Best Tips To Pass Cisco SISE 300-715 Exam in First Attempt

test2022-09-07T06:54:10+00:00

The best tip to pass your Cisco SISE 300-715 exam is to use the latest update 300-715 questions and answers from FreeTestShare. Cisco SISE 300-715 practice exam will help you better comprehend the information included in the actual exam.The Cisco SISE 300-715 practice exam fully describes what you will face on the real exam, allowing you to pass the CCNP Security Certification 300-715 exam quickly. We promise your success in the first attempt if you use Cisco SISE 300-715 practice exam as your Exam preparation.

Before taking the exam, you may test your knowledge with a free 300-715 practice test.

Page 1 of 6

1. What is the purpose of the ip http server command on a switch?

It enables the https server for users for web authentication

It enables MAB authentication on the switch

It enables the switch to redirect users for web authentication.

It enables dot1x authentication on the switch.

2. A network administrator must use Cisco ISE to check whether endpoints have the correct version of antivirus installed.

Which action must be taken to allow this capability?

Configure a native supplicant profile to be used for checking the antivirus version

Configure Cisco ISE to push the HostScan package to the endpoints to check for the antivirus version.

Create a Cisco AnyConnect Network Visibility Module configuration profile to send the antivirus information of the endpoints to Cisco IS

Create a Cisco AnyConnect configuration within Cisco ISE for the Compliance Module and associated configuration files

3. Which two ports do network devices typically use for CoA? (Choose two)

443

19005

8080

3799

1700

4. What are two components of the posture requirement when configuring Cisco ISE posture? (Choose two)

updates

remediation actions

Client Provisioning portal

conditions

access policy

5. An employee must access the internet through the corporate network from a new mobile device that does not support native supplicant provisioning provided by Cisco ISE .

Which portal must the employee use to provision to the device?

BYOD

Personal Device

My Devices

Client Provisioning

6. An engineer is designing a new distributed deployment for Cisco ISE in the network and is considering failover options for the admin nodes. There is a need to ensure that an admin node is available for configuration of policies at all times .

What is the requirement to enable this feature?

one primary admin and one secondary admin node in the deployment

one policy services node and one secondary admin node

one policy services node and one monitoring and troubleshooting node

one primary admin node and one monitoring and troubleshooting node

7. Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two).

TCP 8443

TCP 8906

TCP 443

TCP 80

TCP 8905

8. Which two roles are taken on by the administration person within a Cisco ISE distributed environment? (Choose two.)

backup

secondary

standby

primary

active

9. A Cisco device has a port configured in multi-authentication mode and is accepting connections only from hosts assigned the SGT of SGT_0422048549 The VLAN trunk link supports a maximum of 8 VLANS.

What is the reason for these restrictions?

The device is performing inline tagging without acting as a SXP speaker

The device is performing mime tagging while acting as a SXP speaker

The IP subnet addresses are dynamically mapped to an SG

The IP subnet addresses are statically mapped to an SGT

10. Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

TCP 8909

TCP 8905

UDP 1812

TCP 443

Page 2 of 6

11. A network administrator must configure Cisco SE Personas in the company to share session information via syslog .

Which Cisco ISE personas must be added to syslog receivers to accomplish this goal?

pxGrid

admin

policy services

monitor

12. Refer to the exhibit:

Which command is typed within the CU of a switch to view the troubleshooting output?

show authentication sessions mac 000e.84af.59af details

show authentication registrations

show authentication interface gigabitethemet2/0/36

show authentication sessions method

13. An engineer is enabling a newly configured wireless SSID for tablets and needs visibility into which other types of devices are connecting to it .

What must be done on the Cisco WLC to provide this information to Cisco ISE9

enable IP Device Tracking

enable MAC filtering

enable Fast Transition

enable mDNS snooping

14. What are two requirements of generating a single signing in Cisco ISE by using a certificate provisioning portal, without generating a certificate request? (Choose two)

Location the CSV file for the device MAC

Select the certificate template

Choose the hashing method

Enter the common name

Enter the IP address of the device

15. What is a valid guest portal type?

Sponsored-Guest

My Devices

Sponsor

Captive-Guest

16. What should be considered when configuring certificates for BYOD?

An endpoint certificate is mandatory for the Cisco ISE BYOD

An Android endpoint uses EST whereas other operation systems use SCEP for enrollment

The CN field is populated with the endpoint host name.

The SAN field is populated with the end user name

17. An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened.

From which Cisco ISE persona should this traffic be originating?

monitoring

policy service

administration

authentication

18. An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port .

Which command should be used to accomplish this task?

permit tcp any any eq <port number>

aaa group server radius proxy

ip http port <port number>

aaa group server radius

19. A new employee just connected their workstation to a Cisco IP phone. The network administrator wants to ensure that the Cisco IP phone remains online when the user disconnects their Workstation from the corporate network.

