[Jan 09, 2024] 300-715 Test Prep Training Practice Exam Questions Practice Tests [Q75-Q89]

NEW QUESTION 75
Refer to the exhibit.

An organization recently implemented network device administration using Cisco ISE. Upon testing the ability to access all of the required devices, a user in the Cisco ISE group IT Admins is attempting to login to a device in their organization’s finance department but is unable to. What is the problem?

The IT training rule is taking precedence over the IT Admins rule.

The authorization conditions wrongly allow IT Admins group no access to finance devices.

The finance location is not a condition in the policy set.

The authorization policy doesn’t correctly grant them access to the finance devices.

NEW QUESTION 76
When creating a policy within Cisco ISE for network access control, the administrator wants to allow different access restrictions based upon the wireless SSID to which the device is connecting. Which policy condition must be used in order to accomplish this?

Network Access NetworkDeviceName CONTAINS <SSID Name>

DEVICE Device Type CONTAINS <SSID Name>

Radius Called-Station-ID CONTAINS <SSID Name>

Airespace Airespace-Wlan-ld CONTAINS <SSID Name>

NEW QUESTION 77
A policy is being created in order to provide device administration access to the switches on a network. There is a requirement to ensure that if the session is not actively being used, after 10 minutes, it will be disconnected. Which task must be configured in order to meet this requirement?

session timeout

idle time

monitor

set attribute as

NEW QUESTION 78
Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles?
(Choose two.)

Firepower

WLC

IOS

ASA

Shell

Explanation
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide TACACS+ ProfileTACACS+ profiles control the initial login session of the device administrator. A session refers to each individual authentication, authorization, or accounting request. A session authorization request to a network device elicits an ISE response. The response includes a token that is interpreted by the network device, which limits the commands that may be executed for the duration of a session. The authorization policy for a device administration access service can contain a single shell profile and multiple command sets.
The TACACS+ profile definitions are split into two components:
* Common tasks
* Custom attributes
There are two views in the TACACS+ Profiles page (Work Centers > Device Administration > Policy Elements > Results > TACACS Profiles)-Task Attribute View and Raw View. Common tasks can be entered using the Task Attribute View and custom attributes can be created in the Task Attribute View as well as the Raw View.
The Common Tasks section allows you to select and configure the frequently used attributes for a profile. The attributes that are included here are those defined by the TACACS+ protocol draft specifications. However, the values can be used in the authorization of requests from other services. In the Task Attribute View, the ISE administrator can set the privileges that will be assigned to the device administrator. The common task types are:
* Shell
* WLC
* Nexus
* Generic
The Custom Attributes section allows you to configure additional attributes. It provides a list of attributes that are not recognized by the Common Tasks section. Each definition consists of the attribute name, an indication of whether the attribute is mandatory or optional, and the value for the attribute. In the Raw View, you can enter the mandatory attributes using a equal to (=) sign between the attribute name and its value and optional attributes are entered using an asterisk (*) between the attribute name and its value. The attributes entered in the Raw View are reflected in the Custom Attributes section in the Task Attribute View and vice versa. The Raw View is also used to copy paste the attribute list (for example, another product’s attribute list) from the clipboard onto ISE. Custom attributes can be defined for nonshell services.

NEW QUESTION 79
Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.

NEW QUESTION 80

Refer to the exhibit Which switch configuration change will allow only one voice and one data endpoint on each port?

Multi-auth to multi-domain

Mab to dot1x

Auto to manual

Multi-auth to single-auth

NEW QUESTION 81
An administrator is configuring TACACS+ on a Cisco switch but cannot authenticate users with Cisco ISE. The configuration contains the correct key of Cisc039712287. but the switch is not receiving a response from the Cisco ISE instance What must be done to validate the AAA configuration and identify the problem with the TACACS+ servers?

Check for server reachability using the test aaa group tacacs+ admin <key> legacy command.

Test the user account on the server using the test aaa group radius server CUCS user admin pass <key> legacy command.

Validate that the key value is correct using the test aaa authentication admin <key> legacy command.

Confirm the authorization policies are correct using the test aaa authorization admin drop legacy command.

NEW QUESTION 82
What is a requirement for Feed Service to work?

TCP port 3080 must be opened between Cisco ISE and the feed server

Cisco ISE has a base license.

Cisco ISE has access to an internal server to download feed update

Cisco ISE has Internet access to download feed update

NEW QUESTION 83
An organization wants to improve their BYOD processes to have Cisco ISE issue certificates to the BYOD endpoints. Currently, they have an active certificate authority and do not want to replace it with Cisco ISE. What must be configured within Cisco ISE to accomplish this goal?

Create a certificate signing request and have the root certificate authority sign it.

Add the root certificate authority to the trust store and enable it for authentication.

Create an SCEP profile to link Cisco ISE with the root certificate authority.

Add an OCSP profile and configure the root certificate authority as secondary.

NEW QUESTION 84
An engineer is implementing Cisco ISE and needs to configure 802.1X. The port settings are configured for port-based authentication. Which command should be used to complete this configuration?

dot1x pae authenticator

dot1x system-auth-control

authentication port-control auto

aaa authentication dot1x default group radius

NEW QUESTION 85
An organization is migrating its current guest network to Cisco ISE and has 1000 guest users in the current database There are no resources to enter this information into the Cisco ISE database manually. What must be done to accomplish this task effciently?

Use a CSV file to import the guest accounts

Use SOL to link me existing database to Ctsco ISE

Use a JSON fie to automate the migration of guest accounts

Use an XML file to change the existing format to match that of Cisco ISE

NEW QUESTION 86
Refer to the exhibit.

A network engineers configuring the switch to accept downloadable ACLs from a Cisco ISC server Which two commands should be run to complete the configuration? (Choose two)

aaa authorization auth-proxy default group radius

radius server vsa sand authentication

radius-server attribute 8 include-in-access-req

ip device tracking

dot1x system-auth-control

NEW QUESTION 87
What is the maximum number of PSN nodes supported in a medium-sized deployment?

three

five

two

eight

NEW QUESTION 88
Which protocol must be allowed for a BYOD device to access the BYOD portal?

HTTP

SMTP

HTTPS

SSH

NEW QUESTION 89
Refer to the exhibit.

A network engineers configuring the switch to accept downloadable ACLs from a Cisco ISC server Which two commands should be run to complete the configuration? (Choose two)