2023 Correct Practice Tests of 300-715 Dumps with Practice Exam
Certification Sample Questions of 300-715 Dumps With 100% Exam Passing Guarantee
The 300-715 exam covers a broad range of topics related to Cisco ISE, including network access device configuration, endpoint compliance, network segmentation, device profiling, and monitoring and troubleshooting. 300-715 exam also tests the candidates' knowledge of network security principles, including AAA protocols, identity and access management, and network security threats and mitigation. Successful candidates will be able to implement and configure Cisco ISE solutions, troubleshoot common issues, and ensure compliance with security policies and regulations.
NEW QUESTION # 21
An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port.
Which command should be used to accomplish this task?
- A. ip http port <port number>
- B. aaa group server radius
- C. permit tcp any any eq <port number>
- D. aaa group server radius proxy
Answer: A
Explanation:
Section: Web Auth and Guest Services
NEW QUESTION # 22
An administrator for a small network is configuring Cisco ISE to provide dynamic network access to users. Management needs Cisco ISE to not automatically trigger a CoA whenever a profile change is detected. Instead, the administrator needs to verify the new profile and manually trigger a CoA. What must be configuring in the profiler to accomplish this goal?
- A. Port Bounce
- B. Session Query
- C. No CoA
- D. Reauth
Answer: C
Explanation:
Explanation
https://ciscocustomer.lookbookhq.com/iseguidedjourney/ISE-profiling-policies
NEW QUESTION # 23
Which two probes must be enabled for the ARP cache to function in the Cisco ISE profile service so that a user can reliably bind the IP address and MAC addresses of endpoints? (Choose two.)
- A. SNMP
- B. RADIUS
- C. HTTP
- D. NetFlow
- E. DHCP
Answer: B,E
Explanation:
Cisco ISE implements an ARP cache in the profiling service, so that you can reliably map the IP addresses and the MAC addresses of endpoints. For the ARP cache to function, you must enable either the DHCP probe or the RADIUS probe. The DHCP and RADIUS probes carry the IP addresses and the MAC addresses of endpoints in the payload data. The dhcp-requested address attribute in the DHCP probe and the Framed-IP-address attribute in the RADIUS probe carry the IP addresses of endpoints, along with their MAC addresses, which can be mapped and stored in the ARP cache.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-
1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html
NEW QUESTION # 24
An engineer is designing a BYOD environment utilizing Cisco ISE for devices that do not support native supplicants Which portal must the security engineer configure to accomplish this task?
- A. MDM
- B. Client provisioning
- C. BYOD
- D. My devices
Answer: D
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01111.html
NEW QUESTION # 25
Which statement is not correct about the Cisco ISE Monitoring node?
- A. Cisco ISE supports distributed log collection across all nodes to optimize local data collection, aggregation, and centralized correlation and storage.
- B. The local collector buffers transport the collected data to designated Cisco ISE Monitoring nodes as syslog; once Monitoring nodes are globally defined via Administration, ISE nodes automatically send logs to one or both of the configured Monitoring nodes.
- C. The local collector agent process runs only the Inline Posture node.
- D. The local collector agent collects logs locally from itself and from any NAD that is configured to send logs to the Policy Service node.
Answer: C
NEW QUESTION # 26
A network administrator notices that after a company-wide shut down, many users cannot connect their laptops to the corporate SSID. What must be done to permit access in a timely manner?
- A. Authenticate the user's system to the secondary Cisco ISE node and move this user to the primary with the renewed certificate.
- B. Allow authentication for expired certificates within the EAP-TLS section under the allowed protocols.
- C. Add a certificate issue from the CA server, revoke the expired certificate, and add the new certificate in system.
- D. Connect this system as a guest user and then redirect the web auth protocol to log in to the network.
Answer: A
NEW QUESTION # 27
An engineer is designing a new distributed deployment for Cisco ISE in the network and is considering failover options for the admin nodes. There is a need to ensure that an admin node is available for configuration of policies at all times. What is the requirement to enable this feature?
- A. one policy services node and one secondary admin node
- B. one primary admin and one secondary admin node in the deployment
- C. one primary admin node and one monitoring and troubleshooting node
- D. one policy services node and one monitoring and troubleshooting node
Answer: B
NEW QUESTION # 28
An organization wants to improve their BYOD processes to have Cisco ISE issue certificates to the BYOD endpoints. Currently, they have an active certificate authority and do not want to replace it with Cisco ISE. What must be configured within Cisco ISE to accomplish this goal?
- A. Create a certificate signing request and have the root certificate authority sign it.
- B. Create an SCEP profile to link Cisco ISE with the root certificate authority.
- C. Add an OCSP profile and configure the root certificate authority as secondary.
