Updated Dec-2021 Test Engine to Practice 300-715 Dumps & Practice Exam
Dumps Collection 300-715 Test Engine Dumps Training With 153 Questions
Cisco SISE 300-715 Practice Test Questions, Cisco SISE 300-715 Exam Practice Test Questions
The Implementing and Configuring Cisco Identity Services Engine (300-715 SISE) exam validates the competency of the candidates in Cisco Identify Services Engine, including policy enforcement, architecture & deployment, profiler, Web Auth & guest services, BYOD, endpoint compliance, as well as network access device administration. This test is a mandatory requirement for obtaining the Cisco Certified Specialist – Security Identity Management Implementation certificate. It is also one of the concentration exams that the applicants can choose in addition to the Implementing and Operating Cisco Security Core Technologies (350-701 SCOR) test required for earning the Cisco Certified Network Professional (CCNP) Security certification.
NEW QUESTION 25
An organization is hosting a conference and must make guest accounts for several of the speakers attending. The conference ended two days early but the guest accounts are still being used to access the network. What must be configured to correct this?
- A. Create an authorization rule denying sponsored guest access.
- B. Navigate to the Guest Portal and delete the guest accounts.
- C. Create an authorization rule denying guest access.
- D. Navigate to the Sponsor Portal and suspend the guest accounts.
Answer: D
NEW QUESTION 26
What are the three default behaviors of Cisco ISE with respect to authentication, when a user connects to a switch that is configured for 802.1X, MAB, and WebAuth? (Choose three)
- A. Dot1X traffic uses a user-defined identity store for retrieving identity.
- B. Unmatched traffic is allowed on the network.
- C. MAB traffic uses internal endpoints for retrieving identity.
- D. Unmatched traffic is dropped because of the Reject/Reject/Drop action that is configured under Options.
- E. Dot1 traffic uses internal users for retrieving identity.
Answer: C,D,E
NEW QUESTION 27
Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.
Answer:
Explanation:
Explanation
Monitoring = provides advanced monitoring and troubleshooting tools that you can use to effectively manage your network and resources Policy Service = provides network access, posture, guest access, client provisioning, and profiling services.
This persona evaluates the policies and makes all the decisions.
Administration = manages all system-related configuration and configurations that relate to functionality such as authentication, authorization, auditing, and so on pxGrid = shares context-sensitive information from Cisco ISE to subscribers
https://www.cisco.com/c/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide
NEW QUESTION 28
When setting up profiling in an environment using Cisco ISE for network access control, an organization must use non-proprietary protocols for collecting the information at layer 2. Which two probes will provide this information without forwarding SPAN packets to Cisco ISE? {Choose two.)
- A. DHCP SPAN probe
- B. NetFlow probe
- C. DNS probe
- D. RADIUS probe
- E. SNMP query probe
Answer: D,E
Explanation:
Reference:
https://ciscocustomer.lookbookhq.com/iseguidedjourney/ISE-profiling-design
NEW QUESTION 29
An administrator is configuring RADIUS on a Cisco switch with a key set to Cisc403012128 but is receiving the error "Authentication failed: 22040 Wrong password or invalid shared secret. "what must be done to address this issue?
- A. Configure the key on the Cisco ISE instead of the Cisco switch.
- B. Add the network device as a NAD inside Cisco ISE using the existing key.
- C. Use a key that is between eight and ten characters.
- D. Validate that the key is correct on both the Cisco switch as well as Cisco ISE.
Answer: D
NEW QUESTION 30
What gives Cisco ISE an option to scan endpoints for vulnerabilities?
- A. authentication policy
- B. authorization policy
- C. authorization profile
- D. authentication profile
Answer: B
NEW QUESTION 31
Which two values are compared by the binary comparison (unction in authentication that is based on Active Directory?
