Cisco CCNP Security 300-715 Questions & Answers

• Question 321:

  What is a method for transporting security group tags throughout the network?

  A. by enabling 802.1AE on every network device

  B. by the Security Group Tag Exchange Protocol

  C. by embedding the security group tag in the IP header

  D. by embedding the security group tag in the 802.1Q header

  Correct Answer: B

• Question 322:

  Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

  A. endpoint marked as lost in My Devices Portal

  B. addition of endpoint to My Devices Portal

  C. endpoint profile transition from Aop.e-dev.ee to Apple-iPhone

  D. endpoint profile transition from Unknown to Windows 10-Workstation

  E. updating of endpoint dACL.

  Correct Answer: CD

• Question 323:

  Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two).

  A. TCP 8443

  B. TCP 8906

  C. TCP 443

  D. DTCP80

  E. TCP 8905

  Correct Answer: AE

• Question 324:

  Which statement about configuring certificates for BYOD is true?

  or

  What should be considered when configuring certificates for BYOD?

  A. An Android endpoint uses EST, whereas other operating systems use SCEP for enrollment

  B. The SAN field is populated with the end user name.

  C. An endpoint certificate is mandatory for the Cisco ISE BYOD

  D. The CN field is populated with the endpoint host name

  Correct Answer: D

• Question 325:

  Which description of the use of low-impact mode in a Cisco ISE deployment is correct?

  A. It continues to use the authentication open capabilities of the switch port, which allows traffic to enter theswitch before an authorization result.

  B. Low-impact mode must be the final phase in deploying Cisco ISE into a network environment using thephased approach.

  C. It enables authentication (with authentication open), sees exactly which devices fail and which succeed, andcorrects the failed authentications before they

  D. The port does not allow any traffic before the authentication (except for EAP, Cisco Discovery Protocol, andLLDP), and then the port is assigned to specific authorization results after the authentication

  Correct Answer: C

• Question 326:

  What gives Cisco ISE an option to scan endpoints for vulnerabilities?

  A. authorization policy

  B. authentication policy

  C. authentication profile

  D. authorization profile

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010100.html

• Question 327:

  Which two responses from the RADIUS server to NAS are valid during the authentication process? (Choose two )

  A. access-response

  B. access-request

  C. access-reserved

  D. access-accept

  E. access-challenge

  Correct Answer: DE

• Question 328:

  What does the dot1x system-auth-control command do?

  A. causes a network access switch not to track 802.1x sessions

  B. globally enables 802.1x

  C. enables 802.1x on a network access device interface

  D. causes a network access switch to track 802.1x sessions

  Correct Answer: B

  https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-8-0E/15-24E/configuration/guide/xe-380-configuration/dot1x.html

• Question 329:

  What service can be enabled on the Cisco ISE node to identify the types of devices connecting to a network?

  A. MAB

  B. profiling

  C. posture

  D. central web authentication

  Correct Answer: B

• Question 330:

  A user reports that a switch's RADIUS accounting packets are not being seen on the Cisco ISE server Which command is the user missing in the switch's configuration?

  A. radius-server vsa send accounting

  B. aaa accounting network default start-stop group radius

  C. aaa accounting resource default start-stop group radius

  D. aaa accounting exec default start-stop group radius

  Correct Answer: A