An engineer is configuring Cisco ISE policies to support MAB for devices that do not have 802.1X capabilities. The engineer is configuring new endpoint identity groups as conditions to be used in the AuthZ policies, but noticed that the endpoints are not hitting the correct policies. What must be done in order to get the devices into the right policies?

Identify the non 802.1 * supported device types and create custom profiles for them to profile into.

Manually add the MAC addresses of the devices to endpoint ID groups in the context visibility database.

Create an AuthZ policy to identify Unknown devices and provide partial network access prior to profiling.

Add an identity policy to dynamically add the IP address of the devices to their endpoint identity groups.

Identify the non 802.1 * supported device types and create custom profiles for them to profile into.

A network administrator is currently using Cisco ISE to authenticate devices and users via 802 1X There is now a need to also authorize devices and users using EAP-TLS. Which two additional components must be configured in Cisco ISE to accomplish this'? (Choose two.)

Common Name attribute that maps to an identity store

Certificate Authentication Profile

Serial Number attribute that maps to a CA Server

Common Name attribute that maps to an identity store

Certificate Authentication Profile

An engineer is configuring sponsored guest access and needs to limit each sponsored guest to a maximum of two devices. There are other guest services in production that rely on the default guest types. How should this configuration change be made without disrupting the other guest services currently offering three or more guest devices per user?

Create a new sponsor group and adjust the settings to limit the devices for each guest.

Create an ISE identity group to add users to and limit the number of logins via the group configuration.

Create a new guest type and set the maximum number of devices sponsored guests can register

Create an LDAP login for each guest and tag that in the guest portal for authentication.

Create a new sponsor group and adjust the settings to limit the devices for each guest.

A Cisco ISE administrator needs to ensure that guest endpoint registrations are only valid for 1 day.When testing the guest policy flow, the administrator sees that the Cisco ISE does not delete the endpoint in the Guest Endpoints identity store after one day and allows access to the guest network after that period. Which configuration is causing this problem?

The Endpoint Purge Policy is set to 30 days for guest devices.

The RADIUS policy set for guest access is set to allow repeated authentication of the same device.

The length of access is set to 7 days in the Guest Portal Settings.

The Endpoint Purge Policy is set to 30 days for guest devices.

The Guest Account Purge Policy is set to 15 days.

What are two differences between the RADIUS and TACACS+ protocols'? (Choose two.)

TACACS+uses TCP port 49. whereas RADIUS uses UDP ports 1812 and 1813.

RADIUS combines authentication and authorization, whereas TACACS+ does not

RADIUS is a Cisco proprietary protocol, whereas TACACS+ is an open standard protocol

TACACS+uses TCP port 49. whereas RADIUS uses UDP ports 1812 and 1813.

RADIUS offers multiprotocol support, whereas TACACS+ does not

RADIUS combines authentication and authorization, whereas TACACS+ does not

RADIUS enables encryption of all the packets, whereas with TACACS+. only the password is encrypted.

An administrator is configuring a new profiling policy in Cisco ISE for a printer type that is missing from the profiler feed The logical profile Printers must be used in the authorization rule and the rule must be hit. What must be done to ensure that this configuration will be successful^

Enable the EndPoints:EndPointPolicy condition in the authorization policy.

Create a new logical profile for the new printer policy

Enable the EndPoints:EndPointPolicy condition in the authorization policy.

Add the new profiling policy to the logical profile Printers.

Modify the profiler conditions to ensure that it goes into the correct logical profile

An administrator is configuring a switch port for use with 802 1X What must be done so that the port will allow voice and multiple data endpoints?

Configure the port with the authentication host-mode multi-auth command

Connect the data devices to the port, then attach the phone behind them.

Use the command authentication host-mode multi-domain on the port

Connect a hub to the switch port to allow multiple devices access after authentication

Refer to the exhibit.An engineer is configuring Cisco ISE for guest services They would like to have any unregistered guests redirected to the guest portal for authentication then have a CoA provide them with full access to the network that is segmented via firewalls Why is the given configuration failing to accomplish this goal?

The Guest Portal and Guest Access policy lines are in the wrong order

The Guest Flow condition is not in the line that gives access to the quest portal

The Network_Access_Authentication_Passed condition will not work with guest services for portal access.

The Permit Access result is not set to restricted access in its policy line

The Guest Portal and Guest Access policy lines are in the wrong order

An engineer is configuring ISE for network device administration and has devices that support both protocols. What are two benefits of choosing TACACS+ over RADUs for these devices? (Choose two.)

TACACS+ provides the ability to authorize specific commands while RADIUS does not

TACACS+ encrypts the entire payload being sent while RADIUS only encrypts the password.

TACACS+ is FIPS compliant while RADIUS is not

TACACS+ is designed for network access control while RADIUS is designed for role-based access.

TACACS+ uses secure EAP-TLS while RADIUS does not.

TACACS+ provides the ability to authorize specific commands while RADIUS does not

TACACS+ encrypts the entire payload being sent while RADIUS only encrypts the password.

During a 802 1X deployment, an engineer must identify failed authentications without causing problems for the connected endpoint. Which command will successfully achieve this''

authentication port-control auto

An engineer is configuring 802.1X and is testing out their policy sets. After authentication, some endpoints are given an access-reject message but are still allowed onto the network. What is causing this issue to occur?

The switch port is configured with authentication open.

The switch port is configured with authentication event server dead action authorize vlan.

The authorization results for the endpoints include a dACL allowing access.

The authorization results for the endpoints include the Trusted security group tag.

The switch port is configured with authentication open.

