300-715 Pre-Exam Practice Tests | (Updated 210 Questions)
Valid 300-715 Exam Q&A PDF - One Year Free Update
Cisco SISE 300-715 Practice Test Questions, Cisco SISE 300-715 Exam Practice Test Questions
The Implementing and Configuring Cisco Identity Services Engine (300-715 SISE) exam validates the competency of the candidates in Cisco Identify Services Engine, including policy enforcement, architecture & deployment, profiler, Web Auth & guest services, BYOD, endpoint compliance, as well as network access device administration. This test is a mandatory requirement for obtaining the Cisco Certified Specialist – Security Identity Management Implementation certificate. It is also one of the concentration exams that the applicants can choose in addition to the Implementing and Operating Cisco Security Core Technologies (350-701 SCOR) test required for earning the Cisco Certified Network Professional (CCNP) Security certification.
Network Access Device Management: The last section assesses the skills of the individuals in the following areas:
- Comparing various AAA protocols
- Setting TACACS+ device management and command authorization
NEW QUESTION 30
An administrator adds a new network device to the Cisco ISE configuration to authenticate endpoints to the network. The RADIUS test fails after the administrator configures all of the settings in Cisco ISE and adds the proper configurations to the switch. What is the issue"?
- A. The endpoint profile is showing as "unknown."
- B. The certificate on the switch is self-signed not a CA-provided certificate.
- C. The endpoint does not have the appropriate credentials for network access.
- D. The shared secret is incorrect on the switch or on Cisco ISE.
Answer: C
NEW QUESTION 31
In a standalone Cisco ISE deployment, which two personas are configured on a node? (Choose two )
- A. subscriber
- B. publisher
- C. administration
- D. policy service
- E. primary
Answer: C,D
NEW QUESTION 32
An engineer is configuring a dedicated SSID for onboarding devices. Which SSID type accomplishes this configuration?
- A. hidden
- B. dual
- C. broadcast
- D. guest
Answer: D
NEW QUESTION 33
What should be considered when configuring certificates for BYOD?
- A. The CN field is populated with the endpoint host name.
- B. An Android endpoint uses EST whereas other operation systems use SCEP for enrollment
- C. An endpoint certificate is mandatory for the Cisco ISE BYOD
- D. The SAN field is populated with the end user name
Answer: C
NEW QUESTION 34
An administrator is manually adding a device to a Cisco ISE identity group to ensure that it is able to access the network when needed without authentication Upon testing, the administrator notices that the device never hits the correct authorization policy line using the condition EndPoints LogicalProfile EQUALS static_list Why is this occurring?
- A. The device is changing identity groups after profiling instead ot remaining static
- B. The identity group is being assigned instead of the logical profile
- C. The dynamic logical profile is overriding the statically assigned profile
- D. The logical profile is being statically assigned instead of the identity group
Answer: D
NEW QUESTION 35
Drag the descriptions on the left onto the components of 802.1X on the right.
Answer:
Explanation:
NEW QUESTION 36
Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.
Answer:
Explanation:
Explanation
Monitoring = provides advanced monitoring and troubleshooting tools that you can use to effectively manage your network and resources Policy Service = provides network access, posture, guest access, client provisioning, and profiling services.
This persona evaluates the policies and makes all the decisions.
Administration = manages all system-related configuration and configurations that relate to functionality such as authentication, authorization, auditing, and so on pxGrid = shares context-sensitive information from Cisco ISE to subscribers
https://www.cisco.com/c/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide
NEW QUESTION 37
Which permission is common to the Active Directory Join and Leave operations?
- A. Set attributes on the Cisco ISE machine account.
- B. Search Active Directory to see if a Cisco ISE machine account already exists.
- C. Create a Cisco ISE machine account in the domain if the machine account does not already exist.
- D. Remove the Cisco ISE machine account from the domain.
Answer: B
Explanation:
Section: Policy Enforcement
NEW QUESTION 38
An administrator is adding a switch to a network that is running Cisco ISE and is only for IP Phones. The phones do not have the ability to auto switch port for authentication?
- A. dot1x system-auth-control
- B. enable network-authentication
- C. mab
- D. enable bypass-MAC
Answer: A
NEW QUESTION 39
An organization wants to implement 802.1X and is debating whether to use PEAP-MSCHAPv2 or PEAP-EAP-TLS for authentication. Drag the characteristics on the left to the corresponding protocol on the right.
Answer:
Explanation:
NEW QUESTION 40
An administrator is attempting to replace the built-in self-signed certificates on a Cisco ISE appliance. The CA is requesting some information about the appliance in order to sign the new certificate. What must be done in order to provide the CA this information?
