Implementing and Configuring Cisco Identity Services Engine (SISE) practice questions

1. Question 1 of 25

   A Cisco ISE server sends a CoA to a NAD after a user logs in successfully using CWA. Which action does the CoA perform?

   • AIt terminates the client session.
   • BIt applies the downloadable ACL provided in the CoA.
   • CIt triggers the NAD to reauthenticate the client.
   • DIt applies new permissions provided in the CoA to the client session.

   Show answer

   Correct answer: C

   How others answered

   • C62%
   • D27%

   Only 62% agreed on this answer — treat it as contested rather than settled.

   Explanation

   https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html On the WLC this can be seen in AAA all debugs. *radiusCoASupportTransportThread: audit session ID recieved in CoA = 0a6a207a0000000b5fe90410 *radiusCoASupportTransportThread: Received a 'CoA-Request' from 10.106.32.25 port 23974 *radiusCoASupportTransportThread: CoA - Received IP Address : 10.106.32.122, Vlan ID: (received 0) *radiusCoASupportTransportThread: d0:37:45:89:ef:64 Calling-Station-Id ---> d0:37:45:89:ef:64 *radiusCoASupportTransportThread: Handling a valid 'CoA-Request' regarding station d0:37:45:89:ef:64 *radiusCoASupportTransportThread: Sending Radius CoA Response packet on srcPort: 1700, dpPort: 2, tx Port: 23974 *radiusCoASupportTransportThread: Sent a 'CoA-Ack' to 10.106.32.25 (port:23974) After this the client is reauthenticated and granted access to the network.

   Adapted from community discussion by johndelorien · 2023-12-03 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

   1. J

      johndelorien

      2023-12-03

      Selected C3 upvotes

      https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html On the WLC this can be seen in AAA all debugs. *radiusCoASupportTransportThread: audit session ID recieved in CoA = 0a6a207a0000000b5fe90410 *radiusCoASupportTransportThread: Received a 'CoA-Request' from 10.106.32.25 port 23974 *radiusCoASupportTransportThread: CoA - Received IP Address : 10.106.32.122, Vlan ID: (received 0) *radiusCoASupportTransportThread: d0:37:45:89:ef:64 Calling-Station-Id ---> d0:37:45:89:ef:64 *radiusCoASupportTransportThread: Handling a valid 'CoA-Request' regarding station d0:37:45:89:ef:64 *radiusCoASupportTransportThread: Sending Radius CoA Response packet on srcPort: 1700, dpPort: 2, tx Port: 23974 *radiusCoASupportTransportThread: Sent a 'CoA-Ack' to 10.106.32.25 (port:23974) After this the client is reauthenticated and granted access to the network.

   2. N

      NikoTomas

      2024-09-02

      4 upvotes

      Correct is C) - CoA triggers the NAD to reauthenticate. SISE ebook: “Centralized Web Authentication uses a web portal that is hosted on ISE to receive the user’s credentials. The authenticator sends a MAB request to ISE, and ISE responds with a RADIUS Access-Accept and a URL redirection, and often a dACL limits the access to the network. After the credentials are received through the web portal, ISE sends a Change of Authorization (CoA) to the authenticator, causing REAUTHENTICATION. The reauthentication maintains the same session ID, and ISE is able to tie the user’s credentials to the MAB request and send the final authorization results for the end user.” - (continuation in comment)

   3. M

      matan24

      2023-10-10

      Selected C5 upvotes

      AGREE, THE ANSWER IS C. checked on cisco ISE CCNP official course.

   4. N

      NikoTomas

      2024-09-02

      4 upvotes

      Wrong! "Cisco ISE sends a CoA to the NAD with new permissions for the user" - this is NOT TRUE, ISE sends CoA just to trigger REAUTHENTICATION, so NAD sends a NEW authentication request (RADIUS Access-Request) to the ISE with same session ID. ISE then evaluates the Authorization Policy and new session parameters (dACL, VLAN, etc...) are sent as a result of new authorization to the NAD (you can match second authorization by GuestFlow flag on ISE).

2. Question 2 of 25

   Select 2

   Users in an organization report issues about having to remember multiple usernames and passwords. The network administrator wants the existing Cisco ISE deployment to utilize an external identity source to alleviate this issue. Which two requirements must be met to implement this change? (Choose two.)

   • AEstablish access to one Global Catalog server
   • BEnsure that the NAT address is properly configured
   • CProvide domain administrator access to Active Directory
   • DConfigure a secure LDAP connection
   • EEnable IPC access over port 80

   Show answer

   Correct answer: A, C

   How others answered

   • AC56%
   • AD31%

   Only 56% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Here the administrator will use AD as the third party identity source. Here there are the prerequisite asked for this: Join ISE to AD Prerequisites for Active Directory and ISE integration Verify that you have the privileges of a Super Admin or System Admin in ISE. Use the Network Time Protocol (NTP) server settings to synchronize the time between the Cisco server and Active Directory. The maximum allowed time difference between ISE and AD is 5 minutes The configured DNS on ISE must be able to answer SRV queries for DCs, GCs, and KDCs with or without additional Site information. Ensure that all the DNS servers can answer forward and reverse DNS queries for any possible Active Directory DNS domain. AD must have at least one global catalog server operational and accessible by Cisco, in the domain to which you join Cisco. Below the link: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215233-identity-service-engine-ise-and-active.html

   Adapted from community discussion by XBfoundX · 2024-05-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

   1. R

      rhylos

      2023-11-26

      Selected A, C4 upvotes

      Poorly worded question A. Establish access to one Global Catalog server YES B. Ensure that the NAT address is properly configured NO. Cant be behind NAT C. Provide domain administrator access to Active Directory - YES. Domain Admin not requires as long as can create COmputer Objects. OK but not great answer D. Configure a secure LDAP connection NO. THis is AD< not LDAP server E. Enable IPC access over port 80 . No. Huh? Use for what .

   2. X

      XBfoundX

      2024-05-19

      2 upvotes

      Here the administrator will use AD as the third party identity source. Here there are the prerequisite asked for this: Join ISE to AD Prerequisites for Active Directory and ISE integration Verify that you have the privileges of a Super Admin or System Admin in ISE. Use the Network Time Protocol (NTP) server settings to synchronize the time between the Cisco server and Active Directory. The maximum allowed time difference between ISE and AD is 5 minutes The configured DNS on ISE must be able to answer SRV queries for DCs, GCs, and KDCs with or without additional Site information. Ensure that all the DNS servers can answer forward and reverse DNS queries for any possible Active Directory DNS domain. AD must have at least one global catalog server operational and accessible by Cisco, in the domain to which you join Cisco. Below the link: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215233-identity-service-engine-ise-and-active.html

   3. E

      ElCobra90

      2024-01-28

      Selected A, C3 upvotes

      I will go with A and C, another BAD question from SISE Dump, A is the only 100% correct answer, then we have two possible choices: C:It is not necessary have domain administrator access (we need only a user that could create an ISE machine account inside the AD) as rhylos response, not the best in terms of security but ok. D:is not mandatory (but of course more secure) Also in you configure ldaps you need also to trust Certifcate or each other's certifcates CA.

   4. N

      Nonce

      2024-02-10

      Selected A, C2 upvotes

      A&C https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_2x.html#reference_8DC463597A644A5C9CF5D582B77BB24F

3. Question 3 of 25

   What should be considered when configuring certificates for BYOD?

   • AThe SAN field is populated with the end user name.
   • BThe CN field is populated with the endpoint host name.
   • CAn endpoint certificate is mandatory for the Cisco ISE BYOD.
   • DAn Android endpoint uses EST, whereas other operating systems use SCEP for enrollment.

   Show answer

   Correct answer: B

   How others answered

   • B56%
   • D38%

   Only 56% agreed on this answer — treat it as contested rather than settled.

   Explanation

   It should be B. When configuring certificates for Bring Your Own Device (BYOD), it is important to consider populating the CN (Common Name) field with the endpoint host name. The CN field should contain the host name or FQDN (Fully Qualified Domain Name) of the endpoint device. This allows the certificate to be properly validated when the device connects to the network. The CN field helps ensure that the device is correctly identified and authorized for network access.

   Adapted from community discussion by TomMarvolo · 2023-12-07 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Microsoft Learn
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

   1. T

      TomMarvolo

      2023-12-07

      Selected B3 upvotes

      It should be B. When configuring certificates for Bring Your Own Device (BYOD), it is important to consider populating the CN (Common Name) field with the endpoint host name. The CN field should contain the host name or FQDN (Fully Qualified Domain Name) of the endpoint device. This allows the certificate to be properly validated when the device connects to the network. The CN field helps ensure that the device is correctly identified and authorized for network access.