Which CoA configuration meets this requirement?

Port Bounce

Reauth

NoCoA

Disconnect

20. An administrator is configuring cisco ISE lo authenticate users logging into network devices using TACACS+ The administrator is not seeing any oí the authentication in the TACACS+ live logs .

Which action ensures the users are able to log into the network devices?

Enable the device administration service in the Administration persona

Enable the session services in the administration persona

Enable the service sessions in the PSN persona.

Enable the device administration service in the PSN persona.

Page 3 of 6

21. An administrator is adding a switch to a network that is running Cisco ISE and is only for IP Phones The phones do not have the ability to authenticate via 802 1X.

Which command is needed on each switch port for authentication?

dot1x system-auth-control

enable bypass-mac

enable network-authentication

mab

22. Refer to the exhibit.

A network engineers configuring the switch to accept downloadable ACLs from a Cisco ISC server.

Which two commands should be run to complete the configuration? (Choose two)

aaa authorization auth-proxy default group radius

radius server vsa sand authentication

radius-server attribute 8 include-in-access-req

ip device tracking

dot1x system-auth-control

23. An administrator needs to connect ISE to Active Directory as an external authentication source and allow the proper ports through the firewall .

Which two ports should be opened to accomplish this task? (Choose two)

TELNET 23

LDAP 389

HTTP 80

HTTPS 443

MSRPC 445

24. When planning for the deployment of Cisco ISE, an organization's security policy dictates that they must use network access authentication via RADIUS. It also states that the deployment provide an adequate amount of security and visibility for the hosts on the network .

Why should the engineer configure MAB in this situation?

The Cisco switches only support MA

MAB provides the strongest form of authentication available.

The devices in the network do not have a supplicant.

MAB provides user authentication.

25. What happens when an internal user is configured with an external identity store for authentication, but an engineer uses the Cisco ISE admin portal to select an internal identity store as the identity source?

Authentication is redirected to the internal identity source.

Authentication is redirected to the external identity source.

Authentication is granted.

Authentication fails.

26. In which two ways can users and endpoints be classified for TrustSec? (Choose Two.)

VLAN

SXP

dynamic

QoS

SGACL

27. Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

personas

qualys

nexpose

posture

28. A company is attempting to improve their BYOD policies and restrict access based on certain criteria. The company's subnets are organized by building .

Which attribute should be used in order to gain access based on location?

static group assignment

IP address

device registration status

MAC address

29. What is an advantage of using EAP-TLS over EAP-MS-CHAPv2 for client authentication?

EAP-TLS uses a username and password for authentication to enhance security, while EAP-MS-CHAPv2 does not.

EAP-TLS secures the exchange of credentials, while EAP-MS-CHAPv2 does not.

EAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not.

EAP-TLS uses multiple forms of authentication, while EAP-MS-CHAPv2 only uses one.

30. Which RADIUS attribute is used to dynamically assign the inactivity active timer for MAB users from the Cisco ISE node'?

radius-server timeout

session-timeout

idle-timeout

termination-action

Page 4 of 6

31. How is policy services node redundancy achieved in a deployment?

by enabling VIP

by utilizing RADIUS server list on the NAD

by creating a node group

by deploying both primary and secondary node

32. There is a need within an organization for a new policy to be created in Cisco ISE. It must validate that a specific anti-virus application is not only installed, but running on a machine before it is allowed access to the network .

Which posture condition should the administrator configure in order for this policy to work?

file

registry

application

service

33. While configuring Cisco TrustSec on Cisco IOS devices the engineer must set the CTS device ID and password in order for the devices to authenticate with each other. However after this is complete the devices are not able to property authenticate.

What issue would cause this to happen even if the device ID and passwords are correct?

The device aliases are not matching

The 5GT mappings have not been defined

The devices are missing the configuration cts credentials trustsec verify 1

EAP-FAST is not enabled

34. A network administrator is currently using Cisco ISE to authenticate devices and users via 802 1X There is now a need to also authorize devices and users using EAP-TLS .

Which two additional components must be configured in Cisco ISE to accomplish this'? (Choose two.)

Network Device Group

Serial Number attribute that maps to a CA Server

Common Name attribute that maps to an identity store

Certificate Authentication Profile

EAP Authorization Profile

35. An engineer is configuring the remote access VPN to use Cisco ISE for AAA and needs to conduct posture checks on the connecting endpoints After the endpoint connects, it receives its initial authorization result and continues onto the compliance scan.

What must be done for this AAA configuration to allow compliant access to the network?

