Cisco 300-715 Dumps PDF Study Tips And Information 2023

Jonnie Karnath2023-04-22T00:29:27+00:00

Cisco 300-715 exam is a highly sought-after certification that can open doors to new job opportunities and career advancements. But passing the exam can be a challenge, especially if you’re not well-prepared. That’s where Certspot comes in with their Cisco 300-715 dumps PDF which are designed to help you prepare for the exam by providing you with a realistic testing experience. Cisco 300-715 dumps PDF are up-to-date, accurate, and designed to cover all the topics and concepts that you’ll need to know to pass the Implementing and Configuring Cisco Identity Services Engine (SISE) exam. By studying Certspot’s Cisco 300-715 dumps PDF, you’ll be able to identify any knowledge gaps and focus your studying efforts on those areas, leading to a better chance of passing the exam.

Page 1 of 8

1. An administrator is adding a switch to a network that is running Cisco ISE and is only for IP Phones The phones do not have the ability to authenticate via 802 1X

Which command is needed on each switch port for authentication?

dot1x system-auth-control

enable bypass-mac

enable network-authentication

mab

2. Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?

session timeout

idle timeout

radius-server timeout

termination-action

3. An engineer must configure Cisco ISE to provide internet access for guests in which guests are required to enter a code to gain network access.

Which action accomplishes the goal?

Configure the hotspot portal for guest access and require an access code.

Configure the sponsor portal with a single account and use the access code as the password.

Configure the self-registered guest portal to allow guests to create a personal access code.

Create a BYOD policy that bypasses the authentication of the user and authorizes access codes.

4. A company manager is hosting a conference. Conference participants must connect to an open guest SSID and only use a preassigned code that they enter into the guest portal prior to gaining access to the network.

How should the manager configure Cisco ISE to accomplish this goal?

Create entries in the guest identity group for all participants.

Create an access code to be entered in the AUP page.

Create logins for each participant to give them sponsored access.

Create a registration code to be entered on the portal splash page.

5. An administrator is configuring RADIUS on a Cisco switch with a key set to Cisc403012128 but is receiving the error “Authentication failed: 22040 Wrong password or invalid shared secret. “what must be done to address this issue?

Add the network device as a NAD inside Cisco ISE using the existing key.

Configure the key on the Cisco ISE instead of the Cisco switch.

Use a key that is between eight and ten characters.

Validate that the key is correct on both the Cisco switch as well as Cisco IS

6. An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port.

Which command should be used to accomplish this task?

permit tcp any any eq <port number>

aaa group server radius proxy

ip http port <port number>

aaa group server radius

7. A user changes the status of a device to stolen in the My Devices Portal of Cisco ISE. The device was originally onboarded in the BYOD wireless Portal without a certificate. The device is found later, but the user cannot re-onboard the device because Cisco ISE assigned the device to the Blocklist endpoint identity group.

What must the user do in the My Devices Portal to resolve this issue?

Manually remove the device from the Blocklist endpoint identity group.

Change the device state from Stolen to Not Registered.

Change the BYOD registration attribute of the device to None.

Delete the device, and then re-add the device.

8. What is the minimum certainty factor when creating a profiler policy?

the minimum number that a predefined condition provides

the maximum number that a predefined condition provides

the minimum number that a device certainty factor must reach to become a member of the profile

the maximum number that a device certainty factor must reach to become a member of the profile

9. What is a difference between RADIUS and TACACS+?

RADIUS uses connection-oriented transport, and TACACS+ uses best-effort delivery.

RADIUS offers multiprotocol support, and TACACS+ supports only IP traffic.

RADIUS combines authentication and authorization functions, and TACACS+ separates them.

RADIUS supports command accounting, and TACACS+ does not.

10. Which two ports do network devices typically use for CoA? (Choose two)

443

19005

8080

3799

1700

Page 2 of 8

11. Refer to the exhibit. An engineer is creating a new TACACS* command set and cannot use any show commands after togging into the device with this command set authorization.

Which configuration is causing this issue?

Question marks are not allowed as wildcards for command sets.

The command set is allowing all commands that are not in the command list

The wildcard command listed is in the wrong format

The command set is working like an ACL and denying every command.

12. Which two authentication protocols are supported by RADIUS but not by TACACS+? (Choose two.)

MSCHAPv1

PAP

EAP

CHAP

MSCHAPV2

13. Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles? (Choose two.)

