Cisco 300-715 Exam Dumps

Implementing and Configuring Cisco Identity Services Engine (SISE) v4.0 (300-715 SISE)

Cisco 300-715 Sample Questions

Question # 1

An administrator plans to use Cisco ISE to deploy posture policies to assess Microsoft Windows endpoints that run Cisco Secure Client. The administrator wants to minimize the occurrence of messages related to unknown posture profiles if Cisco ISE fails to determine the posture of the endpoint. Secure Client is deployed to all the endpoints. and all the required Cisco ISE authentication, authorization, and posture policy configurations were performed. Which action must be taken next to complete the configuration?

A. Install the latest version of the Secure Client client on the endpoints.
B. Enable Cisco ISE posture on Secure Client configuration. 
C. Configure a native supplicant on the endpoints to support the posture policies. 
D. Install the compliance module on the endpoints.

Show Answer

Question # 2

An engineer is configuring a new Cisco ISE node. The Cisco ISE must make authorization decisions based on the threat and vulnerability attributes received from the threat and vulnerability adapters. Which persona must be enabled? 

A. Policy Service
B. Monitoring
C. pxGrid
D. Administration

Show Answer

Question # 3

A network engineer is in the predeployment discovery phase of a Cisco ISE deployment and must discover the network. There is an existing network management system in the network. Which type of probe must be configured to gather the information?

A. RADIUS
B. NMAP
C. NetFlow 
D. SNMP 

Show Answer

Question # 4

An engineer needs to configure a Cisco ISE server to issue a CoA for endpoints already authenticated to access the network. The CoA option must be enforced on a session, even if there are multiple active sessions on a port. What must be configured to accomplish this task?

A. the Reauth CoA option in the Cisco ISE system profiling settings enabled
B. an endpoint profiling policy with the No CoA option enabled
C. an endpoint profiling policy with the Port Bounce CoA option enabled
D. the Port Bounce CoA option in the Cisco ISE system profiling settings enabled

Show Answer

Question # 5

An engineer must use Cisco ISE profiler services to provide network access to Cisco IP phones that cannot support 802.1X. Cisco ISE is configured to use the access switch device sensor information system-description and platform-type to profile Cisco IP phones and allow access. Which two protocols must be configured on the switch to complete the configuration? (Choose two.)

A. CDP 
B. EAPOL 
C. LLDP
D. SNMP
E. STP

Show Answer

Question # 6

An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network. Which node should be used to accomplish this task?

A. PSN 
B. primary PAN
C. pxGrid
D. MnT

Show Answer

Question # 7

An administrator replaced a PSN in the distributed Cisco ISE environment. When endpoints authenticate to it, the devices are not getting the right profiles or attributes and as a result, are not hitting the correct policies. This was working correctly on the previous PSN. Which action must be taken to ensure the endpoints get identified? 

A. Verify that the MnT node is tracking the session. 
B. Verify the shared secret used between the switch and the PSN. 
C. Verify that the profiling service is running on the new PSN. 
D. Verify that the authentication request the PSN is receiving is not malformed.

Show Answer

Question # 8

Which Cisco ISE solution ensures endpoints have the latest version of antivirus updates installed before being allowed access to the corporate network?

A. Threat Services 
B. Profiling Services
C. Provisioning Services
D. Posture Services

Show Answer

Question # 9

An engineer is unable to use SSH to connect to a switch after adding the required CLI commands to the device to enable TACACS+. The device administration license has been added to Cisco ISE, and the required policies have been created. Which action is needed to enable access to the switch?

A. The ip ssh source-interface command needs to be set on the switch.
B. 802.1X authentication needs to be configured on the switch.
C. The RSA keypair used for SSH must be regenerated after enabling TACACS+.
D. The switch needs to be added as a network device in Cisco ISE and set to use TACACS+.

Show Answer

Question # 10

A security administrator is using Cisco ISE to create a BYOD onboarding solution for all employees who use personal devices on the corporate network. The administrator generates a Certificate Signing Request and signs the request using an external Certificate Authority server. Which certificate usage option must be selected when importing the certificate into ISE?

