Cisco CCNP Security 300-715 Questions & Answers

• Question 151:

  An employee must access the internet through the corporate network from a new mobile device that does not support native supplicant provisioning provided by Cisco ISE. Which portal must the employee use to provision to the device?

  A. My Devices

  B. BYOD

  C. Personal Device

  D. Client Provisioning

  Correct Answer: A

• Question 152:

  An engineer builds a five-node distributed Cisco ISE deployment. The first two deployed nodes are responsible for the primary and secondary administration and monitoring personas.

  Which persona configuration is necessary to have the remaining three Cisco ISE nodes serve as dedicated nodes in the Cisco ISE cube that is responsible only for handling the RADIUS and TACACS+ authentication requests, identity lookups, and policy evaluation?

  

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

• Question 153:

  What are two differences between the RADIUS and TACACS+ protocols? (Choose two.)

  A. RADIUS offers multiprotocol support, whereas TACACS+ does not.

  B. RADIUS is a Cisco proprietary protocol, whereas TACACS+ is an open standard protocol.

  C. RADIUS enables encryption of all the packets, whereas with TACACS+, only the password is encrypted.

  D. RADIUS combines authentication and authorization, whereas TACACS+ does not.

  E. TACACS+ uses TCP port 49, whereas RADIUS uses UDP ports 1812 and 1813.

  Correct Answer: DE

• Question 154:

  A network administrator is configuring client provisioning resource policies for client machines and must ensure that an agent pop-up is presented to the client when attempting to connect to the network. Which configuration item needs to be added to allow for this?

  A. a temporal agent that gets installed onto the system

  B. a remote posture agent proxying the network connection

  C. the client provisioning URL in the authorization policy

  D. an API connection back to the client

  Correct Answer: C

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_configure_client_provisioning.html#ID1405 It is mandatory to include the client provisioning URL in authorization policy to enable the agent to popup in the client machines. This prevents request from any random clients and ensures that only clients with proper redirect URL can request for posture assessment.

• Question 155:

  A network administrator is configuring a secondary Cisco ISE node from the backup configuration of the primary Cisco ISE node to create a high availability pair. The Cisco ISE CA certificates and keys must be manually backed up from the primary Cisco ISE and copied into the secondary Cisco ISE.

  Which command must be issued for this to work?

  A. copy certificate ise

  B. certificate configure ise

  C. import certificate ise

  D. application configure ise

  Correct Answer: D

• Question 156:

  A network engineer has been tasked with enabling a switch to support standard web authentication for Cisco ISE. This must include the ability to provision for URL redirection on authentication.

  Which two commands must be entered to meet this requirement? (Choose two.)

  A. ip http secure-server

  B. ip http authentication

  C. ip http server

  D. ip http redirection

  E. ip http secure-authentication

  Correct Answer: AC

• Question 157:

  A network administrator notices that after a company-wide shut down, many users cannot connect their laptops to the corporate SSID.

  What must be done to permit access in a timely manner?

  A. Connect this system as a guest user and then redirect the web auth protocol to log in to the network.

  B. Allow authentication for expired certificates within the EAP-TLS section under the allowed protocols.

  C. Add a certificate issue from the CA server, revoke the expired certificate, and add the new certificate in system.

  D. Authenticate the user's system to the secondary Cisco ISE node and move this user to the primary with the renewed certificate.

  Correct Answer: B

• Question 158:

  An engineer tests Cisco ISE posture services on the network and must configure the compliance module to automatically download and install on endpoints. Which action accomplishes this task for VPN users?

  A. Push the compliance module from Cisco FTD prior to attempting posture.

  B. Use a compound posture condition to check for the compliance module and download, if needed.

  C. Configure the compliance module to be downloaded from within the posture policy.

  D. Create a Cisco AnyConnect configuration and Client Provisioning policy within Cisco ISE.

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_configure_client_provisioning.html

• Question 159:

  Which two external identity stores support EAP-TLS and PEAP-TLS? (Choose two.)

  A. RSA SecurID

  B. RADIUS Token

  C. Active Directory

  D. Internal Database

  E. LDAP

  Correct Answer: CE

  Reference: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/214975-configure-eap-tls-authentication-with-is.html

• Question 160:

  An engineer deploys Cisco ISE and must configure Active Directory to then use information from Active Directory in an authorization policy.

  Which two components must be configured, in addition to Active Directory groups, to achieve this goal? (Choose two.)

  A. Identity Source Sequences

  B. LDAP External Identity Sources

  C. Active Directory External Identity Sources

  D. Library Condition for Identity Group: User Identity Group

  E. Library Condition for External Identity: External Groups

  Correct Answer: CE