Cisco CCNP Security 300-715 Questions & Answers

• Question 251:

  A network engineer received alerts from the monitoring platform that a switch port exists with multiple sessions. RADIUS CoA using Cisco ISE must be used to address the issue. Which RADIUS CoA configuration must be used?

  A. port bounce

  B. no CoA

  C. exception

  D. reauth

  Correct Answer: A

• Question 252:

  An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port. Which command should be used to accomplish this task?

  A. permit tcp any any eq

  B. aaa group server radius proxy

  C. IP http port

  D. aaa group server radius

  Correct Answer: A

• Question 253:

  An engineer is configuring Cisco ISE to reprofile endpoints based only on new requests of INIT-REBOOT and SELECTING message types. Which probe should be used to accomplish this task?

  A. MMAP

  B. DNS

  C. DHCP

  D. RADIUS

  Correct Answer: C

• Question 254:

  In a standalone Cisco ISE deployment, which two personas are configured on a node? (Choose two.)

  A. publisher

  B. administration

  C. primary

  D. policy service

  E. subscriber

  Correct Answer: BD

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20/b_ise_admin_guide_20_chapter_010.html

• Question 255:

  An engineer must create an authentication policy in Cisco ISE to allow wired printers that lack support for 802.1X onto the network. What must the RadiusFlowType be set to in the policy to meet the requirement?

  A. MAB

  B. Wired_MAB

  C. Compliant_Devices

  D. Compliance_Unknown_Devices

  Correct Answer: B

• Question 256:

  Which file extension is required when deploying Cisco ISE using a ZTP configuration file in Microsoft Hyper-V?

  A. .txt

  B. .img

  C. .tar

  D. .iso

  Correct Answer: D

• Question 257:

  An engineer is starting to implement a wired 802.1X project throughout the campus. The task is for failed authentication to be logged to Cisco ISE and also have a minimal impact on the users. Which command must the engineer configure?

  A. monitor-mode enabled

  B. authentication host-mode multi-auth

  C. authentication open

  D. pae dot1x enabled

  Correct Answer: C

• Question 258:

  An engineer wants to preselect AD groups to be used in the access policy after integrating Cisco ISE with an active directory. Which configuration steps must the engineer take to assign groups to the AD on the identity management page?

  A. external identity sources > active directory > groups

  B. user identity groups > groups

  C. external identity sources > groups > active directory

  D. groups > user identity groups

  Correct Answer: A

• Question 259:

  An enterprise uses a separate PSN for each of its four remote sites. Recently, a user reported receiving an "EAP-TLS authentication failed" message when moving between remote sites. Which configuration must be applied on Cisco ISE?

  A. Use a third-party certificate on the network device.

  B. Add the device to all PSN nodes in the deployment.

  C. Configure an authorization profile for the end users.

  D. Renew the expired certificate on one of the PSN.

  Correct Answer: D

• Question 260:

  An engineer must develop a policy that utilizes AD group membership on Cisco ISE. Which type of policy element must the engineer configure to create an AD group within a policy?

  A. conditions

  B. results

  C. dictionaries

  D. smart conditions

  Correct Answer: A