300-715 practice questions 71–80

1. Question 71 · 355 in bank

   A network administrator changed a Cisco ISE deployment from pilot to production and noticed that the JVM memory utilization increased significantly. The administrator suspects this is due to replication between the nodes. What must be configured to minimize performance degradation?

   • AEnable the endpoint attribute filter.
   • BReview the profiling policies for any misconfiguration.
   • CEnsure that Cisco ISE is updated with the latest profiler feed update.
   • DChange the reauthentication interval.

   Show answer

   Answer: A

   Explanation

   The answer seems to be correct according to the provided link, note the following statement: "Enabling the EndPoint Attribute Filter will have the Cisco ISE profiler only to keep significant attributes and discard all other attributes. Significant attributes are those used by the Cisco ISE system or those used specifically in a endpoint profiling policy or rule."

   Source: Adapted from community discussion — YmerG

   References

   • Cisco documentation

   Next question

2. Question 72 · 355 in bank

   An administrator is configuring sponsored guest access using Cisco ISE. Access must be restricted to the sponsor portal to ensure that only necessary employees can issue sponsored accounts, and employees must be classified to do so. What must be done to accomplish this task?

   • AModify the sponsor groups assigned to reflect the desired user groups.
   • BConfigure an identity-based access list in Cisco ISE to restrict the users allowed to login.
   • CEdit the sponsor portal to only accept members from the selected groups.
   • DCreate an authorization rule using the Guest Flow condition to authorize the administrators.

   Show answer

   Answer: A

   Explanation

   I would choose A too, Sponsor Group is the place where we define what the sponsor user can provide such as Create accouns, Create Bulk Accounts, send emails etc. Link: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_guest_pol.html

   Source: Adapted from community discussion — YmerG

   References

   • Cisco documentation

   Next question

3. Question 73 · 355 in bank

   During a 802.1X deployment, an engineer must identify failed authentications without causing problems for the connected endpoint. Which command will successfully achieve this?

   • Aauthentication open
   • Bdot1x pae authenticator
   • Cauthentication port-control auto
   • Ddot1x system-auth-control

   Show answer

   Answer: A

   Explanation

   Gotta be A, as per Cisco support: Both dot1x and MAB are methods of authentication for a port, whereas authentication open provides no authentication for a port, it allows all traffic through if a host is authenticated successfully or not. It is used when setting up dot1x configurations in monitor mode. You could have both dot1x/MAB authentication and authentication open to log authentication details but allow a user access even if they fail authentication.

   Source: Adapted from community discussion — Cnoteone

   Next question

4. Question 74 · 355 in bank

   An engineer is configuring TACACS+ within Cisco ISE for use with a non-Cisco network device. They need to send special attributes in the Access-Accept response to ensure that the users are given the appropriate access. What must be configured to accomplish this?

   • Acustom access conditions for defining the different roles
   • Bshell profiles with custom attributes that define the various roles
   • CdACLs to enforce the various access policies for the users
   • DTACACS+ command sets to provide appropriate access

   Show answer

   Answer: B

   Explanation

   This document provides a compilation of attributes that various Cisco and non-Cisco products expect to receive from an authentication, authorization, and accounting (AAA) server; in this case, the AAA server is an Access Control Server (ACS). The ACS can return these attributes along with an Access-Accept as a part of a shell profile (TACACS+) or authorization profile (RADIUS). https://www.cisco.com/c/en/us/support/docs/security/secure-access-control-system/115926-tacacs-radius-devices-00.html

   Source: Adapted from community discussion — Cnoteone

   References

   • Cisco documentation

   Next question

5. Question 75 · 355 in bank

   Select 2

   An administrator needs to allow guest devices to connect to a private network without requiring usernames and passwords. Which two features must be configured to allow for this? (Choose two.)

   • Acentral WebAuth
   • Bdevice registration WebAuth
   • Clocal WebAuth
   • Dself-registered guest portal
   • Ehotspot guest portal

   Show answer

   Answer: BE

   Explanation

   Using Device Registration Web Authentication (Device Registration WebAuth) and the Hotspot Guest portal, you can allow guest devices to connect to a private network without requiring usernames and passwords.

   Source: Adapted from community discussion — tliz

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 76 · 355 in bank

   An administrator wants to configure network device administration and is trying to decide whether to use TACACS+ or RADIUS. A reliable protocol must be used that can check command authorization. Which protocol meets these requirements and why?

   • ARADIUS because it runs over TCP.
   • BRADIUS because it runs over UDP.
   • CTACACS+ because it runs over TCP.
   • DTACACS+ because it runs over UDP.