An engineer has been tasked with standing up a new guest portal for customers that are waiting in the lobby. There is a requirement to allow guests to use their social media logins to access the guest network to appeal to more customersWhat must be done to accomplish this task?

Create a self-registered guest portal and enable the feature for social media logins

Create a sponsor portal to allow guests to create accounts using their social media logins.

Create a sponsored guest portal and enable social media in the external identity sources.

Create a self-registered guest portal and enable the feature for social media logins

Create a hotspot portal and enable social media login for network access

An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE. but the devices do not change their access due to the new profile. What is the problem'?

The default profiler configuration is set to No CoA for the reauthentication setting

In closed mode, profiling does not work unless CDP is enabled.

The profiling probes are not able to collect enough information to change the device profile

The profiler feed is not downloading new information so the profiler is inactive

The default profiler configuration is set to No CoA for the reauthentication setting

An administrator is configuring cisco ISE lo authenticate users logging into network devices using TACACS+ The administrator is not seeing any oí the authentication in the TACACS+ live logs. Which action ensures the users are able to log into the network devices?

Enable the device administration service in the PSN persona.

Enable the device administration service in the Administration persona

Enable the session services in the administration persona

Enable the service sessions in the PSN persona.

Enable the device administration service in the PSN persona.

An engineer is configuring the remote access VPN to use Cisco ISE for AAA and needs to conduct posture checks on the connecting endpoints After the endpoint connects, it receives its initial authorization result and continues onto the compliance scan What must be done for this AAA configuration to allow compliant access to the network?

Enable dynamic authorization within the AAA server group

Configure the posture authorization so it defaults to unknown status

Ensure that authorization only mode is not enabled

Enable dynamic authorization within the AAA server group

Which two Cisco ISE deployment models require two nodes configured with dedicated PAN and MnT personas? (Choose two.)

five PSN nodes with one PxGrid node

two PSN nodes with one PxGrid node

seven PSN nodes with one PxGrid node

five PSN nodes with one PxGrid node

two PSN nodes with one PxGrid node

A Cisco device has a port configured in multi-authentication mode and is accepting connections only from hosts assigned the SGT of SGT_0422048549 The VLAN trunk link supports a maximum of 8 VLANS What is the reason for these restrictions?

The IP subnet addresses are dynamically mapped to an SGT.

The device is performing inline tagging without acting as a SXP speaker

The device is performing mime tagging while acting as a SXP speaker

The IP subnet addresses are dynamically mapped to an SGT.

The IP subnet addresses are statically mapped to an SGT

An administrator wants to configure network device administration and is trying to decide whether to use TACACS* or RADIUS. A reliable protocol must be used that can check command authorization Which protocol meets these requirements and why?

TACACS+ because it runs over TCP

RADIUS because it runs over UDP

RADIUS because it runs over TCP.

TACACS+ because it runs over UDP

An administrator is configuring sponsored guest access using Cisco ISE Access must be restricted to the sponsor portal to ensure that only necessary employees can issue sponsored accounts and employees must be classified to do soWhat must be done to accomplish this task?

Modify the sponsor groups assigned to reflect the desired user groups

Configure an identity-based access list in Cisco ISE to restrict the users allowed to login

Edit the sponsor portal to only accept members from the selected groups

Modify the sponsor groups assigned to reflect the desired user groups

Create an authorization rule using the Guest Flow condition to authorize the administrators

Refer to the exhibit. An engineer is configuring a client but cannot authenticate to Cisco ISE During troubleshooting, the show authentication sessions command was issued to display the authentication status of each port Which command gives additional information to help identify the problem with the authentication?

show authentication sessions interface Gi1/0/1 details

show authentication sessions Interface Gil/0/1 output

show authentication sessions interface Gi1/0/1 details

show authentication sessions output

An administrator is manually adding a device to a Cisco ISE identity group to ensure that it is able to access the network when needed without authentication Upon testing, the administrator notices that the device never hits the correct authorization policy line using the condition EndPoints LogicalProfile EQUALS static_list Why is this occurring?

The logical profile is being statically assigned instead of the identity group

The dynamic logical profile is overriding the statically assigned profile

The device is changing identity groups after profiling instead ot remaining static

The logical profile is being statically assigned instead of the identity group

The identity group is being assigned instead of the logical profile

An engineer is creating a new authorization policy to give the endpoints access to VLAN 310 upon successful authentication The administrator tests the 802.1X authentication for the endpoint and sees that it is authenticating successfullyWhat must be done to ensure that the endpoint is placed into the correct VLAN?

Add VLAN 310 in the common tasks of the authorization profile

Configure the switchport access vlan 310 command on the switch port

Ensure that the security group is not preventing the endpoint from being in VLAN 310

Add VLAN 310 in the common tasks of the authorization profile

Ensure that the endpoint is using The correct policy set

An engineer is configuring posture assessment for their network access control and needs to use an agent that supports using service conditions as conditions for the assessment. The agent should be run as a background process to avoid user interruption but when it is run. the user can see it. What is the problem?

The engineer is using the "Anyconnect” posture agent but should be using the "Stealth Anyconnect posture agent

The posture module was deployed using the headend instead of installing it with SCCM

The user was in need of remediation so the agent appeared m the notifications

The proper permissions were no! given to the temporal agent to conduct the assessment

Cisco 300-715 Practice Test 5 - Free Online Exam Questions 161-200

An engineer is configuring TACACS+ within Cisco ISE for use with a non-Cisco network device. They need to send special attributes in the Access-Accept response to ensure that the users are given the appropriate access. What must be configured to accomplish this'?

Become a Premium Member for full access

Unlock Premium Member

Cisco 300-715 Practice Test 5

Question

Cisco 300-715 Practice Tests

Practice Tests