How to pass Cisco 300-715 exam with the help of dumps?

Question # 1

An organization is adding nodes to their Cisco ISE deployment and has two nodesdesignated as primary and secondary PAN and MnT nodes. The organization also has fourPSNs An administrator is adding two more PSNs to this deployment but is having problemsadding one of them What is the problem?

A. The new nodes must be set to primary prior to being added to the deployment
B. The current PAN is only able to track a max of four nodes
C. Only five PSNs are allowed to be in the Cisco ISE cube if configured this way.
D. One of the new nodes must be designated as a pxGrid node

Show Answer

Question # 2

Which two Cisco ISE deployment models require two nodes configured with dedicated PANand MnT personas? (Choose two.)

A. three PSN nodes
B. seven PSN nodes with one PxGrid node
C. five PSN nodes with one PxGrid node
D. two PSN nodes with one PxGrid node
E. six PSN nodes

Show Answer

Question # 3

An engineer is configuring static SGT classification. Which configuration should be usedwhen authentication is disabled and third-party switches are in use?

A. VLAN to SGT mapping
B. IP Address to SGT mapping
C. L3IF to SGT mapping
D. Subnet to SGT mapping

Show Answer

Question # 4

Refer to the exhibit.Which two configurations are needed on a catalyst switch for it to be added as a networkaccess device in a Cisco ISE that is being used for 802 1X authentications? (Choose two )

A. Option A
B. Option B
C. Option C
D. Option D
E. Option E

Show Answer

Question # 5

An engineer is unable to use SSH to connect to a switch after adding the required CLIcommands to the device to enable TACACS+. The device administration license has beenadded to Cisco ISE, and the required policies have been created. Which action is neededto enable access to the switch?

A. The ip ssh source-interface command needs to be set on the switch
B. 802.1X authentication needs to be configured on the switch.
C. The RSA keypair used for SSH must be regenerated after enabling TACACS+.
D. The switch needs to be added as a network device in Cisco ISE and set to useTACACS+.

Show Answer

Question # 6

While configuring Cisco TrustSec on Cisco IOS devices the engineer must set the CTSdevice ID and password in order for the devices to authenticate with each other. Howeverafter this is complete the devices are not able to property authenticate What issue wouldcause this to happen even if the device ID and passwords are correct?

A. The device aliases are not matching
B. The 5GT mappings have not been defined
C. The devices are missing the configuration cts credentials trustsec verify 1
D. EAP-FAST is not enabled

Show Answer

Question # 7

Which compliance status is set when a matching posture policy has been defined for thatendpomt. but all the mandatory requirements during posture assessment are not met?

A. unauthorized
B. untrusted
C. non-compliant
D. unknown

Show Answer

Question # 8

An administrator is manually adding a device to a Cisco ISE identity group to ensure that itis able to access the network when needed without authentication Upon testing, theadministrator notices that the device never hits the correct authorization policy line usingthe condition EndPoints LogicalProfile EQUALS static_list Why is this occurring?

A. The dynamic logical profile is overriding the statically assigned profile
B. The device is changing identity groups after profiling instead ot remaining static
C. The logical profile is being statically assigned instead of the identity group
D. The identity group is being assigned instead of the logical profile

Show Answer

Question # 9

A network engineer needs to deploy 802.1x using Cisco ISE in a wired networkenvironment where thin clients download their system image upon bootup using PXE. Forwhich mode must the switch ports be configured?

A. closed
B. restricted
C. monitor
D. low-impact

Show Answer

Question # 10

An engineer wants to learn more about Cisco ISE and deployed a new lab with two nodes.Which two persona configurations allow the engineer to successfully test redundancy of afailed node? (Choose two.)

A. Configure one of the Cisco ISE nodes as the Health Check node.
B. Configure both nodes with the PAN and MnT personas only.
C. Configure one of the Cisco ISE nodes as the primary PAN and MnT personas and theother as the secondary.
D. Configure both nodes with the PAN, MnT, and PSN personas.
E. Configure one of the Cisco ISE nodes as the primary PAN and PSN personas and theother as the secondary.

