Cisco CCNP Security 300-715 Questions & Answers

• Question 211:

  A network engineer is configuring guest access and notices that when a guest user registers a second device for access, the first device loses access What must be done to ensure that both devices for a particular user are able to access the guest network simultaneously?

  A. Configure the sponsor group to increase the number of logins.

  B. Use a custom portal to increase the number of logins

  C. Modify the guest type to increase the number of maximum devices

  D. Create an Adaptive Network Control policy to increase the number of devices

  Correct Answer: C

  https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_admin_guide_27/b_ise_admin_guide_27_chapter_01111.html.xml

• Question 212:

  An organization wants to standardize the 802 1X configuration on their switches and remove static ACLs on the switch ports while allowing Cisco ISE to communicate to the switch what access to provide What must be configured to accomplish this task?

  A. security group tag within the authorization policy

  B. extended access-list on the switch for the client

  C. port security on the switch based on the client's information

  D. dynamic access list within the authorization profile

  Correct Answer: D

  https://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_sga_pol.html#

• Question 213:

  An engineer is tasked with placing a guest access anchor controller in the DMZ. Which two ports or port sets must be opened up on the firewall to accomplish this task? (Choose two.)

  A. UDP port 1812 RADIUS

  B. TCP port 161

  C. TCP port 514

  D. UDP port 79

  E. UDP port 16666

  Correct Answer: BC

• Question 214:

  A network administrator is configuring authorization policies on Cisco ISE There is a requirement to use AD group assignments to control access to network resources After a recent power failure and Cisco ISE rebooting itself, the AD group assignments no longer work

  What is the cause of this issue?

  A. The AD join point is no longer connected.

  B. The AD DNS response is slow.

  C. The certificate checks are not being conducted.

  D. The network devices ports are shut down.

  Correct Answer: A

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_2x.html#ID612

• Question 215:

  There are several devices on a network that are considered critical and need to be placed into the ISE database and a policy used for them. The organization does not want to use profiling. What must be done to accomplish this goal?

  A. Enter the MAC address in the correct Endpoint Identity Group.

  B. Enter the MAC address in the correct Logical Profile.

  C. Enter the IP address in the correct Logical Profile.

  D. Enter the IP address in the correct Endpoint Identity Group.

  Correct Answer: A

• Question 216:

  An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened. From which Cisco ISE persona should this traffic be originating?

  A. monitoring

  B. policy service

  C. administration

  D. authentication

  Correct Answer: B

• Question 217:

  What is an advantage of using EAP-TLS over EAP-MS-CHAPv2 for client authentication?

  A. EAP-TLS uses a username and password for authentication to enhance security, while EAP-MS- CHAPv2 does not.

  B. EAP-TLS secures the exchange of credentials, while EAP-MS-CHAPv2 does not.

  C. EAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not.

  D. EAP-TLS uses multiple forms of authentication, while EAP-MS-CHAPv2 only uses one.

  Correct Answer: C

• Question 218:

  What is a function of client provisioning?

  A. Client provisioning ensures that endpoints receive the appropriate posture agents.

  B. Client provisioning checks a dictionary attribute with a value.

  C. Client provisioning ensures an application process is running on the endpoint.

  D. Client provisioning checks the existence, date, and versions of the file on a client.

  Correct Answer: A

  https://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_client_prov.html#:~:text=After%20Cisco%20ISE%20classifies%20a,packages%20an d%20profiles%2C%20if%20necessary.

• Question 219:

  A company manager is hosting a conference. Conference participants must connect to an open guest SSID and only use a preassigned code that they enter into the guest portal prior to gaining access to the network. How should the manager configure Cisco ISE to accomplish this goal?

  A. Create entries in the guest identity group for all participants.

  B. Create an access code to be entered in the AUP page.

  C. Create logins for each participant to give them sponsored access.

  D. Create a registration code to be entered on the portal splash page.

  Correct Answer: B

• Question 220:

  When setting up profiling in an environment using Cisco ISE for network access control, an organization must use non-proprietary protocols for collecting the information at layer 2. Which two probes will provide this information without forwarding SPAN packets to Cisco ISE? {Choose two.)

  A. DHCP SPAN probe

  B. SNMP query probe

  C. NetFlow probe

  D. RADIUS probe

  E. DNS probe

  Correct Answer: BD

  https://ciscocustomer.lookbookhq.com/iseguidedjourney/ISE-profiling-design