Cisco CCNP Security 300-715 Questions & Answers

• Question 221:

  A network security engineer needs to configure 802.1X port authentication to allow a single host to be authenticated for data and another single host to be authenticated for voice. Which command should the engineer run on the interface to accomplish this goal?

  A. authentication host-mode single-host

  B. authentication host-mode multi-auth

  C. authentication host-mode multi-host

  D. authentication host-mode multi-domain

  Correct Answer: D

• Question 222:

  What is the deployment mode when two Cisco ISE nodes are configured in an environment?

  A. distributed

  B. active

  C. standalone

  D. standard

  Correct Answer: A

• Question 223:

  Which two roles are taken on by the administration person within a Cisco ISE distributed environment? (Choose two.)

  A. backup

  B. secondary

  C. standby

  D. primary

  E. active

  Correct Answer: BD

• Question 224:

  A company is attempting to improve their BYOD policies and restrict access based on certain criteria

  The company's subnets are organized by building. Which attribute should be used in order to gain access based on location?

  A. static group assignment

  B. IP address

  C. device registration status

  D. MAC address

  Correct Answer: A

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html#ID1353

• Question 225:

  An engineer is migrating users from MAB to 802.1X on the network. This must be done during normal business hours with minimal impact to users. Which CoA method should be used?

  A. Port Bounce

  B. Port Shutdown

  C. Session Termination

  D. Session Reauthentication

  Correct Answer: D

• Question 226:

  What must be configured on the WLC to configure Central Web Authentication using Cisco ISE and a WLC?

  A. Set the NAC State option to SNMP NAC.

  B. Set the NAC State option to RADIUS NAC.

  C. Use the radius-server vsa send authentication command.

  D. Use the ip access-group webauth in command.

  Correct Answer: B

• Question 227:

  Refer to the exhibit.

  

  An organization recently implemented network device administration using Cisco ISE. Upon testing the ability to access all of the required devices, a user in the Cisco ISE group IT Admins is attempting to login to a device in their organization's finance department but is unable to. What is the problem?

  A. The IT training rule is taking precedence over the IT Admins rule.

  B. The authorization conditions wrongly allow IT Admins group no access to finance devices.

  C. The finance location is not a condition in the policy set.

  D. The authorization policy doesn't correctly grant them access to the finance devices.

  Correct Answer: D

• Question 228:

  When creating a policy within Cisco ISE for network access control, the administrator wants to allow different access restrictions based upon the wireless SSID to which the device is connecting. Which policy condition must be used in order to accomplish this?

  A. Network Access NetworkDeviceName CONTAINS

  B. DEVICE Device Type CONTAINS

  C. Radius Called-Station-ID CONTAINS

  D. Airespace Airespace-Wlan-ld CONTAINS

  Correct Answer: C

  https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115734-ise-policies-ssid-00.html

• Question 229:

  An engineer is designing a new distributed deployment for Cisco ISE in the network and is considering failover options for the admin nodes. There is a need to ensure that an admin node is available for configuration of policies at all times. What is the requirement to enable this feature?

  A. one primary admin and one secondary admin node in the deployment

  B. one policy services node and one secondary admin node

  C. one policy services node and one monitoring and troubleshooting node

  D. one primary admin node and one monitoring and troubleshooting node

  Correct Answer: A

• Question 230:

  An administrator is adding network devices for a new medical building into Cisco ISE. These devices must be in a network device group that is identifying them as "Medical Switch" so that the policies can be made separately for the endpoints connecting through them.

  Which configuration item must be changed in the network device within Cisco ISE to accomplish this goal?

  A. Change the device type to Medical Switch.

  B. Change the device profile to Medical Switch.

  C. Change the model name to Medical Switch.

  D. Change the device location to Medical Switch.

  Correct Answer: A