Dumps of 300-715 Cover all the requirements of the Real Exam
Correct Practice Tests of 300-715 Dumps with Practice Exam
NEW QUESTION # 89
Which interface-level command is needed to turn on 802 1X authentication?
- A. aaa server radius dynamic-author
- B. Dofl1x pae authenticator
- C. authentication host-mode single-host
- D. dot1x system-auth-control
Answer: D
NEW QUESTION # 90
Which two components are required for creating a Native Supplicant Profile within a BYOD flow? (Choose two)
- A. iOS Settings
- B. Connection Type
- C. Windows Settings
- D. Redirect ACL
- E. Operating System
Answer: B,E
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010101.html#reference_21024A3B2B27427EAC78495E56962729
NEW QUESTION # 91
A network administrator is configuring authorization policies on Cisco ISE There is a requirement to use AD group assignments to control access to network resources After a recent power failure and Cisco ISE rebooting itself, the AD group assignments no longer work What is the cause of this issue?
- A. The AD join point is no longer connected.
- B. The AD DNS response is slow.
- C. The network devices ports are shut down.
- D. The certificate checks are not being conducted.
Answer: A
Explanation:
Explanation
https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_
NEW QUESTION # 92
Refer to the exhibit.
A network engineers configuring the switch to accept downloadable ACLs from a Cisco ISC server Which two commands should be run to complete the configuration? (Choose two)
- A. dot1x system-auth-control
- B. radius-server attribute 8 include-in-access-req
- C. ip device tracking
- D. radius server vsa sand authentication
- E. aaa authorization auth-proxy default group radius
Answer: B,D
NEW QUESTION # 93
An administrator needs to give the same level of access to the network devices when users are logging into them using TACACS+ However, the administrator must restrict certain commands based on one of three user roles that require different commands How is this accomplished without creating too many objects using Cisco ISE?
- A. Create one shell profile and one command set.
- B. Create one shell profile and multiple command sets.
- C. Create multiple shell profiles and one command set
- D. Create multiple shell profiles and multiple command sets.
Answer: D
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_0100010.html
https://www.youtube.com/watch?v=IlZwB71Szog&ab_channel=JasonMaynard
NEW QUESTION # 94
Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?
- A. session timeout
- B. idle timeout
- C. radius-server timeout
- D. termination-action
Answer: B
Explanation:
When the inactivity timer is enabled, the switch monitors the activity from authenticated endpoints. When the inactivity timer expires, the switch removes the authenticated session. The inactivity timer for MAB can be statically configured on the switch port, or it can be dynamically assigned using the RADIUS Idle-Timeout attribute
NEW QUESTION # 95
Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)
- A. endpoint profile transition from Unknown to Windows 10-Workstation
- B. updating of endpoint dACL.
- C. endpoint profile transition from Aop.e-dev.ee to Apple-iPhone
- D. endpoint marked as lost in My Devices Portal
- E. addition of endpoint to My Devices Portal
Answer: A,C
NEW QUESTION # 96
An engineer is configuring static SGT classification. Which configuration should be used when authentication is disabled and third-party switches are in use?
- A. IP Address to SGT mapping
- B. L3IF to SGT mapping
- C. Subnet to SGT mapping
- D. VLAN to SGT mapping
Answer: A
Explanation:
https://community.cisco.com/t5/security-knowledge-base/segmentation-strategy/ta-p/3757424: "The method of sending out IP to SGT mappings from ISE is particularly useful if the access switch does not support TrustSec"
NEW QUESTION # 97
Which two endpoint compliance statuses are possible? (Choose two.)
- A. known
- B. invalid
- C. unknown
- D. compliant
- E. valid
Answer: C,D
NEW QUESTION # 98
An administrator is configuring the Native Supplicant Profile to be used with the Cisco ISE posture agents and needs to test the connection using wired devices to determine which profile settings are available. Which two configuration settings should be used to accomplish this task? (Choose two.)
- A. certificate template
- B. allowed protocol
- C. authentication mode
- D. security
- E. proxy host/IP
Answer: A,B
NEW QUESTION # 99
An engineer builds a five-node distributed Cisco ISE deployment The first two deployed nodes are responsible for the primary and secondary administration and monitoring personas Which persona configuration is necessary to have the remaining three Cisco ISE nodes serve as dedicated nodes in the Cisco ISE cube that is responsible only for handling the RADIUS and TACACS+ authentication requests, identity lookups, and policy evaluation?