   2. N

      NikoTomas

      2024-08-17

      1 upvote

      According to CiscoPress SISE ebook, BYOD: --- For Android: "The NSP portal displays the device registration page with the Device ID field prepopulated with the MAC address of the endpoint." - you can see this also in the video at time 4:20: https://youtu.be/z0sRiffVdpg?t=264 - For Apple iOS, there are 2 certificates in the BYOD flow: 1. Device Enrollment ■ CN=device-UDID ■ SAN=MAC-Address --- 2. Device Provisioning ■ CN=Username ■ SAN=MAC-Address --- UDID is NOT hostname, just some numeric value and exists only for Apple. UDID according to Cisco is: "UDID Value. Match based on Unique Device Identifier (Apple specific)" https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867 - Example of UDID (it is just number): https://messapps.com/allcategories/development/finding-ios-devices-udid-via-itunes-2/ --- (continuation in comment)

   3. M

      matan24

      2023-10-10

      Selected B1 upvote

      i would go with B, "CN is auto populated with the username that is going through the BYOD flow. Other attributes can be entered here to reflect the site. If differentiating different endpoint or users based on certificate is needed, then any of the attributes here can be changed and can be used during AuthZ to provide differentiated access. For instance if OU=HR, the endpoint can have access to HR resources, while other endpoints cannot access HR resources" https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867

   4. N

      NikoTomas

      2024-08-17

      1 upvote

      Even thought CN can be MAC address (Device ID) in case of Android, this is NOT true for Apple iOS. So B (hostname in CN) is NOT correct according to me. See issued BYOD certificates here (screenshot in the section Manage issued certificates): https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId-2093653871 --- Endpoint certificate is NOT mandatory for BYOD. "While ISE supports various EAP types for 802.1X authentication, with ISE BYOD, there are three EAP Types that can be used; EAP-TLS, EAP-PEAP-MSCHAPv2, and EAP-FAST" https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867 --- (continuation in comment)

4. Question 4 of 25

   A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed interface. Which command should be used to accomplish this task?

   • Acts role-based policy priority-static
   • Bcts cache enable
   • Ccts authorization list
   • Dcts role-based enforcement

   Show answer

   Correct answer: D

   How others answered

   • D88%

   Explanation

   How to Configure CTS SGACL Support Enabling SGACL Policy Enforcement Globally To enable SGACL policy enforcement on Cisco TrustSec-enabled routed interfaces, perform this task: enable configure terminal cts role-based enforcement Enabling SGACL Policy Enforcement Per Interface You can enable SGACL enforcement globally and disable on a specific interface with cts role-based enforcement command. SGACL enforcement can also be enabled on specific interfaces without enabling it globally. To enable SGACL policy enforcement on interfaces, perform this task: enable configure terminal interface GigabitEthernet 0/1/1 cts role-based enforcement

   Adapted from community discussion by ed81044 · 2024-08-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

   1. E

      ed81044

      2024-08-18

      Selected D2 upvotes

      How to Configure CTS SGACL Support Enabling SGACL Policy Enforcement Globally To enable SGACL policy enforcement on Cisco TrustSec-enabled routed interfaces, perform this task: enable configure terminal cts role-based enforcement Enabling SGACL Policy Enforcement Per Interface You can enable SGACL enforcement globally and disable on a specific interface with cts role-based enforcement command. SGACL enforcement can also be enabled on specific interfaces without enabling it globally. To enable SGACL policy enforcement on interfaces, perform this task: enable configure terminal interface GigabitEthernet 0/1/1 cts role-based enforcement

   2. X

      XBfoundX

      2023-10-08

      1 upvote

      The answer is D: Procedure Command or Action Purpose Step 1 enable Example: Device# enable Enables privileged EXEC mode. Enter your password if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 cts role-based enforcement Example: Device(config)# cts role-based enforcement Enables Cisco TrustSec SGACL policy enforcement on routed interfaces. Step 4 end Example: Device(config)# end Exits global configuration mode and returns to privileged EXEC mode. cisco doc link below: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9200/software/release/16-11/configuration_guide/cts/b_1611_cts_9200_cg/configuring_security_group_acl_policies.html

   3. J

      jcms700

      2023-07-11

      Selected D2 upvotes

      per Cisco documentation "cts role-based enforcement" is the correct answer https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cts/configuration/xe-16/sec-usr-cts-xe-16-book/sec-cts-sgacl.html

   4. T

      THEODORABLE

      2023-05-17

      Selected D2 upvotes

      D is correct-- To enable SGACL policy enforcement on Cisco TrustSec-enabled routed interfaces, perform this task: enable configure terminal cts role-based enforcement

5. Question 5 of 25

   Select 2

   Which two components are required for creating a Native Supplicant Profile within a BYOD flow? (Choose two.)

   • ARedirect ACL
   • BConnection Type
   • COperating System
   • DWindows Settings
   • EiOS Settings

   Show answer

   Correct answer: B, C

   How others answered

   • BC100%

   Explanation

   The two components required for creating a Native Supplicant Profile within a BYOD flow are - Connection Type and - Operating System. The Connection Type specifies the type of connection that the supplicant will use to connect to the network. The Operating System specifies the operating system that the supplicant is running on. The other options are not required for creating a Native Supplicant Profile. The Redirect ACL is used to redirect users to a specific URL after they have authenticated. The Windows Settings and iOS Settings are used to configure the supplicant for Windows and iOS devices, respectively.

   Adapted from community discussion by denverfly · 2024-12-08 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

   1. D

      denverfly

      2024-12-08

      Selected B, C3 upvotes

      The two components required for creating a Native Supplicant Profile within a BYOD flow are - Connection Type and - Operating System. The Connection Type specifies the type of connection that the supplicant will use to connect to the network. The Operating System specifies the operating system that the supplicant is running on. The other options are not required for creating a Native Supplicant Profile. The Redirect ACL is used to redirect users to a specific URL after they have authenticated. The Windows Settings and iOS Settings are used to configure the supplicant for Windows and iOS devices, respectively.

   2. S

      Seawanderer

      2023-10-28

      Selected B, C2 upvotes

      Client provisioning -> Resources -> add -> Native Supplicant Profile. Read.

   3. M

      MrCalifornia

      2022-10-14

      2 upvotes

      B & C https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_01111.html

   4. Y

      YmerG

      2024-09-09

      Selected B, C1 upvote

      Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_configure_client_provisioning.html

6. Question 6 of 25

   An engineer is configuring a dedicated SSID for onboarding devices. Which SSID type accomplishes this configuration?

   • Ahidden
   • Bguest
   • Cdual
   • Dbroadcast

   Show answer

   Correct answer: B

   How others answered

   • B57%
   • C43%

   Only 57% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The correct answer is - guest. A guest SSID is a dedicated SSID that is used for onboarding devices. It is typically used for devices that are not owned by the organization, such as devices that are owned by employees or contractors. The guest SSID is typically configured with a lower level of security than the corporate SSID. This is because the devices that connect to the guest SSID are not trusted devices. The other options are not correct. A hidden SSID is an SSID that is not broadcast. This means that devices will not be able to see the SSID when they scan for networks. A dual SSID is a configuration where there are two SSIDs, one for corporate devices and one for guest devices. A broadcast SSID is an SSID that is broadcast. This means that devices will be able to see the SSID when they scan for networks.

   Adapted from community discussion by denverfly · 2023-06-08 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • cisco.com documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

   1. D

      denverfly

      2023-06-08

      Selected B4 upvotes

      The correct answer is - guest. A guest SSID is a dedicated SSID that is used for onboarding devices. It is typically used for devices that are not owned by the organization, such as devices that are owned by employees or contractors. The guest SSID is typically configured with a lower level of security than the corporate SSID. This is because the devices that connect to the guest SSID are not trusted devices. The other options are not correct. A hidden SSID is an SSID that is not broadcast. This means that devices will not be able to see the SSID when they scan for networks. A dual SSID is a configuration where there are two SSIDs, one for corporate devices and one for guest devices. A broadcast SSID is an SSID that is broadcast. This means that devices will be able to see the SSID when they scan for networks.

   2. Z

      ZappBrannigan

      2023-12-11

      Selected B3 upvotes

      I'm going with B, guest. hisho72 is correct in looking at the provided doc. I also referenced e-learning SISE chapter 10.2. It brought me to a same conclusion. Dual and Single SSID are methods of wireless setups for BYOD onboarding Guest is a type. Also, in that training module, it list "Open SSID" as a type for onboarding both guests and employees. Employees are then redirected to the Secure SSID.