Show Answer

Question # 11

A Cisco ISE administrator must restrict specific endpoints from accessing the network whilein closed mode. The requirement is to have Cisco ISE centrally store the endpoints torestrict access from. What must be done to accomplish this task''

A. Add each MAC address manually to a blocklist identity group and create a policydenying access
B. Create a logical profile for each device's profile policy and block that via authorizationpolicies.
C. Create a profiling policy for each endpoint with the cdpCacheDeviceld attribute.
D. Add each IP address to a policy denying access.

Show Answer

Question # 12

An engineer is configuring Cisco ISE to reprofile endpoints based only on new requests ofINIT-REBOOT and SELECTING message types. Which probe should be used toaccomplish this task?

A. MMAP
B. DNS
C. DHCP
D. RADIUS

Show Answer

Question # 13

An engineer is configuring Cisco ISE for guest services They would like to have anyunregistered guests redirected to the guest portal for authentication then have a CoAprovide them with full access to the network that is segmented via firewalls Why is thegiven configuration failing to accomplish this goal?

A. The Guest Flow condition is not in the line that gives access to the quest portal
B. The Network_Access_Authentication_Passed condition will not work with guest servicesfor portal access.
C. The Permit Access result is not set to restricted access in its policy line
D. The Guest Portal and Guest Access policy lines are in the wrong order

Show Answer

Question # 14

An administrator is attempting to join a new node to the primary Cisco ISE node, butreceives the error message "Node is Unreachable". What is causing this error?

A. The second node is a PAN node.
B. No administrative certificate is available for the second node.
C. The second node is in standalone mode.
D. No admin privileges are available on the second node.

Show Answer

Question # 15

An administrator is attempting to join a new node to the primary Cisco ISE node, butreceives the error message "Node is Unreachable". What is causing this error?

A. The second node is a PAN node.
B. No administrative certificate is available for the second node.
C. The second node is in standalone mode.
D. No admin privileges are available on the second node.

Show Answer

Question # 16

The security team identified a rogue endpoint with MAC address 00:46:91:02:28:4Aattached to the network. Which action must security engineer take within Cisco ISE toeffectivelyrestrict network access for this endpoint?

A. Configure access control list on network switches to block traffic.
B. Create authentication policy to force reauthentication.
C. Add MAC address to the endpoint quarantine list.
D. Implement authentication policy to deny access.

Show Answer

Question # 17

An engineer is working with a distributed deployment of Cisco ISE and needs to configurevarious network probes to collect a set of attributes from the endpoints on the network.Which node should be used to accomplish this task?

A. PSN
B. primary PAN
C. pxGrid
D. MnT

Show Answer

Question # 18

An engineer is working with a distributed deployment of Cisco ISE and needs to configurevarious network probes to collect a set of attributes from the endpoints on the network.Which node should be used to accomplish this task?

A. PSN
B. primary PAN
C. pxGrid
D. MnT

Show Answer

Question # 19

An engineer must configure Cisco ISE to provide internet access for guests in which guestsare required to enter a code to gain network access. Which action accomplishes the goal?

A. Configure the hotspot portal for guest access and require an access code.
B. Configure the sponsor portal with a single account and use the access code as thepassword.
C. Configure the self-registered guest portal to allow guests to create a personal accesscode.
D. Create a BYOD policy that bypasses the authentication of the user and authorizesaccess codes.

Show Answer

Question # 20

What is a valid status of an endpoint attribute during the device registration process?

A. block listed
B. pending
C. unknown
D. DenyAccess

Show Answer

Question # 21

An administrator is adding a switch to a network that is running Cisco ISE and is only for IPPhones The phones do not have the ability to authenticate via 802 1X Which command isneeded on each switch port for authentication?

A. dot1x system-auth-control
B. enable bypass-mac
C. enable network-authentication
D. mab

Show Answer

Question # 22

An administrator must block access to BYOD endpoints that were onboarded without acertificate and have been reported as stolen in the Cisco ISE My Devices Portal. Whichcondition must be used when configuring an authorization policy that sets DenyAccesspermission?