A)
B)
C)
D)
- A. Option B
- B. Option D
- C. Option C
- D. Option A
Answer: B
NEW QUESTION # 100
Drag the steps to configure a Cisco ISE node as a primary administration node from the left into the correct order on the night.
Answer:
Explanation:
NEW QUESTION # 101
An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the used to accomplish this task?
- A. monitoring
- B. primary policy administrator
- C. pxGrid
- D. policy service
Answer: A
NEW QUESTION # 102
By default, which traffic does an 802.IX-enabled switch allow before authentication?
- A. no traffic
- B. traffic permitted in the port dACL on Cisco ISE
- C. traffic permitted in the default ACL on the switch
- D. all traffic
Answer: C
NEW QUESTION # 103
What is the deployment mode when two Cisco ISE nodes are configured in an environment?
- A. distributed
- B. active
- C. standalone
- D. standard
Answer: A
NEW QUESTION # 104
Which Cisco ISE node does not support automatic failover?
- A. Policy Services node
- B. Admin node
- C. Monitoring node
- D. Inline Posture node
Answer: A
NEW QUESTION # 105
Which personas can a Cisco ISE node assume?
- A. administration, policy service, gatekeeping
- B. administration, policy service, and monitoring
- C. administration, monitoring, and gatekeeping
- D. policy service, gatekeeping, and monitonng
Answer: B
Explanation:
https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html The persona or personas of a node determine the services provided by a node. An ISE node can assume any or all of the following personas: Administration, Policy Service, and Monitoring. The menu options that are available through the administrative user interface are dependent on the role and personas that an ISE node assumes. See Cisco ISE Nodes and Available Menu Options for more information.
NEW QUESTION # 106
Drag the descriptions on the left onto the components of 802.1X on the right.
Answer:
Explanation:
NEW QUESTION # 107
An engineer is configuring web authentication and needs to allow specific protocols to permit DNS traffic.
Which type of access list should be used for this configuration?
- A. extended ACL
- B. standard ACL
- C. numbered ACL
- D. reflexive ACL
Answer: A
NEW QUESTION # 108
Refer to the exhibit.
An organization recently implemented network device administration using Cisco ISE. Upon testing the ability to access all of the required devices, a user in the Cisco ISE group IT Admins is attempting to login to a device in their organization's finance department but is unable to. What is the problem?
- A. The authorization conditions wrongly allow IT Admins group no access to finance devices.
- B. The IT training rule is taking precedence over the IT Admins rule.
- C. The authorization policy doesn't correctly grant them access to the finance devices.
- D. The finance location is not a condition in the policy set.
Answer: D
NEW QUESTION # 109
An engineer is creating a new authorization policy to give the endpoints access to VLAN 310 upon successful authentication The administrator tests the 802.1X authentication for the endpoint and sees that it is authenticating successfully What must be done to ensure that the endpoint is placed into the correct VLAN?
- A. Add VLAN 310 in the common tasks of the authorization profile
- B. Ensure that the endpoint is using The correct policy set
- C. Ensure that the security group is not preventing the endpoint from being in VLAN 310
- D. Configure the switchport access vlan 310 command on the switch port
Answer: A
NEW QUESTION # 110
Refer to the exhibit:
Which command is typed within the CU of a switch to view the troubleshooting output?
- A. show authentication registrations
- B. show authentication sessions mac 000e.84af.59af details
- C. show authentication interface gigabitethemet2/0/36
- D. show authentication sessions method
Answer: B
NEW QUESTION # 111
An administrator is configuring new probes to use with Cisco ISE and wants to use metadata to help profile the endpoints. The metadata must contain traffic information relating to the endpoints instead of industry-standard protocol information Which probe should be enabled to meet these requirements?
- A. DHCP probe
- B. SNMP query probe
- C. NetFlow probe
- D. DNS probe
Answer: A
Explanation:
Explanation
http://www.network-node.com/blog/2016/1/2/ise-20-profiling
NEW QUESTION # 112
An engineer is configuring a dedicated SSID for onboarding devices. Which SSID type accomplishes this configuration?
- A. guest
- B. hidden
- C. broadcast
- D. dual
Answer: A
NEW QUESTION # 113
......
Sample Questions of 300-715 Dumps With 100% Exam Passing Guarantee: https://www.validdumps.top/300-715-exam-torrent.html
Pass Key features of 300-715 Course with Updated 240 Questions: https://drive.google.com/open?id=1xtpLbFxaUiViByilrASI98HCMe71kT43