Free Access To Latest CCNP Security 300-715 SISE Dumps

test2022-04-08T03:59:16+00:00

Do you want to be able to pass the Cisco 300-715 SISE test with flying colors? The Implementing and Configuring Cisco Identity Services Engine v1.0 (SISE 300-715) exam is a 90-minute exam associated with the CCNP Security, and Cisco Certified Specialist – Security Identity Management Implementation certifications. FreeTestShare 300-715 SISE dumps cover real exam questions and answers to help you prepare for the 300-715 exam well. With real 300-715 SISE dumps, you can learn about the exam topics and pattern fast to better adapt to the exam environment and pass your exam easily.

Try 300-715 sample questions below! You will face them on the actual exam!

Page 1 of 5

1. What is a characteristic of the UDP protocol?

UDP can detect when a server is down.

UDP offers best-effort delivery

UDP can detect when a server is slow

UDP offers information about a non-existent server

2. An administrator is configuring new probes to use with Cisco ISE and wants to use metadata to help profile the endpoints. The metadata must contain traffic information relating to the endpoints instead of industry-standard protocol information.

Which probe should be enabled to meet these requirements?

NetFlow probe

DNS probe

DHCP probe

SNMP query probe

3. Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?

session timeout

idle timeout

radius-server timeout

termination-action

4. What is needed to configure wireless guest access on the network?

endpoint already profiled in ISE

WEBAUTH ACL for redirection

valid user account in Active Directory

Captive Portal Bypass turned on

5. When setting up profiling in an environment using Cisco ISE for network access control, an organization must use non-proprietary protocols for collecting the information at layer 2 .

Which two probes will provide this information without forwarding SPAN packets to Cisco ISE? {Choose two.)

DHCP SPAN probe

SNMP query probe

NetFlow probe

RADIUS probe

DNS probe

6. What should be considered when configuring certificates for BYOD?

An endpoint certificate is mandatory for the Cisco ISE BYOD

An Android endpoint uses EST whereas other operation systems use SCEP for enrollment

The CN field is populated with the endpoint host name.

The SAN field is populated with the end user name

7. Which portal is used to customize the settings for a user to log in and download the compliance module?

Client Profiling

Client Endpoint

Client Provisioning

Client Guest

8. Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

endpoint marked as lost in My Devices Portal

addition of endpoint to My Devices Portal

endpoint profile transition from Apple-Device to Apple-iPhone

endpoint profile transition from Unknown to Windows 10-Workstation

updating of endpoint dAC

9. An engineer is configuring ISE for network device administration and has devices that support both protocols .

What are two benefits of choosing TACACS+ over RADUs for these devices? (Choose two.)

TACACS+ is FIPS compliant while RADIUS is not

TACACS+ is designed for network access control while RADIUS is designed for role-based access.

TACACS+ uses secure EAP-TLS while RADIUS does not.

TACACS+ provides the ability to authorize specific commands while RADIUS does not

TACACS+ encrypts the entire payload being sent while RADIUS only encrypts the password.

10. What gives Cisco ISE an option to scan endpoints for vulnerabilities?

authorization policy

authentication policy

authentication profile

authorization profile

Page 2 of 5

11. Refer to the exhibit.

Which component must be configured to apply the SGACL?

egress router

host

secure server

ingress router

12. Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles? (Choose two)

Firepower

WLC

IOS

ASA

Shell

13. A Cisco ISE administrator needs to ensure that guest endpoint registrations are only valid for 1 day. When testing the guest policy flow, the administrator sees that the Cisco ISE does not delete the endpoint in the Guest Endpoints identity store after one day and allows access to the guest network after that period .

Which configuration is causing this problem?

The RADIUS policy set for guest access is set to allow repeated authentication of the same device.

The length of access is set to 7 days in the Guest Portal Settings.

The Endpoint Purge Policy is set to 30 days for guest devices.

The Guest Account Purge Policy is set to 15 days.

14. A network administrator must configure Cisco SE Personas in the company to share session information via syslog .

Which Cisco ISE personas must be added to syslog receivers to accomplish this goal?

pxGrid

admin

policy services

monitor

15. A network administrator is configuring a secondary cisco ISE node from the backup configuration of the primary cisco ISE node to create a high availability pair The Cisco ISE

CA certificates and keys must be manually backed up from the primary Cisco ISE and copied into the secondary Cisco ISE.

