While configuring Cisco TrustSec on Cisco IOS devices the engineer must set the CTS device ID and password in order for the devices to authenticate with each other. However after this is complete the devices are not able to property authenticate What issue would cause this to happen even if the device ID and passwords are correct?

The 5GT mappings have not been defined

The device aliases are not matching

The 5GT mappings have not been defined

The devices are missing the configuration cts credentials trustsec verify 1

An engineer is configuring a posture policy for Windows 10 endpoints and wants to ensure that users in each AD group have different conditions to meet to be compliant. What must be done to accomplish this task?

Use the authorization policy within the policy set to group each AD group with their respective posture policy

identify The users groups needed for different policies and create service conditions to map each one to its posture requirement

Configure a simple condition for each AD group and use it in the posture policy for each use case

Use the authorization policy within the policy set to group each AD group with their respective posture policy

Change the posture requirements to use an AD group lor each use case then use those requirements in the posture policy

An organization is adding nodes to their Cisco ISE deployment and has two nodes designated as primary and secondary PAN and MnT nodes. The organization also has four PSNs An administrator is adding two more PSNs to this deployment but is having problems adding one of them What is the problem?

Only five PSNs are allowed to be in the Cisco ISE cube if configured this way.

The new nodes must be set to primary prior to being added to the deployment

The current PAN is only able to track a max of four nodes

Only five PSNs are allowed to be in the Cisco ISE cube if configured this way.

One of the new nodes must be designated as a pxGrid node

What is a difference between RADIUS and TACACS+?

RADIUS combines authentication and authorization functions, and TACACS+ separates them.

RADIUS uses connection-oriented transport, and TACACS+ uses best-effort delivery.

RADIUS offers multiprotocol support, and TACACS+ supports only IP traffic.

RADIUS combines authentication and authorization functions, and TACACS+ separates them.

RADIUS supports command accounting, and TACACS+ does not.

An engineer is unable to use SSH to connect to a switch after adding the required CLI commands to the device to enable TACACS+. The device administration license has been added to Cisco ISE, and the required policies have been created. Which action is needed to enable access to the switch?

The switch needs to be added as a network device in Cisco ISE and set to use TACACS+.

The ip ssh source-interface command needs to be set on the switch

802.1X authentication needs to be configured on the switch.

The RSA keypair used for SSH must be regenerated after enabling TACACS+.

The switch needs to be added as a network device in Cisco ISE and set to use TACACS+.

The IT manager wants to provide different levels of access to network devices when users authenticate using TACACS+. The company needs specific commands to be allowed based on the Active Directory group membership of the different roles within the IT department. The solution must minimize the number of objects created in Cisco ISE. What must be created to accomplish this task?

one shell profile and multiple command sets

one shell profile and one command set

multiple shell profiles and one command set

one shell profile and multiple command sets

multiple shell profiles and multiple command sets

What are two differences of TACACS+ compared to RADIUS? (Choose two.)

TACACS+ encrypts the full packet payload, whereas RADIUS only encrypts the password.

TACACS+ uses a connection-oriented transport protocol, whereas RADIUS uses a connectionless transport protocol.

TACACS+ uses a connectionless transport protocol, whereas RADIUS uses a connection-oriented transport protocol.

TACACS+ encrypts the full packet payload, whereas RADIUS only encrypts the password.

TACACS+ only encrypts the password, whereas RADIUS encrypts the full packet payload.

TACACS+ uses a connection-oriented transport protocol, whereas RADIUS uses a connectionless transport protocol.

TACACS+ supports multiple sessions per user, whereas RADIUS supports one session per user.

An administrator is configuring posture assessment in Cisco ISE for the first time. Which two components must be uploaded to Cisco ISE to use Anyconnect for the agent configuration in a client provisioning policy? (Choose two.)

Anyconnect network visibility module

What is a difference between TACACS+ and RADIUS in regards to encryption?

TACACS+ encrypts the entire packet, whereas RADIUS encrypts only the password.

TACACS+ encrypts only the password, whereas RADIUS encrypts the username and password.

TACACS+ encrypts the username and password, whereas RADIUS encrypts only the password.

TACACS+ encrypts the password, whereas RADIUS sends the entire packet in clear text.

TACACS+ encrypts the entire packet, whereas RADIUS encrypts only the password.

An administrator must block access to BYOD endpoints that were onboarded without a certificate and have been reported as stolen in the Cisco ISE My Devices Portal. Which condition must be used when configuring an authorization policy that sets DenyAccess permission?

Endpoint Identity Group is Blocklist, and the BYOD state is Registered.

Endpoint Identify Group is Blocklist, and the BYOD state is Pending.

Endpoint Identity Group is Blocklist, and the BYOD state is Lost.

Endpoint Identity Group is Blocklist, and the BYOD state is Reinstate.

A user changes the status of a device to stolen in the My Devices Portal of Cisco ISE. The device was originally onboarded in the BYOD wireless Portal without a certificate. The device is found later, but the user cannot re-onboard the device because Cisco ISE assigned the device to the Blocklist endpoint identity group. What must the user do in the My Devices Portal to resolve this issue?

Change the device state from Stolen to Not Registered.

Manually remove the device from the Blocklist endpoint identity group.

Change the device state from Stolen to Not Registered.

Change the BYOD registration attribute of the device to None.

Delete the device, and then re-add the device.

Which two actions must be verified to confirm that the internet is accessible via guest access when configuring a guest portal? (Choose two.)

The guest user gets redirected to the authentication page when opening a browser.