   3. A

      awhamm

      2022-10-06

      Selected B3 upvotes

      The question asks for the SSID 'type' that performs the enrolment so should still be B. Guest. Even in the link it describes the concept of single vs. dual but Guest SSID is used for onboarding.

   4. N

      NikoTomas

      2024-03-03

      3 upvotes

      Question states "configuring a dedicated SSID for onboarding devices" - talking about 1 particular SSID, which should be dedicated for first phase of Dual-SSID BYOD approach. You are confusing SSID type (which is open or Guest in this case) with BYOD type (which is either Single-SSID or Dual-SSID). For me, correct answer is B - Guest SSID.

7. Question 7 of 25

   An engineer is designing a BYOD environment utilizing Cisco ISE for devices that do not support native supplicants. Which portal must the security engineer configure to accomplish this task?

   • ABYOD
   • BClient Provisioning
   • CMy Devices
   • DMDM

   Show answer

   Correct answer: C

   How others answered

   • C62%
   • B38%

   Only 62% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I will go for B too. the question is about design and put in production a solution for let authenticate devices that do not have native supplicant. The need to log in into the My device portal for add the device is not the right answer for me. In this guide is clear how to configure BYOD without the need of a native supplicant policy configured https://community.cisco.com/t5/security-blogs/ise-byod-registration-only-without-native-supplicant-or/ba-p/3099290 We can also define how many devices that does not support the native supplicant. After that we need to configure the specific authorization policies for these devices. https://www.google.com/search?sca_esv=584485115&sxsrf=AM9HkKl4Nf8vU-mivr0QzBoio-yaTCjJwQ:1700626451946&q=my+devices+portal+cisco+ise&tbm=vid&source=lnms&sa=X&ved=2ahUKEwik_8Cc39aCAxWIhv0HHV3eDxAQ0pQJegQICBAB&cshid=1700626456264194&biw=2400&bih=1138&dpr=0.8

   Adapted from community discussion by XBfoundX · 2023-11-22 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

   1. X

      XBfoundX

      2023-11-22

      3 upvotes

      I will go for B too. the question is about design and put in production a solution for let authenticate devices that do not have native supplicant. The need to log in into the My device portal for add the device is not the right answer for me. In this guide is clear how to configure BYOD without the need of a native supplicant policy configured https://community.cisco.com/t5/security-blogs/ise-byod-registration-only-without-native-supplicant-or/ba-p/3099290 We can also define how many devices that does not support the native supplicant. After that we need to configure the specific authorization policies for these devices. https://www.google.com/search?sca_esv=584485115&sxsrf=AM9HkKl4Nf8vU-mivr0QzBoio-yaTCjJwQ:1700626451946&q=my+devices+portal+cisco+ise&tbm=vid&source=lnms&sa=X&ved=2ahUKEwik_8Cc39aCAxWIhv0HHV3eDxAQ0pQJegQICBAB&cshid=1700626456264194&biw=2400&bih=1138&dpr=0.8

   2. Y

      YmerG

      2023-03-09

      Selected C3 upvotes

      Correct. look here: https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_byod.html#task_323AFE02F568400B93FFB3448D0CA3F3

   3. C

      Cnoteone

      2023-03-26

      Selected C2 upvotes

      Thanks YmerG! As per : https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_byod.html#task_323AFE02F568400B93FFB3448D0CA3F3 My Devices Portals: Enables employees to add and register personal devices, including those that do not support native supplicant provisioning, and then manage them.

   4. H

      Han2022

      2023-08-20

      3 upvotes

      The key point of question is "Which portal must the security engineer configure to accomplish this task?" So security engineer should configure for that not a user. Answer is B Client Provisioning Reference: Official Guide - Page 562

8. Question 8 of 25

   Select 2

   An employee logs on to the My Devices portal and marks a currently on-boarded device as `Lost`. Which two actions occur within Cisco ISE as a result of this action? (Choose two.)

   • ABYOD Registration status is updated to No.
   • BBYOD Registration status is updated to Unknown.
   • CThe device access has been denied.
   • DCertificates provisioned to the device are not revoked.
   • EThe device status is updated to Stolen.

   Show answer

   Correct answer: A, D

   How others answered

   • AD53%
   • CD47%

   Only 53% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Answers are correct https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_byod.html Lost: The user logs on to the My Devices portal, and marks a currently onboarded device as Lost that causes the following actions: The device is assigned to Blacklist identity group. Certificates provisioned to the device are not revoked. The device status is updated to Lost. BYODRegistration status is updated to No. A lost device still has network access unless you create an authorization policy to block lost devices.

   Adapted from community discussion by awhamm · 2022-10-06 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

   1. A

      awhamm

      2022-10-06

      6 upvotes

      Answers are correct https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_byod.html Lost: The user logs on to the My Devices portal, and marks a currently onboarded device as Lost that causes the following actions: The device is assigned to Blacklist identity group. Certificates provisioned to the device are not revoked. The device status is updated to Lost. BYODRegistration status is updated to No. A lost device still has network access unless you create an authorization policy to block lost devices.

   2. I

      IlPerdan0

      2023-01-04

      Selected A, D6 upvotes

      Lost: The user logs on to the My Devices portal, and marks a currently onboarded device as Lost that causes the following actions: - The device is assigned to Blacklist identity group. - Certificates provisioned to the device are not revoked. - The device status is updated to Lost. - BYODRegistration status is updated to No.

   3. X

      XBfoundX

      2023-11-20

      5 upvotes

      A and D answers are correct: • Lost—The user logs on to the MyDevices portal, and marks a currently onboarded device as Lost. That causes the following actions: • That device is assigned to Blacklist identity group. • Certificates provisioned to the device are not revoked. • The device status is updated to Lost. • “BYODRegistration” is updated to No https://www.cisco.com/c/ja_jp/td/docs/security/ise/2-7/admin_guide/workflow/html/b_byod_2_7.pdf

   4. C

      Cachaman

      2025-03-09

      Selected A, D1 upvote

      A & D Lost—The user logs on to the MyDevices portal, and marks a currently onboarded device as Lost. That causes the following actions: • That device is assigned to Blacklist identity group. • Certificates provisioned to the device are not revoked. • The device status is updated to Lost. • “BYODRegistration” is updated to No. A lost device still has network access unless you create an authorization policy to block lost devices. You can use the Blacklist identity group or the endpoint:BYODRegistration attribute in your rule. For example, IF Endpoint Identity Group is Blacklist AND EndPoints:BYODRegistrations Equals No THEN BYOD. For more granular access, you can also add NetworkAccess:EAPAuthenticationMethod Equals PEAP or EAP-TLS or EAP-FAST” , InternalUser:IdentityGroup Equals > to the IF part of the rule. https://www.cisco.com/c/ja_jp/td/docs/security/ise/2-7/admin_guide/workflow/html/b_byod_2_7.pdf

9. Question 9 of 25

   Select 2

   What are two components of the posture requirement when configuring Cisco ISE posture? (Choose two.)

   • AClient Provisioning portal
   • Bremediation actions
   • Cupdates
   • Daccess policy
   • Econditions

   Show answer

   Correct answer: B, E

   How others answered

   • BE100%

   Explanation

   https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_compliance.html#task_52F2E45628EF43C889B5559AF657B884 Create Client Posture Requirements You can create a requirement in the Requirements window where you can associate user-defined conditions and Cisco defined conditions, and remediation actions. Once created and saved in the Requirements window, user-defined conditions and remediation actions can be viewed from their respective list windows.

   Adapted from community discussion by iceise · 2023-11-07 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

   1. 5

      5tuple

      2022-09-02

      8 upvotes

      The given answer is correct (Conditions and Remediation actions) https://community.cisco.com/t5/security-documents/ise-posture-prescriptive-deployment-guide/ta-p/3680273 Check the video: "Posture Requirements"

   2. I

      iceise

      2023-11-07

      Selected B, E4 upvotes

      https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_compliance.html#task_52F2E45628EF43C889B5559AF657B884 Create Client Posture Requirements You can create a requirement in the Requirements window where you can associate user-defined conditions and Cisco defined conditions, and remediation actions. Once created and saved in the Requirements window, user-defined conditions and remediation actions can be viewed from their respective list windows.

   3. X

      XBfoundX

      2024-11-22

      2 upvotes

      Also for me this is correct. The flow is really specific the first two options are conditions and remediations. If we think in a logical way step by step this makes sense because the first thing that I have to configure are the conditions for have a compliant host in the network, the second step is that if a client is not compliant the client needs to solves that so we need to configure remediations also. This settings are available in the policy elements page. After that the client is compliant then you configure the policies for let the client have a specific result.

