Cisco CCNP Security 300-715 Questions & Answers

• Question 141:

  During a 802 1X deployment, an engineer must identify failed authentications without causing problems for the connected endpoint.

  Which command will successfully achieve this?

  A. dotlxsystem-auth-control

  B. dotlx pae authenticator

  C. authentication open

  D. authentication port-control auto

  Correct Answer: C

• Question 142:

  An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network.

  Which node should be used to accomplish this task?

  A. PSN

  B. primary PAN

  C. pxGrid

  D. MnT

  Correct Answer: A

• Question 143:

  An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE. but the devices do not change their access due to the new profile. What is the problem?

  A. In closed mode, profiling does not work unless CDP is enabled.

  B. The profiling probes are not able to collect enough information to change the device profile

  C. The profiler feed is not downloading new information so the profiler is inactive

  D. The default profiler configuration is set to No CoA for the reauthentication setting

  Correct Answer: D

• Question 144:

  An engineer is configuring sponsored guest access and needs to limit each sponsored guest to a maximum of two devices. There are other guest services in production that rely on the default guest types.

  How should this configuration change be made without disrupting the other guest services currently offering three or more guest devices per user?

  A. Create an ISE identity group to add users to and limit the number of logins via the group configuration.

  B. Create a new guest type and set the maximum number of devices sponsored guests can register

  C. Create an LDAP login for each guest and tag that in the guest portal for authentication.

  D. Create a new sponsor group and adjust the settings to limit the devices for each guest.

  Correct Answer: B

• Question 145:

  An engineer is configuring Cisco ISE policies to support MAB for devices that do not have 802.1X capabilities. The engineer is configuring new endpoint identity groups as conditions to be used in the AuthZ policies, but noticed that the endpoints are not hitting the correct policies.

  What must be done in order to get the devices into the right policies?

  A. Manually add the MAC addresses of the devices to endpoint ID groups in the context visibility database.

  B. Create an AuthZ policy to identify Unknown devices and provide partial network access prior to profiling.

  C. Add an identity policy to dynamically add the IP address of the devices to their endpoint identity groups.

  D. Identify the non 802.1x supported device types and create custom profiles for them to profile into.

  Correct Answer: A

• Question 146:

  An organization is implementing Cisco ISE posture services and must ensure that a host-based firewall is in place on every Windows and Mac computer that attempts to access the network They have multiple vendors' firewall applications for their devices, so the engineers creating the policies are unable to use a specific application check in order to validate the posture for this

  What should be done to enable this type of posture check?

  A. Use the file registry condition to ensure that the firewal is installed and running appropriately.

  B. Use a compound condition to look for the Windows or Mac native firewall applications.

  C. Enable the default rewall condition to check for any vendor rewall application.

  D. Enable the default application condition to identify the applications installed and validade the rewall app.

  Correct Answer: C

  https://www.youtube.com/watch?v=6Kj8P8Hn7dYandt=109sandab_channel=CiscoISE-IdentityServicesEngine

• Question 147:

  A network administrator is currently using Cisco ISE to authenticate devices and users via 802 1X There is now a need to also authorize devices and users using EAP-TLS.

  Which two additional components must be configured in Cisco ISE to accomplish this? (Choose two.)

  A. Network Device Group

  B. Serial Number attribute that maps to a CA Server

  C. Common Name attribute that maps to an identity store

  D. Certificate Authentication Profile

  E. EAP Authorization Profile

  Correct Answer: DE

• Question 148:

  An engineer has been tasked with standing up a new guest portal for customers that are waiting in the lobby. There is a requirement to allow guests to use their social media logins to access the guest network to appeal to more customers

  What must be done to accomplish this task?

  A. Create a sponsor portal to allow guests to create accounts using their social media logins.

  B. Create a sponsored guest portal and enable social media in the external identity sources.

  C. Create a self-registered guest portal and enable the feature for social media logins

  D. Create a hotspot portal and enable social media login for network access

  Correct Answer: C

• Question 149:

  An administrator is configuring a new profiling policy within Cisco ISE. The organization has several endpoints that are the same device type, and all have the same Block ID in their MAC address. The profiler does not currently have a profiling policy created to categorize these endpoints, therefore a custom profiling policy must be created.

  Which condition must the administrator use in order to properly profile an ACME AI Connector endpoint for network access with MAC address 01:41:14:65:50:AB?

  A. CDP_cdpCacheDeviceID_CONTAINS_

  B. MAC_MACAddress_CONTAINS_

  C. Radius_Called_Station-ID_STARTSWITH_

  D. MAC_OUI_STARTSWITH_

  Correct Answer: B

• Question 150:

  An administrator adds a new network device to the Cisco ISE configuration to authenticate endpoints to the network. The RADIUS test fails after the administrator configures all of the settings in Cisco ISE and adds the proper configurations to the switch.

  What is the issue?

  A. The endpoint profile is showing as ''unknown"

  B. The endpoint does not have the appropriate credentials for network access

  C. The certificate on the switch is self-signed, not a CA-provided certificate

  D. The shared secret is incorrect on the switch or on Cisco ISE

  Correct Answer: D