Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CCNP Security
300-715
Implementing and Configuring Cisco Identity Services Engine (SISE) v1.1 (300-715 SISE) Questions and Answers

Pass the Cisco CCNP Security 300-715 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 300-715 Premium Access

View all detail and faqs for the 300-715 exam

Go to Exam

818 Students Passed

96% Average Score

93% Same Questions

Viewing page 2 out of 10 pages

Viewing questions 11-20 out of questions

Questions # 11:

A network administrator must configura endpoints using an 802 1X authentication method with EAP identity certificates that are provided by the Cisco ISE When the endpoint presents the identity certificate to Cisco ISE to validate the certificate, endpoints must be authorized to connect to the network Which EAP type must be configured by the network administrator to complete this task?

Options:

EAP-PEAP-MSCHAPv2

EAP-TTLS

EAP-FAST

EAP-TLS

Answer

Explanation

https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/certificate-requirements-eap-tls-peap

about EAP FAST

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/eap-fast/200322-Understanding-EAP-FAST-and-Chaining-imp.html

Questions # 12:

An engineer is configuring Cisco ISE and needs to dynamically identify the network endpoints and ensure that endpoint access is protected. Which service should be used to accomplish this task?

Profiling

Options:

Guest access

Client provisioning

Posture

Answer

Questions # 13:

What is the maximum number of PSN nodes supported in a medium-sized deployment?

Options:

three

five

two

eight

Answer

Questions # 14:

A network administrator must use Cisco ISE to check whether endpoints have the correct version of antivirus installed Which action must be taken to allow this capability?

Options:

Configure a native supplicant profile to be used for checking the antivirus version

Configure Cisco ISE to push the HostScan package to the endpoints to check for the antivirus version.

Create a Cisco AnyConnect Network Visibility Module configuration profile to send the antivirus information of the endpoints to Cisco ISE.

Create a Cisco AnyConnect configuration within Cisco ISE for the Compliance Module and associated configuration files

Answer

Explanation

https://www.cisco.com/c/en/us/td/docs/security/ise/1 -2/user_guide/ise_client_prov.html

About Anyconnect Network Visibility Module

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect45/administration/guide/b_AnyConnect_Administrator_Guide_4-5/nvm.html

Questions # 15:

Which two external identity stores support EAP-TLS and PEAP-TLS? (Choose two.)

Options:

Active Directory

RADIUS Token

Internal Database

RSA SecurlD

LDAP

Answer

A, E

Questions # 16:

Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles?

(Choose two.)

Options:

Firepower

WLC

IOS

ASA

Shell

Answer

B, E

Explanation

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_0100010.html

TACACS+ Profile

TACACS+ profiles control the initial login session of the device administrator. A session refers to each individual authentication, authorization, or accounting request. A session authorization request to a network device elicits an ISE response. The response includes a token that is interpreted by the network device, which limits the commands that may be executed for the duration of a session. The authorization policy for a device administration access service can contain a single shell profile and multiple command sets. The TACACS+ profile definitions are split into two components:

Common tasks

Custom attributes

There are two views in the TACACS+ Profiles page (Work Centers > Device Administration > Policy Elements > Results > TACACS Profiles)—Task Attribute View and Raw View. Common tasks can be entered using the Task Attribute View and custom attributes can be created in the Task Attribute View as well as the Raw View.

The Common Tasks section allows you to select and configure the frequently used attributes for a profile. The attributes that are included here are those defined by the TACACS+ protocol draft specifications. However, the values can be used in the authorization of requests from other services. In the Task Attribute View, the ISE administrator can set the privileges that will be assigned to the device administrator. The common task types are:

Shell

WLC

Nexus

Generic

The Custom Attributes section allows you to configure additional attributes. It provides a list of attributes that are not recognized by the Common Tasks section. Each definition consists of the attribute name, an indication of whether the attribute is mandatory or optional, and the value for the attribute. In the Raw View, you can enter the mandatory attributes using a equal to (=) sign between the attribute name and its value and optional attributes are entered using an asterisk (*) between the attribute name and its value. The attributes entered in the Raw View are reflected in the Custom Attributes section in the Task Attribute View and vice versa. The Raw View is also used to copy paste the attribute list (for example, another product's attribute list) from the clipboard onto ISE. Custom attributes can be defined for nonshell services.

Questions # 17:

What is a difference between RADIUS and TACACS+?

Options:

RADIUS uses connection-oriented transport, and TACACS+ uses best-effort delivery.

RADIUS offers multiprotocol support, and TACACS+ supports only IP traffic.

RADIUS combines authentication and authorization functions, and TACACS+ separates them.

RADIUS supports command accounting, and TACACS+ does not.

Answer

Questions # 18:

Which nodes are supported in a distributed Cisco ISE deployment?

Options:

Policy Service nodes for session failover

Monitoring nodes for PxGrid services

Administration nodes for session failover

Policy Service nodes for automatic failover

Answer

B, D

Questions # 19:

Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

Options:

TCP 8909

TCP 8905

UDP 1812

TCP 443

Answer

Questions # 20:

What are two requirements of generating a single signing in Cisco ISE by using a certificate provisioning portal, without generating a certificate request? (Choose two )