- A. Generate the CSR.
- B. Install the Root CA and intermediate CA.
- C. Download the CA server certificate.
- D. Download the intermediate server certificate.
Answer: B
NEW QUESTION 41
Refer to the exhibit. In which scenario does this switch configuration apply?
- A. when allowing a hub with multiple clients connected
- B. when allowing multiple IP phones to be connected
- C. when passing IP phone authentication
- D. when preventing users with hypervisor
Answer: A
Explanation:
Reference:
https://www.linkedin.com/pulse/mac-authentication-bypass-priyanka-kumari#:~:text=Multi%2Dauthentication%20host%20mode%3A%20You,allows%20multiple%20source%20MAC%20addresses.
NEW QUESTION 42
Which two roles are taken on by the administration person within a Cisco ISE distributed environment?
(Choose two.)
- A. standby
- B. secondary
- C. active
- D. backup
- E. primary
Answer: B,E
NEW QUESTION 43
Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?
- A. profiled
- B. blacklist
- C. Endpoint
- D. white list
- E. unknown
Answer: E
Explanation:
Explanation
If you do not have a matching profiling policy, you can assign an unknown profiling policy. The endpoint is therefore profiled as Unknown. The endpoint that does not match any profile is grouped within the Unknown identity group. The endpoint profiled to the Unknown profile requires that you create a profile with an attribute or a set of attributes collected for that endpoint.
https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_identities.html
NEW QUESTION 44
What does a fully distributed Cisco ISE deployment include?
- A. PAN and MnT on the same node while PSNs are on their own dedicated nodes.
- B. All Cisco ISE personas are sharing the same node.
- C. PAN and PSN on the same node while MnTs are on their own dedicated nodes.
- D. All Cisco ISE personas on their own dedicated nodes.
Answer: C
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_setup_cisco_ise.html
NEW QUESTION 45
A network engineer must enforce access control using special tags, without re-engineering the network design.
Which feature should be configured to achieve this in a scalable manner?
- A. SGT
- B. dACL
- C. RBAC
- D. VLAN
Answer: A
NEW QUESTION 46
An administrator is adding a switch to a network that is running Cisco ISE and is only for IP Phones The phones do not have the ability to authenticate via 802 1X Which command is needed on each switch port for authentication?
- A. enable network-authentication
- B. mab
- C. enable bypass-mac
- D. dot1x system-auth-control
Answer: B
Explanation:
Explanation
https://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_aaa/configuration/15-2mt/sec-config-mab.html
NEW QUESTION 47
What is the deployment mode when two Cisco ISE nodes are configured in an environment?
- A. active
- B. standalone
- C. distributed
- D. standard
Answer: C
NEW QUESTION 48
An organization wants to improve their BYOD processes to have Cisco ISE issue certificates to the BYOD endpoints. Currently, they have an active certificate authority and do not want to replace it with Cisco ISE.
What must be configured within Cisco ISE to accomplish this goal?
- A. Add the root certificate authority to the trust store and enable it for authentication.
- B. Create a certificate signing request and have the root certificate authority sign it.
- C. Create an SCEP profile to link Cisco ISE with the root certificate authority.
- D. Add an OCSP profile and configure the root certificate authority as secondary.
Answer: C
NEW QUESTION 49
An engineer is configuring posture assessment for their network access control and needs to use an agent that supports using service conditions as conditions for the assessment. The agent should be run as a background process to avoid user interruption but when it is run. the user can see it. What is the problem?
- A. The posture module was deployed using the headend instead of installing it with SCCM
- B. The proper permissions were no! given to the temporal agent to conduct the assessment
- C. The user was in need of remediation so the agent appeared m the notifications
- D. The engineer is using the "Anyconnect" posture agent but should be using the "Stealth Anyconnect posture agent
Answer: D
NEW QUESTION 50
An engineer is configuring 802.1X and wants it to be transparent from the users' point of view. The implementation should provide open authentication on the switch ports while providing strong levels of security for non-authenticated devices. Which deployment mode should be used to achieve this?
- A. closed
- B. low-impact
- C. open
- D. high-impact
Answer: B
Explanation:
https://www.lookingpoint.com/blog/cisco-ise-wired-802.1x-deployment-monitormode#:~:text=Low%20impact%20mode%20works%20similar,DHCP%2C%20PXE%20boot%2C%20etc.
NEW QUESTION 51
......
Implementing and Configuring Cisco Identity Services Engine Free Update Certification Sample Questions: https://actualtests.torrentexam.com/300-715-exam-latest-torrent.html