Which command most be issued for this to work?

copy certificate Ise

application configure Ise

certificate configure Ise

Import certificate Ise

16. Which two actions occur when a Cisco ISE server device administrator logs in to a device? (Choose two)

The device queries the internal identity store

The Cisco ISE server queries the internal identity store

The device queries the external identity store

The Cisco ISE server queries the external identity store.

The device queries the Cisco ISE authorization server

17. A network administrator must configura endpoints using an 802 1X authentication method with EAP identity certificates that are provided by the Cisco ISE When the endpoint presents the identity certificate to Cisco ISE to validate the certificate, endpoints must be authorized to connect to the network.

Which EAP type must be configured by the network administrator to complete this task?

EAP-PEAP-MSCHAPv2

EAP-TTLS

EAP-FAST

EAP-TLS

18. DRAG DROP

Drag and drop the description from the left onto the protocol on the right that is used to carry out system authentication, authentication, and accounting.

19. A network administrator must use Cisco ISE to check whether endpoints have the correct version of antivirus installed.

Which action must be taken to allow this capability?

Configure a native supplicant profile to be used for checking the antivirus version

Configure Cisco ISE to push the HostScan package to the endpoints to check for the antivirus version.

Create a Cisco AnyConnect Network Visibility Module configuration profile to send the antivirus information of the endpoints to Cisco IS

Create a Cisco AnyConnect configuration within Cisco ISE for the Compliance Module and associated configuration files

20. An engineer is configuring 802.1X and is testing out their policy sets. After authentication, some endpoints are given an access-reject message but are still allowed onto the network .

What is causing this issue to occur?

The switch port is configured with authentication event server dead action authorize vlan.

The authorization results for the endpoints include a dACL allowing access.

The authorization results for the endpoints include the Trusted security group tag.

The switch port is configured with authentication open.

Page 3 of 5

21. How is policy services node redundancy achieved in a deployment?

by enabling VIP

by utilizing RADIUS server list on the NAD

by creating a node group

by deploying both primary and secondary node

22. Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?

Endpoint

unknown

blacklist

white list

profiled

23. What does a fully distributed Cisco ISE deployment include?

PAN and PSN on the same node while MnTs are on their own dedicated nodes.

PAN and MnT on the same node while PSNs are on their own dedicated nodes.

All Cisco ISE personas on their own dedicated nodes.

All Cisco ISE personas are sharing the same node.

24. What are two differences between the RADIUS and TACACS+ protocols'? (Choose two.)

RADIUS is a Cisco proprietary protocol, whereas TACACS+ is an open standard protocol

TACACS+uses TCP port 49. whereas RADIUS uses UDP ports 1812 and 1813.

RADIUS offers multiprotocol support, whereas TACACS+ does not

RADIUS combines authentication and authorization, whereas TACACS+ does not

RADIUS enables encryption of all the packets, whereas with TACACS+. only the password is encrypted.

25. A customer wants to set up the Sponsor portal and delegate the authentication flow to a third party for added security while using Kerberos.

Which database should be used to accomplish this goal?

RSA Token Server

Active Directory

Local Database

LDAP

26. Which two components are required for creating a Native Supplicant Profile within a BYOD flow? (Choose two)

Windows Settings

Connection Type

iOS Settings

Redirect ACL

Operating System

27. What are two components of the posture requirement when configuring Cisco ISE posture? (Choose two)

updates

remediation actions

Client Provisioning portal

conditions

access policy

28. An organization is adding new profiling probes to the system to improve profiling on Oseo ISE. The probes must support a common network management protocol to receive information about the endpoints and the ports to which they are connected

What must be configured on the network device to accomplish this goal?

ARP

SNMP

WCCP

ICMP

29. A network engineer is configuring Cisco TrustSec and needs to ensure that the Security Group Tag is being transmitted between two devices

Where in the Layer 2 frame should this be verified?

CMD filed

802.1Q filed

Payload

802.1 AE header

30. An engineer deploys Cisco ISE and must configure Active Directory to then use information from Active Directory in an authorization policy .

Which two components must be configured, in addition to Active Directory groups, to achieve this goat? (Choose two)

Active Directory External Identity Sources

Library Condition for External Identity. External Groups

Identity Source Sequences

LDAP External Identity Sources E Library Condition for Identity Group: User Identity Group

Page 4 of 5

31. An administrator is configuring RADIUS on a Cisco switch with a key set to Cisc403012128 but is receiving the error “Authentication failed: 22040 Wrong password or invalid shared secret. “what must be done to address this issue?

Add the network device as a NAD inside Cisco ISE using the existing key.