Cisco ISE sends a CoA upon successful guest authentication.

The guest device successfully associates with the correct SSID.

The guest user gets redirected to the authentication page when opening a browser.

The guest device has internal network access on the WLAN.

The guest device can connect to network file shares.

Cisco ISE sends a CoA upon successful guest authentication.

An administrator made changes in Cisco ISE and needs to apply new permissions for endpoints that have already been authenticated by sending a CoA packet to the network devices. Which IOS command must be configured on the devices to accomplish this goal?

aaa server radius dynamic-author

authentication command bounce-port

authentication command disable-port

An ISE administrator must change the inactivity timer for MAB endpoints to terminate the authentication session whenever a switch port that is connected to an IP phone does not detect packets from the device for 30 minutes. Which action must be taken to accomplish this task?

Add the authentication timer inactivity 3600 command to the switchport.

Add the authentication timer reauthenticate server command to the switchport.

Add the authentication timer inactivity 3600 command to the switchport.

Change the idle-timeout on the Radius server to 3600 seconds for IP Phone endpoints.

Configure the session-timeout to be 3600 seconds on Cisco ISE.

An engineer must configure Cisco ISE to provide internet access for guests in which guests are required to enter a code to gain network access. Which action accomplishes the goal?

Configure the hotspot portal for guest access and require an access code.

Configure the sponsor portal with a single account and use the access code as the password.

Configure the self-registered guest portal to allow guests to create a personal access code.

Create a BYOD policy that bypasses the authentication of the user and authorizes access codes.

An engineer wants to learn more about Cisco ISE and deployed a new lab with two nodes. Which two persona configurations allow the engineer to successfully test redundancy of a failed node? (Choose two.)

Configure one of the Cisco ISE nodes as the primary PAN and MnT personas and the other as the secondary.

Configure one of the Cisco ISE nodes as the primary PAN and PSN personas and the other as the secondary.

Configure one of the Cisco ISE nodes as the Health Check node.

Configure both nodes with the PAN and MnT personas only.

Configure one of the Cisco ISE nodes as the primary PAN and MnT personas and the other as the secondary.

Configure both nodes with the PAN, MnT, and PSN personas.

Configure one of the Cisco ISE nodes as the primary PAN and PSN personas and the other as the secondary.

Which Cisco ISE deployment model is recommended for an enterprise that has over 50,000 concurrent active endpoints?

medium deployment with primary and secondary PAN/MnT/pxGrid nodes with dedicated PSNs

large deployment with fully distributed nodes running all personas

medium deployment with primary and secondary PAN/MnT/pxGrid nodes with shared PSNs

medium deployment with primary and secondary PAN/MnT/pxGrid nodes with dedicated PSNs

small deployment with one primary and one secondary node running all personas

What is a restriction of a standalone Cisco ISE node deployment?

Personas are enabled by default and cannot be edited on the node.

Only the Policy Service persona can be disabled on the node.

The domain name of the node cannot be changed after installation.

Personas are enabled by default and cannot be edited on the node.

The hostname of the node cannot be changed after installation.

What are the minimum requirements for deploying the Automatic Failover feature on Administration nodes in a distributed Cisco ISE deployment?

a primary and secondary PAN and a health check node for the Primary PAN

a primary and secondary PAN and a health check node for the Secondary PAN

a primary and secondary PAN and no health check nodes

a primary and secondary PAN and a pair of health check nodes

a primary and secondary PAN and a health check node for the Primary PAN

An administrator is attempting to join a new node to the primary Cisco ISE node, but receives the error message "Node is Unreachable". What is causing this error?

No administrative certificate is available for the second node.

The second node is in standalone mode.

No admin privileges are available on the second node.

An administrator is configuring cisco ISE lo authenticate users logging into network devices using TACACS+ The administrator is not seeing any oí the authentication in the TACACS+ live logs. Which action ensures the users are able to log into the network devices?

Enable the device administration service in the PSN persona.

Enable the device administration service in the Administration persona

Enable the session services in the administration persona

Enable the service sessions in the PSN persona.

Enable the device administration service in the PSN persona.

An engineer is starting to implement a wired 802.1X project throughout the campus. The task is for failed authentication to be logged to Cisco ISE and also have a minimal impact on the users. Which command must the engineer configure?

authentication host-mode multi-auth

The security team identified a rogue endpoint with MAC address 00:46:91:02:28:4A attached to the network. Which action must security engineer take within Cisco ISE to effectively restrict network access for this endpoint?

Add MAC address to the endpoint quarantine list.

Configure access control list on network switches to block traffic.

Create authentication policy to force reauthentication.

Add MAC address to the endpoint quarantine list.

Implement authentication policy to deny access.

An administrator is configuring cisco ISE lo authenticate users logging into network devices using TACACS+ The administrator is not seeing any o the authentication in the TACACS+ live logs. Which action ensures the users are able to log into the network devices?

Enable the device administration service in the PSN persona.

Enable the device administration service in the Administration persona

Enable the session services in the administration persona

Enable the service sessions in the PSN persona.

Enable the device administration service in the PSN persona.

Cisco 300-715 Practice Test 6 - Free Online Exam Questions 201-240

A user is attempting to register a BYOD device to the Cisco ISE deployment, but needs to use the onboarding policy to request a digital certificate and provision the endpoint. What must be configured to accomplish this task?

Become a Premium Member for full access

Unlock Premium Member

Cisco 300-715 Practice Test 6

Question

Cisco 300-715 Practice Tests

Practice Tests