What should be considered when configuring certificates for BYOD?

An endpoint certificate is mandatory for the Cisco ISE BYOD.

The SAN field is populated with the end user name.

The CN field is populated with the endpoint host name.

An endpoint certificate is mandatory for the Cisco ISE BYOD.

An Android endpoint uses EST, whereas other operating systems use SCEP for enrollment.

An administrator is attempting to replace the built-in self-signed certificates on a Cisco ISE appliance.The CA is requesting some information about the appliance in order to sign the new certificate. What must be done in order to provide the CA this information?

Install the Root CA and intermediate CA.

Download the intermediate server certificate.

Download the CA server certificate.

An organization is hosting a conference and must make guest accounts for several of the speakers attending. The conference ended two days early but the guest accounts are still being used to access the network. What must be configured to correct this?

Navigate to the Sponsor Portal and suspend the guest accounts.

Create an authorization rule denying sponsored guest access.

Navigate to the Guest Portal and delete the guest accounts.

Create an authorization rule denying guest access.

Navigate to the Sponsor Portal and suspend the guest accounts.

An administrator is configuring posture with Cisco ISE and wants to check that specific services are present on the workstations that are attempting to access the network. What must be configured to accomplish this goal?

Create a service posture condition using a non-OPSWAT API version.

Create a registry posture condition using a non-OPSWAT API version.

Create an application posture condition using a OPSWAT API version.

Create a compound posture condition using a OPSWAT API version.

Create a service posture condition using a non-OPSWAT API version.

What must be configured on the WLC to configure Central Web Authentication using Cisco ISE and a WLC?

Set the NAC State option to RADIUS NAC.

Set the NAC State option to SNMP NAC.

Set the NAC State option to RADIUS NAC.

Use the radius-server vsa send authentication command.

Use the ip access-group webauth in command.

Refer to the exhibit. An organization recently implemented network device administration using Cisco ISE. Upon testing the ability to access all of the required devices, a user in the Cisco ISE group IT Admins is attempting to login to a device in their organization's finance department but is unable to. What is the problem?

The authorization policy doesn't correctly grant them access to the finance devices.

The IT training rule is taking precedence over the IT Admins rule.

The authorization conditions wrongly allow IT Admins group no access to finance devices.

The finance location is not a condition in the policy set.

The authorization policy doesn't correctly grant them access to the finance devices.

When creating a policy within Cisco ISE for network access control, the administrator wants to allow different access restrictions based upon the wireless SSID to which the device is connecting. Which policy condition must be used in order to accomplish this?

Radius Called-Station-ID CONTAINS <SSID Name>

Network Access NetworkDeviceName CONTAINS <SSID Name>

DEVICE Device Type CONTAINS <SSID Name>

Radius Called-Station-ID CONTAINS <SSID Name>

Airespace Airespace-Wlan-ld CONTAINS <SSID Name>

An organization wants to improve their BYOD processes to have Cisco ISE issue certificates to the BYOD endpoints. Currently, they have an active certificate authority and do not want to replace it with Cisco ISE. What must be configured within Cisco ISE to accomplish this goal?

Create an SCEP profile to link Cisco ISE with the root certificate authority.

Create a certificate signing request and have the root certificate authority sign it.

Add the root certificate authority to the trust store and enable it for authentication.

Create an SCEP profile to link Cisco ISE with the root certificate authority.

Add an OCSP profile and configure the root certificate authority as secondary.

An administrator is adding network devices for a new medical building into Cisco ISE. These devices must be in a network device group that is identifying them as "Medical Switch" so that the policies can be made separately for the endpoints connecting through them. Which configuration item must be changed in the network device within Cisco ISE to accomplish this goal?

Change the device type to Medical Switch.

Change the device profile to Medical Switch.

Change the model name to Medical Switch.

Change the device location to Medical Switch.

An engineer is designing a new distributed deployment for Cisco ISE in the network and is considering failover options for the admin nodes. There is a need to ensure that an admin node is available for configuration of policies at all times.What is the requirement to enable this feature?

one primary admin and one secondary admin node in the deployment

one policy services node and one secondary admin node

one policy services node and one monitoring and troubleshooting node

one primary admin node and one monitoring and troubleshooting node

A company manager is hosting a conference. Conference participants must connect to an open guest SSID and only use a preassigned code that they enter into the guest portal prior to gaining access to the network. How should the manager configure Cisco ISE to accomplish this goal?

Create an access code to be entered in the AUP page.

Create entries in the guest identity group for all participants.

Create an access code to be entered in the AUP page.

Create logins for each participant to give them sponsored access.

Create a registration code to be entered on the portal splash page.

A network security engineer needs to configure 802.1X port authentication to allow a single host to be authenticated for data and another single host to be authenticated for voice. Which command should the engineer run on the interface to accomplish this goal?

authentication host-mode multi-domain

authentication host-mode single-host

authentication host-mode multi-auth

authentication host-mode multi-host

authentication host-mode multi-domain

What is a function of client provisioning?

Client provisioning ensures that endpoints receive the appropriate posture agents.

Client provisioning checks a dictionary attribute with a value.

Client provisioning ensures an application process is running on the endpoint.

Client provisioning checks the existence, date, and versions of the file on a client.

What is an advantage of using EAP-TLS over EAP-MS-CHAPv2 for client authentication?

EAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not.