   4. B

      Bobolongo

      2022-06-01

      2 upvotes

      The correct answer is: https://community.cisco.com/t5/security-documents/ise-posture-prescriptive-deployment-guide/ta-p/3680273 Posture Configuration Flow Configuring posture assessment in ISE requires several components to be taken into consideration: Conditions, Remediations, Requirements, Posture Policy, Client Provisioning and Access Policy. Conditions and Acces Policy

10. Question 10 of 25

    A user reports that the RADIUS accounting packets are not being seen on the Cisco ISE server. Which command is the user missing in the switch's configuration?

    • Aaaa accounting resource default start-stop group radius
    • Bradius-server vsa send accounting
    • Caaa accounting network default start-stop group radius
    • Daaa accounting exec default start-stop group radius

    Show answer

    Correct answer: C

    How others answered

    • C77%
    • B23%

    Explanation

    The correct answer is aaa accounting network default start-stop group radius. The command aaa accounting network default start-stop group radius enables RADIUS accounting for all network activity on the switch. This includes both inbound and outbound traffic. The start-stop keyword tells the switch to send a RADIUS accounting packet at the beginning and end of each network activity. The group radius keyword tells the switch to send the RADIUS accounting packets to the RADIUS server that is configured in the radius-server command.

    Adapted from community discussion by denverfly · 2023-11-30 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. D

       denverfly

       2023-11-30

       Selected C5 upvotes

       The correct answer is aaa accounting network default start-stop group radius. The command aaa accounting network default start-stop group radius enables RADIUS accounting for all network activity on the switch. This includes both inbound and outbound traffic. The start-stop keyword tells the switch to send a RADIUS accounting packet at the beginning and end of each network activity. The group radius keyword tells the switch to send the RADIUS accounting packets to the RADIUS server that is configured in the radius-server command.

    2. L

       Leogxn

       2024-01-30

       Selected C3 upvotes

       radius-server vsa send accounting - > Enables the gateway to recognize and use accounting VSAs as defined by RADIUS attribute 26. aaa accounting network default start-stop group radius - > Enable accounting for all network-related service requests and list the default method to use for all start-stop accounting services.

    3. X

       XBfoundX

       2024-05-24

       2 upvotes

       For me in this case is B: You can configure the device to send Cisco vendor-specific attributes (VSAs) to the RADIUS server. Before VSAs can be sent in the accounting records you must configure this command: radius-server vsa send accounting Here they are asking about the switch that needs to send these packets. BTW in every reference guide the configuration provided by Cisco is this: You must configure the RADIUS server to perform accounting tasks. Router# configure terminal Router(config)# aaa new-model Router(config)# radius-server host 172.20.39.46 auth-port 1812 acct-port 1813 key rad123 Router(config)# aaa accounting dot1x default start-stop group radius Router(config)# aaa accounting system default start-stop group radius Router(config)# end Router#

    4. M

       MrCalifornia

       2021-10-14

       4 upvotes

       CORRECT IS C Cause Beginning from Cisco IOS version 15.2(1)E / XE 3.5.0E , the VSA commands are enabled by default. To disbale VSA, the “no” option must be used. Correct answer is the command in answer C

11. Question 11 of 25

    Select 2

    Refer to the exhibit.

    

    A network engineer is configuring the switch to accept downloadable ACLs from a Cisco ISE server. Which two commands should be run to complete the configuration? (Choose two.)

    • Aradius-server attribute 8 include-in-access-req
    • Bip device tracking
    • Cdot1x system-auth-control
    • Dradius server vsa send authentication
    • Eaaa authorization auth-proxy default group radius

    Show answer

    Correct answer: B, C

    How others answered

    • BC50%
    • AC25%
    • BD25%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer is B and D https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/15-mt/sec-user-8021x-15-mt-book/sec-ieee-802x-acl-assign.html Configuring Downloadable ACLs To configure a switch to accept downloadable ACLs or redirect URLs from the RADIUS server during authentication of an attached host, perform this task. SUMMARY STEPS 1. enable 2. configure terminal 3. ip device tracking 4. aaa new-model 5. aaa authorization network default group radius 6. radius-server vsa send authentication 7. interface interface-id 8. ip access-group acl-id in 9. end 10. show running-config interfaceinterface-id 11. copy running-config startup-config

    Adapted from community discussion by DarkArmy · 2024-04-09 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. N

       Natcat

       2021-08-03

       8 upvotes

       Correct answer should be B and D. Option C is only enable dot1x globally, not for accept downloadable ACLs.

    2. X

       XBfoundX

       2024-05-24

       3 upvotes

       For me the two answers are dot1x enable globally and the device ip tracking command. If i don't have dot1x enabled my switch will simply does not use the dot1x feature. How a switch can download a dynamic acl from ISE if i do not enable the feature that permit to that client to authenticate via ISE and based on what result he got he will receive a result with a dACL? the ip tracking device feature is enabled for this purpose: per-user ACL with any SW use ip tracking to re-arrange the ACL to add instead of any to host IP. What this means is that the device ip tracking command let the switch modify that specific acl with the host ip address /32 address of the device that is connected to that port.

    3. D

       DarkArmy

       2024-04-09

       3 upvotes

       Answer is B and D https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/15-mt/sec-user-8021x-15-mt-book/sec-ieee-802x-acl-assign.html Configuring Downloadable ACLs To configure a switch to accept downloadable ACLs or redirect URLs from the RADIUS server during authentication of an attached host, perform this task. SUMMARY STEPS 1. enable 2. configure terminal 3. ip device tracking 4. aaa new-model 5. aaa authorization network default group radius 6. radius-server vsa send authentication 7. interface interface-id 8. ip access-group acl-id in 9. end 10. show running-config interfaceinterface-id 11. copy running-config startup-config

    4. J

       JimboOh

       2023-09-18

       Selected B, C3 upvotes

       To configure a switch to accept downloadable ACLs from a Cisco ISE server, the following two commands are required: B. ip device tracking: This command enables the switch to track IP device information, which is needed for the ISE server to provide dynamic access policies based on a device's IP address. C. dot1x system-auth-control: This command enables 802.1X authentication on the switch and allows the switch to forward authentication requests to the ISE server.

12. Question 12 of 25

    An administrator is migrating device administration access to Cisco ISE from the legacy TACACS+ solution that used only privilege 1 and 15 access levels. The organization requires more granular controls of the privileges and wants to customize access levels 2-5 to correspond with different roles and access needs. Besides defining a new shell profile in Cisco ISE, what must be done to accomplish this configuration?

    • AEnable the privilege levels in Cisco ISE.
    • BEnable the privilege levels in the IOS devices.
    • CDefine the command privileges for levels 2-5 in Cisco ISE.
    • DDefine the command privileges for levels 2-5 in the IOS devices.

    Show answer

    Correct answer: C

    How others answered

    • C68%
    • D26%

    Only 68% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct is D: „Define the command privileges for levels 2-5 in the IOS devices”. --- - Privilege level under which NAD sends commands to ISE for authorization IS NOT specified by privilege level of USER but by privilege level of COMMAND - i. e. level to which particular COMMAND belongs. https://community.cisco.com/t5/network-access-control/command-authorization-by-ise/td-p/3577202 - Commands by default belongs to level 1 or 15. Question states another levels. - "When you set a command to a privilege level, all commands whose syntax is a subset of that command are also set to that level. ..." https://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3se/consolidated_guide/b_consolidated_3850_3se_cg_chapter_0110010.html#ref_1352530 - We for sure need to configure IOS device privilege levels with desired commands. - Answer B: “Enable the privilege levels in the IOS devices.” - not correct, as levels are not disabled, just not configured

    Adapted from community discussion by NikoTomas · 2024-08-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. W

       west33637

       2023-07-29

       Selected C8 upvotes

       the command privileges for 2 - 5 are defined in ISE, not on the IOS device. If the IOS device defines the command privileges, then why do we even need ISE. When ISE is centrally managing the network devices, it configures the command privileges and the shell profile.

    2. D

       denverfly

       2023-11-30

       Selected C4 upvotes

       The correct answer is Define the command privileges for levels 2-5 in Cisco ISE. Cisco ISE provides centralized authentication, authorization, and accounting (AAA) for network devices. The device administration service in Cisco ISE allows you to define custom privilege levels and assign commands to each level. To accomplish this configuration, you must define the command privileges for levels 2-5 in Cisco ISE.

