Valid CCNP Security 300-715 Dumps Ensure Your Passing [Q113-Q134]

300-715 Cisco

admin -

February 20, 2023

4/5 - (1 vote)

Valid CCNP Security 300-715 Dumps Ensure Your Passing

300-715 Dumps Real Exam Questions Test Engine Dumps Training

Cisco 300-715 Exam Syllabus Topics:

Topic	Details
Topic 1	Network Access Device Administration Configure Native AD And LDAP
Topic 2	Describe Endpoint Compliance, Posture Services, And Client Provisioning Configure 802.1X Phasing Deployment
Topic 3	Configure Certificates For BYOD Implement Profiler Services
Topic 4	Configure The Compliance Module Configure Network Access Devices
Topic 5	Configure Cisco ISE Posture Agents And Operational Modes Configure Wired Wireless 802.1X Network Access
Topic 6	Web Auth And Guest Services Configure Cisco Trustsec
Topic 7	Configure Blacklist Whitelist Describe Cisco BYOD Functionality Configure Web Authentication
Topic 8	Configure Policies Including Authentication And Authorization Profiles Configure Sponsor And Guest Portals
Topic 9	Configure TACACS+ Device Administration And Command Authorization Architecture And Deployment

NO.113 An administrator is attempting to replace the built-in self-signed certificates on a Cisco ISE appliance. The CA is requesting some information about the appliance in order to sign the new certificate. What must be done in order to provide the CA this information?

Install the Root CA and intermediate CA.

Generate the CSR.

Download the intermediate server certificate.

Download the CA server certificate.

NO.114 What is the purpose of the ip http server command on a switch?

It enables the https server for users for web authentication.

It enables dot1x authentication on the switch.

It enables MAB authentication on the switch.

It enables the switch to redirect users for web authentication.

Section: Web Auth and Guest Services

NO.115 Which two values are compared by the binary comparison (unction in authentication that is based on Active Directory?

subject alternative name and the common name

MS-CHAPv2 provided machine credentials and credentials stored in Active Directory

user-presented password hash and a hash stored in Active Directory

user-presented certificate and a certificate stored in Active Directory

Explanation
Basic certificate checking does not require an identity source. If you want binary comparison checking for the certificates, you must select an identity source. If you select Active Directory as an identity source, subject and common name and subject alternative name (all values) can be used to look up a user.
https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_01110.html

NO.116 Refer to the exhibit:

Which command is typed within the CLI of a switch to view the troubleshooting output?

show authentication sessions mac 000e.84af.59af details

show authentication registrations

show authentication interface gigabitethemet2/0/36

show authentication sessions method

NO.117 Refer to the exhibit.

An organization recently implemented network device administration using Cisco ISE. Upon testing the ability to access all of the required devices, a user in the Cisco ISE group IT Admins is attempting to login to a device in their organization’s finance department but is unable to. What is the problem?

The IT training rule is taking precedence over the IT Admins rule.

The authorization conditions wrongly allow IT Admins group no access to finance devices.

The finance location is not a condition in the policy set.

The authorization policy doesn’t correctly grant them access to the finance devices.

NO.118 An administrator is configuring cisco ISE lo authenticate users logging into network devices using TACACS+ The administrator is not seeing any or the authentication in the TACACS+ live logs. Which action ensures the users are able to log into the network devices?

Enable the device administration service in the Administration persona

Enable the session services in the administration persona

Enable the service sessions in the PSN persona.

Enable the device administration service in the PSN persona.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_ise_tacacs_device_admin.html

NO.119 A network engineer must enforce access control using special tags, without re-engineering the network design.
Which feature should be configured to achieve this in a scalable manner?

SGT

dACL

VLAN

RBAC

NO.120 Drag the steps to configure a Cisco ISE node as a primary administration node from the left into the correct order on the night.

Explanation
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide Step 1 Choose Administration > System The Register button will be disabled initially. To enable this button, you must configure a Primary PAN.
Step 2
Check the check box next to the current node, and click
Step 3
Click Make Primary to configure your Primary PAN.
Step 4
Enter data on the General Settings tab.
Step 5
Click Save to save the node configuration.