- D. Add the root certificate authority to the trust store and enable it for authentication.
Answer: B
NEW QUESTION # 29
An engineer is implementing network access control using Cisco ISE and needs to separate the traffic based on the network device ID and use the IOS device sensor capability. Which probe must be used to accomplish this task?
- A. RADIUS probe
- B. NetFlow probe
- C. HTTP probe
- D. network scan probe
Answer: C
NEW QUESTION # 30
An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE. but the devices do not change their access due to the new profile. What is the problem'?
- A. In closed mode, profiling does not work unless CDP is enabled.
- B. The profiling probes are not able to collect enough information to change the device profile
- C. The default profiler configuration is set to No CoA for the reauthentication setting
- D. The profiler feed is not downloading new information so the profiler is inactive
Answer: C
NEW QUESTION # 31
Refer to the exhibit Which switch configuration change will allow only one voice and one data endpoint on each port?
- A. Auto to manual
- B. Multi-auth to single-auth
- C. Multi-auth to multi-domain
- D. Mab to dot1x
Answer: C
Explanation:
https://community.cisco.com/t5/network-access-control/cisco-ise-multi-auth-or-multi-host/m-p/3750907
NEW QUESTION # 32
An engineer is configuring ISE for network device administration and has devices that support both protocols. What are two benefits of choosing TACACS+ over RADUs for these devices? (Choose two.)
- A. TACACS+ provides the ability to authorize specific commands while RADIUS does not
- B. TACACS+ is designed for network access control while RADIUS is designed for role-based access.
- C. TACACS+ uses secure EAP-TLS while RADIUS does not.
- D. TACACS+ encrypts the entire payload being sent while RADIUS only encrypts the password.
- E. TACACS+ is FIPS compliant while RADIUS is not
Answer: A,D
NEW QUESTION # 33
An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network.
Which node should be used to accomplish this task?
- A. primary policy administrator
- B. monitoring
- C. policy service
- D. pxGrid
Answer: C
Explanation:
Section: Profiler
NEW QUESTION # 34
Which two default endpoint identity groups does cisco ISE create? (Choose two )
- A. end point
- B. whitelist
- C. profiled
- D. blacklist
- E. Unknown
Answer: C,D,E
Explanation:
Default Endpoint Identity Groups Created for Endpoints Cisco ISE creates the following five endpoint identity groups by default: Blacklist, GuestEndpoints, Profiled, RegisteredDevices, and Unknown. In addition, it creates two more identity groups, such as Cisco-IP-Phone and Workstation, which are associated to the Profiled (parent) identity group. A parent group is the default identity group that exists in the system.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-
4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_010101.html#ID16
78
NEW QUESTION # 35
In which two ways can users and endpoints be classified for TrustSec?
(Choose Two.)
- A. SXP
- B. VLAN
- C. SGACL
- D. dynamic
- E. QoS
Answer: B,D
NEW QUESTION # 36
What is a requirement for Feed Service to work?
- A. Cisco ISE has Internet access to download feed update
- B. Cisco ISE has a base license.
- C. TCP port 3080 must be opened between Cisco ISE and the feed server
- D. Cisco ISE has access to an internal server to download feed update
Answer: D
NEW QUESTION # 37
An organization wants to implement 802.1X and is debating whether to use PEAP-MSCHAPv2 or PEAP-EAP-TLS for authentication. Drag the characteristics on the left to the corresponding protocol on the right.
Answer:
Explanation:
NEW QUESTION # 38
An employee logs on to the My Devices portal and marks a currently on-boarded device as 'Lost'.
Which two actions occur within Cisco ISE as a result oí this action? (Choose two)
- A. The device access has been denied
- B. BYOD Registration status is updated to No
- C. BYOD Registration status is updated to Unknown.
- D. The device status is updated to Stolen
- E. Certificates provisioned to the device are not revoked
Answer: B,E
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01111.html
NEW QUESTION # 39
A network security engineer needs to configure 802.1X port authentication to allow a single host to be authenticated for data and another single host to be authenticated for voice. Which command should the engineer run on the interface to accomplish this goal?
- A. authentication host-mode multi-host
- B. authentication host-mode multi-domain
- C. authentication host-mode single-host
- D. authentication host-mode multi-auth
Answer: B
NEW QUESTION # 40
What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?
- A. Network Access Control
- B. My Devices Portal
- C. Supplicant Provisioning Wizard
- D. Application Visibility and Control
Answer: B
Explanation:
Section: BYOD
NEW QUESTION # 41
......
300-715 Sample Practice Exam Questions 2023 Updated Verified: https://actualtests.testbraindump.com/300-715-exam-prep.html