    3. N

       NikoTomas

       2024-08-19

       2 upvotes

       Correct is D: „Define the command privileges for levels 2-5 in the IOS devices”. --- - Privilege level under which NAD sends commands to ISE for authorization IS NOT specified by privilege level of USER but by privilege level of COMMAND - i. e. level to which particular COMMAND belongs. https://community.cisco.com/t5/network-access-control/command-authorization-by-ise/td-p/3577202 - Commands by default belongs to level 1 or 15. Question states another levels. - "When you set a command to a privilege level, all commands whose syntax is a subset of that command are also set to that level. ..." https://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3se/consolidated_guide/b_consolidated_3850_3se_cg_chapter_0110010.html#ref_1352530 - We for sure need to configure IOS device privilege levels with desired commands. - Answer B: “Enable the privilege levels in the IOS devices.” - not correct, as levels are not disabled, just not configured

    4. F

       faridh

       2024-02-25

       3 upvotes

       ciscopress book page 933: The remaining privilege levels, 2 through 14, are available for customization in individual IOS devices. If you were to use a customized privilege level, it would need to be configured on an IOS device first before it could be called as a TACACS+ result.

13. Question 13 of 25

    Select 2

    Which two Cisco ISE deployment models require two nodes configured with dedicated PAN and MnT personas? (Choose two.)

    • Aseven PSN nodes with one PxGrid node
    • Btwo PSN nodes with one PxGrid node
    • Cfive PSN nodes with one PxGrid node
    • Dsix PSN nodes:
    • Ethree PSN nodes

    Show answer

    Correct answer: B, E

    How others answered

    • BE45%
    • AD45%

    Only 45% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The questions says: dedicated PAN and MnT personas. So 1 PAN and 1 MnT. That means A and D are correct. If you read it like dedicated combined PAN and MnT nodes (1 node with prim. PAN and prim. MnT, and 1 node with sec. PAN and sec. Mnt) it would be B, C and E. But we need to select just 2 options so I would go for A and D. Nice those clear Cisco questions…

    Adapted from community discussion by kornalt · 2023-07-14 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. S

       shonda319

       2023-03-24

       Selected B, E7 upvotes

       correct answers are B and E. Maximum PSNs + PXG nodes = 5 https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/install_guide/b_ise_InstallationGuide23/b_ise_InstallationGuide23_chapter_00.pdf

    2. K

       kornalt

       2023-07-14

       3 upvotes

       The questions says: dedicated PAN and MnT personas. So 1 PAN and 1 MnT. That means A and D are correct. If you read it like dedicated combined PAN and MnT nodes (1 node with prim. PAN and prim. MnT, and 1 node with sec. PAN and sec. Mnt) it would be B, C and E. But we need to select just 2 options so I would go for A and D. Nice those clear Cisco questions…

    3. N

       NikoTomas

       2024-09-03

       1 upvote

       Sorry again, it must be really A) & D). My interpretation of the question as "TWO NODES" for PAN and MnT (not 4 nodes) leads to Medium-size deployment and 3 correct answers (optionally 4 if ISE v3+ is used): - B) - two PSNs + one PxGrid - C) - five PSNs + one PxGrid - E) - three PSNs - D) - six PSNs in ISE v3 (but question is for sure from older versions) --- As correct are only 2 options, we can SURELY say that question "two nodes configured with dedicated PAN and MnT" actually means LARGE deployment with 4 nodes (2x PAN, 2x MnT). So, correct are the answers with more than 5 PSNs (or more 6 PSN for ISE v3), i. e., CORRECT ARE: A. seven PSN nodes with one PxGrid node D. six PSN nodes (question is is for sure from ISE v2.x)

    4. C

       Chris1210

       2023-05-23

       1 upvote

       i think correct answers are B and D In a distributed deployment, you can have the following combination of nodes on your network: - Primary and secondary Administration nodes for high availability - A pair of Monitoring nodes for automatic failover - One or more Policy Service nodes for session failover - One or more pxGrid nodes for pxGrid services Remember that pxgrid is not mandatory, If we have two nodes dedicated (with no PSN and PxGrid), Option 1 (2 nodes PAN+MNT dedicated + 2 nodes PSN with or without pxgrid) Option 2 (2 nodes PAN+MNT dedicated + 6 nodes PSN with or without pxgrid) Three nodes couldnt be a valid response because nodes with PAN and Mnt won't be dedicated, they need to have PSN service in all nodes

14. Question 14 of 25

    

    Refer to the exhibit. An engineer is configuring Cisco ISE for guest services. They would like to have any unregistered guests redirected to the guest portal for authentication, then have a CoA provide them with full access to the network that is segmented via firewalls. Why is the given configuration failing to accomplish this goal?

    • AThe Guest Portal and Guest Access policy lines are in the wrong order.
    • BThe PermitAccess result is not set to restricted access in its policy line.
    • CThe Network_Access_Authentication_Passed condition will not work with guest services for portal access.
    • DThe Guest_Flow condition is not in the line that gives access to the guest portal.

    Show answer

    Correct answer: A

    How others answered

    • A75%
    • D25%

    Explanation

    the lines are in the wrong order. The initial flow is MAB - not guest flow - https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475#toc-hId-1320686318 Guest flow only starts as soon as the user enters his credentials

    Adapted from community discussion by MORTND · 2024-01-25 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. X

       XBfoundX

       2024-05-25

       3 upvotes

       For me the answer is A. B and C are not true, and D is not also right the Guest_Flow condition is not used for give access to the webportal. A is true because the Network_Access_Authentication_Passed attribute is the default condition for network access, so the first policy is saying if authentication is ok the client is going to be redirected. After that the client is going to be authenticated again the MAB authentication will be successful again, so this means that the user will be again redirected to the portal because is gonna match always the firts policy. What we must do is change the order of the policies. After that the user is gonna to authenticate then the CoA will be sent and another process for authentication will occur. After that this time the policy that will be hit is the Guest Portal, that means if you have done a Guest_Flow correctly then permitaccess

    2. M

       MORTND

       2024-01-25

       Selected A4 upvotes

       the lines are in the wrong order. The initial flow is MAB - not guest flow - https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475#toc-hId-1320686318 Guest flow only starts as soon as the user enters his credentials

    3. N

       NikoTomas

       2024-09-04

       1 upvote

       Because: 1. Guest connects his unknown device to the network, no supplicant, so MAB will occur. 2. First rule "Guest Portal" redirects to WebAuth portal, where guest authenticates. 3. ISE issues CoA, NAD will start new authentication (which is MAB again, as guest does not have supplicant). 4. As "Guest Portal" rule is #1 in the policy, MAB will hit it again and redirecs guest to WebAuth portal (again). 5. As rule "Guest Access", which matches Guest_Flow (i. e. guest is autheticated) is on #2 place, it will never match. So guest keeps looping on rule #1. --- We need to move rule "Guest Access" to the top (#1). If not authenticated guest connects, the #1 rule (Guest_Flow) will NOT match and ISE will continue to rule #2 (WebAuth portal). As authenticated guest is being evaluated after CoA, policy matches rule #1 (Guest_Flow) and guest is allowed to the network.

    4. C

       cris711

       2024-06-13

       4 upvotes

       Guest_Flow is used to identify when an authentication has occurred via an ISE web portal.

15. Question 15 of 25

    While configuring Cisco TrustSec on Cisco IOS devices, the engineer must set the CTS device ID and password in order for the devices to authenticate with each other. However, after this is complete, the devices are not able to properly authenticate. What issue would cause this to happen even if the device ID and passwords are correct?

    • AEAP-FAST is not enabled.
    • BThe SGT mappings have not been defined.
    • CThe device aliases are not matching.
    • DThe devices are missing the configuration cts credentials trustsec verify 1.

    Show answer

    Correct answer: A

    How others answered

    • A78%

    Explanation

    I believe A is the correct answer. This question appears to be calling out NDAC which uses EAP-FAST. It's not B because SGT mappings don't have anything to do with devices authenticating to each other. It's not C because I don't think there is a device alias concept in TrustSec It's not D because this command doesn't exist as far as I can tell.

    Adapted from community discussion by tliz · 2024-02-15 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. T

       tliz

       2024-02-15

       Selected A6 upvotes

       I believe A is the correct answer. This question appears to be calling out NDAC which uses EAP-FAST. It's not B because SGT mappings don't have anything to do with devices authenticating to each other. It's not C because I don't think there is a device alias concept in TrustSec It's not D because this command doesn't exist as far as I can tell.

