Cisco 300-715 Test Engine Dumps Training With 210 Questions [Q80-Q95]

4.7/5 - (3 votes)

Cisco 300-715 Test Engine Dumps Training With 210 Questions

300-715 Questions Pass on Your First Attempt Dumps for CCNP Security Certified

Understanding functional and technical aspects of Implementing and Configuring Cisco Identity Services Engine (300-715 SISE) Endpoint compliance

The following will be discussed in CISCO 300-715 exam dumps:

Configure endpoint identity management
Implement probes
Implement CoA
Implement profiler services

NO.80 When configuring an authorization policy, an administrator cannot see specific Active Directory groups present in their domain to be used as a policy condition. However, other groups that are in the same domain are seen What is causing this issue?

Cisco ISE only sees the built-in groups, not user created ones

The groups are present but need to be manually typed as conditions

Cisco ISE’s connection to the AD join point is failing

The groups are not added to Cisco ISE under the AD join point

https://www.youtube.com/watch?v=0kuEZEo564s&ab_channel=CiscoISE-IdentityServicesEngine

NO.81 Refer to the exhibit.

Which component must be configured to apply the SGACL?

egress router

host

secure server

ingress router

NO.82 Which two ports do network devices typically use for CoA? (Choose two )

443

19005

8080

2799

1700

NO.83 An engineer is implementing Cisco ISE and needs to configure 802.1X. The port settings are configured for port-based authentication. Which command should be used to complete this configuration?

dot1x pae authenticator

dot1x system-auth-control

authentication port-control auto

aaa authentication dot1x default group radius

NO.84 An engineer is migrating users from MAB to 802.1X on the network. This must be done during normal business hours with minimal impact to users. Which CoA method should be used?

Port Bounce

Port Shutdown

Session Termination

Session Reauthentication

NO.85 An engineer is configuring 802.1X and is testing out their policy sets. After authentication, some endpoints are given an access-reject message but are still allowed onto the network. What is causing this issue to occur?

The switch port is configured with authentication event server dead action authorize vlan.

The authorization results for the endpoints include a dACL allowing access.

The authorization results for the endpoints include the Trusted security group tag.

The switch port is configured with authentication open.

NO.86 Which two features should be used on Cisco ISE to enable the TACACS+ feature? (Choose two )

External TACACS Servers

Device Admin Service

Device Administration License

Server Sequence

Command Sets

NO.87 An administrator connects an HP printer to a dot1x enable port, but the printer in not accessible Which feature must the administrator enable to access the printer?

MAC authentication bypass

change of authorization

TACACS authentication

RADIUS authentication

https://community.cisco.com/t5/network-access-control/ise-for-printer-security/m-p/3933216

NO.88 Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.

NO.89 Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE?
(Choose two).

TCP 8443

TCP 8906

TCP 443

DTCP80

TCP 8905

NO.90 What are two benefits of TACACS+ versus RADIUS for device administration? (Choose two )

TACACS+ supports 802.1X, and RADIUS supports MAB

TACACS+ uses UDP, and RADIUS uses TCP

TACACS+ has command authorization, and RADIUS does not.

TACACS+ provides the service type, and RADIUS does not

TACACS+ encrypts the whole payload, and RADIUS encrypts only the password.

NO.91 An administrator adds a new network device to the Cisco ISE configuration to authenticate endpoints to the network. The RADIUS test fails after the administrator configures all of the settings in Cisco ISE and adds the proper configurations to the switch. What is the issue”?

The endpoint profile is showing as “unknown.”

The endpoint does not have the appropriate credentials for network access.

The shared secret is incorrect on the switch or on Cisco ISE.

The certificate on the switch is self-signed not a CA-provided certificate.

NO.92 When setting up profiling in an environment using Cisco ISE for network access control, an organization must use non-proprietary protocols for collecting the information at layer 2. Which two probes will provide this information without forwarding SPAN packets to Cisco ISE? {Choose two.)

DHCP SPAN probe

SNMP query probe

NetFlow probe

RADIUS probe

DNS probe

Explanation
https://ciscocustomer.lookbookhq.com/iseguidedjourney/ISE-profiling-design

NO.93 Which two default endpoint identity groups does Cisco ISE create? (Choose two )

block list

endpoint

profiled

allow list

unknown

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html Default Endpoint Identity Groups Created for Endpoints Cisco ISE creates the following five endpoint identity groups by default: Blacklist, GuestEndpoints, Profiled, RegisteredDevices, and Unknown. In addition, it creates two more identity groups, such as Cisco-IP-Phone and Workstation, which are associated to the Profiled (parent) identity group. A parent group is the default identity group that exists in the system.
Cisco ISE creates the following endpoint identity groups:
Blacklist-This endpoint identity group includes endpoints that are statically assigned to this group in Cisco ISE and endpoints that are block listed in the device registration portal. An authorization profile can be defined in Cisco ISE to permit, or deny network access to endpoints in this group.
GuestEndpoints-This endpoint identity group includes endpoints that are used by guest users.
Profiled-This endpoint identity group includes endpoints that match endpoint profiling policies except Cisco IP phones and workstations in Cisco ISE.
RegisteredDevices-This endpoint identity group includes endpoints, which are registered devices that are added by an employee through the devices registration portal. The profiling service continues to profile these devices normally when they are assigned to this group. Endpoints are statically assigned to this group in Cisco ISE, and the profiling service cannot reassign them to any other identity group. These devices will appear like any other endpoint in the endpoints list. You can edit, delete, and block these devices that you added through the device registration portal from the endpoints list in the Endpoints page in Cisco ISE. Devices that you have blocked in the device registration portal are assigned to the Blacklist endpoint identity group, and an authorization profile that exists in Cisco ISE redirects blocked devices to a URL, which displays “Unauthorised Network Access”, a default portal page to the blocked devices.
Unknown-This endpoint identity group includes endpoints that do not match any profile in Cisco ISE.
In addition to the above system created endpoint identity groups, Cisco ISE creates the following endpoint identity groups, which are associated to the Profiled identity group:
Cisco-IP-Phone-An identity group that contains all the profiled Cisco IP phones on your network.
Workstation-An identity group that contains all the profiled workstations on your network.

NO.94 A network engineer must enforce access control using special tags, without re-engineering the network design.
Which feature should be configured to achieve this in a scalable manner?

SGT

dACL

VLAN

RBAC

NO.95 An administrator is configuring cisco ISE lo authenticate users logging into network devices using TACACS+ The administrator is not seeing any of the authentication in the TACACS+ live logs. Which action ensures the users are able to log into the network devices?

Enable the device administration service in the Administration persona

Enable the session services in the administration persona

Enable the service sessions in the PSN persona.

Enable the device administration service in the PSN persona.

Loading …