Firepower

WLC

IOS

ASA

Shell

14. Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose two.)

hotspot

new AD user 802 1X authentication

posture

BYOD

guest AUP

15. Which Cisco ISE solution ensures endpoints have the latest version of antivirus updates installed before being allowed access to the corporate network?

Threat Services

Profiling Services

Provisioning Services

Posture Services

16. An engineer is configuring TACACS+ within Cisco ISE for use with a non-Cisco network device. They need to send special attributes in the Access-Accept response to ensure that the users are given the appropriate access.

What must be configured to accomplish this'?

dACLs to enforce the various access policies for the users

custom access conditions for defining the different roles

shell profiles with custom attributes that define the various roles

TACACS+ command sets to provide appropriate access

17. An organization is adding new profiling probes to the system to improve profiling on Oseo ISE The probes must support a common network management protocol to receive information about the endpoints and the ports to which they are connected.

What must be configured on the network device to accomplish this goal?

ARP

SNMP

WCCP

ICMP

18. What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?

Network Access Control

My Devices Portal

Application Visibility and Control

Supplicant Provisioning Wizard

19. What are two differences of TACACS+ compared to RADIUS? (Choose two.)

TACACS+ uses a connectionless transport protocol, whereas RADIUS uses a connection-oriented transport protocol.

TACACS+ encrypts the full packet payload, whereas RADIUS only encrypts the password.

TACACS+ only encrypts the password, whereas RADIUS encrypts the full packet payload.

TACACS+ uses a connection-oriented transport protocol, whereas RADIUS uses a connectionless transport protocol.

TACACS+ supports multiple sessions per user, whereas RADIUS supports one session per user.

20. In a Cisco ISE split deployment model, which load is split between the nodes?

AAA

network admission

log collection

device admission

Page 3 of 8

21. A network administrator must configura endpoints using an 802 1X authentication method with EAP identity certificates that are provided by the Cisco ISE When the endpoint presents the identity certificate to Cisco ISE to validate the certificate, endpoints must be authorized to connect to the network.

Which EAP type must be configured by the network administrator to complete this task?

EAP-PEAP-MSCHAPv2

EAP-TTLS

EAP-FAST

EAP-TLS

22. A network administrator must use Cisco ISE to check whether endpoints have the correct version of antivirus installed.

Which action must be taken to allow this capability?

Configure a native supplicant profile to be used for checking the antivirus version

Configure Cisco ISE to push the HostScan package to the endpoints to check for the antivirus version.

Create a Cisco AnyConnect Network Visibility Module configuration profile to send the antivirus information of the endpoints to Cisco IS

Create a Cisco AnyConnect configuration within Cisco ISE for the Compliance Module and associated configuration files

23. What is a requirement for Feed Service to work?

TCP port 3080 must be opened between Cisco ISE and the feed server

Cisco ISE has a base license.

Cisco ISE has access to an internal server to download feed update

Cisco ISE has Internet access to download feed update

24. Which two Cisco ISE deployment models require two nodes configured with dedicated PAN and MnT personas? (Choose two.)

three PSN nodes

seven PSN nodes with one PxGrid node

five PSN nodes with one PxGrid node

two PSN nodes with one PxGrid node

six PSN nodes

25. An engineer is configuring Cisco ISE policies to support MAB for devices that do not have 802.1X capabilities. The engineer is configuring new endpoint identity groups as conditions to be used in the AuthZ policies, but noticed that the endpoints are not hitting the correct policies.

What must be done in order to get the devices into the right policies?

Manually add the MAC addresses of the devices to endpoint ID groups in the context visibility database.

Create an AuthZ policy to identify Unknown devices and provide partial network access prior to profiling.

Add an identity policy to dynamically add the IP address of the devices to their endpoint identity groups.

Identify the non 802.1X supported device types and create custom profiles for them to profile into.

26. Which protocol must be allowed for a BYOD device to access the BYOD portal?

HTTP

SMTP

HTTPS

SSH

27. An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE. but the devices do not change their access due to the new profile.

What is the problem'?

In closed mode, profiling does not work unless CDP is enabled.

The profiling probes are not able to collect enough information to change the device profile

The profiler feed is not downloading new information so the profiler is inactive

The default profiler configuration is set to No CoA for the reauthentication setting

28. Which two external identity stores support EAP-TLS and PEAP-TLS? (Choose two.)

Active Directory

RADIUS Token

Internal Database

RSA SecurlD

LDAP

29. An engineer is enabling a newly configured wireless SSID for tablets and needs visibility into which other types of devices are connecting to it.

