Cisco 300-715 Exam Questions Free Practice Test

Viewing page 1 out of 8 pages

Viewing questions 1-10 out of questions

Questions # 1:

What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?

Options:

Cisco-av-pair

Class attribute

Event

State attribute

Expert Solution

Questions # 2:

In a Cisco ISE split deployment model, which load is split between the nodes?

Options:

AAA

network admission

log collection

device admission

Expert Solution

Questions # 3:

Which two default endpoint identity groups does Cisco ISE create? (Choose two )

Options:

block list

endpoint

profiled

allow list

unknown

Expert Solution

Answer

C, E

Explanation

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html

Default Endpoint Identity Groups Created for EndpointsCisco ISE creates the following five endpoint identity groups by default: Blacklist, GuestEndpoints, Profiled, RegisteredDevices, and Unknown. In addition, it creates two more identity groups, such as Cisco-IP-Phone and Workstation, which are associated to the Profiled (parent) identity group. A parent group is the default identity group that exists in the system.

Cisco ISE creates the following endpoint identity groups:

Blacklist—This endpoint identity group includes endpoints that are statically assigned to this group in Cisco ISE and endpoints that are block listed in the device registration portal. An authorization profile can be defined in Cisco ISE to permit, or deny network access to endpoints in this group.

GuestEndpoints—This endpoint identity group includes endpoints that are used by guest users.

Profiled—This endpoint identity group includes endpoints that match endpoint profiling policies except Cisco IP phones and workstations in Cisco ISE.

RegisteredDevices—This endpoint identity group includes endpoints, which are registered devices that are added by an employee through the devices registration portal. The profiling service continues to profile these devices normally when they are assigned to this group. Endpoints are statically assigned to this group in Cisco ISE, and the profiling service cannot reassign them to any other identity group. These devices will appear like any other endpoint in the endpoints list. You can edit, delete, and block these devices that you added through the device registration portal from the endpoints list in the Endpoints page in Cisco ISE. Devices that you have blocked in the device registration portal are assigned to the Blacklist endpoint identity group, and an authorization profile that exists in Cisco ISE redirects blocked devices to a URL, which displays “Unauthorised Network Access”, a default portal page to the blocked devices.

Unknown—This endpoint identity group includes endpoints that do not match any profile in Cisco ISE.

In addition to the above system created endpoint identity groups, Cisco ISE creates the following endpoint identity groups, which are associated to the Profiled identity group:

Cisco-IP-Phone—An identity group that contains all the profiled Cisco IP phones on your network.

Workstation—An identity group that contains all the profiled workstations on your network.

Questions # 4:

An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened. From which Cisco ISE persona should this traffic be originating?

Options:

monitoring

policy service

administration

authentication

Expert Solution

Questions # 5:

In which two ways can users and endpoints be classified for TrustSec?

(Choose Two.)

Options:

VLAN

SXP

dynamic

QoS

SGACL

Expert Solution

Questions # 6:

Refer to the exhibit. An engineer is creating a new TACACS* command set and cannot use any show commands after togging into the device with this command set authorization Which configuration is causing this issue?

Options:

Question marks are not allowed as wildcards for command sets.

The command set is allowing all commands that are not in the command list

The wildcard command listed is in the wrong format

The command set is working like an ACL and denying every command.

Expert Solution

Questions # 7:

Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?

Options:

session timeout

idle timeout

radius-server timeout

termination-action

Expert Solution

Questions # 8:

What is the maximum number of PSN nodes supported in a medium-sized deployment?

Options:

three

five

two

eight

Expert Solution

Questions # 9:

Question # 9

Refer to the exhibit Which component must be configured to apply the SGACL?

Options:

egress router

host

secure server

ingress router

Expert Solution

Questions # 10:

When configuring an authorization policy, an administrator cannot see specific Active Directory groups present in their domain to be used as a policy condition. However, other groups that are in the same domain are seen What is causing this issue?

Options:

Cisco ISE only sees the built-in groups, not user created ones

The groups are present but need to be manually typed as conditions

Cisco ISE's connection to the AD join point is failing

The groups are not added to Cisco ISE under the AD join point

Expert Solution

Viewing page 1 out of 8 pages

Viewing questions 1-10 out of questions

Pass the Cisco CCNP Security 300-715 Questions and answers with CertsForce