Quiz
Access Solutions
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (107)
1A network administrator is seeing a posture status "unknown" for a single corporate machine on the Cisco
ISE authentication report, whereas the other machines are reported as "compliant". Which option is the
reason for machine being reported as "unknown"?- AA. Posture agent is not installed on the machine.
- BB. Posture policy does not support the OS.
- CC. Posfure compliance condition is missing on the machine.
- DD. Posture service is disabled on Cisco ISE.
2Where is client traffic decrypted in a controller-based wireless network protected with WPA2 Security?
- AA. Access Point
- BB. Switch
- CC. Wireless LAN Controller
- DD. Authentication Server
3Which two switchport commands enable MAB and allow non-802.1X capable devices to immediately run
through the MAB process? (Choose two.)- AA. authentication order mab dot1x
- BB. authentication order dot1x mab
- CC. no authentication timer
- DD. dot1x timeout tx-period
- EE. authentication open
- FF. mab
4Which three remediation actions are supported by the Web Agent for Windows? (Choose three.)
- AA. Automatic Remediation
- BB. Message text
- CC. URL Link
- DD. File Distribution
- EE. AV definition update
- FF. Launch Program
5When using CA for identity source, which method can be used to provide real-time certificate validation?
- AA. X.509
- BB. PKI
- CC. OCSP
- DD. CRL
6Which configuration must you perform on a switch to deploy Cisco ISE in low-impact mode?
- AA. Configure an ingress port ACL on the switchport.
- BB. Configure DHCP snooping globally.
- CC. Configure IP-device tracking.
- DD. Configure BPDU filtering.
7Which command configures console port authorization under line con 0?
- AA. authorization default|WORD
- BB. authorization exec line con 0|WORD
- CC. authorization line con 0|WORD
- DD. authorization exec default|WORD
8A security engineer has a new TrustSec project and must create a few static security group tag classifications as a proof of concept. Which two classifications can the tags be mapped to? (Choose two.)
- AA. VLAN
- BB. user ID
- CC. interface
- DD. switch ID
- EE. MAC address
9Which description of the use of low-impact mode in a Cisco ISE deployment is correct?
- AIt continues to use the authentication open capabilities of the switch port, which allows traffic to enter
the switch before an authentication result. - BLow-impact mode must be the final phase in deploying Cisco ISE into a network environment using the
phased approach. - CThe port does not allow any traffic before the authentication (except for EAP, Cisco Discovery Protocol,
and LLDP), and then the port is assigned to specific authorization results after the authentication. - DIt enables authentication (with authentication open), sees exactly which devices fail and which
succeed, and corrects the failed authentications before they cause any problems.
- AIt continues to use the authentication open capabilities of the switch port, which allows traffic to enter
10When you select Centralized Web Auth in the ISE Authorization Profile, which two components host the
web authentication portal? (Choose two.)- AA. ISE
- BB. the WLC
- CC. the access point
- DD. the switch
- EE. the endpoints
11Which definition of "posturing" as it relates to a general network infrastructure and access into the internal network is true?
- AA. The process by which an operating system or application running on an endpoint provides critical information about internet activity being used by the endpoint.
- BB. The process by which an endpoint device can be monitored while connected to the network to determine if it could contain viruses or potential harmful programs running.
- CC. The process by which an operating system or application running on an endpoint provides critical information about the software that is actively running on the device.
- DD. The process when software is uploaded to an end device before it is allowed to gain access to a secure network.
12Which 2 options are functional components of the posture service?
- AA. Quarantined policy
- BB. Posture policy
- CC. Client provisioning
- DD. Network provisioning
13Which components must be selected for a client provisioning policy to do a Posture check on the Cisco
ISE?- AA. Configuration Wizard, Wizard Profile
- BB. Remediation Actions, Posture Requirements
- CC. Operating System, Posture Requirements
- DD. Agent, Profile, Compliance Module
14Which two options can a sponsor select to create bulk guest accounts from the sponsor portal? (Choose
two.)- AA. Known
- BB. Random
- CC. Monthly
- DD. Imported
- EE. Daily
- FF. Yearly
15Which advanced authentication setting is needed to allow an unknown device to utilize Central WebAuth?