   Show answer

   Answer: C

   Next question

7. Question 77 · 355 in bank

   An engineer is creating a new authorization policy to give the endpoints access to VLAN 310 upon successful authentication. The administrator tests the 802.1X authentication for the endpoint and sees that it is authenticating successful. What must be done to ensure that the endpoint is placed into the correct VLAN?

   • AConfigure the switchport access vlan 310 command on the switch port.
   • BAdd VLAN 310 in the common tasks of the authorization profile.
   • CEnsure that the endpoint is using the correct policy set.
   • DEnsure that the security group is not preventing the endpoint from being in VLAN 310.

   Show answer

   Answer: B

   Explanation

   Authentication was successfull. So i assume that the endpoint used the right policyset. https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/217043-configure-dynamic-vlan-assignment-with-c.html#anc13 Step 3. Configure the RADIUS (IETF) attributes used for dynamic VLAN Assignment This procedure explains how to create an authorization profile and an authentication policy for wireless users. Complete these steps: From the ISE GUI, navigate to Policy > Policy Elements > Results > Authorization > Authorization profiles and select Add to create a new profile. Complete the authorization profile configuration with VLAN information for the respective group.

   Source: Adapted from community discussion — iceise

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

8. Question 78 · 355 in bank

   Select 2

   An engineer is configuring Cisco ISE for network device administration and has devices that support both protocols. What are two benefits of choosing TACACS+ over RADIUS for these devices? (Choose two.)

   • ATACACS+ uses secure EAP-TLS while RADIUS does not.
   • BTACACS+ is FIPS compliant while RADIUS is not.
   • CTACACS+ encrypts the entire payload being sent while RADIUS only encrypts the password.
   • DTACACS+ is designed for network access control while RADIUS is designed for role-based access.
   • ETACACS+ provides the ability to authorize specific commands while RADIUS does not.

   Show answer

   Answer: CE

   Next question

9. Question 79 · 355 in bank

   An engineer is enabling a newly configured wireless SSID for tablets and needs visibility into which other types of devices are connecting to it. What must be done on the Cisco WLC to provide this information to Cisco ISE?

   • Aenable mDNS snooping
   • Benable Fast Transition
   • Cenable MAC filtering
   • Denable IP Device Tracking

   Show answer

   Answer: D

   Explanation

   The correct answer is: enable IP Device Tracking. IP Device Tracking (IPDT) is a feature that allows the Cisco WLC to track the IP addresses of devices that are connected to the wireless network. This information can then be provided to Cisco ISE, which can use it to identify the types of devices that are connecting to the network. The other options are incorrect: enable mDNS snooping: mDNS snooping is a feature that allows the Cisco WLC to intercept mDNS traffic and use it to build a database of devices that are connected to the wireless network. However, this information is not provided to Cisco ISE. enable Fast Transition: Fast Transition is a feature that allows devices to roam between access points more quickly. However, this feature does not provide any information about the types of devices that are connecting to the network. enable MAC filtering: MAC filtering is a feature that allows the Cisco WLC to block devices from connecting to the wireless network based on their MAC addresses. However, this feature does not provide any information about the types of devices that are connecting to the network.

   Source: Adapted from community discussion — denverfly

   References

   • cisco.com documentation
   • cisco.com documentation

   Next question

10. Question 80 · 355 in bank

    An engineer is configuring a posture policy for Windows 10 endpoints and wants to ensure that users in each AD group have different conditions to meet to be compliant. What must be done to accomplish this task?

    • AChange the posture requirements to use an AD group for each use case, then use those requirements in the posture policy.
    • BIdentify the users groups needed for different policies and create service conditions to map each one to its posture requirement.
    • CConfigure a simple condition for each AD group and use it in the posture policy for each use case.
    • DUse the authorization policy within the policy set to group each AD group with their respective posture policy.

    Show answer

    Answer: B

    Explanation

    Correct is C: "Configure a simple condition for each AD group and use it in the posture policy for each use case." --- NOT correct answers: A: “Change the posture requirements...” = this has nothing to do with AD groups, posture requirements are about conditions (firewall is running, file exists, etc...) and their expected remediation actions. B: “...create service conditions to map each one to its posture requirement” – Service Conditions? – they verifies that Win service or macOS daemon is running. Nothing to do with AD groups. D: “Use the authorization policy within the policy set...” – Authorization policy just uses posture attribute (“is compliant”), which refers to Posture policy as standalone entity, where requirements per AD group can be configured. ebook SISE: “The posture policies determine which requirements are mandatory and for whom” – i. e. NOT Authorization policy.

    Source: Adapted from community discussion — NikoTomas

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 71. 355 questions available.