An administrator needs to give the same level of access to the network devices when users are logging into them using TACACS+ However, the administrator must restrict certain commands based on one of three user roles that require different commands How is this accomplished without creating too many objects using Cisco ISE?

Create one shell profile and multiple command sets.

Create multiple shell profiles and multiple command sets.

Create one shell profile and one command set.

Create multiple shell profiles and one command set

An administrator for a small network is configuring Cisco ISE to provide dynamic network access to users. Management needs Cisco ISE to not automatically trigger a CoA whenever a profile change is detected. Instead, the administrator needs to verify the new profile and manually trigger a Co

What must be configuring in the profiler to accomplish this goal?

An organization wants to split their Cisco ISE deployment to separate the device administration functionalities from the mam deployment. For this to work, the administrator must deregister any nodes that will become a part of the new deployment, but the button for this option is grayed out Which configuration is causing this behavior?

One of the nodes is the Primary PAN

One of the nodes is an active PSN.

One of the nodes is the Primary PAN

All of the nodes participate in the PAN auto failover.

All of the nodes are actively being synched.

An employee logs on to the My Devices portal and marks a currently on-boarded device as 'Lost'.Which two actions occur within Cisco ISE as a result oí this action? (Choose two)

Certificates provisioned to the device are not revoked

BYOD Registration status is updated to No

Certificates provisioned to the device are not revoked

BYOD Registration status is updated to No

The device access has been denied

BYOD Registration status is updated to Unknown.

The device status is updated to Stolen

A network administrator must use Cisco ISE to check whether endpoints have the correct version of antivirus installed Which action must be taken to allow this capability?

Configure a native supplicant profile to be used for checking the antivirus version

Configure Cisco ISE to push the HostScan package to the endpoints to check for the antivirus version.

Create a Cisco AnyConnect Network Visibility Module configuration profile to send the antivirus information of the endpoints to Cisco ISE.

Create a Cisco AnyConnect configuration within Cisco ISE for the Compliance Module and associated configuration files

Refer to the exhibit. An engineer is creating a new TACACS* command set and cannot use any show commands after togging into the device with this command set authorization Which configuration is causing this issue?

Question marks are not allowed as wildcards for command sets.

The command set is allowing all commands that are not in the command list

The wildcard command listed is in the wrong format

The command set is working like an ACL and denying every command.

An organization is migrating its current guest network to Cisco ISE and has 1000 guest users in the current database There are no resources to enter this information into the Cisco ISE database manually. What must be done to accomplish this task effciently?

Use a CSV file to import the guest accounts

Use SOL to link me existing database to Ctsco ISE

Use a JSON fie to automate the migration of guest accounts

Use an XML file to change the existing format to match that of Cisco ISE

What does a fully distributed Cisco ISE deployment include?

PAN and PSN on the same node while MnTs are on their own dedicated nodes.

PAN and MnT on the same node while PSNs are on their own dedicated nodes.

All Cisco ISE personas on their own dedicated nodes.

All Cisco ISE personas are sharing the same node.

An administrator is trying to collect metadata information about the traffic going across the network to gam added visibility into the hosts. This Information will be used to create profiling policies for devices us mg Cisco ISE so that network access policies can be used What must be done to accomplish this task?

Configure the DHCP probe within Cisco ISE

Configure the RADIUS profiling probe within Cisco ISE

Configure NetFlow to be sent to me Cisco ISE appliance.

Configure SNMP to be used with the Cisco ISE appliance

Configure the DHCP probe within Cisco ISE

A laptop was stolen and a network engineer added it to the block list endpoint identity group What must be done on a new Cisco ISE deployment to redirect the laptop and restrict access?

Ensure that access to port 8444 is allowed within the ACL.

Select DenyAccess within the authorization policy.

Ensure that access to port 8443 is allowed within the ACL.

Ensure that access to port 8444 is allowed within the ACL.

Select DROP under If Auth fail within the authentication policy.

An adminístrator is migrating device administration access to Cisco ISE from the legacy TACACS+ solution that used only privilege 1 and 15 access levels. The organization requires more granular controls of the privileges and wants to customize access levels 2-5 to correspond with different roles and access needs. Besides defining a new shell profile in Cisco ISE. what must be done to accomplish this configuration?

Enable the privilege levels in the IOS devices.

Enable the privilege levels in Cisco ISE

Enable the privilege levels in the IOS devices.

Define the command privileges for levels 2-5 in the IOS devices

Define the command privileges for levels 2-5 in Cisco ISE

An administrator is configuring RADIUS on a Cisco switch with a key set to Cisc403012128 but is receiving the error "Authentication failed: 22040 Wrong password or invalid shared secret. "what must be done to address this issue?

Validate that the key is correct on both the Cisco switch as well as Cisco ISE.

Add the network device as a NAD inside Cisco ISE using the existing key.

Configure the key on the Cisco ISE instead of the Cisco switch.

Use a key that is between eight and ten characters.

Validate that the key is correct on both the Cisco switch as well as Cisco ISE.

An organization has a fully distributed Cisco ISE deployment When implementing probes, an administrator must scan for unknown endpoints to learn the IP-to-MAC address bindings. The scan is complete on one FPSN. but the information is not available on the others. What must be done to make the information available?

