Cisco Implementing and Configuring Cisco Identity Services Engine 300-715 SISE Exam Questions

Page: 1 / 14
Total 323 questions
Question 1

An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network. Which node should be used to accomplish this task?



Answer : A


Question 2

Which two services must the administrator enable on the Cisco ISE deployment to ensure that the endpoint with MAC address 05:27:81:68:04:CA is authenticated, profiled, and added to the appropriate endpoint identity group? (Choose two.)



Answer : A, D

RADIUS and Profiling services are required. RADIUS processes the endpoint's network-access authentication request, including MAC Authentication Bypass when the device does not support 802.1X. The RADIUS request also provides attributes such as the calling-station ID, network-device information, and connection context. Profiling collects and evaluates endpoint attributes received through probes such as RADIUS, DHCP, HTTP, SNMP Query, and Device Sensor. Cisco ISE applies profiling policies to classify the endpoint and assign it to the appropriate endpoint identity group. Posture evaluates endpoint compliance but is not required merely to authenticate and classify the device. TACACS+ is used for administrative access to network devices rather than endpoint network authentication. ''Session'' is not a separately enabled ISE service that performs the required profiling and identity-group assignment functions.


Question 3

Which two components are required for creating a Native Supplicant Profile within a BYOD flow? (Choose two)



Answer : B, E

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010101.html#reference_21024A3B2B27427EAC78495E56962729


Question 4

Using the SAK Active Directory Federation Services server. The configurations were performed:

* created a new SAML Identity provider profile in Cisco ISE

* exported the service provider Information

* configured all the required Active Directory Federation Services configurations

* Imported the Active Directory Federation Services metadata

* configured groups in the new SAML identity

* added attributes to the new SAML identity provider profile

* configured Advanced Settings in the new SAML identity provider profile

Which two actions must be taken to complete the configuration? (Choose two.)



Answer : D, E


Question 5

Which two default endpoint identity groups does Cisco ISE create? (Choose two )



Answer : C, E

https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html

Default Endpoint Identity Groups Created for EndpointsCisco ISE creates the following five endpoint identity groups by default: Blacklist, GuestEndpoints, Profiled, RegisteredDevices, and Unknown. In addition, it creates two more identity groups, such as Cisco-IP-Phone and Workstation, which are associated to the Profiled (parent) identity group. A parent group is the default identity group that exists in the system.

Cisco ISE creates the following endpoint identity groups:

Blacklist---This endpoint identity group includes endpoints that are statically assigned to this group in Cisco ISE and endpoints that are block listed in the device registration portal. An authorization profile can be defined in Cisco ISE to permit, or deny network access to endpoints in this group.

GuestEndpoints---This endpoint identity group includes endpoints that are used by guest users.

Profiled---This endpoint identity group includes endpoints that match endpoint profiling policies except Cisco IP phones and workstations in Cisco ISE.

RegisteredDevices---This endpoint identity group includes endpoints, which are registered devices that are added by an employee through the devices registration portal. The profiling service continues to profile these devices normally when they are assigned to this group. Endpoints are statically assigned to this group in Cisco ISE, and the profiling service cannot reassign them to any other identity group. These devices will appear like any other endpoint in the endpoints list. You can edit, delete, and block these devices that you added through the device registration portal from the endpoints list in the Endpoints page in Cisco ISE. Devices that you have blocked in the device registration portal are assigned to the Blacklist endpoint identity group, and an authorization profile that exists in Cisco ISE redirects blocked devices to a URL, which displays ''Unauthorised Network Access'', a default portal page to the blocked devices.

Unknown---This endpoint identity group includes endpoints that do not match any profile in Cisco ISE.

In addition to the above system created endpoint identity groups, Cisco ISE creates the following endpoint identity groups, which are associated to the Profiled identity group:

Cisco-IP-Phone---An identity group that contains all the profiled Cisco IP phones on your network.

Workstation---An identity group that contains all the profiled workstations on your network.


Question 6

Which two responses from the RADIUS server to NAS are valid during the authentication process? (Choose two)



Answer : B, D


Question 7

A network engineer must create a guest portal for wireless guests on Cisco ISE. The guest users must not be able to create accounts; however, the portal should require a username and password to connect. Which portal type must be created in Cisco ISE to meet the requirements?



Answer : A


Page:    1 / 14   
Total 323 questions