    2. X

       XBfoundX

       2024-11-25

       3 upvotes

       I go with A. Device# cts credentials id device-id password password Specifies the Cisco TrustSec device ID and password for this switch to use when authenticating with other Cisco TrustSec devices with EAP-FAST. The device-id argument has a maximum length of 32 characters and is case sensitive. https://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/configuration/guide/trustsec/ident-conn_config.html

    3. F

       flambadone

       2024-10-03

       1 upvote

       I don't think this is correct. The question implies this is done with 'However, after this is complete' - because the last sentence says 'you have to use a username and password'. Personally I'm going with A

    4. G

       Gago77

       2024-02-06

       1 upvote

       the Cisco TrustSec device ID and password for this switch to use when authenticating with other Cisco TrustSec devices with EAP-FAST.

16. Question 16 of 25

    Select 2

    An administrator is configuring a Cisco WLC for web authentication. Which two client profiling methods are enabled by default if the Apply Cisco ISE Default Settings check box has been selected? (Choose two.)

    • ALLDP
    • BCDP
    • CDHCP
    • DSNMP
    • EHTTP

    Show answer

    Correct answer: C, E

    How others answered

    • CE82%
    • CD18%

    Explanation

    no need to vote - provided answer is correct see wlc config doc: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-4/config-guide/b_cg84/initial_setup.html (Optional) Enable Apply Cisco ISE default settings to automatically set the following parameters: RADIUS client profiling: DHCP profiling and HTTP profiling are enabled by default

    Adapted from community discussion by johndelorien · 2024-06-03 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. J

       johndelorien

       2024-06-03

       Selected C, E6 upvotes

       no need to vote - provided answer is correct see wlc config doc: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-4/config-guide/b_cg84/initial_setup.html (Optional) Enable Apply Cisco ISE default settings to automatically set the following parameters: RADIUS client profiling: DHCP profiling and HTTP profiling are enabled by default

    2. X

       XBfoundX

       2024-10-26

       3 upvotes

       CE ARE RIGHT: By default in the radius client profiling tab there is specified to enable DHCP and HTTP profiling: https://community.cisco.com/t5/security-knowledge-base/top-six-important-cisco-wlc-settings-for-ise-integration/ta-p/3643795 https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/7-5/NativeProfiling75.html just se ctrl + f and search for profiling, you will see the wlc dashboard with this two options in the images.

    3. B

       Borostu

       2024-02-23

       3 upvotes

       By default, the DHCP, RADIUS, Network Mapper (NMAP), Simple Network Management Protocol (SNMP) QUERY, and Active Directory probes are enabled.

    4. Y

       YmerG

       2024-03-11

       Selected C, E2 upvotes

       I would say the provided answer is correct. According to the book we need to enable HTTP and DHCP profiling option in WLC so probably this option will automate this process

17. Question 17 of 25

    What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?

    • AThe secondary node restarts.
    • BThe primary node restarts.
    • CBoth nodes restart.
    • DThe primary node becomes standalone.

    Show answer

    Correct answer: A

    How others answered

    • A74%
    • C19%

    Only 74% agreed on this answer — treat it as contested rather than settled.

    Explanation

    primary keep working tested on my LAB in eve--ng read the question its say deregisters Answer is: A Secondary Restart pls correct the answer

    Adapted from community discussion by Cybersec1989 · 2022-02-21 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. C

       Cybersec1989

       2022-02-21

       Selected A10 upvotes

       primary keep working tested on my LAB in eve--ng read the question its say deregisters Answer is: A Secondary Restart pls correct the answer

    2. G

       g33k

       2024-09-27

       Selected A2 upvotes

       Effects of Modifying Nodes in Cisco ISE When you make any of the following changes to a node in a Cisco ISE, that node restarts, which causes a delay: Register a node (Standalone to Secondary) Deregister a node (Secondary to Standalone) Change a primary node to Standalone (if no other nodes are registered with it; Primary to Standalone) Promote an Administration node (Secondary to Primary) Change the personas (when you assign or remove the Policy Service or Monitoring persona from a node) Modify the services in the Policy Service node (enable or disable the session and profiler services) Restore a backup on the primary and a sync up operation is triggered to replicate data from primary to secondary nodes Taken straight from: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_setup_cisco_ise.html#ID193

    3. M

       MrCalifornia

       2021-04-14

       2 upvotes

       the question is strange. shuld be A if intended node = application in this case . more info on See Chapter 10, "Setting Up Inline Posture" for information on how to deregister Inline Posture nodes. The application server in an ISE node restarts when you make any of the following changes: •Register a node (Standalone to Secondary) •Deregister a node (Secondary to Standalone) •Primary node is changed to Standalone (if no other nodes are registered with it; Primary to Standalone) •Administration ISE node is promoted (Secondary to Primary) •Change the personas (when you assign or remove the Policy Service or Monitoring persona from a node) •Modify the services in the Policy Service ISE node (enable or disable the session and profiler services) •Restore a backup on the primary and a sync up operation is triggered to replicate data from primary to secondary nodes Note When you make any of the above changes, the application services are restarted. You must expect a delay while these services restart.

    4. N

       NikoTomas

       2024-02-26

       1 upvote

       ISE 3.0 and later - Youki82 is correct: Primary PAN node does NOT become standalone when Secondary is deregistered: "If the node has a Primary role, and there are no other nodes registered with it, the Make Standalone button appears next to it." - this means that you have to make it Standalone manually after deregistration of Secondary. "When you make any of the following changes to a node in a Cisco ISE, that node restarts... - Register a node (Standalone to Secondary) - DEREGISTER a node (Secondary to Standalone) - Change a primary node to Standalone (if no other nodes are registered with it; Primary to Standalone) - Promote an Administration node (Secondary to Primary) ... Note When you promote the secondary Administration node to the primary PAN position, the primary node will assume a secondary role. This causes both the primary and secondary nodes to restart, causing a delay. " https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_deployment.html

18. Question 18 of 25

    A user changes the status of a device to stolen in the My Devices Portal of Cisco ISE. The device was originally onboarded in the BYOD wireless Portal without a certificate. The device is found later, but the user cannot re-onboard the device because Cisco ISE assigned the device to the Blocklist endpoint identity group. What must the user do in the My Devices Portal to resolve this issue?

    • AManually remove the device from the Blocklist endpoint identity group.
    • BChange the device state from Stolen to Not Registered.
    • CChange the BYOD registration attribute of the device to None.
    • DDelete the device, and then re-add the device.

    Show answer

    Correct answer: D

    How others answered

    • D63%
    • B25%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The correct answer is D. Delete the device, and then re-add the device. When a device is marked as stolen in the My Devices Portal of Cisco ISE, it is automatically assigned to the Blocklist endpoint identity group. This group is used to prevent unauthorized devices from accessing the network. In order to resolve this issue and re-onboard the device, the user needs to delete the device from the My Devices Portal. This will remove it from the Blocklist endpoint identity group. Once deleted, the user can then re-add the device and go through the onboarding process again. Options A, B, and C are incorrect because they do not address the issue of being assigned to the Blocklist endpoint identity group. Manually removing the device from this group (option A) would require administrative access and may not be possible for a regular user. Changing the device state from stolen to not registered (option B) or changing the BYOD registration attribute of the device to none (option C) would not remove it from the Blocklist endpoint identity group.

    Adapted from community discussion by faridh · 2023-08-19 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. F

       faridh

       2023-08-19

       Selected D3 upvotes

       The correct answer is D. Delete the device, and then re-add the device. When a device is marked as stolen in the My Devices Portal of Cisco ISE, it is automatically assigned to the Blocklist endpoint identity group. This group is used to prevent unauthorized devices from accessing the network. In order to resolve this issue and re-onboard the device, the user needs to delete the device from the My Devices Portal. This will remove it from the Blocklist endpoint identity group. Once deleted, the user can then re-add the device and go through the onboarding process again. Options A, B, and C are incorrect because they do not address the issue of being assigned to the Blocklist endpoint identity group. Manually removing the device from this group (option A) would require administrative access and may not be possible for a regular user. Changing the device state from stolen to not registered (option B) or changing the BYOD registration attribute of the device to none (option C) would not remove it from the Blocklist endpoint identity group.

    2. J

       JimboOh

       2023-03-18

       3 upvotes

       Actually I think it may be D as YmerG says, "If a user reinstates a stolen device, the status reverts to not registered. The user must delete that device, and add that it back. That starts the onboarding process."

