Pass the Cisco CCNP Security 300-715 Questions and answers with CertsForce

Viewing page 3 out of 8 pages
Viewing questions 21-30 out of questions
Questions # 21:

Which two actions occur when a Cisco ISE server device administrator logs in to a device? (Choose two)

Options:

A.

The device queries the internal identity store


B.

The Cisco ISE server queries the internal identity store


C.

The device queries the external identity store


D.

The Cisco ISE server queries the external identity store.


E.

The device queries the Cisco ISE authorization server


Expert Solution
Questions # 22:

Which Cisco ISE solution ensures endpoints have the latest version of antivirus updates installed before being allowed access to the corporate network?

Options:

A.

Threat Services


B.

Profiling Services


C.

Provisioning Services


D.

Posture Services


Expert Solution
Questions # 23:

Which two features should be used on Cisco ISE to enable the TACACS+ feature? (Choose two )

Options:

A.

External TACACS Servers


B.

Device Admin Service


C.

Device Administration License


D.

Server Sequence


E.

Command Sets


Expert Solution
Questions # 24:

An engineer needs to export a file in CSV format, encrypted with the password C1$c0438563935, and contains users currently configured in Cisco ISE. Drag and drop the steps from the left into the sequence on the right to complete this task.

Question # 24


Expert Solution
Questions # 25:

Which portal is used to customize the settings for a user to log in and download the compliance module?

Options:

A.

Client Profiling


B.

Client Endpoint


C.

Client Provisioning


D.

Client Guest


Expert Solution
Questions # 26:

When creating a policy within Cisco ISE for network access control, the administrator wants to allow different access restrictions based upon the wireless SSID to which the device is connecting. Which policy condition must be used in order to accomplish this?

Options:

A.

Network Access NetworkDeviceName CONTAINS


B.

DEVICE Device Type CONTAINS


C.

Radius Called-Station-ID CONTAINS


D.

Airespace Airespace-Wlan-ld CONTAINS


Expert Solution
Questions # 27:

A Cisco ISE administrator must restrict specific endpoints from accessing the network while in closed mode. The requirement is to have Cisco ISE centrally store the endpoints to restrict access from. What must be done to accomplish this task''

Options:

A.

Add each MAC address manually to a blocklist identity group and create a policy denying access


B.

Create a logical profile for each device's profile policy and block that via authorization policies.


C.

Create a profiling policy for each endpoint with the cdpCacheDeviceld attribute.


D.

Add each IP address to a policy denying access.


Expert Solution
Questions # 28:

An administrator is manually adding a device to a Cisco ISE identity group to ensure that it is able to access the network when needed without authentication Upon testing, the administrator notices that the device never hits the correct authorization policy line using the condition EndPoints LogicalProfile EQUALS static_list Why is this occurring?

Options:

A.

The dynamic logical profile is overriding the statically assigned profile


B.

The device is changing identity groups after profiling instead ot remaining static


C.

The logical profile is being statically assigned instead of the identity group


D.

The identity group is being assigned instead of the logical profile


Expert Solution
Questions # 29:

What are two differences between the RADIUS and TACACS+ protocols'? (Choose two.)

Options:

A.

RADIUS is a Cisco proprietary protocol, whereas TACACS+ is an open standard protocol


B.

TACACS+uses TCP port 49. whereas RADIUS uses UDP ports 1812 and 1813.


C.

RADIUS offers multiprotocol support, whereas TACACS+ does not


D.

RADIUS combines authentication and authorization, whereas TACACS+ does not


E.

RADIUS enables encryption of all the packets, whereas with TACACS+. only the password is encrypted.


Expert Solution
Questions # 30:

When setting up profiling in an environment using Cisco ISE for network access control, an organization must use non-proprietary protocols for collecting the information at layer 2. Which two probes will provide this information without forwarding SPAN packets to Cisco ISE? {Choose two.)

Options:

A.

DHCP SPAN probe


B.

SNMP query probe


C.

NetFlow probe


D.

RADIUS probe


E.

DNS probe


Expert Solution
Viewing page 3 out of 8 pages
Viewing questions 21-30 out of questions