- AA. If Authentication failed > Continue
- BB. If Authentication failed > Drop
- CC. If user not found > Continue
- DD. If user not found > Reject
16Which three network access devices allow for static security group tag assignment? (Choose three.)
- AA. intrusion prevention system
- BB. access layer switch
- CC. data center access switch
- DD. load balancer
- EE. VPN concentrator
- FF. wireless LAN controller
17Which three statements describe differences between TACACS+ and RADIUS? (Choose three.)
- AA. RADIUS encrypts the entire packet, while TACACS+ encrypts only the password.
- BB. TACACS+ encrypts the entire packet, while RADIUS encrypts only the password.
- CC. RADIUS uses TCP, while TACACS+ uses UDP.
- DD. TACACS+ uses TCP, while RADIUS uses UDP.
- EE. RADIUS uses ports 1812 and 1813, while TACACS+ uses port 49.
- FF. TACACS+ uses ports 1812 and 1813, while RADIUS uses port 49
18Which protocol is EAP encapsulated in for communications between the authenticator and the
authentication server ?- AA. EAP-MD5
- BB. IPSec
- CC. EAPOL
- DD. Radius
19Refer to the exhibit. Which authentication method is being used?
- AA. PEAP-MSCHAP
- BB. EAP-GTC
- CC. EAP-TLS
- DD. PEAP-TLS
20When MAB is configured, how often are ports reauthenticated by default?
- AA. every 60 seconds
- BB. every 90 seconds
- CC. every 120 seconds
- DD. never
21Which functionality does the Cisco ISE self-provisioning flow provide?
- AA. It provides support for native supplicants, allowing users to connect devices directly to the network.
- BB. It provides the My Devices portal, allowing users to add devices to the network.
- CC. It provides support for users to install the Cisco NAC agent on enterprise devices.
- DD. It provides self-registration functionality to allow guest users to access the network.
22You discover that the Cisco ISE is failing to connect to the Active Directory server. Which option is a
possible cause of the problem?- AA. NTP server time synchronization is configured incorrectly.
- BB. There is a certificate mismatch between Cisco ISE and Active Directory.
- CC. NAT statements required for Active Directory are configured incorrectly.
- DD. The RADIUS authentication ports are being blocked by the firewall.
23Which feature must you configure on a switch to allow it to redirect wired endpoints to Cisco ISE?
- AA. the http secure-server command
- BB. RADIUS Attribute 29
- CC. the RADIUS VSA for accounting
- DD. the RADIUS VSA for URL-REDIRECT
24Which debug command on a Cisco WLC shows the reason that a client session was terminated?
- AA. debug dot11 state enable
- BB. debug dot1x packet enable
- CC. debug client mac addr
- DD. debug dtls event enable
- EE. debug ap enable cisco ap
25Which technology performs CoA support Posture Service?
- AA. External root CA
- BB. Cisco ACS
- CC. Cisco ISE
- DD. Internal root CA
26Under which circumstance would an inline posture node be deployed?
- AA. When the NAD does not support CoA
- BB. When the NAD cannot support the number of connected endpoints
- CC. When a PSN is overloaded
- DD. To provide redundancy for a PSN
27What are three ways that an SGT can be assigned to network traffic?
- AA. Manual binding of the IP address to an SGT
- BB. Manually configured on the switch port
- CC. Dynamically assigned by the network access device
- DD. Dynamically assigned by the 802.1X authorization result
- EE. Manually configured in the NAC agent profile
- FF. Dynamically assigned by the AnyConnect network access manager
28In Cisco ISE 1.3, which feature is available to a sponsor in a sponsor group?
- AA. Help employees add and manage new devices by entering the MAC address for the device.
- BB. Restrict sponsors from viewing guest passwords.
- CC. Allow the user to download a native supplicant profile.
- DD. Reinstate or delete devices that were registered previously.
29Refer to the exhibit
aaa new-model
radius-server host 10.0.0.12 key secret12
Which statement about the authentication protocol used in the configuration is true?- AA. There is separate authentic and authorization request packet.
- BB. The authentication request contains only a password.
- CC. The authentication and authorization requests are grouped in a single packet
- DD. The authentication request contains only a username.
30Which Cisco ISE feature can differentiate a corporate endpoint from a personal device?