- A. user-presented certificate and a certificate stored in Active Directory
- B. subject alternative name and the common name
- C. user-presented password hash and a hash stored in Active Directory
- D. MS-CHAFV2 provided machine credentials and credentials stored in Active Directory
Answer: B
Explanation:
Explanation
Basic certificate checking does not require an identity source. If you want binary comparison checking for the certificates, you must select an identity source. If you select Active Directory as an identity source, subject and common name and subject alternative name (all values) can be used to look up a user.
https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/ b_ise_admin_guide_sample_chapter_01110.html
NEW QUESTION 32
Which two default endpoint identity groups does Cisco ISE create? (Choose two )
- A. endpoint
- B. unknown
- C. allow list
- D. block list
- E. profiled
Answer: B,E
Explanation:
Explanation
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide Default Endpoint Identity Groups Created for EndpointsCisco ISE creates the following five endpoint identity groups by default: Blacklist, GuestEndpoints, Profiled, RegisteredDevices, and Unknown. In addition, it creates two more identity groups, such as Cisco-IP-Phone and Workstation, which are associated to the Profiled (parent) identity group. A parent group is the default identity group that exists in the system.
Cisco ISE creates the following endpoint identity groups:
* Blacklist-This endpoint identity group includes endpoints that are statically assigned to this group in Cisco ISE and endpoints that are block listed in the device registration portal. An authorization profile can be defined in Cisco ISE to permit, or deny network access to endpoints in this group.
* GuestEndpoints-This endpoint identity group includes endpoints that are used by guest users.
* Profiled-This endpoint identity group includes endpoints that match endpoint profiling policies except Cisco IP phones and workstations in Cisco ISE.
* RegisteredDevices-This endpoint identity group includes endpoints, which are registered devices that are added by an employee through the devices registration portal. The profiling service continues to profile these devices normally when they are assigned to this group. Endpoints are statically assigned to this group in Cisco ISE, and the profiling service cannot reassign them to any other identity group.
These devices will appear like any other endpoint in the endpoints list. You can edit, delete, and block these devices that you added through the device registration portal from the endpoints list in the Endpoints page in Cisco ISE. Devices that you have blocked in the device registration portal are assigned to the Blacklist endpoint identity group, and an authorization profile that exists in Cisco ISE
* redirects blocked devices to a URL, which displays "Unauthorised Network Access", a default portal page to the blocked devices.
* Unknown-This endpoint identity group includes endpoints that do not match any profile in Cisco ISE.
In addition to the above system created endpoint identity groups, Cisco ISE creates the following endpoint identity groups, which are associated to the Profiled identity group:
* Cisco-IP-Phone-An identity group that contains all the profiled Cisco IP phones on your network.
* Workstation-An identity group that contains all the profiled workstations on your network.
NEW QUESTION 33
An organization wants to improve their BYOD processes to have Cisco ISE issue certificates to the BYOD endpoints. Currently, they have an active certificate authority and do not want to replace it with Cisco ISE. What must be configured within Cisco ISE to accomplish this goal?
- A. Add an OCSP profile and configure the root certificate authority as secondary.
- B. Create an SCEP profile to link Cisco ISE with the root certificate authority.
- C. Add the root certificate authority to the trust store and enable it for authentication.
- D. Create a certificate signing request and have the root certificate authority sign it.
Answer: B
NEW QUESTION 34
Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?
- A. unknown
- B. profiled
- C. Endpoint
- D. blacklist
- E. white list
Answer: A
Explanation:
Explanation
If you do not have a matching profiling policy, you can assign an unknown profiling policy. The endpoint is therefore profiled as Unknown. The endpoint that does not match any profile is grouped within the Unknown identity group. The endpoint profiled to the Unknown profile requires that you create a profile with an attribute or a set of attributes collected for that endpoint.
https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_identities.html
NEW QUESTION 35
MacOS users are complaining about having to read through wordy instructions when remediating their workstations to gam access to the network Which alternate method should be used to tell users how to remediate?
- A. message text
- B. file distribution
- C. executable
- D. URL link
Answer: D
Explanation:
https://www.sciencedirect.com/topics/computer-science/remediation-action
NEW QUESTION 36 
Refer to the exhibit. In which scenario does this switch configuration apply?
