2023 Cisco 300-715 Exam Dumps Questions

1. An administrator plans to use Cisco ISE to deploy posture policies to assess Microsoft Windows endpoints that run Cisco Secure Client. The administrator wants to minimize the occurrence of messages related to unknown posture profiles if Cisco ISE fails to determine the posture of the endpoint. Secure Client is deployed to all the endpoints. and all the required Cisco ISE authentication, authorization, and posture policy configurations were performed.

Which action must be taken next to complete the configuration?

2. A network administrator is configuring a new access switch to use with Cisco ISE for network access control. There is a need to use a centralized server for the reauthentication timers.

What must be configured in order to accomplish this task?

3. Which two Cisco ISE deployment models require two nodes configured with dedicated PAN and MnT personas? (Choose two.)

4. An engineer is configuring static SGT classification.

Which configuration should be used when authentication is disabled and third-party switches are in use?

5. Which two default guest portals are available with Cisco ISE? (Choose two.)

6. An administrator has added a new Cisco ISE PSN to their distributed deployment.

Which two features must the administrator enable to accept authentication requests and profile the endpoints correctly, and add them to their respective endpoint identity groups? (Choose two)

7. Which two endpoint compliance statuses are possible? (Choose two.)

8. What is a valid guest portal type?

9. A Cisco ISE server sends a CoA to a NAD after a user logs in successfully using CWA.

Which action does the CoA perform?

10. Which command displays all 802 1X/MAB sessions that are active on the switch ports of a Cisco Catalyst switch?

11. A company is attempting to improve their BYOD policies and restrict access based on certain criteria. The company's subnets are organized by building.

Which attribute should be used in order to gain access based on location?

12. An administrator is configuring the Native Supplicant Profile to be used with the Cisco ISE posture agents and needs to test the connection using wired devices to determine which profile settings are available.

Which two configuration settings should be used to accomplish this task? (Choose two.)

13. In a Cisco ISE split deployment model, which load is split between the nodes?

14. What is a difference between RADIUS and TACACS+?

15. An administrator for a small network is configuring Cisco ISE to provide dynamic network access to users. Management needs Cisco ISE to not automatically trigger a CoA whenever a profile change is detected. Instead, the administrator needs to verify the new profile and manually trigger a CoA.

What must be configuring in the profiler to accomplish this goal?

16. An administrator is troubleshooting an endpoint that is supposed to bypass 802 1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB. however the endpoint cannot communicate because it cannot obtain an IP address.

What is the problem?

17. What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?

18. A user is attempting to register a BYOD device to the Cisco ISE deployment, but needs to use the onboarding policy to request a digital certificate and provision the endpoint.

What must be configured to accomplish this task?

19. Refer to the exhibit.





A network engineers configuring the switch to accept downloadable ACLs from a Cisco ISC server.

Which two commands should be run to complete the configuration? (Choose two)

20. Which two features must be used on Cisco ISE to enable the TACACS. feature? (Choose two)

21. What is the difference between how RADIUS and TACACS+ handle encryption?

22. Which are two characteristics of TACACS+? (Choose two)

23. A Cisco ISE administrator must authenticate users against Microsoft Active Directory.

The solution must meet these requirements:

Users and computers must be authenticated.

User groups must be retrieved during authentication.

Which protocol must be added to the allowed protocols on the policy to authenticate the users?

24. Which three default endpoint identity groups does cisco ISE create? (Choose three)

25. An engineer is configuring the remote access VPN to use Cisco ISE for AAA and needs to conduct posture checks on the connecting endpoints After the endpoint connects, it receives its initial authorization result and continues onto the compliance scan.

What must be done for this AAA configuration to allow compliant access to the network?

26. An engineer is deploying a new guest WLAN for a company. The company wants this WLAN to use a sponsored guest portal for secure guest access. The wireless LAN controller must direct the guests to a web page on Cisco ISE for authentication.