- AA. EAP chaining
- BB. PAC files
- CC. authenticated in-band provisioning
- DD. machine authentication
31You configured wired 802.1X with EAP-TLS on Windows machines. The ISE authentication detail report
shows "EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain."
What is the most likely cause of this error?- AA. The ISE certificate store is missing a CA certificate.
- BB. The Wireless LAN Controller is missing a CA certificate.
- CC. The switch is missing a CA certificate
- DD. The Windows Active Directory server is missing a CA certificate.
32A malicious user gained network access by spoofing printer connections that were authorized using MAB
on four different switch ports at the same time. What two catalyst switch security features will prevent
further violations? (Choose two)- AA. DHCP Snooping
- BB. 802.1AE MacSec
- CC. Port security
- DD. IP Device tracking
- EE. Dynamic ARP inspection
- FF. Private VLANs
33Which condition triggers wireless authentication?
- AA. NAS-Port-Type is set to IEEE 802.11.
- BB. Framed-Compression is set to None.
- CC. Service-Type is set to Framed.
- DD. Tunnel-Type is set to VLAN.
34Which type of remediation does Windows Server Update Services provide?
- AA. automatic remediation
- BB. administrator-initiated remediation
- CC. redirect remediation
- DD. central Web auth remediation
35Which mechanism does Cisco ISE use to force a device off the network if it is reported lost or stolen?
- AA. CoA
- BB. dynamic ACLs
- CC. SGACL
- DD. certificate revocation
36Which two options are EAP methods supported by Cisco ISE? (Choose two.)
- AA. EAP-FAST
- BB. EAP-TLS
- CC. EAP-MS-CHAPv2
- DD. EAP-GTC
37Which two options are valid for configuring IEEE 802.1AE MACSec between switches in a TrustSec
network? (Choose two.)- AA. manually on links between supported switches
- BB. in the Cisco Identity Services Engine
- CC. in the global configuration of a TrustSec non-seed switch
- DD. dynamically on links between supported switches
- EE. in the Cisco Secure Access Control System
- FF. in the global configuration of a TrustSec seed switch
38Which command can check a AAA server authentication for server group Group1, user cisco, and
password cisco555 on a Cisco ASA device?- AA. ASA# test aaa-server authentication Group1 username cisco password cisco555
- BB. ASA# test aaa-server authentication group Group1 username cisco password cisco555
- CC. ASA# aaa-server authorization Group1 username cisco password cisco555
- DD. ASA# aaa-server authentication Group1 roger cisco555
39In a multi-node ISE deployment, backups are not working on the MnT node. Which ISE CLI option would
help mitigate this issue?- AA. repository
- BB. ftp-url
- CC. application-bundle
- DD. collector
40You are troubleshooting RADIUS issues on the network and the debug radius command returns the given
output. What is the most likely reason for the failure?
- AA. An invalid username or password was entered.
- BB. The RADIUS port is incorrect.
- CC. The NAD is untrusted by the RADIUS server.
- DD. The RADIUS server is unreachable.
- EE. RADIUS shared secret does not match
41What are the four code fields which identify the type of an EAP packet?
- AA. Request, Reply, Accept, Reject
- BB. Request, Reply, Success, Failure
- CC. Request, Response, Success, Failure
- DD. Request, Response. Accept Reject
42A network engineer is configuring HTTP based CWA on a switch. Which three configuration elements are
required? (Choose three.)- AA. HTTP server enabled
- BB. Radius authentication on the port with MAB
- CC. Redirect access-list
- DD. Redirect-URL
- EE. HTTP secure server enabled
- FF. Radius authentication on the port with 802.1x
- GG. Pre-auth port based access-list
43Which two components are required to connect to a WLAN network that is secured by EAP-TLS
authentication? (Choose two.)- AA. Kerberos authentication server
- BB. AAA/RADIUS server
- CC. PSKs
- DD. CA server
44When you select Centralized Web Auth in the ISE Authorization Profile, which component hosts the web
authentication portal?- AA. the endpoints
- BB. the WLC
- CC. the access point
- DD. the switch
- EE. ISE
45Which administrative role has permission to assign Security Group Access Control Lists?
