Cisco CCNP Security 300-715 Questions & Answers

• Question 81:

  Which two authentication protocols are supported by RADIUS but not by TACACS+? (Choose two.)

  A. MSCHAPv1

  B. PAP

  C. EAP

  D. CHAP

  E. MSCHAPV2

  Correct Answer: CE

• Question 82:

  An engineer is configuring Cisco ISE for network device administration and has devices that support both protocols. What are two benefits of choosing TACACS+ over RADIUS for these devices? (Choose two.)

  A. TACACS+ uses secure EAP-TLS while RADIUS does not.

  B. TACACS+ is FIPS compliant while RADIUS is not.

  C. TACACS+ encrypts the entire payload being sent while RADIUS only encrypts the password.

  D. TACACS+ is designed for network access control while RADIUS is designed for role-based access.

  E. TACACS+ provides the ability to authorize specific commands while RADIUS does not.

  Correct Answer: CE

• Question 83:

  The IT manager wants to provide different levels of access to network devices when users authenticate using TACACS+. The company needs specific commands to be allowed based on the Active Directory group membership of the different roles within the IT department. The solution must minimize the number of objects created in Cisco ISE. What must be created to accomplish this task?

  A. one shell profile and one command set

  B. multiple shell profiles and one command set

  C. one shell profile and multiple command sets

  D. multiple shell profiles and multiple command sets

  Correct Answer: D

• Question 84:

  An engineer is unable to use SSH to connect to a switch after adding the required CLI commands to the device to enable TACACS+. The device administration license has been added to Cisco ISE, and the required policies have been created. Which action is needed to enable access to the switch?

  A. The ip ssh source-interface command needs to be set on the switch

  B. 802.1X authentication needs to be configured on the switch.

  C. The RSA keypair used for SSH must be regenerated after enabling TACACS+.

  D. The switch needs to be added as a network device in Cisco ISE and set to use TACACS+.

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_device_admin.html

• Question 85:

  An administrator is configuring posture assessment in Cisco ISE for the first time. Which two components must be uploaded to Cisco ISE to use Secure Client for the agent configuration in a client provisioning policy? (Choose two.)

  A. SecureClientProtie.xsd file

  B. Secure Client compliance module

  C. Secure Client agent image

  D. SecureClientProfie.xml file

  E. Secure Client network visibility module

  Correct Answer: BC

• Question 86:

  What is a difference between TACACS+ and RADIUS in regards to encryption?

  A. TACACS+ encrypts only the password, whereas RADIUS encrypts the username and password.

  B. TACACS+ encrypts the username and password, whereas RADIUS encrypts only the password.

  C. TACACS+ encrypts the password, whereas RADIUS sends the entire packet in clear text.

  D. TACACS+ encrypts the entire packet, whereas RADIUS encrypts only the password.

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.html

• Question 87:

  What is a difference between RADIUS and TACACS+?

  A. RADIUS uses connection-oriented transport, and TACACS+ uses best-effort delivery.

  B. RADIUS offers multiprotocol support, and TACACS+ supports only IP traffic.

  C. RADIUS combines authentication and authorization functions, and TACACS+ separates them.

  D. RADIUS supports command accounting, and TACACS+ does not.

  Correct Answer: C

  Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.html

• Question 88:

  What is a valid status of an endpoint attribute during the device registration process?

  A. block listed

  B. pending

  C. unknown

  D. DenyAccess

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_new_chapter_0100011.html

• Question 89:

  An administrator is configuring the Native Supplicant Profile to be used with the Cisco ISE posture agents and needs to test the connection using wired devices to determine which profile settings are available. Which two configuration settings should be used to accomplish this task? (Choose two.)

  A. authentication mode

  B. proxy host/IP

  C. certificate template

  D. security

  E. allowed protocol

  Correct Answer: CE

• Question 90:

  Which Cisco ISE solution ensures endpoints have the latest version of antivirus updates installed before being allowed access to the corporate network?

  A. Threat Services

  B. Profiling Services

  C. Provisioning Services

  D. Posture Services

  Correct Answer: D