Cisco CCNP Security 300-715 Questions & Answers

• Question 271:

  In a Cisco ISE split deployment model, which load is split between the nodes?

  A. AAA

  B. network admission

  C. log collection

  D. device admission

  Correct Answer: A

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/install_guide/b_ise_InstallationGuide26.pdf

• Question 272:

  What happen when an internal user is configured with an external identity store for authentication but an engineer uses the cisco ise admin portal to select an internal identity store as the identity source?

  A. Authentication is granted

  B. Authentication failed

  C. Authentication is redirected to an external identity store

  D. Authentication is redirected to an external identity store

  Correct Answer: B

• Question 273:

  An engineer is working with a distributed deployment of cisco ise and needs to configure various network probes to collect a set of attributes from the endpoints on the network. Which node should be used to accomplish this task?

  A. Policy service

  B. Monitoring

  C. Primary policy administrator

  D. PxGrid

  Correct Answer: C

  The question is asking for configuring the probes. You cannot configure from a Policy Service Node. All configuration is done via the Policy Admin Node (PAN). C is the correct answer

• Question 274:

  An engineer is configuring web authentication and needs to allow specific protocol to permit DNS traffic. Which type of access list should be used for this configuration?

  A. Numbered ACL

  B. Standard ACL

  C. Reflexive ACL

  D. Extended ACL

  Correct Answer: D

• Question 275:

  Which two actions occur when a Cisco ISE server device administrator logs in to a device? (Choose two.)

  A. The device queries the internal identity store.

  B. The Cisco ISE server queries the internal identity store.

  C. The device queries the internal identity store.

  D. The Cisco ISE server queries the external identity store.

  E. The device queries the Cisco ISE authorization server.

  Correct Answer: BD

• Question 276:

  When planning for the deployment of Cisco ISE, an organization's security policy dictates that they must use network access authentication via RADIUS. It also states that the deployment provides an adequate amount of security and visibility for the hosts on the network. Why should the engineer configure MAB in this situation?

  A. The Cisco switches only support MAB.

  B. MAB provides the strongest form of authentication available.

  C. The devices in the network do not have a supplicant.

  D. MAB provides user authentication.

  Correct Answer: C

• Question 277:

  In which scenario does Cisco ISE allocate an Advanced license?

  A. guest services with dACL enforcement

  B. endpoint authorization using SGA enforcement

  C. dynamic device profiling

  D. high availability Administrator nodes

  Correct Answer: C

• Question 278:

  Which Cisco ISE node does not support automatic failover?

  A. Inline Posture node

  B. Monitoring node

  C. Policy Services node

  D. Admin node

  Correct Answer: D

• Question 279:

  Which scenario does not support Cisco ISE guest services?

  A. wired NAD with local WebAuth

  B. wireless LAN controller with central WebAuth

  C. wireless LAN controller with local WebAuth

  D. wired NAD with central WebAuth

  Correct Answer: B

• Question 280:

  By default, which traffic does an 802.IX-enabled switch allow before authentication?

  A. all traffic

  B. no traffic

  C. traffic permitted in the port dACL on Cisco ISE

  D. traffic permitted in the default ACL on the switch

  Correct Answer: D