Which type of authentication must be configured for the guest portal in Cisco ISE?

27. A customer wants to set up the Sponsor portal and delegate the authentication flow to a third party for added security while using Kerberos.

Which database should be used to accomplish this goal?

28. Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?

29. Which two actions must be verified to confirm that the internet is accessible via guest access when configuring a guest portal? (Choose two.)

30. An engineer is implementing network access control using Cisco ISE and needs to separate the traffic based on the network device ID and use the IOS device sensor capability.

Which probe must be used to accomplish this task?

31. DRAG DROP

An organization wants to implement 802.1X and is debating whether to use PEAP-MSCHAPv2 or PEAP-EAP-TLS for authentication.

Drag the characteristics on the left to the corresponding protocol on the right.

32. DRAG DROP

Select and Place

33. Which use case validates a change of authorization?

34. An administrator must block access to BYOD endpoints that were onboarded without a certificate and have been reported as stolen in the Cisco ISE My Devices Portal.

Which condition must be used when configuring an authorization policy that sets DenyAccess permission?

35. A Cisco ISE administrator must restrict specific endpoints from accessing the network while in closed mode. The requirement is to have Cisco ISE centrally store the endpoints to restrict access from.

What must be done to accomplish this task''

36. DRAG DROP

A security engineer configures a Cisco Catalyst switch to use Cisco TrustSec. The engineer must define the PAC key to authenticate the switch to Cisco IISE.

Drag and drop the commands from the left into sequence on the right. Not all options are used.

37. An administrator is responsible for configuring network access for a temporary network printer. The administrator must only use the printer MAC address 50:89:65: 18:8: AB for authentication.

Which authentication method will accomplish the task?

38. What must be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

39. An administrator needs to connect ISE to Active Directory as an external authentication source and allow the proper ports through the firewall.

Which two ports should be opened to accomplish this task? (Choose two)

40. An engineer is migrating users from MAB to 802.1X on the network. This must be done during normal business hours with minimal impact to users.

Which CoA method should be used?

41. What are the minimum requirements for deploying the Automatic Failover feature on Administration nodes in a distributed Cisco ISE deployment?

42. How does Cisco ISE enforce compliance for devices attempting to access network resources?

43. A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed into this task?

44. Which default "guest type" is included with Cisco ISE?

45. An administrator is configuring posture assessment in Cisco ISE for the first time.

Which two components must be uploaded to Cisco ISE to use Anyconnect for the agent configuration in a client provisioning policy? (Choose two.)

46. A company manager is hosting a conference. Conference participants must connect to an open guest SSID and only use a preassigned code that they enter into the guest portal prior to gaining access to the network.

How should the manager configure Cisco ISE to accomplish this goal?

47. What is the role of the Inline Posture Node (IPN. in Cisco ISE?

48. A policy is being created in order to provide device administration access to the switches on a network. There is a requirement to ensure that if the session is not actively being used, after 10 minutes, it will be disconnected.

Which task must be configured in order to meet this requirement?

49. An administrator is configuring posture with Cisco ISE and wants to check that specific services are present on the workstations that are attempting to access the network.

What must be configured to accomplish this goal?

50. An engineer is starting to implement a wired 802.1X project throughout the campus. The task is for failed authentication to be logged to Cisco ISE and also have a minimal impact on the users.

Which command must the engineer configure?

A. authentication open

B. pae dot1x enabled

C. authentication host-mode multi-auth

D. monitor-mode enabled

51. An administrator is trying to collect metadata information about the traffic going across the network to gam added visibility into the hosts. This Information will be used to create profiling policies for devices us mg Cisco ISE so that network access policies can be used.

What must be done to accomplish this task?

52. An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE. but the devices do not change their access due to the new profile.

What is the problem?

53. An engineer is assigned to enhance security across the campus network. The task is to enable MAB across all access switches in the network.

Which command must be entered on the switch to enable MAB?