Configure the posture authorization so it defaults to unknown status

Fix the CoA port number

Ensure that authorization only mode is not enabled

Enable dynamic authorization within the AAA server group

36. A network administrator is configuring a secondary cisco ISE node from the backup configuration of the primary cisco ISE node to create a high availability pair The Cisco ISE CA certificates and keys must be manually backed up from the primary Cisco ISE and copied into the secondary Cisco ISE.

Which command most be issued for this to work?

copy certificate Ise

application configure Ise

certificate configure Ise

Import certificate Ise

37. What must be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

pass

reject

drop

continue

38. A network engineer must enforce access control using special tags, without re-engineering the network design .

Which feature should be configured to achieve this in a scalable manner?

SGT

dACL

VLAN

RBAC

39. What is a requirement for Feed Service to work?

TCP port 3080 must be opened between Cisco ISE and the feed server

Cisco ISE has a base license.

Cisco ISE has access to an internal server to download feed update

Cisco ISE has Internet access to download feed update

40. An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network .

Which node should be used to accomplish this task?

PSN

primary PAN

pxGrid

MnT

Page 5 of 6

41. What does the dot1x system-auth-control command do?

causes a network access switch not to track 802.1x sessions

globally enables 802.1x

enables 802.1x on a network access device interface

causes a network access switch to track 802.1x sessions

42. An administrator needs to give the same level of access to the network devices when users are logging into them using TACACS+ However, the administrator must restrict certain commands based on one of three user roles that require different commands.

How is this accomplished without creating too many objects using Cisco ISE?

Create one shell profile and multiple command sets.

Create multiple shell profiles and multiple command sets.

Create one shell profile and one command set.

Create multiple shell profiles and one command set

43. Which configuration is required in the Cisco ISE authentication policy to allow Central Web Authentication?

MAB and if user not found, continue

MAB and if authentication failed, continue

Dot1x and if user not found, continue

Dot1x and if authentication failed, continue

44. An engineer is configuring posture assessment for their network access control and needs to use an agent that supports using service conditions as conditions for the assessment. The agent should be run as a background process to avoid user interruption but when it is run. the user can see it .

What is the problem?

The engineer is using the "Anyconnect” posture agent but should be using the "Stealth Anyconnect posture agent

The posture module was deployed using the headend instead of installing it with SCCM

The user was in need of remediation so the agent appeared m the notifications

The proper permissions were no! given to the temporal agent to conduct the assessment

45. Which two probes must be enabled for the ARP cache to function in the Cisco ISE profile service so that a user can reliably bind the IP address and MAC addresses of endpoints? (Choose two.)

NetFlow

SNMP

HTTP

DHCP

RADIUS

46. An engineer is implementing network access control using Cisco ISE and needs to separate the traffic based on the network device ID and use the IOS device sensor capability .

Which probe must be used to accomplish this task?

HTTP probe

NetFlow probe

network scan probe

RADIUS probe

47. Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose two.)

hotspot

new AD user 802 1X authentication

posture

BYOD

guest AUP

48. An organization is migrating its current guest network to Cisco ISE and has 1000 guest users in the current database There are no resources to enter this information into the Cisco ISE database manually .

What must be done to accomplish this task effciently?

Use a CSV file to import the guest accounts

Use SOL to link me existing database to Ctsco ISE

Use a JSON fie to automate the migration of guest accounts

Use an XML file to change the existing format to match that of Cisco ISE

49. Which personas can a Cisco ISE node assume'?

policy service, gatekeeping, and monitoring

administration, policy service, and monitoring

administration, policy service, gatekeeping

administration, monitoring, and gatekeeping

50. An engineer is using the low-impact mode for a phased deployment of Cisco ISE and is trying to connect to the network prior to authentication .

Which access will be denied in this?

HTTP

DNS

EAP

DHCP

Page 6 of 6

51. An engineer tests Cisco ISE posture services on the network and must configure the compliance module to automatically download and install on endpoints.

Which action accomplishes this task for VPN users?

Create a Cisco AnyConnect configuration and Client Provisioning policy within Cisco IS

Configure the compliance module to be downloaded from within the posture policy.

Push the compliance module from Cisco FTD prior to attempting posture.

Use a compound posture condition to check for the compliance module and download if needed.

52. An organization wants to improve their BYOD processes to have Cisco ISE issue certificates to the BYOD endpoints. Currently, they have an active certificate authority and do not want to replace it with Cisco ISE .

What must be configured within Cisco ISE to accomplish this goal?

Create a certificate signing request and have the root certificate authority sign it.

Add the root certificate authority to the trust store and enable it for authentication.

Create an SCEP profile to link Cisco ISE with the root certificate authority.

Add an OCSP profile and configure the root certificate authority as secondary.

Best Tips To Pass Cisco SISE 300-715 Exam in First Attempt

Best Tips To Pass Cisco SISE 300-715 Exam in First Attempt

Share this post

Author

Leave a Reply Cancel reply

Related Posts