A. Endpoint Identity Group is Blocklist, and the BYOD state is Registered.
B. Endpoint Identify Group is Blocklist, and the BYOD state is Pending.
C. Endpoint Identity Group is Blocklist, and the BYOD state is Lost.
D. Endpoint Identity Group is Blocklist, and the BYOD state is Reinstate.

Show Answer

Question # 23

An adminístrator is migrating device administration access to Cisco ISE from the legacyTACACS+ solution that used only privilege 1 and 15 access levels. The organizationrequires more granular controls of the privileges and wants to customize access levels 2-5to correspond with different roles and access needs. Besides defining a new shell profile inCisco ISE. what must be done to accomplish this configuration?

A. Enable the privilege levels in Cisco ISE
B. Enable the privilege levels in the IOS devices.
C. Define the command privileges for levels 2-5 in the IOS devices
D. Define the command privileges for levels 2-5 in Cisco ISE

Show Answer

Question # 24

Refer to the exhibit. An engineer is configuring a client but cannot authenticate to Cisco ISE Duringtroubleshooting, the show authentication sessions command was issued to display theauthentication status of each port Which command gives additional information to helpidentify the problem with the authentication?

A. show authentication sessions
B. show authentication sessions Interface Gil/0/1 output
C. show authentication sessions interface Gi1/0/1 details
D. show authentication sessions output

Show Answer

Question # 25

A network administrator notices that after a company-wide shut down, many users cannotconnect their laptops to the corporate SSID. What must be done to permit access in atimely manner?

A. Authenticate the user's system to the secondary Cisco ISE node and move this user tothe primary with the renewed certificate.
B. Connect this system as a guest user and then redirect the web auth protocol to log in tothe network.
C. Add a certificate issue from the CA server, revoke the expired certificate, and add thenew certificate in system.
D. Allow authentication for expired certificates within the EAP-TLS section under theallowed protocols.

Show Answer

Question # 26

Which Cisco ISE deployment model is recommended for an enterprise that has over50,000 concurrent active endpoints?

A. large deployment with fully distributed nodes running all personas
B. medium deployment with primary and secondary PAN/MnT/pxGrid nodes with sharedPSNs
C. medium deployment with primary and secondary PAN/MnT/pxGrid nodes with dedicatedPSNs
D. small deployment with one primary and one secondary node running all personas

Show Answer

Question # 27

A network security administrator needs a web authentication configuration when a guestuser connects to the network with a wireless connection using these steps:. An initial MAB request is sent to the Cisco ISE node.. Cisco ISE responds with a URL redirection authorization profile if the user's MAC addressis unknown in the endpoint identity store.. The URL redirection presents the user with an AUP acceptance page when the userattempts to go to any URL.Which authentication must the administrator configure on Cisco ISE?

A. device registration WebAuth
B. WLC with local WebAuth
C. wired NAD with local WebAuth
D. NAD with central WebAuth

Show Answer

Question # 28

Which two actions must be verified to confirm that the internet is accessible via guestaccess when configuring a guest portal? (Choose two.)

A. The guest device successfully associates with the correct SSID.
B. The guest user gets redirected to the authentication page when opening a browser.
C. The guest device has internal network access on the WLAN.
D. The guest device can connect to network file shares.
E. Cisco ISE sends a CoA upon successful guest authentication.

Show Answer

Question # 29

What are two differences of TACACS+ compared to RADIUS? (Choose two.)

A. TACACS+ uses a connectionless transport protocol, whereas RADIUS uses aconnection-oriented transport protocol.
B. TACACS+ encrypts the full packet payload, whereas RADIUS only encrypts thepassword.
C. TACACS+ only encrypts the password, whereas RADIUS encrypts the full packetpayload.
D. TACACS+ uses a connection-oriented transport protocol, whereas RADIUS uses aconnectionless transport protocol.
E. TACACS+ supports multiple sessions per user, whereas RADIUS supports one sessionper user.

Show Answer

Question # 30

An administrator wants to configure network device administration and is trying to decidewhether to use TACACS* or RADIUS. A reliable protocol must be used that can checkcommand authorization Which protocol meets these requirements and why?