EAP-TLS uses a username and password for authentication to enhance security, while EAP-MSCHAPv2 does not.

EAP-TLS secures the exchange of credentials, while EAP-MS-CHAPv2 does not.

EAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not.

EAP-TLS uses multiple forms of authentication, while EAP-MS-CHAPv2 only uses one.

There are several devices on a network that are considered critical and need to be placed into the ISE database and a policy used for them. The organization does not want to use profiling. What must be done to accomplish this goal?

Enter the MAC address in the correct Endpoint Identity Group.

Enter the MAC address in the correct Logical Profile.

Enter the IP address in the correct Logical Profile.

Enter the IP address in the correct Endpoint Identity Group.

A network administrator is configuring authorization policies on Cisco ISE There is a requirement to use AD group assignments to control access to network resources After a recent power failure and Cisco ISE rebooting itself, the AD group assignments no longer work What is the cause of this issue?

The AD join point is no longer connected.

The certificate checks are not being conducted.

The network devices ports are shut down.

A network administrator is setting up wireless guest access and has been unsuccessful in testing client access. The endpoint is able to connect to the SSID but is unable to grant access to the guest network through the guest portal. What must be done to identify the problem?

Use the endpoint ID to execute a session trace.

Use context visibility to verify posture status.

Use the endpoint ID to execute a session trace.

Use the identity group to validate the authorization rules.

Use traceroute to ensure connectivity.

An organization wants to standardize the 802 1X configuration on their switches and remove static ACLs on the switch ports while allowing Cisco ISE to communicate to the switch what access to provide What must be configured to accomplish this task?

security group tag within the authorization policy

extended access-list on the switch for the client

port security on the switch based on the client's information

dynamic access list within the authorization profile

A network engineer is configuring guest access and notices that when a guest user registers a second device for access, the first device loses access What must be done to ensure that both devices for a particular user are able to access the guest network simultaneously?

Modify the guest type to increase the number of maximum devices

Configure the sponsor group to increase the number of logins.

Use a custom portal to increase the number of logins

Modify the guest type to increase the number of maximum devices

Create an Adaptive Network Control policy to increase the number of devices

An organization is implementing Cisco ISE posture services and must ensure that a host-based firewall is in place on every Windows and Mac computer that attempts to access the network They have multiple vendors' firewall applications for their devices, so the engineers creating the policies are unable to use a specific application check in order to validate the posture for this What should be done to enable this type of posture check?

Enable the default firewall condition to check for any vendor firewall application.

Use the file registry condition to ensure that the firewal is installed and running appropriately.

Use a compound condition to look for the Windows or Mac native firewall applications.

Enable the default firewall condition to check for any vendor firewall application.

Enable the default application condition to identify the applications installed and validade the firewall app.

An administrator is configuring TACACS+ on a Cisco switch but cannot authenticate users with Cisco ISE. The configuration contains the correct key of Cisc039712287. but the switch is not receiving a response from the Cisco ISE instanceWhat must be done to validate the AAA configuration and identify the problem with the TACACS+ servers?

Check for server reachability using the test aaa group tacacs+ admin <key> legacy command.

Test the user account on the server using the test aaa group radius server CUCS user admin pass<key> legacy command.

Validate that the key value is correct using the test aaa authentication admin <key> legacy command.

Confirm the authorization policies are correct using the test aaa authorization admin drop legacy command.

Refer to the exhibit: Refer to the exhibit. In which scenario does this switch configuration apply?

when allowing a hub with multiple clients connected

when passing IP phone authentication

when allowing multiple IP phones to be connected

when preventing users with hypervisor

When configuring an authorization policy, an administrator cannot see specific Active Directory groups present in their domain to be used as a policy condition. However, other groups that are in the same domain are seen What is causing this issue?

The groups are not added to Cisco ISE under the AD join point

Cisco ISE only sees the built-in groups, not user created ones

The groups are present but need to be manually typed as conditions

Cisco ISE's connection to the AD join point is failing

The groups are not added to Cisco ISE under the AD join point

A network administrator changed a Cisco ISE deployment from pilot to production and noticed that the JVM memory utilization increased significantly. The administrator suspects this is due to replication between the nodes What must be configured to minimize performance degradation?

Enable the endpoint attribute filter

Review the profiling policies for any misconfiguration

Enable the endpoint attribute filter

Change the reauthenticate interval.

Ensure that Cisco ISE is updated with the latest profiler feed update

A Cisco ISE administrator needs to ensure that guest endpoint registrations are only valid for one day When testing the guest policy flow, the administrator sees that the Cisco ISE does not delete the endpoint in the Guest Endpoints identity store after one day and allows access to the guest network after that period. Which configuration is causing this problem?

The Endpoint Purge Policy is set to 30 days for guest devices

The RADIUS policy set for guest access is set to allow repeated authentication of the same device

The length of access is set to 7 days in the Guest Portal Settings

The Guest Account Purge Policy is set to 15 days

A Cisco ISE server sends a CoA to a NAD after a user logs in successfully using CWA Which action does the CoA perform?

It applies the downloadable ACL provided in the CoA

It terminates the client session

It applies the downloadable ACL provided in the CoA

It applies new permissions provided in the CoA to the client session.

It triggers the NAD to reauthenticate the client

Cisco 300-715 Practice Test 3 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Cisco 300-715 Practice Test 3

Question

Cisco 300-715 Practice Tests

Practice Tests