Cisco CCNP Security 300-715 Questions & Answers

• Question 231:

  An organization wants to improve their BYOD processes to have Cisco ISE issue certificates to the BYOD endpoints. Currently, they have an active certificate authority and do not want to replace it with Cisco ISE. What must be configured within Cisco ISE to accomplish this goal?

  A. Create a certificate signing request and have the root certificate authority sign it.

  B. Add the root certificate authority to the trust store and enable it for authentication.

  C. Create an SCEP profile to link Cisco ISE with the root certificate authority.

  D. Add an OCSP profile and configure the root certificate authority as secondary.

  Correct Answer: C

  Ref:https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/116068-configure-product-00.html

• Question 232:

  There is a need within an organization for a new policy to be created in Cisco ISE. It must validate that a specific anti-virus application is not only installed, but running on a machine before it is allowed access to the network. Which posture condition should the administrator configure in order for this policy to work?

  A. file

  B. registry

  C. application

  D. service

  Correct Answer: C

• Question 233:

  A network engineer must enforce access control using special tags, without re-engineering the network design. Which feature should be configured to achieve this in a scalable manner?

  A. SGT

  B. dACL

  C. VLAN

  D. RBAC

  Correct Answer: A

• Question 234:

  A policy is being created in order to provide device administration access to the switches on a network. There is a requirement to ensure that if the session is not actively being used, after 10 minutes, it will be disconnected.

  Which task must be configured in order to meet this requirement?

  A. session timeout

  B. idle time

  C. monitor

  D. set attribute as

  Correct Answer: A

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_admin_accesspolicy_settings.html#reference_0E24B8FB FAB248219E1194435670347F

• Question 235:

  An administrator is attempting to replace the built-in self-signed certificates on a Cisco ISE appliance. The CA is requesting some information about the appliance in order to sign the new certificate. What must be done in order to provide the CA this information?

  A. Install the Root CA and intermediate CA.

  B. Generate the CSR.

  C. Download the intermediate server certificate.

  D. Download the CA server certificate.

  Correct Answer: B

• Question 236:

  An organization is hosting a conference and must make guest accounts for several of the speakers attending. The conference ended two days early but the guest accounts are still being used to access the network. What must be configured to correct this?

  A. Create an authorization rule denying sponsored guest access.

  B. Navigate to the Guest Portal and delete the guest accounts.

  C. Create an authorization rule denying guest access.

  D. Navigate to the Sponsor Portal and suspend the guest accounts.

  Correct Answer: D

• Question 237:

  An administrator is configuring posture with Cisco ISE and wants to check that specific services are present on the workstations that are attempting to access the network. What must be configured to accomplish this goal?

  A. Create a registry posture condition using a non-OPSWAT API version.

  B. Create an application posture condition using a OPSWAT API version.

  C. Create a compound posture condition using a OPSWAT API version.

  D. Create a service posture condition using a non-OPSWAT API version.

  Correct Answer: D

• Question 238:

  An engineer is configuring 802.1X and wants it to be transparent from the users' point of view. The implementation should provide open authentication on the switch ports while providing strong levels of security for non-authenticated devices. Which deployment mode should be used to achieve this?

  A. closed

  B. low-impact

  C. open

  D. high-impact

  Correct Answer: B

  https://www.lookingpoint.com/blog/cisco-ise-wired-802.1x-deployment-monitormode#:~:text=Low%20impact%20mode%20works%20similar,DHCP%2C%20PXE%20boot%2 C%20etc.

• Question 239:

  An engineer is configuring web authentication and needs to allow specific protocols to permit DNS traffic. Which type of access list should be used for this configuration?

  A. reflexive ACL

  B. extended ACL

  C. standard ACL

  D. numbered ACL

  Correct Answer: B

• Question 240:

  Which three default endpoint identity groups does cisco ISE create? (Choose three)

  A. Unknown

  B. whitelist

  C. end point

  D. profiled

  E. block list

  Correct Answer: ADE

  Default Endpoint Identity Groups Created for Endpoints Cisco ISE creates the following five endpoint identity groups by default: Blacklist, GuestEndpoints, Profiled, RegisteredDevices, and Unknown. In addition, it creates two more identity groups, such as Cisco-IP-Phone and Workstation, which are associated to the Profiled (parent) identity group. A parent group is the default identity group that exists in the system.

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_010101.html#ID1678