- AA. System Admin
- BB. Network Device Admin
- CC. Policy Admin
- DD. Identity Admin
46Which two posture redirect ACLs and remediation DACLs must be pushed from Cisco ISE to a Cisco IOS
switch if the endpoint must remediate itself? The ISE IP address is 10.201.228.76 and the IP address of
the remediating server is 10.201.229.1. (Choose two.)- AA. ip access-l ex ACL-POSTURE-REDIRECT deny udp any any eq domain deny ip any host
10.201.228.76 permit tcp any any eq 80 permit tcp any any eq 443 - BB. ip access-l ex ACL-POSTURE-REDIRECT deny udp any any eq domain deny ip any host
10.201.228.76 deny ip any host 10.201.229.1 permit tcp any any eq 80permit tcp any any eq 443 - CC. ip access-l ex ACL-POSTURE-REDIRECT deny udp any any eq domain permit ip any host
10.201.228.76 permit ip any host 10.201.229.1 deny ip any any - DD. POSTURE_REMEDIATION DACL permit udp any any eq domain permit tcp any host 10.201.228.76
permit tcp any any eq 80 permit tcp any any eq 443 - EE. POSTURE_REMEDIATION DACL permit udp any any eq domain deny tcp any host 10.201.228.76
permit tcp any any eq 80 permit tcp any any eq 443 permit ip any host 10.210.229.1 - FF. POSTURE_REMEDIATION DACL permit udp any any eq domain deny tcp any host 10.201.228.76
deny ip any host 10.210.229.1 permit tcp any any eq 80 permit tcp any any eq 443
- AA. ip access-l ex ACL-POSTURE-REDIRECT deny udp any any eq domain deny ip any host
47Where is dynamic SGT classification configured?
- AA. Cisco ISE
- BB. NAD
- CC. supplicant
- DD. RADIUS proxy
48Which three statements about the given configuration are true? (Choose three.)
- AA. TACACS+ authentication configuration is complete.
- BB. TACACS+ authentication configuration is incomplete.
- CC. TACACS+ server hosts are configured correctly.
- DD. TACACS+ server hosts are misconfigured.
- EE. The TACACS+ server key is encrypted.
- FF. The TACACS+ server key is unencrypted.
49Which packets are allowed on a dot1x port with no authentication open before the port goes to an
authorized state?- AA. DHCP, EAPOL, HTTP
- BB. CDP, EAPOL, STP
- CC. CDP, DHCP, DNS
- DD. CDP, EAPOL, HTTP
50Which error in a redirect ACL can cause the redirection of an endpoint to the provisioning portal to fail?
- AA. The redirect ACL is blocking access to ports 80 and 443.
- BB. The redirect ACL is applied to an incorrect SVI.
- CC. The redirect ACL is blocking access to the client provisioning portal.
- DD. The redirect ACL is blocking access to Cisco ISE port 8905.
51Which option is one method for transporting security group tags throughout the network?
- AA. by embedding the SGT in the IP header
- BB. via Security Group Exchange Protocol
- CC. by embedding the SGT in the 802.1Q header
- DD. by enabling 802.1AE on every network device
52If the host sends a packet across the Cisco TrustSec domain, where is the SGACL enforced?
- AA. At the egress router
- BB. Dynamically at the host
- CC. After the packet enters the Cisco TrustSec domain
- DD. At the ingress router.
53Which Cisco ISE 1.x protocol can be used to control admin access to network access devices?
- AA. TACACS+
- BB. RADIUS
- CC. EAP
- DD. Kerberos
54An organization has recently deployed ISE with Trustsec capable Cisco switches and would like to allow
differentiated network access based on user groups. Which solution is most suitable for achieving these
goals?- AA. Cyber Threat Defense for user group control by leveraging Netflow exported from the Cisco switches and identity information from ISE
- BB. MACsec in Multiple-Host Mode in order to encrypt traffic at each hop of the network infrastructure
- CC. Identity-based ACLs preconfigured on the Cisco switches with user identities provided by ISE
- DD. Cisco Security Group Access Policies to control access based on SGTs assigned to different user groups
55Which network component would issue the CoA?