    3. C

       ccamar

       2023-06-16

       Selected D1 upvote

       If the device was onboarded by provisioning a profile (no certificate), Cisco ISE assigns the device to the Blacklist endpoint identity group. The device still has network access, unless you create an authorization policy for this situation. For example, IF Endpoint Identity Group is Blacklist AND BYOD_is_Registered THEN DenyAccess. If a user reinstates a stolen device, the status reverts to Not Registered. The user must delete that device, and add it back. This starts the onboarding process.

    4. Y

       YmerG

       2023-03-11

       2 upvotes

       Very tricky question as if a user reinstates a stolen device, the status reverts to Not Registered. The user must delete that device, and add it back. This starts the onboarding process. So there is no reinstate in the options but since reinstate is the action it will lead to unregistered device. Once reinstating the device it must be deleted and readded. I am still in doubt between B and D

19. Question 19 of 25

    How is policy services node redundancy achieved in a deployment?

    • Aby creating a node group
    • Bby deploying both primary and secondary node
    • Cby enabling VIP
    • Dby utilizing RADIUS server list on the NAD

    Show answer

    Correct answer: A

    How others answered

    • A59%
    • D41%

    Only 59% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Hello yes, the answer is D. Node groups don't necessarily provide HA for your NADs, they just share extra information about endpoints with other nodes on the same L2 domain. They have a basic monitor role of their peers so that they can help client authentication recover when a node fails mid web redirect. The HA and impact of an upgrade is dependent on how you have the radius servers configured on the NAD, not the node groups. If you want HA during an upgrade you still need to make sure you have at least two radius servers configured on each NAD, and at least one of those servers is online and able to authenticate endpoints. If you go look up the CiscoLive.com library session BRKSEC-3699, there is a detailed section on the function of node groups in the reference slide deck.

    Adapted from community discussion by kapplejacks · 2022-01-16 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. P

       Pipi

       2021-03-25

       7 upvotes

       Correct answer is A. If you configure a node group and one PSN goes down, the other will send a CoA and take over.

    2. M

       MrCalifornia

       2021-04-14

       5 upvotes

       CORRECT IS A https://www.ciscopress.com/articles/article.asp?p=2812072&seqNum=2 If a PSN goes down and orphans a URL-redirected session, one of the other PSNs in the node group sends a Change of Authorization (CoA) to the NAD so that the endpoint can restart the session establishment with a new PSN.

    3. K

       kapplejacks

       2022-01-16

       3 upvotes

       Hello yes, the answer is D. Node groups don't necessarily provide HA for your NADs, they just share extra information about endpoints with other nodes on the same L2 domain. They have a basic monitor role of their peers so that they can help client authentication recover when a node fails mid web redirect. The HA and impact of an upgrade is dependent on how you have the radius servers configured on the NAD, not the node groups. If you want HA during an upgrade you still need to make sure you have at least two radius servers configured on each NAD, and at least one of those servers is online and able to authenticate endpoints. If you go look up the CiscoLive.com library session BRKSEC-3699, there is a detailed section on the function of node groups in the reference slide deck.

    4. F

       faridh

       2023-08-20

       Selected A3 upvotes

       A is correct. The question ask for redundancy in "deployment" not in configuration so D is not the right choice. Additionally, utilizing RADIUS server list on NAD make redundancy for authentication, the attributes also share between group nodes. When a member of a node group learns endpoint attributes (through profiling), it is able to send the information directly to the other members of the node group.

20. Question 20 of 25

    A network engineer responsible for the switching environment must provision a new switch to properly propagate security group tags within the TrustSec inline method. Which CLI command must the network engineer enter on the switch to globally enable the tagging of SGTs?

    • Acts sxp enable
    • Bcts manual
    • Ccts role-based sgt-map
    • Dcts role-based enforcement

    Show answer

    Correct answer: B

    How others answered

    • B83%
    • A17%

    Explanation

    Correct is D: "cts role-based enforcement" Ebook SISE: "Configuring Manual SGT Propagation on Cisco IOS XE Switches This section discusses the configuration of SGT propagation on access-layer switches such as the Catalyst 9300 and 9500 switches that have the ability to use native tags. Step 1. Enable Cisco TrustSec role-based enforcement on the switch: CAT9300(config)# cts role-based enforcement This GLOBALLY ENABLES THE TAGGING of frames. It also makes it possible to enforce SGACLs... Without this command in the global configuration, the switch does not tag the Layer 2 traffic." Example 17-4 Enabling Tagging on a 9300 Series Access Switch C9300(config)# cts role-based enforcement C9300(config)# interface g1/0/1 C9300(config-if)# cts manual C9300(config-if-cts-manual)# policy static sgt 2 trusted --- Confusing is that Cisco do not mention a word regarding tagging activation in the command reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/17-3/command_reference/b_173_9500_cr/cisco_trustsec_commands.html#wp2692401855

    Adapted from community discussion by NikoTomas · 2024-02-25 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. N

       NikoTomas

       2024-02-25

       5 upvotes

       Correct is D: "cts role-based enforcement" Ebook SISE: "Configuring Manual SGT Propagation on Cisco IOS XE Switches This section discusses the configuration of SGT propagation on access-layer switches such as the Catalyst 9300 and 9500 switches that have the ability to use native tags. Step 1. Enable Cisco TrustSec role-based enforcement on the switch: CAT9300(config)# cts role-based enforcement This GLOBALLY ENABLES THE TAGGING of frames. It also makes it possible to enforce SGACLs... Without this command in the global configuration, the switch does not tag the Layer 2 traffic." Example 17-4 Enabling Tagging on a 9300 Series Access Switch C9300(config)# cts role-based enforcement C9300(config)# interface g1/0/1 C9300(config-if)# cts manual C9300(config-if-cts-manual)# policy static sgt 2 trusted --- Confusing is that Cisco do not mention a word regarding tagging activation in the command reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/17-3/command_reference/b_173_9500_cr/cisco_trustsec_commands.html#wp2692401855

    2. T

       thol119

       2023-11-03

       4 upvotes

       I would go for B as it is the only command that has anything to do with inline SGT tagging. The others are for sgt-mapping, SGACL enforcment and SXP. But CTS manual is not global, it is per interface, so weird question.

    3. Z

       ZoneHacker

       2024-07-04

       Selected B1 upvote

       The correct answer is the B. cts manual Example: SGT Static Inline Tagging This example shows how to enable an interface on the device for L2-SGT tagging or imposition and defines whether the interface is trusted for Cisco TrustSec Device# configure terminal Device(config)# interface gigabitethernet 1/0/1 Device(config-if)# cts manual Device(config-if-cts-manual)# propagate sgt Device(config-if-cts-manual)# policy static sgt 77 trusted

    4. C

       ce1997d

       2025-03-10

       Selected B1 upvote

       Very poor question. cts manual is configured at interface not global. cts role-based is a global config but it only enables SGT tagging on routed interfaces which may not be used since they specified its a switching environment. So both B and D are kind of right kind of wrong.

21. Question 21 of 25

    Which Cisco ISE module contains a list of vendor names, product names, and attributes provided by OPSWAT?

    • ACompliance Module
    • BClient Provisioning Module
    • CEndpoint Security Module
    • DPosture Module

    Show answer

    Correct answer: A

    How others answered

    • A79%
    • D21%

    Explanation

    The compliance module contains a list of fields, such as vendor name, product version, product name, and attributes provided by OPSWAT that supports Cisco ISE posture conditions. https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010001.html#:~:text=The%20compliance%20module%20contains%20a,supports%20Cisco%20ISE%20posture%20conditions.

    Adapted from community discussion by G0909 · 2024-05-14 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. G

       G0909

       2024-05-14

       Selected A6 upvotes

       The compliance module contains a list of fields, such as vendor name, product version, product name, and attributes provided by OPSWAT that supports Cisco ISE posture conditions. https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010001.html#:~:text=The%20compliance%20module%20contains%20a,supports%20Cisco%20ISE%20posture%20conditions.

    2. 4

       4004aa3

       2024-06-30

       Selected A3 upvotes

       https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_compliance.html?bookSearch=true

    3. C

       Cachaman

       2025-03-23

       Selected A1 upvote

       Correct A Compliance Module The compliance module contains a list of fields, such as vendor name, product version, product name, and attributes provided by OPSWAT that supports Cisco ISE posture conditions. https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_compliance.html#id_17065 Posture Checks (this one uses the library) The ISE Posture module uses the OPSWAT v3 or v4 library to perform posture checks. https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect44/administration/guide/b_AnyConnect_Administrator_Guide_4-4/configure-posture.html

    4. B

       BoxChevy

       2025-03-04

       Selected A1 upvote

       https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_compliance.html.

22. Question 22 of 25

    Select 2

    Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose two.)