- A. when allowing multiple IP phones to be connected
- B. when passing IP phone authentication
- C. when preventing users with hypervisor
- D. when allowing a hub with multiple clients connected
Answer: D
Explanation:
Explanation
https://www.linkedin.com/pulse/mac-authentication-bypass-priyanka-kumari#:~:text=Multi%2Dauthentication%
NEW QUESTION 37
An organization is hosting a conference and must make guest accounts for several of the speakers attending. The conference ended two days early but the guest accounts are still being used to access the network. What must be configured to correct this?
- A. Create an authorization rule denying sponsored guest access.
- B. Navigate to the Guest Portal and delete the guest accounts.
- C. Navigate to the Sponsor Portal and suspend the guest accounts.
- D. Create an authorization rule denying guest access.
Answer: D
NEW QUESTION 38
Which two features must be used on Cisco ISE to enable the TACACS. feature? (Choose two)
- A. External TACACS Servers
- B. Device Administration License
- C. Server Sequence
- D. Command Sets
- E. Enable Device Admin Service
Answer: B,E
NEW QUESTION 39
In a Cisco ISE split deployment model, which load is split between the nodes?
- A. log collection
- B. device admission
- C. network admission
- D. AAA
Answer: D
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/install_guide/b_ise_InstallationGuide26.pdf
NEW QUESTION 40
An engineer is configuring 802.1X and wants it to be transparent from the users' point of view. The implementation should provide open authentication on the switch ports while providing strong levels of security for non-authenticated devices. Which deployment mode should be used to achieve this?
- A. open
- B. closed
- C. high-impact
- D. low-impact
Answer: D
Explanation:
Explanation
https://www.lookingpoint.com/blog/cisco-ise-wired-802.1x-deployment-monitormode#:~:text=Low%20imp
NEW QUESTION 41
What is a characteristic of the UDP protocol?
- A. UDP offers best-effort delivery.
- B. UDP can detect when a server is slow.
- C. UDP can detect when a server is down.
- D. UDP offers information about a non-existent server.
Answer: A
Explanation:
Section: Network Access Device Administration
Explanation/Reference:
NEW QUESTION 42
Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.
Answer:
Explanation:
Explanation
Monitoring = provides advanced monitoring and troubleshooting tools that you can use to effectively manage your network and resources Policy Service = provides network access, posture, guest access, client provisioning, and profiling services.
This persona evaluates the policies and makes all the decisions.
Administration = manages all system-related configuration and configurations that relate to functionality such as authentication, authorization, auditing, and so on pxGrid = shares context-sensitive information from Cisco ISE to subscribers
https://www.cisco.com/c/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide
NEW QUESTION 43
What happens when an internal user is configured with an external identity store for authentication, but an engineer uses the Cisco ISE admin portal to select an internal identity store as the identity source?
- A. Authentication is redirected to the external identity source.
- B. Authentication is redirected to the internal identity source.
- C. Authentication fails.
- D. Authentication is granted.
Answer: C
NEW QUESTION 44
......
Once you have completed the session, you will be prepared to sit and pass 300-715 exam. Here are some of the course objectives:
- Show how you can use Cisco ISE policies to comply with the requirements of your company;
- Gaining an understanding of the deployment of Cisco ISE, its advantages, and how each of the different components takes part in these benefits;
- Understand and demonstrate the use of components associated with 802.1X & MAC Authentication Bypass (MAB) authentication;
- Demonstrate knowledge of Network Access Devices (NADs), TrustSec of Cisco, Easy Connect, and how you can use them at work;
- Show an understanding of BYOD issues, solutions, procedures, and platforms.
Prior to registering, there are vital requirements to meet. They include the awareness of Cisco IOS Software CLI, 802.1X, Microsoft Windows OS, and more. The benefits of studying with this course for exam 300-715 include building skills and qualification for highly-demanded job roles. Plus, completion of this training also comes with 40 CE credits, which will be considered when recertifying.
Cisco 300-715 Dumps Cover Real Exam Questions: https://www.actual4cert.com/300-715-real-questions.html
Real 300-715 dumps - Real Cisco dumps PDF: https://drive.google.com/open?id=1PDDZ0Dt_TCFnMTeHN5UhmgBKej1poh0i