54. An engineer is configuring 802.1X and wants it to be transparent from the users' point of view. The implementation should provide open authentication on the switch ports while providing strong levels of security for non-authenticated devices.

Which deployment mode should be used to achieve this?

55. An engineer is configuring Cisco ISE for guest services They would like to have any unregistered guests redirected to the guest portal for authentication then have a CoA provide them with full access to the network that is segmented via firewalls.

Why is the given configuration failing to accomplish this goal?

56. 1.What are two components of the posture requirement when configuring Cisco ISE posture? (Choose two)

57. What is the purpose of the ip http server command on a switch?

58. Which nodes are supported in a distributed Cisco ISE deployment?

59. A network engineer is in the predeployment discovery phase of a Cisco ISE deployment and must discover the network. There is an existing network management system in the network.

Which type of probe must be configured to gather the information?

60. A Cisco ISE administrator needs to ensure that guest endpoint registrations are only valid for one day When testing the guest policy flow, the administrator sees that the Cisco ISE does not delete the endpoint in the Guest Endpoints identity store after one day and allows access to the guest network after that period.

Which configuration is causing this problem?

61. A network administrator is configuring authorization policies on Cisco ISE There is a requirement to use AD group assignments to control access to network resources After a recent power failure and Cisco ISE rebooting itself, the AD group assignments no longer work.

What is the cause of this issue?

62. An engineer is configuring a new Cisco ISE node. Context-sensitive information must be shared between the Cisco ISE and a Cisco ASA.

Which persona must be enabled?

63. An organization is adding nodes to their Cisco ISE deployment and has two nodes designated as primary and secondary PAN and MnT nodes. The organization also has four PSNs An administrator is adding two more PSNs to this deployment but is having problems adding one of them.

What is the problem?

64. An administrator is configuring new probes to use with Cisco ISE and wants to use metadata to help profile the endpoints. The metadata must contain traffic information relating to the endpoints instead of industry-standard protocol information.

Which probe should be enabled to meet these requirements?

65. A network administrator must configure Cisco SE Personas in the company to share session information via syslog.

Which Cisco ISE personas must be added to syslog receivers to accomplish this goal?

66. An administrator is configuring a new profiling policy in Cisco ISE for a printer type that is missing from the profiler feed. The logical profile Printers must be used in the authorization rule and the rule must be hit.

What must be done to ensure that this configuration will be successful^

67. A new employee just connected their workstation to a Cisco IP phone. The network administrator wants to ensure that the Cisco IP phone remains online when the user disconnects their Workstation from the corporate network.

Which CoA configuration meets this requirement?

68. A network engineer is configuring guest access and notices that when a guest user registers a second device for access, the first device loses access.

What must be done to ensure that both devices for a particular user are able to access the guest network simultaneously?

69. An administrator must provide wired network access to unidentified Cisco devices that fail 802.1X authentication. Cisco ISE profiling services must be configured to gather Cisco Discovery Protocol and LLDP endpoint information from a Cisco switch.

These configurations were performed:

• configured switches to accept SNMP queries from Cisco ISE

• enabled Cisco Discovery Protocol and LLDP on the switches

• added the switch as a NAD to Cisco ISE

What must be enabled to complete the configuration?

70. An engineer is configuring Central Web Authentication in Cisco ISE to provide guest access. When an authentication rule is configured in the Default Policy Set for the Wired_MAB or Wireless_MAB conditions, what must be selected for the "if user not found" setting?

71. Which two external identity stores are supported by Cisco ISE for password types? (Choose two.)

72. What is the default port used by Cisco ISE for NetFlow version 9 probe?

73. Which protocol must be allowed for a BYOD device to access the BYOD portal?

74. What happens when an internal user is configured with an external identity store for authentication, but an engineer uses the Cisco ISE admin portal to select an internal identity store as the identity source?

75. Refer to the exhibit.





Which component must be configured to apply the SGACL?