What must be done on the Cisco WLC to provide this information to Cisco ISE?

enable IP Device Tracking

enable MAC filtering

enable Fast Transition

enable mDNS snooping

30. An engineer has been tasked with standing up a new guest portal for customers that are waiting in the lobby. There is a requirement to allow guests to use their social media logins to access the guest network to appeal to more customers.

What must be done to accomplish this task?

Create a sponsor portal to allow guests to create accounts using their social media logins.

Create a sponsored guest portal and enable social media in the external identity sources.

Create a self-registered guest portal and enable the feature for social media logins

Create a hotspot portal and enable social media login for network access

Page 4 of 8

31. An administrator needs to give the same level of access to the network devices when users are logging into them using TACACS+ However, the administrator must restrict certain commands based on one of three user roles that require different commands.

How is this accomplished without creating too many objects using Cisco ISE?

Create one shell profile and multiple command sets.

Create multiple shell profiles and multiple command sets.

Create one shell profile and one command set.

Create multiple shell profiles and one command set

32. An administrator is attempting to join a new node to the primary Cisco ISE node, but receives the error message "Node is Unreachable".

What is causing this error?

The second node is a PAN node.

No administrative certificate is available for the second node.

The second node is in standalone mode.

No admin privileges are available on the second node.

33. An employee logs on to the My Devices portal and marks a currently on-boarded device as ‘Lost’.

Which two actions occur within Cisco ISE as a result oí this action? (Choose two)

Certificates provisioned to the device are not revoked

BYOD Registration status is updated to No

The device access has been denied

BYOD Registration status is updated to Unknown.

The device status is updated to Stolen

34. An administrator is configuring the Native Supplicant Profile to be used with the Cisco ISE posture agents and needs to test the connection using wired devices to determine which profile settings are available.

Which two configuration settings should be used to accomplish this task? (Choose two.)

authentication mode

proxy host/IP

certificate template

security

allowed protocol

35. An administrator is attempting to replace the built-in self-signed certificates on a Cisco ISE appliance. The CA is requesting some information about the appliance in order to sign the new certificate.

What must be done in order to provide the CA this information?

Install the Root CA and intermediate C

Generate the CS

Download the intermediate server certificate.

Download the CA server certificate.

36. An administrator is configuring a new profiling policy within Cisco ISE The organization has several endpoints that are the same device type and all have the same Block ID in their MAC address. The profiler does not currently have a profiling policy created to categorize these endpoints. therefore a custom profiling policy must be created.

Which condition must

the administrator use in order to properly profile an ACME Al Connector endpoint for network access with MAC address <MAC ADDRESS>?

MAC_OUI_STARTSWITH_<MACADDRESS>

CDP_cdpCacheDevicelD_CONTAINS_<MACADDRESS>

MAC_MACAddress_CONTAINS_<MACADDRESS>

Radius Called Station-ID STARTSWITH <MACADDRESS>

37. What must be configured on the WLC to configure Central Web Authentication using Cisco ISE and a WLC?

Set the NAC State option to SNMP NA

Set the NAC State option to RADIUS NA

Use the radius-server vsa send authentication command.

Use the ip access-group webauth in command.

38. An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened.

From which Cisco ISE persona should this traffic be originating?

monitoring

policy service

administration

authentication

39. A new employee just connected their workstation to a Cisco IP phone. The network administrator wants to ensure that the Cisco IP phone remains online when the user disconnects their Workstation from the corporate network.

Which CoA configuration meets this requirement?

Port Bounce

Reauth

NoCoA

Disconnect

40. A network administrator must configure Cisco SE Personas in the company to share session information via syslog.

Which Cisco ISE personas must be added to syslog receivers to accomplish this goal?

pxGrid

admin

policy services

monitor

Page 5 of 8

41. Which interface-level command is needed to turn on 802 1X authentication?

Dofl1x pae authenticator

dot1x system-auth-control

authentication host-mode single-host

aaa server radius dynamic-author

42. Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

endpoint marked as lost in My Devices Portal

addition of endpoint to My Devices Portal

endpoint profile transition from Apple-Device to Apple-iPhone

endpoint profile transition from Unknown to Windows 10-Workstation

updating of endpoint dAC

43. What must be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

pass

reject

drop

continue

44. Refer to the exhibit

Which switch configuration change will allow only one voice and one data endpoint on each port?

Multi-auth to multi-domain

Mab to dot1x

Auto to manual

Multi-auth to single-auth

45. DRAG DROP

Drag the descriptions on the left onto the components of 802.1X on the right.

