300-715 practice questions 81–90

1. Question 81 · 355 in bank

   An engineer has been tasked with standing up a new guest portal for customers that are waiting in the lobby. There is a requirement to allow guests to use their social media logins to access the guest network to appeal to more customers. What must be done to accomplish this task?

   • ACreate a sponsored guest portal and enable social media in the external identity sources.
   • BCreate a self-registered guest portal and enable the feature for social media logins.
   • CCreate a hotspot portal and enable social media login for network access.
   • DCreate a sponsor portal to allow guests to create accounts using their social media logins.

   Show answer

   Answer: B

   Explanation

   B: https://community.cisco.com/t5/security-knowledge-base/how-to-configure-amp-use-a-facebook-social-media-login-on-ise/ta-p/3609532 Configure the Guest Portal to Use Facebook Step 1: Navigate to Work Centers > Guest Access > Portal & Components > Guest Portals Step 2: Select the Self-Registered Guest Portal (Default) Step 3: Open Login Page Settings

   Source: Adapted from community discussion — Han2022

   References

   • cisco.com documentation

   Next question

2. Question 82 · 355 in bank

   An administrator is attempting to replace the built-in self-signed certificates on a Cisco ISE appliance. The CA is requesting some information about the appliance in order to sign the new certificate. What must be done in order to provide the CA this information?

   • AInstall the Root CA and intermediate CA.
   • BGenerate the CSR.
   • CDownload the CA server certificate.
   • DDownload the intermediate server certificate.

   Show answer

   Answer: B

   Explanation

   B is correct-- you Generate the CSR along with the public key pair needed for the certificate. the pertinent details are included in the certificate template

   Source: Adapted from community discussion — THEODORABLE

   Next question

3. Question 83 · 355 in bank

   A Cisco device has a port configured in multi-authentication mode and is accepting connections only from hosts assigned the SGT of SGT_0123456789. The VLAN trunk link supports a maximum of 8 VLANS. What is the reason for these restrictions?

   • AThe device is performing inline tagging without acting as a SXP speaker.
   • BThe device is performing inline tagging while acting as a SXP speaker.
   • CThe IP subnet addresses are dynamically mapped to an SGT.
   • DThe IP subnet addresses are statically mapped to an SGT.

   Show answer

   Answer: A

   Explanation

   https://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/configuration/guide/trustsec/sxp_config.html#Restriction%20for%20SGT%20Exchange%20Protocol The following restrictions are applicable when running Cisco TrustSec in enforcement mode or inline tagging mode. These restrictions do not apply when these switches are used as an SXP speaker: • An IP subnet address cannot be statically mapped to a Security Group Tag (SGT). • If a port is configured in multi-authentication mode, all hosts connecting to that port must be assigned the same SGT. • Cisco TrustSec enforcement mode on a VLAN trunk line supports only up to eight VLANs. If more than eight VLANs are configured on a VLAN trunk link and Cisco TrustSec is enabled on those VLANs,

   Source: Adapted from community discussion — iceise

   References

   • Cisco documentation

   Next question

4. Question 84 · 355 in bank

   Select 2

   An administrator is configuring a Cisco WLC for web authentication. Which two client profiling methods are enabled by default if the Apply Cisco ISE Default Settings check box has been selected? (Choose two.)

   • ALLDP
   • BCDP
   • CDHCP
   • DSNMP
   • EHTTP

   Show answer

   Answer: CE

   Explanation

   no need to vote - provided answer is correct see wlc config doc: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-4/config-guide/b_cg84/initial_setup.html (Optional) Enable Apply Cisco ISE default settings to automatically set the following parameters: RADIUS client profiling: DHCP profiling and HTTP profiling are enabled by default

   Source: Adapted from community discussion — johndelorien

   References

   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

5. Question 85 · 355 in bank

   Which Cisco ISE deployment model provides redundancy by having every node in the deployment configured with the Administration, Policy Service, and Monitoring personas to protect from a complete node failure?

   • Adispersed
   • Bdistributed
   • Ctwo-node
   • Dhybrid

   Show answer

   Answer: C

   Explanation

   this question is stupid. there are by definition from cisco only 2 deployment models: standalone and distributed also... as "all nodes" have PAN and MnT there can only be two nodes in the deployment as 2PAN/ 2MnT are max in a distributed deployment. so answer would be a "small" distributed deployment with two-nodes

   Source: Adapted from community discussion — johndelorien

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 86 · 355 in bank

   An engineer is configuring posture assessment for their network access control and needs to use an agent that supports using service conditions as conditions for the assessment. The agent should be run as a background process to avoid user interruption, but when it is run, the user can see it. What is the problem?

