Cisco CCNP Security 300-715 Questions & Answers

• Question 361:

  What is a valid guest portal type?

  A. Sponsored-Guest

  B. My Devices

  C. Sponsor

  D. Captive-Guest

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_01111.html

• Question 362:

  What is a requirement for Feed Service to work?

  A. TCP port 3080 must be opened between Cisco ISE and the feed server

  B. Cisco ISE has a base license.

  C. Cisco ISE has access to an internal server to download feed update D. Cisco ISE has Internet access to download feed update

  Correct Answer: D

• Question 363:

  Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?

  A. Endpoint

  B. unknown

  C. blacklist

  D. white list

  E. profiled

  Correct Answer: B

  If you do not have a matching profiling policy, you can assign an unknown profiling policy. The endpoint is therefore profiled as Unknown. The endpoint that does not match any profile is grouped within the Unknown identity group. The endpoint profiled to the Unknown profile requires that you create a profile with an attribute or a set of attributes collected for that endpoint.

  https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_identities.html

• Question 364:

  Which personas can a Cisco ISE node assume?

  A. policy service, gatekeeping, and monitoring

  B. administration, policy service, and monitoring

  C. administration, policy service, gatekeeping

  D. administration, monitoring, and gatekeeping

  Correct Answer: B

  https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html

  The persona or personas of a node determine the services provided by a node. An ISE node can assume any or all of the following personas: Administration, Policy Service, and Monitoring. The menu options that are available through the administrative user interface are dependent on the role and personas that an ISE node assumes. See Cisco ISE Nodes and Available Menu Options for more information.

• Question 365:

  Which term refers to an endpoint agent that tries to join an 802 1X-enabled network?

  A. EAP server

  B. supplicant

  C. client

  D. authenticator

  Correct Answer: B

  https://www.oreilly.com/library/view/cisco-ise-for/9780133103632/ch16.html#:~:text=What%20is%20a%20supplicant%3F,networks%2C%20both%20wired%20and%20wireless.andtext=The%20802.1X%20transactions%20are,Identity% 20Services%20Engine%20(ISE).

• Question 366:

  What are two benefits of TACACS+ versus RADIUS for device administration? (Choose two )

  A. TACACS+ supports 802.1X, and RADIUS supports MAB

  B. TACACS+ uses UDP, and RADIUS uses TCP

  C. TACACS+ has command authorization, and RADIUS does not.

  D. TACACS+ provides the service type, and RADIUS does not

  E. TACACS+ encrypts the whole payload, and RADIUS encrypts only the password.

  Correct Answer: CE

• Question 367:

  Which use case validates a change of authorization?

  A. An authenticated, wired EAP-capable endpoint is discovered

  B. An endpoint profiling policy is changed for authorization policy.

  C. An endpoint that is disconnected from the network is discovered

  D. Endpoints are created through device registration for the guests

  Correct Answer: B

  https://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_prof_pol.html

• Question 368:

  Which permission is common to the Active Directory Join and Leave operations?

  A. Create a Cisco ISE machine account in the domain if the machine account does not already exist

  B. Remove the Cisco ISE machine account from the domain.

  C. Set attributes on the Cisco ISE machine account

  D. Search Active Directory to see if a Cisco ISE machine account already ex.sts.

  Correct Answer: D

  https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/ise_active_directory_integration/b_ISE_AD_integration_2x.html

• Question 369:

  Which two features must be used on Cisco ISE to enable the TACACS feature? (Choose two)

  A. Command Sets

  B. Server Sequence

  C. Device Administration License

  D. External TACACS Servers

  E. Device Admin Service

  Correct Answer: CE

• Question 370:

  Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

  A. TCP 8909

  B. TCP 8905

  C. CUDP 1812

  D. TCP 443

  Correct Answer: B