Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CCNP Security
300-715
Implementing and Configuring Cisco Identity Services Engine (SISE) v1.1 (300-715 SISE) Questions and Answers

Pass the Cisco CCNP Security 300-715 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 300-715 Premium Access

View all detail and faqs for the 300-715 exam

Go to Exam

818 Students Passed

96% Average Score

93% Same Questions

Viewing page 9 out of 10 pages

Viewing questions 81-90 out of questions

Questions # 81:

What is a difference between RADIUS versus TACACS+ with regards to packet encryption?

Options:

TACACS+ encrypts the entire body of the packet, and RADIUS encrypts the username and password in the access-request packet.

RADIUS encrypts the entire body of the packet, and TACACS+ encrypts the username and password in the access-request packet.

RADIUS encrypts the entire body of the packet, and TACACS+ encrypts only the password in the access-request packet.

TACACS+ encrypts the entire body of the packet, and RADIUS encrypts only the password in the access-request packet.

Answer

Questions # 82:

Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?

Options:

DHCP server

static IP tunneling

override Interface ACL

AAA override

Answer

Questions # 83:

Which personas can a Cisco ISE node assume'?

Options:

policy service, gatekeeping, and monitoring

administration, policy service, and monitoring

administration, policy service, gatekeeping

administration, monitoring, and gatekeeping

Answer

Explanation

https://www.cisco.com/en/US/docs/ security/ise/1.0/user_guide/ise10_dis_deploy.html

The persona or personas of a node determine the services provided by a node. An ISE node can assume any or all of the following personas: Administration, Policy Service, and Monitoring. The menu options that are available through the administrative user interface are dependent on the role and personas that an ISE node assumes. See Cisco ISE Nodes and Available Menu Options for more information.

Questions # 84:

Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose two.)

Options:

hotspot

new AD user 802 1X authentication

posture

BYOD

guest AUP

Answer

B, C

Questions # 85:

An engineer must use Cisco ISE to provide network access to endpoints that cannot support 802.1X. The endpoint MAC addresses must be allowlisted by configuring an endpoint identity group. These configurations were performed:

• configured an identity group named allowlist

• configured the endpoints to use the MAC address of incompatible 802.1X devices

• added the endpoints to the allowlist identity group

• configured an authentication policy for MAB users

What must be configured?

Options:

authorization profile that has the PermitAccess permission and matches the allowlist identity group

logical profile that matches the allowlist identity group based on the configured policy

authentication profile that has the PermitAccess permission and matches the allowlist identity group authorization policy that has the PermitAccess permission and matches the allowlist identity group

authorization policy that has the PermitAccess permission and matches the allowtist identity group

Answer

Questions # 86:

Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

Options:

endpoint marked as lost in My Devices Portal

addition of endpoint to My Devices Portal

endpoint profile transition from Apple-Device to Apple-iPhone

endpoint profile transition from Unknown to Windows 10-Workstation

updating of endpoint dACL.

Answer

C, D

Questions # 87:

An engineer is unable to use SSH to connect to a switch after adding the required CLI commands to the device to enable TACACS+. The device administration license has been added to Cisco ISE, and the required policies have been created. Which action is needed to enable access to the switch?

Options:

The ip ssh source-interface command needs to be set on the switch

802.1X authentication needs to be configured on the switch.

The RSA keypair used for SSH must be regenerated after enabling TACACS+.

The switch needs to be added as a network device in Cisco ISE and set to use TACACS+.

Answer

Questions # 88:

If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

Options:

Client Provisioning

Guest

BYOD

Blacklist

Answer

Explanation

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_ Access/BYOD_Design_Guide/Managing_Lost_or_Stolen_Device.html#90273

The Blacklist identity group is system generated and maintained by ISE to prevent access to lost or stolen devices. In this design guide, two authorization profiles are used to enforce the permissions for wireless and wired devices within the Blacklist:

Blackhole WiFi Access

Blackhole Wired Access

Questions # 89:

An administrator is responsible for configuring network access for a temporary network printer. The administrator must only use the printer MAC address 50:89:65: 18:8: AB for authentication. Which authentication method will accomplish the task?

Options:

Posturing

Profiling

MAB

802.1x

Answer

Questions # 90:

When creating a policy within Cisco ISE for network access control, the administrator wants to allow different access restrictions based upon the wireless SSID to which the device is connecting. Which policy condition must be used in order to accomplish this?