Configure the key on the Cisco ISE instead of the Cisco switch.

Use a key that is between eight and ten characters.

Validate that the key is correct on both the Cisco switch as well as Cisco IS

32. Refer to the exhibit.

An organization recently implemented network device administration using Cisco ISE. Upon testing the ability to access all of the required devices, a user in the Cisco ISE group IT Admins is attempting to login to a device in their organization's finance department but is unable to .

What is the problem?

The IT training rule is taking precedence over the IT Admins rule.

The authorization conditions wrongly allow IT Admins group no access to finance devices.

The finance location is not a condition in the policy set.

The authorization policy doesn't correctly grant them access to the finance devices.

33. An administrator for a small network is configuring Cisco ISE to provide dynamic network access to users. Management needs Cisco ISE to not automatically trigger a CoA whenever a profile change is detected. Instead, the administrator needs to verify the new profile and manually trigger a CoA .

What must be configuring in the profiler to accomplish this goal?

Port Bounce

No CoA

Session Query

Reauth

34. What is the purpose of the ip http server command on a switch?

It enables the https server for users for web authentication

It enables MAB authentication on the switch

It enables the switch to redirect users for web authentication.

It enables dot1x authentication on the switch.

35. What is a method for transporting security group tags throughout the network?

by enabling 802.1AE on every network device

by the Security Group Tag Exchange Protocol

by embedding the security group tag in the IP header

by embedding the security group tag in the 802.1Q header

36. A network administrator changed a Cisco ISE deployment from pilot to production and

noticed that the JVM memory utilization increased significantly. The administrator suspects this is due to replication between the nodes

What must be configured to minimize performance degradation?

Review the profiling policies for any misconfiguration

Enable the endpoint attribute filter

Change the reauthenticate interval.

Ensure that Cisco ISE is updated with the latest profiler feed update

37. An administrator needs to allow guest devices to connect to a private network without requiring usernames and passwords .

Which two features must be configured to allow for this? (Choose two.)

hotspot guest portal

device registration WebAuth

central WebAuth

local WebAuth

self-registered guest portal

38. What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?

The primary node restarts

The secondary node restarts.

The primary node becomes standalone

Both nodes restart.

39. An engineer is configuring a virtual Cisco ISE deployment and needs each persona to be on a different node .

Which persona should be configured with the largest amount of storage in this environment?

policy Services

Primary Administration

Monitoring and Troubleshooting

Platform Exchange Grid

40. What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?

Network Access Control

My Devices Portal

Application Visibility and Control

Supplicant Provisioning Wizard

Page 5 of 5

41. Refer to the exhibit:

Which command is typed within the CU of a switch to view the troubleshooting output?

show authentication sessions mac 000e.84af.59af details

show authentication registrations

show authentication interface gigabitethemet2/0/36

show authentication sessions method

42. An administrator is troubleshooting an endpoint that is supposed to bypass 802 1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB. however the endpoint cannot communicate because it cannot obtain an IP address.

What is the problem?

The DHCP probe for Cisco ISE is not working as expected.

The 802.1 X timeout period is too long.

The endpoint is using the wrong protocol to authenticate with Cisco IS

An AC I on the port is blocking HTTP traffic

43. What is the maximum number of PSN nodes supported in a medium-sized deployment?

three

five

two

eight

44. A new employee just connected their workstation to a Cisco IP phone. The network administrator wants to ensure that the Cisco IP phone remains online when the user disconnects their Workstation from the corporate network.

Which CoA configuration meets this requirement?

Port Bounce

Reauth

NoCoA

Disconnect

45. What must be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

pass

reject

drop

continue

46. Which permission is common to the Active Directory Join and Leave operations?

Create a Cisco ISE machine account in the domain if the machine account does not already exist

Remove the Cisco ISE machine account from the domain.

Set attributes on the Cisco ISE machine account

Search Active Directory to see if a Cisco ISE machine account already ex.sts.

47. An administrator is configuring posture with Cisco ISE and wants to check that specific services are present on the workstations that are attempting to access the network .

What must be configured to accomplish this goal?

Create a registry posture condition using a non-OPSWAT API version.

Create an application posture condition using a OPSWAT API version.

Create a compound posture condition using a OPSWAT API version.

Create a service posture condition using a non-OPSWAT API version.

48. Which personas can a Cisco ISE node assume'?

policy service, gatekeeping, and monitoring

administration, policy service, and monitoring

administration, policy service, gatekeeping

administration, monitoring, and gatekeeping