Cisco CCNP Security 300-715 Questions & Answers

• Question 311:

  Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?

  A. DHCP server

  B. static IP tunneling

  C. override Interface ACL

  D. AAA override

  Correct Answer: D

• Question 312:

  In addition to the CLI, what is another option to manage a Cisco IPS?

  A. SDEE

  B. Cisco SDM

  C. Cisco IDM

  D. Cisco ISE

  Correct Answer: D

• Question 313:

  Which valid external identity source can be used with Cisco ISE?

  A. IPsec vpn authentication

  B. smart card

  C. local user name and password

  D. TACACS+ token

  Correct Answer: B

• Question 314:

  Which port does cisco ISE use for native supplicant provisioning of a windows computer?

  A. TCP/UDP 8905

  B. TCP 8443

  C. TCP/UDP 8909

  D. TCP 443

  Correct Answer: A

• Question 315:

  Which radius attribute can be used to dynamically assign the inactivity active timer for MAB users from the Cisco ISE node?

  A. radius-server timeout

  B. idle-timeout attribute

  C. termination-action attribute

  D. session-timeout attribute

  Correct Answer: B

  When the inactivity timer is enabled, the switch monitors the activity from authenticated endpoints. When the inactivity timer expires, the switch removes the authenticated session. The inactivity timer for MAB can be statically configured on the switch port, or it can be dynamically assigned using the RADIUS Idle-Timeout attribute (Attribute 28)

• Question 316:

  Cisco ISE antivirus remediation policy options?

  A. Upload a file

  B. Antivirus

  C. Uniform resource locator

  Correct Answer: AC

  http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116143-config-cise- posture-00.html

• Question 317:

  If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

  A. Client Provisioning

  B. Guest

  C. BYOD

  D. Blacklist

  Correct Answer: D

  https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Design_Guide/Managing_Lost_or_Stolen_Device.html#90273

  The Blacklist identity group is system generated and maintained by ISE to prevent access to lost or stolen devices. In this design guide, two authorization profiles are used to enforce the permissions for wireless and wired devices within the Blacklist:

  1.

  Blackhole WiFi Access

  2.

  Blackhole Wired Access

• Question 318:

  Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles?

  (Choose two.)

  A. Firepower

  B. WLC

  C. IOS

  D. ASA

  E. Shell

  Correct Answer: BE

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_0100010.html

  TACACS+ ProfileTACACS+ profiles control the initial login session of the device administrator. A session refers to each individual authentication, authorization, or accounting request. A session authorization request to a network device elicits

  an ISE response. The response includes a token that is interpreted by the network device, which limits the commands that may be executed for the duration of a session. The authorization policy for a device administration access service can

  contain a single shell profile and multiple command sets.

  The TACACS+ profile definitions are split into two components:

  1.

  Common tasks

  2.

  Custom attributes

  There are two views in the TACACS+ Profiles page (Work Centers > Device Administration > Policy Elements > Results > TACACS Profiles)--Task Attribute View and Raw View. Common tasks can be entered using the Task Attribute View

  and custom attributes can be created in the Task Attribute View as well as the Raw View.

  The Common Tasks section allows you to select and configure the frequently used attributes for a profile. The attributes that are included here are those defined by the TACACS+ protocol draft specifications. However, the values can be used

  in the authorization of requests from other services. In the Task Attribute View, the ISE administrator can set the privileges that will be assigned to the device administrator. The common task types are:

  1.

  Shell

  2.

  WLC

  3.

  Nexus

  4.

  Generic

  The Custom Attributes section allows you to configure additional attributes. It provides a list of attributes that are not recognized by the Common Tasks section. Each definition consists of the attribute name, an indication of whether the attribute is mandatory or optional, and the value for the attribute. In the Raw View, you can enter the mandatory attributes using a equal to (=) sign between the attribute name and its value and optional attributes are entered using an asterisk (*) between the attribute name and its value. The attributes entered in the Raw View are reflected in the Custom Attributes section in the Task Attribute View and vice versa. The Raw View is also used to copy paste the attribute list (for example, another product's attribute list) from the clipboard onto ISE. Custom attributes can be defined for nonshell services.

• Question 319:

  Which two fields are available when creating an endpoint on the context visibility page of Cisco IS? (Choose two )

  A. Policy Assignment

  B. Endpoint Family

  C. Identity Group Assignment

  D. Security Group Tag E. IP Address

  Correct Answer: AC

• Question 320:

  Which are two characteristics of TACACS+? (Choose two ) ,

  A. It uses TCP port 49.

  B. It combines authorization and authentication functions.

  C. It separates authorization and authentication functions.

  D. It encrypts the password only.

  E. It uses UDP port 49.

  Correct Answer: AC