): “Even though ENDPOINT IDENTITY GROUPS were useful in very early versions of ISE, their use for profiling has been deprecated in favor of using actual endpoint profiles or logical profiles directly in the authorization policy. ... Today, ENDPOINT IDENTITY GROUPS are used for a different purpose. They are used for a MAC Address Management (MAM) model, where you can create a STATIC LIST of MAC addresses to be authorized specifically (for example, a list of all Apple iPads that are owned by the company so they can be differentiated from personally owned iPads).”

    Source: Adapted from community discussion — NikoTomas

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 61. 355 questions available.