A. RADIUS
B. DLTS
C. Portal
D. Admin

Show Answer

Question # 11

An engineer must organize endpoints in a Cisco ISE identity management store to improve the operational management of IP phone endpoints. The endpoints must meet these requirements: • classify endpoints for finance, sales, and marketing departments • tag each endpoint as profiled Which action organizes the endpoints?

A. Create an endpoint identity group for each department with the IP phone parent group. 
B. Create an endpoint identity group for each department with the profiled parent group. 
C. Add a tag for the endpoints of each department and add an endpoint to profiled group.
D. Add a tag for the endpoints of each department and use the identity group filter.

Show Answer

Question # 12

An engineer is assigned to enhance security across the campus network. The task is to enable MAB across all access switches in the network. Which command must be entered on the switch to enable MAB?

A. Switch(config-if)# mab
B. Switch(config)# mab
C. Switch# authentication port-control auto
D. Switch(config)# authentication port-control auto

Show Answer

Question # 13

A network engineer must configure a centralized Cisco ISE solution for wireless guest access with users in different time zones. The guest account activation time must be independent of the user time zone, and the guest account must be enabled automatically when the user self-registers on the guest portal. Which option in the time profile settings must be selected to meet the requirement?

A. Select FromFirstLogin from the Account Type dropdown.
B. Select FromCreation from the Account Type dropdown.
C. Set the Maximum Account Duration to 1 Day.
D. Set the Duration field to 24:00:00.

Show Answer

Question # 14

An administrator must deploy the Cisco Secure Client posture agent to employee endpoints that access a wireless network by using URL redirection in Cisco ISE. The compliance module must be downloaded from Cisco and uploaded to the Cisco ISE client provisioning resource. What must be used to upload the compliance module?

A. Secure Client configuration
B. agent resources from the local disk
C. Secure Client posture profile
D. Client Provisioning Portal 

Show Answer

Question # 15

Which default "guest type" is included with Cisco ISE? 

A. visitors
B. sponsor
C. guest
D. contractor 

Show Answer

Question # 16

What is a valid status of an endpoint attribute during the device registration process?

A. block listed 
B. pending
C. unknown 
D. DenyAccess 

Show Answer

Question # 17

What is the Microsoft security policy recommendation (or fast user switching in Cisco ISE? 

A. Disable BYOD posture agent.
B. Enable fast user switching.
C. Disable fast user switching.
D. Enable Cisco Secure Client posture agent. 

Show Answer

Question # 18

An ISE administrator must change the inactivity timer for MAB endpoints to terminate theauthentication session whenever a switch port that is connected to an IP phone does notdetect packets from the device for 30 minutes. Which action must be taken to accomplishthis task?

A. Add the authentication timer reauthenticate server command to the switchport.
B. Add the authentication timer inactivity 3600 command to the switchport.
C. Change the idle-timeout on the Radius server to 3600 seconds for IP Phone endpoints.
D. Configure the session-timeout to be 3600 seconds on Cisco ISE. 

Show Answer

Question # 19

The IT manager wants to provide different levels of access to network devices when usersauthenticate using TACACS+. The company needs specific commands to be allowedbased on the Active Directory group membership of the different roles within the ITdepartment. The solution must minimize the number of objects created in Cisco ISE. Whatmust be created to accomplish this task?

A. one shell profile and one command set
B. multiple shell profiles and one command set
C. one shell profile and multiple command sets
D. multiple shell profiles and multiple command sets 

Show Answer

Question # 20

An engineer is designing a BYOD environment utilizing Cisco ISE for devices that do not support native supplicants Which portal must the security engineer configure to accomplish this task?

A. MDM
B. Client provisioning 
C. My devices
D. BYOD

Show Answer

Question # 21

What is a function of client provisioning? 

A. It ensures an application process is running on the endpoint.
B. It checks a dictionary' attribute with a value.
C. It ensures that endpoints receive the appropriate posture agents
D. It checks the existence date and versions of the file on a client.

Show Answer