A. TACACS+ because it runs over TCP
B. RADIUS because it runs over UDP
C. RADIUS because it runs over TCP.
D. TACACS+ because it runs over UDP

Show Answer

Question # 31

Which two authentication protocols are supported by RADIUS but not by TACACS+?(Choose two.)

A. MSCHAPv1
B. PAP
C. EAP
D. CHAP
E. MSCHAPV2

Show Answer

Question # 32

Which Cisco ISE solution ensures endpoints have the latest version of antivirus updatesinstalled before being allowed access to the corporate network?

A. Threat Services
B. Profiling Services
C. Provisioning Services
D. Posture ServicesA

Show Answer

Question # 33

An administrator replaced a PSN in the distributed Cisco ISE environment. When endpointsauthenticate to it, the devices are not getting the right profiles or attributes and as a result,are not hitting the correct policies. This was working correctly on the previous PSN. Whichaction must be taken to ensure the endpoints get identified?

A. Verify that the MnT node is tracking the session.
B. Verify the shared secret used between the switch and the PSN.
C. Verify that the profiling service is running on the new PSN.
D. Verify that the authentication request the PSN is receiving is not malformed.

Show Answer

Question # 34

An engineer is creating a new authorization policy to give the endpoints access to VLAN310 upon successful authentication The administrator tests the 802.1X authentication forthe endpoint and sees that it is authenticating successfully What must be done to ensurethat the endpoint is placed into the correct VLAN?

A. Configure the switchport access vlan 310 command on the switch port
B. Ensure that the security group is not preventing the endpoint from being in VLAN 310
C. Add VLAN 310 in the common tasks of the authorization profile
D. Ensure that the endpoint is using The correct policy set

Show Answer

Question # 35

What are the minimum requirements for deploying the Automatic Failover feature onAdministration nodes in a distributed Cisco ISE deployment?

A. a primary and secondary PAN and a health check node for the Secondary PAN
B. a primary and secondary PAN and no health check nodes
C. a primary and secondary PAN and a pair of health check nodes
D. a primary and secondary PAN and a health check node for the Primary PAN

Show Answer

Question # 36

An engineer is configuring the remote access VPN to use Cisco ISE for AAA and needs toconduct posture checks on the connecting endpoints After the endpoint connects, itreceives its initial authorization result and continues onto the compliance scan What mustbe done for this AAA configuration to allow compliant access to the network?

A. Configure the posture authorization so it defaults to unknown status
B. Fix the CoA port number
C. Ensure that authorization only mode is not enabled
D. Enable dynamic authorization within the AAA server group

Show Answer

Question # 37

A Cisco device has a port configured in multi-authentication mode and is acceptingconnections only from hosts assigned the SGT of SGT_0422048549 The VLAN trunk linksupports a maximum of 8 VLANS What is the reason for these restrictions?

A. The device is performing inline tagging without acting as a SXP speaker
B. The device is performing mime tagging while acting as a SXP speaker
C. The IP subnet addresses are dynamically mapped to an SGT.
D. The IP subnet addresses are statically mapped to an SGT

Show Answer

Question # 38

What is a difference between TACACS+ and RADIUS in regards to encryption?

A. TACACS+ encrypts only the password, whereas RADIUS encrypts the username andpassword.
B. TACACS+ encrypts the username and password, whereas RADIUS encrypts only thepassword.
C. TACACS+ encrypts the password, whereas RADIUS sends the entire packet in cleartext.
D. TACACS+ encrypts the entire packet, whereas RADIUS encrypts only the password.

Show Answer

Question # 39

What is a restriction of a standalone Cisco ISE node deployment?

A. Only the Policy Service persona can be disabled on the node.
B. The domain name of the node cannot be changed after installation.
C. Personas are enabled by default and cannot be edited on the node.
D. The hostname of the node cannot be changed after installation.

Show Answer

Question # 40

An administrator is configuring sponsored guest access using Cisco ISE Access must berestricted to the sponsor portal to ensure that only necessary employees can issuesponsored accounts and employees must be classified to do so What must be done toaccomplish this task?

