Cisco CCNP Security 300-715 Questions & Answers

• Question 121:

  Which compliance status is set when a matching posture policy has been defined for that endpomt. but all the mandatory requirements during posture assessment are not met?

  A. unauthorized

  B. untrusted

  C. non-compliant

  D. unknown

  Correct Answer: C

• Question 122:

  A Cisco device has a port configured in multi-authentication mode and is accepting connections only from hosts assigned the SGT of SGT_0422048549 The VLAN trunk link supports a maximum of 8 VLANS

  What is the reason for these restrictions?

  A. The device is performing inline tagging without acting as a SXP speaker

  B. The device is performing mime tagging while acting as a SXP speaker

  C. The IP subnet addresses are dynamically mapped to an SGT.

  D. The IP subnet addresses are statically mapped to an SGT

  Correct Answer: A

• Question 123:

  While configuring Cisco TrustSec on Cisco IOS devices the engineer must set the CTS device ID and password in order for the devices to authenticate with each other. However after this is complete the devices are not able to property authenticate

  What issue would cause this to happen even if the device ID and passwords are correct?

  A. The device aliases are not matching

  B. The 5GT mappings have not been defined

  C. The devices are missing the configuration cts credentials trustsec verify 1

  D. EAP-FAST is not enabled

  Correct Answer: D

• Question 124:

  Refer to the exhibit.

  

  An administrator is manually adding a device to a Cisco ISE identity group to ensure that it is able to access the network when needed without authentication. Upon testing, the administrator notices that the device never hits the correct authorization policy line using the condition EndPoints-LogicalProfile EQUALS static_list. Why is this occurring?

  A. The dynamic logical profile is overriding the statically assigned profile

  B. The device is changing identity groups after profiling instead ot remaining static

  C. The logical profile is being statically assigned instead of the identity group

  D. The identity group is being assigned instead of the logical profile

  Correct Answer: C

• Question 125:

  An engineer is configuring a posture policy for Windows 10 endpoints and wants to ensure that users in each AD group have different conditions to meet to be compliant. What must be done to accomplish this task?

  A. Identify the users groups needed for different policies and create service conditions to map each one to its posture requirement.

  B. Configure a simple condition for each AD group and use it in the posture policy for each use case

  C. Use the authorization policy within the policy set to group each AD group with their respective posture policy

  D. Change the posture requirements to use an AD group lor each use case then use those requirements in the posture policy

  Correct Answer: A

• Question 126:

  What is a function of client provisioning?

  A. It ensures an application process is running on the endpoint.

  B. It checks a dictionary' attribute with a value.

  C. It ensures that endpoints receive the appropriate posture agents

  D. It checks the existence date and versions of the file on a client.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_010111.html

• Question 127:

  An organization wants to enable web-based guest access for both employees and visitors. The goal is to use a single portal for both user types.

  Which two authentication methods should be used to meet this requirement? (Choose two.)

  A. LDAP

  B. 802 1X

  C. Certificate-based

  D. LOCAL

  E. MAC based

  Correct Answer: AD

• Question 128:

  An administrator has added a new Cisco ISE PSN to their distributed deployment. Which two features must the administrator enable to accept authentication requests and profile the endpoints correctly, and add them to their respective endpoint identity groups? (Choose two )

  A. Session Services

  B. Endpoint Attribute Filter

  C. Posture Services

  D. Profiling Services

  E. Radius Service

  Correct Answer: AD

• Question 129:

  An administrator is configuring a new profiling policy in Cisco ISE for a printer type that is missing from the profiler feed The logical profile Printers must be used in the authorization rule and the rule must be hit.

  What must be done to ensure that this configuration will be successful?

  A. Create a new logical profile for the new printer policy

  B. Enable the EndPoints:EndPointPolicy condition in the authorization policy.

  C. Add the new profiling policy to the logical profile Printers.

  D. Modify the profiler conditions to ensure that it goes into the correct logical profile

  Correct Answer: B

• Question 130:

  Which two configurations are needed on a catalyst switch for it to be added as a network access device in a Cisco ISE that is being used for 802 1X authentications? (Choose two ) A. Option A

  

  B. Option B

  C. Option C

  D. Option D

  E. Option E

  Correct Answer: AC