Cisco CCNP Security 300-715 Questions & Answers

• Question 301:

  If there is a firewall between Cisco ISE and an Active Directory external identity store, which port does not need to be open?

  A. UDP/TCP 389

  B. UDP123

  C. TCP 21

  D. TCP 445

  E. TCP 88

  Correct Answer: C

• Question 302:

  What are the three default behaviors of Cisco ISE with respect to authentication, when a user connects to a switch that is configured for 802.1X, MAB, and WebAuth? (Choose three)

  A. MAB traffic uses internal endpoints for retrieving identity.

  B. Dot1X traffic uses a user-defined identity store for retrieving identity.

  C. Unmatched traffic is allowed on the network.

  D. Unmatched traffic is dropped because of the Reject/Reject/Drop action that is configured under Options.

  E. Dot1 traffic uses internal users for retrieving identity.

  Correct Answer: ADE

• Question 303:

  A security engineer must create an Antivirus remediation policy within Cisco ISE. Which two options can the engineer select in the new Antivirus remediation policy? (Choose two.)

  A. program installation path

  B. Antivirus vendor name

  C. uniform resource locator

  D. file to upload

  E. operating system

  Correct Answer: BE

  https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_pos_pol.html#wp1655749

• Question 304:

  A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group. Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?

  A. Authenticate guest users to Cisco ISE.

  B. Keep track of guest user activities.

  C. Create and manage guest user accounts.

  D. Configure authorization setting for guest users.

  Correct Answer: C

• Question 305:

  What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?

  A. The primary node restarts

  B. The secondary node restarts.

  C. The primary node becomes standalone

  D. Both nodes restart.

  Correct Answer: B

• Question 306:

  What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?

  A. Network Access Control

  B. My Devices Portal

  C. Application Visibility and Control

  D. Supplicant Provisioning Wizard

  Correct Answer: D

• Question 307:

  Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose 2)

  A. hotspot

  B. new AD user 802 1X authentication

  C. posture

  D. BYOD

  E. guest AUP

  Correct Answer: BC

• Question 308:

  When configuring Active Directory groups, what does the Cisco ISE use to resolve ambiguous group names?

  A. MIB

  B. TGT

  C. OMAB

  D. SID

  Correct Answer: D

• Question 309:

  Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?

  A. session timeout

  B. idle-timeout

  C. radius-server timeout

  D. termination-action

  Correct Answer: B

  When the inactivity timer is enabled, the switch monitors the activity from authenticated endpoints. When the inactivity timer expires, the switch removes the authenticated session. The inactivity timer for MAB can be statically configured on the switch port, or it can be dynamically assigned using the RADIUS Idle-Timeout attribute

• Question 310:

  Which profiling probe collects the user-agent string?

  A. DHCP

  B. AD

  C. HTTP

  D. NMAP

  Correct Answer: C