46. An administrator is configuring a Cisco ISE posture agent in the client provisioning policy and needs to ensure that the posture policies that interact with clients are monitored, and end users are required to comply with network usage rules.

Which two resources must be added in Cisco ISE to accomplish this goal? (Choose two)

AnyConnect

Supplicant

Cisco ISE NAC

PEAP

Posture Agent

47. An administrator is troubleshooting an endpoint that is supposed to bypass 802 1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB. however the endpoint cannot communicate because it cannot obtain an IP address.

What is the problem?

The DHCP probe for Cisco ISE is not working as expected.

The 802.1 X timeout period is too long.

The endpoint is using the wrong protocol to authenticate with Cisco IS

An AC I on the port is blocking HTTP traffic

48. A Cisco ISE administrator must restrict specific endpoints from accessing the network while in closed mode. The requirement is to have Cisco ISE centrally store the endpoints to restrict access from.

What must be done to accomplish this task?

Add each MAC address manually to a blocklist identity group and create a policy denying access

Create a logical profile for each device's profile policy and block that via authorization policies.

Create a profiling policy for each endpoint with the cdpCacheDeviceld attribute.

Add each IP address to a policy denying access.

49. An administrator for a small network is configuring Cisco ISE to provide dynamic network access to users. Management needs Cisco ISE to not automatically trigger a CoA whenever a profile change is detected. Instead, the administrator needs to verify the new profile and manually trigger a CoA.

What must be configuring in the profiler to accomplish this goal?

Port Bounce

No CoA

Session Query

Reauth

50. An engineer is configuring ISE for network device administration and has devices that support both protocols.

What are two benefits of choosing TACACS+ over RADUs for these devices? (Choose two.)

TACACS+ is FIPS compliant while RADIUS is not

TACACS+ is designed for network access control while RADIUS is designed for role-based access.

TACACS+ uses secure EAP-TLS while RADIUS does not.

TACACS+ provides the ability to authorize specific commands while RADIUS does not

TACACS+ encrypts the entire payload being sent while RADIUS only encrypts the password.

Page 6 of 8

51. A network engineer must enforce access control using special tags, without re-engineering the network design.

Which feature should be configured to achieve this in a scalable manner?

SGT

dACL

VLAN

RBAC

52. A network engineer needs to ensure that the access credentials are not exposed during the 802.1x authentication among components.

Which two protocols should complete this task?

PEAP

EAP-MD5

LEAP

EAP-TLS

EAP-TTLS

53. What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?

Cisco-av-pair

Class attribute

Event

State attribute

54. An engineer is using Cisco ISE and configuring guest services to allow wireless devices to access the network.

Which action should accomplish this task?

Create the redirect ACL on the WLC and add it to the WLC policy

Create the redirect ACL on the WLC and add it to the Cisco ISE policy.

Create the redirect ACL on Cisco ISE and add it to the WLC policy

Create the redirect ACL on Cisco ISE and add it to the Cisco ISE Policy

55. An engineer is configuring sponsored guest access and needs to limit each sponsored guest to a maximum of two devices. There are other guest services in production that rely on the default guest types.

How should this configuration change be made without disrupting the other guest services currently offering three or more guest devices per user?

Create an ISE identity group to add users to and limit the number of logins via the group configuration.

Create a new guest type and set the maximum number of devices sponsored guests can register

Create an LDAP login for each guest and tag that in the guest portal for authentication.

Create a new sponsor group and adjust the settings to limit the devices for each guest.

56. Refer to the exhibit.

An engineer is configuring a client but cannot authenticate to Cisco ISE During troubleshooting, the show authentication sessions command was issued to display the authentication status of each port.

Which command gives additional information to help identify the problem with the authentication?

show authentication sessions

show authentication sessions Interface Gil/0/1 output

show authentication sessions interface Gi1/0/1 details

show authentication sessions output

57. An engineer is unable to use SSH to connect to a switch after adding the required CLI commands to the device to enable TACACS+. The device administration license has been added to Cisco ISE, and the required policies have been created.

Which action is needed to enable access to the switch?

The ip ssh source-interface command needs to be set on the switch

802.1X authentication needs to be configured on the switch.

The RSA keypair used for SSH must be regenerated after enabling TACACS+.

The switch needs to be added as a network device in Cisco ISE and set to use TACACS+.

58. An administrator must block access to BYOD endpoints that were onboarded without a certificate and have been reported as stolen in the Cisco ISE My Devices Portal.