A. Configure an identity-based access list in Cisco ISE to restrict the users allowed to login
B. Edit the sponsor portal to only accept members from the selected groups
C. Modify the sponsor groups assigned to reflect the desired user groups
D. Create an authorization rule using the Guest Flow condition to authorize theadministrators

Show Answer

Question # 41

An engineer is starting to implement a wired 802.1X project throughout the campus. Thetask is for failed authentication to be logged to Cisco ISE and also have a minimal impacton the users. Which command must the engineer configure?

A. authentication open
B. pae dot1x enabled
C. authentication host-mode multi-auth
D. monitor-mode enabled

Show Answer

Question # 42

Which type of identity store allows for creating single-use access credentials in Cisco ISE?

A. OpenLDAP
B. Local
C. PKI
D. RSA SecurID

Show Answer

Question # 43

An administrator is configuring posture assessment in Cisco ISE for the first time. Whichtwo components must be uploaded to Cisco ISE to use Anyconnect for the agentconfiguration in a client provisioning policy? (Choose two.)

A. Anyconnect network visibility module
B. Anyconnect compliance module
C. AnyConnectProfile.xml file
D. AnyConnectProfile.xsd file
E. Anyconnect agent image

Show Answer

Question # 44

An enterprise uses a separate PSN for each of its four remote sites. Recently, a userreported receiving an "EAP-TLS authentication failed" message when moving betweenremote sites. Which configuration must be applied on Cisco ISE?

A. Use a third-party certificate on the network device.
B. Add the device to all PSN nodes in the deployment.
C. Renew the expired certificate on one of the PSN.
D. Configure an authorization profile for the end users.

Show Answer

Question # 45

An ISE administrator must change the inactivity timer for MAB endpoints to terminate theauthentication session whenever a switch port that is connected to an IP phone does notdetect packets from the device for 30 minutes. Which action must be taken to accomplishthis task?

A. Add the authentication timer reauthenticate server command to the switchport.
B. Add the authentication timer inactivity 3600 command to the switchport.
C. Change the idle-timeout on the Radius server to 3600 seconds for IP Phone endpoints.
D. Configure the session-timeout to be 3600 seconds on Cisco ISE.

Show Answer

Question # 46

An engineer needs to configure a Cisco ISE server to issue a CoA for endpoints alreadyauthenticated to access the network. The CoA option must be enforced on a session, evenif there are multiple active sessions on a port. What must be configured to accomplish thistask?

A. the Reauth CoA option in the Cisco ISE system profiling settings enabled
B. an endpoint profiling policy with the No CoA option enabled
C. an endpoint profiling policy with the Port Bounce CoA option enabled
D. the Port Bounce CoA option in the Cisco ISE system profiling settings enabled

Show Answer

Question # 47

A user is attempting to register a BYOD device to the Cisco ISE deployment, but needs touse the onboarding policy to request a digital certificate and provision the endpoint. Whatmust be configured to accomplish this task?

A. A native supplicant provisioning policy to redirect them to the BYOD portal foronboarding
B. The Cisco AnyConnect provisioning policy to provision the endpoint for onboarding
C. The BYOD flow to ensure that the endpoint will be provisioned prior to registering
D. The posture provisioning policy to give the endpoint all necessary components prior toregistering

Show Answer

Question # 48

An engineer needs to configure Cisco ISE Profiling Services to authorize network accessfor IP speakers that require access to the intercom system. This traffic needs to beidentified if the ToS bit is set to 5 and the destination IP address is the intercom system.What must be configured to accomplish this goal?

A. NMAP
B. NETFLOW
C. pxGrid
D. RADIUS

Show Answer

Question # 49

An engineer tests Cisco ISE posture services on the network and must configure the compliance module to automatically download and install on endpoints Which action accomplishes this task for VPN users?

A. Create a Cisco AnyConnect configuration and Client Provisioning policy within Cisco ISE.
B. Configure the compliance module to be downloaded from within the posture policy.
C. Push the compliance module from Cisco FTD prior to attempting posture.
D. Use a compound posture condition to check for the compliance module and download if needed.

Show Answer