Cisco CCNP Security 300-715 Questions & Answers

• Question 331:

  Which two default endpoint identity groups does Cisco ISE create? (Choose two )

  A. Unknown

  B. whitelist

  C. end point

  D. profiled

  E. blacklist

  Correct Answer: AD

  Default Endpoint Identity Groups Created for EndpointsCisco ISE creates the following five endpoint identity groups by default: Blacklist, GuestEndpoints, Profiled, RegisteredDevices, and Unknown. In addition, it creates two more identity groups, such as Cisco-IP-Phone and Workstation, which are associated to the Profiled (parent) identity group. A parent group is the default identity group that exists in the system.

  Cisco ISE creates the following endpoint identity groups:

  1.

  Blacklist--This endpoint identity group includes endpoints that are statically assigned to this group in Cisco ISE and endpoints that are block listed in the device registration portal. An authorization profile can be defined in Cisco ISE to permit, or deny network access to endpoints in this group.

  2.

  GuestEndpoints--This endpoint identity group includes endpoints that are used by guest users.

  3.

  Profiled--This endpoint identity group includes endpoints that match endpoint profiling policies except Cisco IP phones and workstations in Cisco ISE.

  4.

  RegisteredDevices--This endpoint identity group includes endpoints, which are registered devices that are added by an employee through the devices registration portal. The profiling service continues to profile these devices normally when they are assigned to this group. Endpoints are statically assigned to this group in Cisco ISE, and the profiling service cannot reassign them to any other identity group. These devices will appear like any other endpoint in the endpoints list. You can edit, delete, and block these devices that you added through the device registration portal from the endpoints list in the Endpoints page in Cisco ISE. Devices that you have blocked in the device registration portal are assigned to the Blacklist endpoint identity group, and an authorization profile that exists in Cisco ISE redirects blocked devices to a URL, which displays "Unauthorised Network Access", a default portal page to the blocked devices.

  5.

  Unknown--This endpoint identity group includes endpoints that do not match any profile in Cisco ISE.

  In addition to the above system created endpoint identity groups, Cisco ISE creates the following endpoint identity groups, which are associated to the Profiled identity group:

  1.

  Cisco-IP-Phone--An identity group that contains all the profiled Cisco IP phones on your network.

  2.

  Workstation--An identity group that contains all the profiled workstations on your network.

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html

• Question 332:

  What is needed to configure wireless guest access on the network?

  A. endpoint already profiled in ISE

  B. WEBAUTH ACL for redirection

  C. valid user account in Active Directory

  D. Captive Portal Bypass turned on

  Correct Answer: B

• Question 333:

  An engineer of Company A wants to know what kind of devices are connecting to the network. Which service can be enabled on the Cisco ISE node?

  A. central web authentication

  B. posture

  C. MAB

  D. profiling

  Correct Answer: D

  Cisco ISE Profiling Services provides dynamic detection and classification of endpoints connected to the network.Using MAC addresses as the unique identifier, ISE collects various attributes for each network endpoint to build an internal endpoint database.

• Question 334:

  A network administrator wants to use dynamic VLAN assignment from Cisco ISE. Which option must be configured on the switch to support this?

  A. AAA authentication

  B. VTP

  C. DTP

  D. AAA authorization

  Correct Answer: D

• Question 335:

  Which two endpoint compliance statuses are possible? (Choose two.)

  A. unknown

  B. known

  C. invalid

  D. compliant

  E. valid

  Correct Answer: AD

• Question 336:

  What are two requirements of generating a single signing in Cisco ISE by using a certificate provisioning portal, without generating a certificate request? (Choose two )

  A. Location the CSV file for the device MAC

  B. Select the certificate template

  C. Choose the hashing method

  D. Enter the common name

  E. Enter the IP address of the device

  Correct Answer: BD

  https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200534-ISE-2-0-Certificate-Provisioning-Portal.html

• Question 337:

  What is a characteristic of the UDP protocol?

  A. UDP can detect when a server is down.

  B. UDP offers best-effort delivery

  C. UDP can detect when a server is slow

  D. UDP offers information about a non-existent server

  Correct Answer: B

  https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.html

• Question 338:

  What is the minimum certainty factor when creating a profiler policy?

  A. the minimum number that a predefined condition provides

  B. the maximum number that a predefined condition provides

  C. the minimum number that a device certainty factor must reach to become a member of the profile

  D. the maximum number that a device certainty factor must reach to become a member of the profile

  Correct Answer: C

• Question 339:

  Which command displays all 802 1X/MAB sessions that are active on the switch ports of a Cisco Catalyst switch?

  A. show authentication sessions output

  B. Show authentication sessions

  C. show authentication sessions interface Gi 1/0/x

  D. show authentication sessions interface Gi1/0/x output

  Correct Answer: B

• Question 340:

  Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

  A. personas

  B. qualys

  C. nexpose

  D. posture

  Correct Answer: D

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010110.html

  Posture is a service in Cisco Identity Services Engine (Cisco ISE) that allows you to check the state, also known as posture, of all the endpoints that are connecting to a network for compliance with corporate security policies. This allows you to control clients to access protected areas of a network.