Which condition must be used when configuring an authorization policy that sets DenyAccess permission?

Endpoint Identity Group is Blocklist, and the BYOD state is Registered.

Endpoint Identify Group is Blocklist, and the BYOD state is Pending.

Endpoint Identity Group is Blocklist, and the BYOD state is Lost.

Endpoint Identity Group is Blocklist, and the BYOD state is Reinstate.

59. An organization is implementing Cisco ISE posture services and must ensure that a host-based firewall is in place on every Windows and Mac computer that attempts to access the network They have multiple vendors’ firewall applications for their devices, so the engineers creating the policies are unable to use a specific application check in order to validate the posture for this.

What should be done to enable this type of posture check?

Use the file registry condition to ensure that the firewal is installed and running appropriately.

Use a compound condition to look for the Windows or Mac native firewall applications.

Enable the default rewall condition to check for any vendor rewall application.

Enable the default application condition to identify the applications installed and validade the rewall app.

60. There is a need within an organization for a new policy to be created in Cisco ISE. It must validate that a specific anti-virus application is not only installed, but running on a machine before it is allowed access to the network.

Which posture condition should the administrator configure in order for this policy to work?

file

registry

application

service

Page 7 of 8

61. Refer to the exhibit.

An organization recently implemented network device administration using Cisco ISE. Upon testing the ability to access all of the required devices, a user in the Cisco ISE group IT Admins is attempting to login to a device in their organization's finance department but is unable to.

What is the problem?

The IT training rule is taking precedence over the IT Admins rule.

The authorization conditions wrongly allow IT Admins group no access to finance devices.

The finance location is not a condition in the policy set.

The authorization policy doesn't correctly grant them access to the finance devices.

62. 1.A network engineer is configuring Cisco TrustSec and needs to ensure that the Security Group Tag is being transmitted between two devices.

Where in the Layer 2 frame should this be verified?

CMD filed

802.1Q filed

Payload

802.1 AE header

63. Which two features should be used on Cisco ISE to enable the TACACS+ feature? (Choose two )

External TACACS Servers

Device Admin Service

Device Administration License

Server Sequence

Command Sets

64. An engineer is migrating users from MAB to 802.1X on the network. This must be done during normal business hours with minimal impact to users.

Which CoA method should be used?

Port Bounce

Port Shutdown

Session Termination

Session Reauthentication

65. A network administrator is configuring client provisioning resource policies for client machines and must ensure that an agent pop-up is presented to the client when attempting to connect to the network.

Which configuration item needs to be added to allow for this'?

the client provisioning URL in the authorization policy

a temporal agent that gets installed onto the system

a remote posture agent proxying the network connection

an API connection back to the client

66. An administrator is configuring a new profiling policy in Cisco ISE for a printer type that is missing from the profiler feed. The logical profile Printers must be used in the authorization rule and the rule must be hit.

What must be done to ensure that this configuration will be successful^

Create a new logical profile for the new printer policy

Enable the EndPoints: EndPointPolicy condition in the authorization policy.

Add the new profiling policy to the logical profile Printers.

Modify the profiler conditions to ensure that it goes into the correct logical profile

67. Users in an organization report issues about having to remember multiple usernames and passwords. The network administrator wants the existing Cisco ISE deployment to utilize an external identity source to alleviate this issue.

Which two requirements must be met to implement this change? (Choose two.)

Enable IPC access over port 80.

Ensure that the NAT address is properly configured

Establish access to one Global Catalog server.

Provide domain administrator access to Active Directory.

Configure a secure LDAP connection.

68. What does the dot1x system-auth-control command do?

causes a network access switch not to track 802.1x sessions

globally enables 802.1x

enables 802.1x on a network access device interface

causes a network access switch to track 802.1x sessions

69. Refer to the exhibit

Which component must be configured to apply the SGACL?

egress router

host

secure server

ingress router

70. An administrator wants to configure network device administration and is trying to decide whether to use TACACS* or RADIUS. A reliable protocol must be used that can check command authorization.

Which protocol meets these requirements and why?

TACACS+ because it runs over TCP

RADIUS because it runs over UDP

RADIUS because it runs over TC

TACACS+ because it runs over UDP

Page 8 of 8

71. What is a valid status of an endpoint attribute during the device registration process?

block listed

pending

unknown

DenyAccess

72. An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network.

Which node should be used to accomplish this task?

PSN

primary PAN

pxGrid

MnT

Facebook Twitter LinkedIn Google + Email