    • Anew AD user 802.1X authentication
    • Bhotspot
    • Cposture
    • Dguest AUP
    • EBYOD

    Show answer

    Correct answer: A, C

    How others answered

    • AC90%

    Explanation

    The following table lists the features that are affected when the primary PAN goes down and the secondary PAN is yet to take over. Features Name Available When Primary PAN is Down? (Yes/No) Existing or new AD user RADIUS authentication Yes Guest: AUP No Posture Yes BYOD with Internal CA No

    Adapted from community discussion by iceise · 2022-11-04 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. S

       Seawanderer

       2022-04-28

       Selected A, C10 upvotes

       https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_setup_cisco_ise.html

    2. D

       denverfly

       2023-07-03

       1 upvote

       New AD user 802.1X authentication: When a new AD user is created, Cisco ISE needs to communicate with Active Directory to authenticate the user. If the primary admin node is down, this communication cannot happen and the user will not be able to authenticate using 802.1X. Posture: Posture is a feature that allows Cisco ISE to assess the security posture of a device before it is allowed to access network resources. This assessment includes checking for software updates, virus signatures, and other security vulnerabilities. If the primary admin node is down, Cisco ISE cannot perform posture assessments and devices will be allowed to access network resources even if they are not up to date with security patches. Guest AUP: Guest AUP is a feature that allows you to create a policy that guests must agree to before they can access network resources. If the primary admin node is down, guests will not be able to agree to the Guest AUP and will not be able to access network resources.

    3. F

       Fenstar

       2021-01-14

       4 upvotes

       Correct answers A & C: https://community.cisco.com/t5/network-access-control/what-happens-when-ise-primary-admin-node-and-secondary-admin/m-p/3598156

    4. M

       MUKD

       2022-06-25

       2 upvotes

       New qns Users in an organization report issues about having to remember multiple usernames and passwords. The network administrator wants the existing Cisco ISE deployment to utilize an external identity source to alleviate this issue. Which two requirements must be met to implement this change? (Choose two.) A. Enable IPC access over port 80. B. Ensure that the NAT address is properly configured C. Establish access to one Global Catalog server. D. Provide domain administrator access to Active Directory. E. Configure a secure LDAP connection.

23. Question 23 of 25

    An organization wants to standardize the 802.1X configuration on their switches and remove static ACLs on the switch ports while allowing Cisco ISE to communicate to the switch what access to provide. What must be configured to accomplish this task?

    • Adynamic access list within the authorization profile
    • Bextended access-list on the switch for the client
    • Csecurity group tag within the authorization policy
    • Dport security on the switch based on the client's information

    Show answer

    Correct answer: A

    How others answered

    • A86%

    Explanation

    SGTs are usable where Trust Sec is deployed, the question simply asks about a better way of handling ACLs, substitute for Static ACLs should be Dynamic ACLs configured on ISE Authorisation Profiles. https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212419-configure-per-user-dynamic-access-contro.html

    Adapted from community discussion by [Removed] · 2023-04-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. I

       IlPerdan0

       2023-06-14

       Selected A5 upvotes

       A is more reasonable, as the question did not mention about SGL/TrustSec

    2. N

       NikoTomas

       2024-09-01

       1 upvote

       Correct is A - DACL. --- SGACL does NOT override Port ACL for sure. Port ACL is overriden only by dACL (downloadable or dynamic – they are sometimes used in the same meaning) Real case: “We are moving from traditional DACL to SGACL and we've noticed that the existing static ACL applied to the port that enforces the traffic when the device has not authenticated yet into the network, overrides the SGACL downloaded from ISE. With DACL this does not happen and the DACL has higher priority over the port ACL, but for some reason this is not the case for SGACLs.” Advised solution: “To retain your Port ACL and use SGT/SGACL you'd probably have to have an ISE authz policy that assigns an SGT as well as a "permit any" DACL to negate the Port ACL.” https://community.cisco.com/t5/network-access-control/port-acl-overrides-sgacl/td-p/4621584

    3. T

       tururu1496

       2023-05-09

       Selected A3 upvotes

       A is correct. It replaces static ACL with dynamic ACL and not introduce the whole new technology

    4. [

       [Removed]

       2023-04-26

       Selected A2 upvotes

       SGTs are usable where Trust Sec is deployed, the question simply asks about a better way of handling ACLs, substitute for Static ACLs should be Dynamic ACLs configured on ISE Authorisation Profiles. https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212419-configure-per-user-dynamic-access-contro.html

24. Question 24 of 25

    What is a requirement for Feed Service to work?

    • ATCP port 8080 must be opened between Cisco ISE and the feed server.
    • BCisco ISE has access to an internal server to download feed update.
    • CCisco ISE has a base license.
    • DCisco ISE has Internet access to download feed update.

    Show answer

    Correct answer: D

    How others answered

    • D75%
    • C15%

    Explanation

    Correct answer D. We are talking about posture feature and this feature utilized Feed server in order to maintain the most update policies for posture assesment(the most recent version for antivirus. https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide_14_chapter_0111.html.xml https://www.cisco.com/c/dam/en/us/td/docs/security/ise/feedserver/partner_portal_faq/Feed_Service_Partner_Portal_FAQs.pdf)

    Adapted from community discussion by jcms700 · 2023-07-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. H

       Heim_Ox

       2021-04-20

       6 upvotes

       You don't download feed from an internal server. Only from Cisco. I'd select D.

    2. J

       jcms700

       2023-07-10

       Selected D2 upvotes

       Correct answer D. We are talking about posture feature and this feature utilized Feed server in order to maintain the most update policies for posture assesment(the most recent version for antivirus. https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide_14_chapter_0111.html.xml https://www.cisco.com/c/dam/en/us/td/docs/security/ise/feedserver/partner_portal_faq/Feed_Service_Partner_Portal_FAQs.pdf)

    3. M

       MrCalifornia

       2021-04-14

       4 upvotes

       Correct is D https://ise.cisco.com:8443/feedserver/feed/serverinfo?ISE_VERSION=2.4.0.357 as example

    4. K

       Kyoraku715

       2021-01-17

       4 upvotes

       i'm not agree, the feed service contact cisco, not an internal server.

25. Question 25 of 25

    An administrator is configuring a switch port for use with 802.1X. What must be done so that the port will allow voice and multiple data endpoints?

    • AConnect a hub to the switch port to allow multiple devices access after authentication.
    • BConfigure the port with the authentication host-mode multi-auth command.
    • CConnect the data devices to the port, then attach the phone behind them.
    • DUse the command authentication host-mode multi-domain on the port.

    Show answer

    Correct answer: B

    How others answered

    • B83%
    • D17%

    Explanation

    Multiple Authentication Mode: Multiple Authentication mode (often called multi-auth mode) allows one 802.1X or MAB client on the voice VLAN. It also allows multiple authenticated 802.1X, MAB, or web authorization clients on the data VLAN. When a hub or access point is connected to an 802.1X port, multi-auth mode provides enhanced security over the multi-hosts mode by requiring authentication of each connected client. For non-802.1X devices, MAB, or web-based authentication, can be used as the fallback method for individual host authentications, which allows different hosts to be authenticated through different methods on a single port.

    Adapted from community discussion by redpassion · 2024-06-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 300-715 or CertExamHQ.

    1. R

       redpassion

       2024-06-05

       Selected B2 upvotes

       Multiple Authentication Mode: Multiple Authentication mode (often called multi-auth mode) allows one 802.1X or MAB client on the voice VLAN. It also allows multiple authenticated 802.1X, MAB, or web authorization clients on the data VLAN. When a hub or access point is connected to an 802.1X port, multi-auth mode provides enhanced security over the multi-hosts mode by requiring authentication of each connected client. For non-802.1X devices, MAB, or web-based authentication, can be used as the fallback method for individual host authentications, which allows different hosts to be authenticated through different methods on a single port.

    2. I

       IlPerdan0

       2024-01-04

       Selected B4 upvotes

       https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/50sg/configuration/guide/Wrapper-46SG/dot1x.html#wp1240475

    3. M

       MORTND

       2024-07-24

       Selected B2 upvotes

       multi domain only allows 1 endpoint per domain the question states multiple data clients , so you can't use this the only solution is to use multi-auth

    4. C

       colla

       2024-06-13

       Selected B1 upvote

       Multiauthentication Mode Available in Cisco IOS Release 12.2(50)SG, multiauthentication mode allows one client on the voice VLAN and multiple authenticated clients on the data VLAN. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/50sg/configuration/guide/Wrapper-46SG/dot1x.html#wp1240475

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 1 of 25