Cisco ISE must learn the IP-MAC binding of unknown endpoints via DHCP profiling, not via scanning

Scanning must be initiated from the PSN that last authenticated the endpoint

Cisco ISE must learn the IP-MAC binding of unknown endpoints via DHCP profiling, not via scanning

Scanning must be initiated from the MnT node to centrally gather the information

Cisco ISE must be configured to learn the IP-MAC binding of unknown endpoints via RADIUS authentication, not via scanning

An administrator is configuring a new profiling policy within Cisco ISE The organization has several endpoints that are the same device type and all have the same Block ID in their MAC address. The profiler does not currently have a profiling policy created to categorize these endpoints. therefore a custom profiling policy must be created Which condition must the administrator use in order to properly profile an ACME Al Connector endpoint for network access with MAC address <MAC ADDRESS>?

Radius Called Station-ID STARTSWITH <MACADDRESS>

MAC_OUI_STARTSWITH_<MACADDRESS>

CDP_cdpCacheDevicelD_CONTAINS_<MACADDRESS>

MAC_MACAddress_CONTAINS_<MACADDRESS>

Radius Called Station-ID STARTSWITH <MACADDRESS>

A network administrator is configuring client provisioning resource policies for client machines and must ensure that an agent pop-up is presented to the client when attempting to connect to the network Which configuration item needs to be added to allow for this'?

a remote posture agent proxying the network connection

the client provisioning URL in the authorization policy

a temporal agent that gets installed onto the system

a remote posture agent proxying the network connection

an API connection back to the client

A network administrator notices that after a company-wide shut down, many users cannot connect their laptops to the corporate SSID. What must be done to permit access in a timely manner?

Authenticate the user's system to the secondary Cisco ISE node and move this user to the primary with the renewed certificate.

Connect this system as a guest user and then redirect the web auth protocol to log in to the network.

Add a certificate issue from the CA server, revoke the expired certificate, and add the new certificate in system.

Allow authentication for expired certificates within the EAP-TLS section under the allowed protocols.

An administrator adds a new network device to the Cisco ISE configuration to authenticate endpoints to the network. The RADIUS test fails after the administrator configures all of the settings in Cisco ISE and adds the proper configurations to the switch. What is the issue"?

The endpoint does not have the appropriate credentials for network access.

The endpoint profile is showing as "unknown."

The endpoint does not have the appropriate credentials for network access.

The shared secret is incorrect on the switch or on Cisco ISE.

The certificate on the switch is self-signed not a CA-provided certificate.

An engineer tests Cisco ISE posture services on the network and must configure the compliance module to automatically download and install on endpoints Which action accomplishes this task for VPN users?

Create a Cisco AnyConnect configuration and Client Provisioning policy within Cisco ISE.

Configure the compliance module to be downloaded from within the posture policy.

Push the compliance module from Cisco FTD prior to attempting posture.

Use a compound posture condition to check for the compliance module and download if needed.

Users in an organization report issues about having to remember multiple usernames and passwords. The network administrator wants the existing Cisco ISE deployment to utilize an external identity source to alleviate this issue. Which two requirements must be met to implement this change? (Choose two.)

Establish access to one Global Catalog server.

Provide domain administrator access to Active Directory.

Enable IPC access over port 80.

Ensure that the NAT address is properly configured

Establish access to one Global Catalog server.

Provide domain administrator access to Active Directory.

Configure a secure LDAP connection.

What is a function of client provisioning?

It ensures that endpoints receive the appropriate posture agents

It ensures an application process is running on the endpoint.

It checks a dictionary' attribute with a value.

It ensures that endpoints receive the appropriate posture agents

It checks the existence date and versions of the file on a client.

An administrator is troubleshooting an endpoint that is supposed to bypass 802 1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB. however the endpoint cannot communicate because it cannot obtain an IP address. What is the problem?

The 802.1 X timeout period is too long.

The DHCP probe for Cisco ISE is not working as expected.

The 802.1 X timeout period is too long.

The endpoint is using the wrong protocol to authenticate with Cisco ISE.

An AC I on the port is blocking HTTP traffic

A Cisco ISE administrator must restrict specific endpoints from accessing the network while in closed mode. The requirement is to have Cisco ISE centrally store the endpoints to restrict access from.What must be done to accomplish this task''

Create a logical profile for each device's profile policy and block that via authorization policies.

Add each MAC address manually to a blocklist identity group and create a policy denying access

Create a logical profile for each device's profile policy and block that via authorization policies.

Create a profiling policy for each endpoint with the cdpCacheDeviceld attribute.

Add each IP address to a policy denying access.

An engineer deploys Cisco ISE and must configure Active Directory to then use information from Active Directory in an authorization policy. Which two components must be configured, in addition to Active Directory groups, to achieve this goat? (Choose two )

Active Directory External Identity Sources

Library Condition for External Identity: External Groups

Active Directory External Identity Sources

Library Condition for External Identity: External Groups

Library Condition for Identity Group: User Identity Group

Cisco 300-715 Practice Test 4 - Free Online Exam Questions 121-160

A customer wants to set up the Sponsor portal and delegate the authentication flow to a third party for added security while using Kerberos Which database should be used to accomplish this goal?

Become a Premium Member for full access

Unlock Premium Member

Cisco 300-715 Practice Test 4

Question

Cisco 300-715 Practice Tests

Practice Tests