Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CCNP Security
300-715
Implementing and Configuring Cisco Identity Services Engine (SISE) v1.1 (300-715 SISE) Questions and Answers

Pass the Cisco CCNP Security 300-715 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 300-715 Premium Access

View all detail and faqs for the 300-715 exam

Go to Exam

818 Students Passed

96% Average Score

93% Same Questions

Viewing page 3 out of 10 pages

Viewing questions 21-30 out of questions

Questions # 21:

What is an advantage of using EAP-TLS over EAP-MS-CHAPv2 for client authentication?

Options:

EAP-TLS uses a username and password for authentication to enhance security, while EAP-MS-CHAPv2 does not.

EAP-TLS secures the exchange of credentials, while EAP-MS-CHAPv2 does not.

EAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not.

EAP-TLS uses multiple forms of authentication, while EAP-MS-CHAPv2 only uses one.

Answer

Questions # 22:

A Cisco ISE administrator needs to ensure that guest endpoint registrations are only valid for 1 day. When testing the guest policy flow, the administrator sees that the Cisco ISE does not delete the endpoint in the Guest Endpoints identity store after one day and allows access to the guest network after that period. Which configuration is causing this problem?

Options:

The RADIUS policy set for guest access is set to allow repeated authentication of the same device.

The length of access is set to 7 days in the Guest Portal Settings.

The Endpoint Purge Policy is set to 30 days for guest devices.

The Guest Account Purge Policy is set to 15 days.

Answer

Questions # 23:

An engineer is configuring posture assessment for their network access control and needs to use an agent that supports using service conditions as conditions for the assessment. The agent should be run as a background process to avoid user interruption but when it is run. the user can see it. What is the problem?

Options:

The engineer is using the "Anyconnect” posture agent but should be using the "Stealth Anyconnect posture agent

The posture module was deployed using the headend instead of installing it with SCCM

The user was in need of remediation so the agent appeared m the notifications

The proper permissions were no! given to the temporal agent to conduct the assessment

Answer

Questions # 24:

Which permission is common to the Active Directory Join and Leave operations?

Options:

Create a Cisco ISE machine account in the domain if the machine account does not already exist

Remove the Cisco ISE machine account from the domain.

Set attributes on the Cisco ISE machine account

Search Active Directory to see if a Cisco ISE machine account already ex.sts.

Answer

Explanation

https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/ise_active_directory_integration/b_ISE_AD_integration_2x.html

Questions # 25:

An engineer is designing a new distributed deployment for Cisco ISE in the network and is considering failover options for the admin nodes. There is a need to ensure that an admin node is available for configuration of policies at all times. What is the requirement to enable this feature?

Options:

one primary admin and one secondary admin node in the deployment

one policy services node and one secondary admin node

one policy services node and one monitoring and troubleshooting node

one primary admin node and one monitoring and troubleshooting node

Answer

Questions # 26:

What does the dot1x system-auth-control command do?

Options:

causes a network access switch not to track 802.1x sessions

globally enables 802.1x

enables 802.1x on a network access device interface

causes a network access switch to track 802.1x sessions

Answer

Explanation

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-8-0E/15-24E/configuration/guide/xe-38 0-configuration/dot1x.html

Questions # 27:

Which platform does a Windows-based device download the Network Assistant Manager from?

Options:

Microsoft app store

Cisco Catalyst Switch

native OS

Cisco ISE

Answer

Questions # 28:

An engineer needs to configure a Cisco ISE server to issue a CoA for endpoints already authenticated to access the network. The CoA option must be enforced on a session, even if there are multiple active sessions on a port. What must be configured to accomplish this task?

Options:

the Reauth CoA option in the Cisco ISE system profiling settings enabled

an endpoint profiling policy with the No CoA option enabled

an endpoint profiling policy with the Port Bounce CoA option enabled

the Port Bounce CoA option in the Cisco ISE system profiling settings enabled

Answer

Questions # 29:

An engineer is enabling a newly configured wireless SSID for tablets and needs visibility into which other types of devices are connecting to it. What must be done on the Cisco WLC to provide this information to Cisco ISE9

Options:

enable IP Device Tracking

enable MAC filtering

enable Fast Transition

enable mDNS snooping

Answer

Explanation

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

IP Device Tracking (IPDT) is a feature that allows the Cisco WLC to track the IP addresses of devices that are connected to the wireless network. This information can then be provided to Cisco ISE, which can use it to identify the types of devices that are connecting to the network.

Questions # 30:

An administrator must deploy the Cisco Secure Client posture agent to employee endpoints that access a wireless network by using URL redirection in Cisco ISE. The compliance module must be downloaded from Cisco and uploaded to the Cisco ISE client provisioning resource. What must be used to upload the compliance module?