76. Refer to exhibit.





An engineer must configure BYOD in Cisco ISE. A single SSID must be used to allow BYOD devices to connect to the network.

These configurations have been performed on Wireless LAN Controller already:

RADIUS server

BYOD-Dot1x SSID

Which two configurations must be done in Cisco ISE to meet the requirement? (Choose two.)

77. DRAG DROP

Drag the steps to configure a Cisco ISE node as a primary administration node from the left into the correct order on the night.

78. Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose two.)

79. A network engineer must configure a centralized Cisco ISE solution for wireless guest access with users in different time zones. The guest account activation time must be independent of the user time zone, and the guest account must be enabled automatically when the user self-registers on the guest portal.

Which option in the time profile settings must be selected to meet the requirement?

80. Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two).

81. What is a requirement for Feed Service to work?

82. An engineer is configuring web authentication and needs to allow specific protocols to permit DNS traffic.

Which type of access list should be used for this configuration?

83. An engineer is configuring Cisco ISE to reprofile endpoints based only on new requests of INIT-REBOOT and SELECTING message types.

Which probe should be used to accomplish this task?

84. Refer to the exhibit:





Which command is typed within the CU of a switch to view the troubleshooting output?

85. Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles? (Choose two.)

86. An employee must access the internet through the corporate network from a new mobile device that does not support native supplicant provisioning provided by Cisco ISE.

Which portal must the employee use to provision to the device?

87. A network security administrator needs a web authentication configuration when a guest user connects to the network with a wireless connection using these steps:

. An initial MAB request is sent to the Cisco ISE node.

. Cisco ISE responds with a URL redirection authorization profile if the user's MAC address is unknown in the endpoint identity store.

. The URL redirection presents the user with an AUP acceptance page when the user attempts to go to any URL.

Which authentication must the administrator configure on Cisco ISE?

88. Which supplicant(s) and server(s) are capable of supporting EAP-CHAINING?

89. An organization is adding new profiling probes to the system to improve profiling on Oseo ISE The probes must support a common network management protocol to receive information about the endpoints and the ports to which they are connected.

What must be configured on the network device to accomplish this goal?

90. An administrator replaced a PSN in the distributed Cisco ISE environment. When endpoints authenticate to it, the devices are not getting the right profiles or attributes and as a result, are not hitting the correct policies. This was working correctly on the previous PSN.

Which action must be taken to ensure the endpoints get identified?

91. Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

92. An administrator must configure Cisco ISE to send CoA requests to a Cisco switch using SNMP.

These configurations were already performed:

enabled SNMP on the switch

added the switch to Cisco ISE

configured a network device profile

configured the NAD port detection method

configured the operation to be performed on the switch port

configured an authorization profile

Which two configurations must be performed to send the CoA requests? (Choose two.)

93. Wireless network users authenticate to Cisco ISE using 802.1X through a Cisco Catalyst switch. An engineer must create an updated configuration to assign a security group tag to the user's traffic using inline tagging to prevent unauthenticated users from accessing a restricted server.

The configurations were performed:

• configured Cisco ISE as a Cisco TrustSec AAA server

• configured the switch as a RADIUS device in Cisco ISE

• configured the wireless LAN controller as a TrustSec device in Cisco ISE

• created a security group tog for the wireless users

• created a certificate authentication profile

• created an identity source sequence

• assigned an appropriate security group tag to the wireless users

• defined security group access control lists to specify an egress policy

• enforced the access control lists on the TrustSec policy matrix in Cisco ISE

• configured TrustSec on the switch

• configured TrustSec on the wireless LAN controller

Which two actions must be taken to complete the configuration? (Choose two.)

94. An engineer is deploying a new Cisco ISE environment for a company. The company wants the deployment to use TACACS+. The engineer verifies that Cisco ISE has a Device Administration license.

What must be configured to enable TACACS+ operations?