   • AThe posture module was deployed using the headend instead of installing it with SCCM.
   • BThe engineer is using the ג€Anyconnectג€ posture agent but should be using the ג€Stealth Anyconnectג€ posture agent.
   • CThe proper permissions were not given to the temporal agent to conduct the assessment.
   • DThe user was in need of remediation so the agent appeared in the notifications.

   Show answer

   Answer: B

   Explanation

   B- The Stealth AnyConnect posture agent is also relatively new and is design to be a permanent installation on the endpoint but in a "headless" configuration. The advantages of the Stealth AnyConnect posture agent is that it supports basically all the posture conditions as the AnyConnect agent however it will run as a background process to the end-user. There is no UI for the Stealth AnyConnect posture. However, if you include other modules such as AMP Enabler or VPN, you will see the UI. The Stealth AnyConnect posture agent requires an AnyConnect Apex license in addition to an ISE Apex license.

   Source: Adapted from community discussion — rhylos

   Next question

7. Question 87 · 355 in bank

   Which Cisco ISE deployment model is recommended for an enterprise that has over 50,000 concurrent active endpoints?

   • Alarge deployment with fully distributed nodes running all personas
   • Bmedium deployment with primary and secondary PAN/MnT/pxGrid nodes with shared PSNs
   • Cmedium deployment with primary and secondary PAN/MnT/pxGrid nodes with dedicated PSNs
   • Dsmall deployment with one primary and one secondary node running all personas

   Show answer

   Answer: C

   Explanation

   I think C is right Considerations for Choosing a Deployment • You can choose small deployment for up to 50,000 concurrent active sessions and medium deployment for up to 150,000 concurrent active sessions. • Large deployment is recommended for more than 150,000 concurrent concurrent active sessions. It is always recommended to register MnT nodes as Dedicated MnT in Large deployment. Medium-Sized Network Deployments In medium-sized network deployments, you can dedicate the new nodes for all AAA functions, and use the original nodes for configuration and logging functions. In a medium-sized network deployment, you cannot enable the Policy Service persona on a node that runs the Administration persona, Monitoring persona, or both. You need dedicated policy service node(s). https://www.cisco.com/c/en/us/td/docs/security/ise/performance_and_scalability/b_ise_perf_and_scale.html#Cisco_Concept.dita_67b428f0-2240-4383-bd49-5eb7a7b98a35

   Source: Adapted from community discussion — ccamar

   References

   • Cisco documentation

   Next question

8. Question 88 · 355 in bank

   What is a restriction of a standalone Cisco ISE node deployment?

   • AOnly the Policy Service persona can be disabled on the node.
   • BThe domain name of the node cannot be changed after installation.
   • CPersonas are enabled by default and cannot be edited on the node.
   • DThe hostname of the node cannot be changed after installation.

   Show answer

   Answer: C

   Explanation

   I believe the answer is C, " You cannot edit the personas or services of a standalone Cisco ISE node". "You can change the hostname, IP address, or domain name of standalone Cisco ISE nodes." so the answer cannot be D. https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010.html#ID561

   Source: Adapted from community discussion — JimboOh

   References

   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 89 · 355 in bank

   What are the minimum requirements for deploying the Automatic Failover feature on Administration nodes in a distributed Cisco ISE deployment?

   • Aa primary and secondary PAN and a health check node for the Secondary PAN
   • Ba primary and secondary PAN and no health check nodes
   • Ca primary and secondary PAN and a pair of health check nodes
   • Da primary and secondary PAN and a health check node for the Primary PAN

   Show answer

   Answer: D

   Explanation

   Cisco ISE supports Automatic Failover for the Administration persona. To enable the automatic failover feature, at least two nodes in your distributed setup should assume the Administration persona and one node should assume the nonadministration persona. If the primary PAN goes down, an automatic promotion of the secondary PAN is initiated. For this, a non-administration secondary node is designated as the health check node for each of the PANs. The health check node checks the health of the primary PAN at configured intervals. If the health check response received for the primary PAN is not good for reasons, such as the device being down or unreachable, the health check node initiates the promotion of the secondary PAN to take over the primary role after waiting for the configured threshold value. Some features are unavailable after automatic failover of the secondary PAN. Cisco ISE does not support fallback to the original primary PAN

   Source: Adapted from community discussion — redpassion

   References

   • Cisco documentation

   Next question

10. Question 90 · 355 in bank

    An engineer is testing low-impact mode for a phased deployment of Cisco ISE. Which type of traffic is denied when a host tries to connect to the network prior to authentication?

    • ADNS
    • BEAP
    • CDHCP
    • DHTTP

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 81. 355 questions available.