NO.121 An organization is hosting a conference and must make guest accounts for several of the speakers attending.
The conference ended two days early but the guest accounts are still being used to access the network. What must be configured to correct this?

Create an authorization rule denying sponsored guest access.

Navigate to the Guest Portal and delete the guest accounts.

Create an authorization rule denying guest access.

Navigate to the Sponsor Portal and suspend the guest accounts.

NO.122 When setting up profiling in an environment using Cisco ISE for network access control, an organization must use non-proprietary protocols for collecting the information at layer 2. Which two probes will provide this information without forwarding SPAN packets to Cisco ISE? {Choose two.)

SNMP query probe

DNS probe

NetFlow probe

DHCP SPAN probe

RADIUS probe

NO.123 How is policy services node redundancy achieved in a deployment?

by enabling VIP

by utilizing RADIUS server list on the NAD

by creating a node group

by deploying both primary and secondary node

NO.124 An engineer is implementing Cisco ISE and needs to configure 802.1X. The port settings are configured for port-based authentication. Which command should be used to complete this configuration?

dot1x pae authenticator

dot1x system-auth-control

authentication port-control auto

aaa authentication dot1x default group radius

NO.125 Which compliance status is set when a matching posture policy has been defined for that endpomt. but all the mandatory requirements during posture assessment are not met?

unauthorized

untrusted

non-compliant

unknown

NO.126 When creating a policy within Cisco ISE for network access control, the administrator wants to allow different access restrictions based upon the wireless SSID to which the device is connecting. Which policy condition must be used in order to accomplish this?

Network Access NetworkDeviceName CONTAINS <SSID Name>

DEVICE Device Type CONTAINS <SSID Name>

Radius Called-Station-ID CONTAINS <SSID Name>

Airespace Airespace-Wlan-ld CONTAINS <SSID Name>

NO.127 An administrator is trying to collect metadata information about the traffic going across the network to gam added visibility into the hosts. This Information will be used to create profiling policies for devices us mg Cisco ISE so that network access policies can be used What must be done to accomplish this task?

Configure the RADIUS profiling probe within Cisco ISE

Configure NetFlow to be sent to me Cisco ISE appliance.

Configure SNMP to be used with the Cisco ISE appliance

Configure the DHCP probe within Cisco ISE

NO.128 Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.

Explanation

Monitoring = provides advanced monitoring and troubleshooting tools that you can use to effectively manage your network and resources Policy Service = provides network access, posture, guest access, client provisioning, and profiling services.
This persona evaluates the policies and makes all the decisions.
Administration = manages all system-related configuration and configurations that relate to functionality such as authentication, authorization, auditing, and so on pxGrid = shares context-sensitive information from Cisco ISE to subscribers
https://www.cisco.com/c/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide

NO.129 What does the dot1x system-auth-control command do?

causes a network access switch not to track 802.1x sessions

globally enables 802.1x

enables 802.1x on a network access device interface

causes a network access switch to track 802.1x sessions

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-8-0E/15-
24E/configuration/guide/xe-380-configuration/dot1x.html

NO.130 Which two roles are taken on by the administration person within a Cisco ISE distributed environment? (Choose two.)

backup

secondary

standby

primary

active

NO.131 Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.

Explanation
Monitoring = provides advanced monitoring and troubleshooting tools that you can use to effectively manage your network and resources Policy Service = provides network access, posture, guest access, client provisioning, and profiling services.
This persona evaluates the policies and makes all the decisions.
Administration = manages all system-related configuration and configurations that relate to functionality such as authentication, authorization, auditing, and so on pxGrid = shares context-sensitive information from Cisco ISE to subscribers
https://www.cisco.com/c/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide

NO.132 Refer to the exhibit.

An organization recently implemented network device administration using Cisco ISE. Upon testing the ability to access all of the required devices, a user in the Cisco ISE group IT Admins is attempting to login to a device in their organization’s finance department but is unable to. What is the problem?