- AA. switch
- BB. endpoint
- CC. Admin Node
- DD. Policy Service Node
56When RADIUS NAC and AAA Override are enabled for a WLC on a Cisco ISE, which two statements
about RADIUS NAC are true? (Choose two.)- AA. It returns an access-accept and sends the redirection URL for all users.
- BB. It establishes secure connectivity between the RADIUS server and the Cisco ISE.
- CC. It allows the Cisco ISE to send a CoA request that indicates when the user is authenticated.
- DD. It is used for posture assessment, so the Cisco ISE changes the user profile based on posture result.
- EE. It allows multiple users to authenticate at the same time.
57Which option is a recommended agent for guest posture assessment?
- AA. Windows Web Agent
- BB. Mac OSX Agent
- CC. Mac OSX Web Agent
- DD. Windows NAC Agent
58You are configuring SGA on a network device that is unable to perform SGT tagging. How can the device
propagate SGT information?- AA. The device can use SXP to pass IP-address-to-SGT mappings to a TrustSec-capable hardware peer.
- BB. The device can use SXP to pass MAC-address-to-STG mappings to a TrustSec-capable hardware
peer. - CC. The device can use SXP to pass MAC-address-to-IP mappings to a TrustSec-capable hardware peer.
- DD. The device can propagate SGT information in an encapsulated security payload.
- EE. The device can use a GRE tunnel to pass the SGT information to a TrustSec-capable hardware peer.
59In a basic ACS deployment consisting of two servers, for which three tasks is the primary server
responsible? (Choose three.)- AA. configuration
- BB. authentication
- CC. sensing
- DD. policy requirements
- EE. monitoring
- FF. repudiation
60An engineer wants to migrate 802. 1X deployment phase from Open to Low-Impact mode. Which option
must be configured on the switch port?- AA. open authentication to the domain
- BB. ingress access list applied to the interface
- CC. authentication host mode to multiple authentication
- DD. authentication host mode to multiple domain
61Cisco 802.1X phasing enables flexible deployments through the use of open, low-impact, and closed
modes. What is a unique characteristic of the most secure mode?- AA. Granular ACLs applied prior to authentication
- BB. Per user dACLs applied after successful authentication
- CC. Only EAPoL traffic allowed prior to authentication
- DD. Adjustable 802.1X timers to enable successful authentication
62Which EAP method uses a modified version of the MS-CHAP authentication protocol?
- AA. EAP-POTP
- BB. EAP-TLS
- CC. LEAP
- DD. EAP-MD5
63Which two identity databases are supported when PEAP-MSCHAPv2 is used as EAP type? (Choose two.)
- AA. Windows Active Directory
- BB. LDAP
- CC. RADIUS token server
- DD. internal endpoint store
- EE. internal user store
- FF. certificate authentication profile
- GG. RSA SecurID
64An engineer is investigating an issue with their Posture Run-time Services implementation.
Which protocol services are used by NAC Agents to communicate with NAC Servers?- AA. SWISS
- BB. IPsec
- CC. IKEv2
- DD. FIX
65Which effect does the ip http secure-server command have on a Cisco ISE?
- AA. It enables the HTTP server for users to connect on the command line.
- BB. It enables the HTTP server for users to connect by using web-based authentication.
- CC. It enables the HTTPS server for users to connect by using web-based authentication.
- DD. It enables the HTTPS server for users to connect on the command line.
66Which three host modes support MACsec? (Choose three.)
- AA. multidomain authentication host mode
- BB. multihost mode
- CC. multi-MAC host mode
- DD. single-host mode
- EE. dual-host mode
- FF. multi-auth host mode
67A network administrator must enable which protocol to utilize EAP-Chaining?
- AA. EAP-FAST
- BB. EAP-TLS
- CC. MSCHAPv2
- DD. PEAP
68Prime Uses Which protocol for devices discovery ?
- AA. RARP
- BB. LLDP
69A network security engineer is considering configuring 802.1x port authentication such that a single host is
allowed to be authenticated for data and another single host for voice. Which port authentication host
mode can be used to achieve this configuration?- AA. single-host
- BB. multihost
- CC. multauth
- DD. multidomain
70In an 802.1X authorization process, a network access device provides which three functions? (Choose
three.)- AA. Filters traffic prior to authentication
- BB. Passes credentials to authentication server
- CC. Enforces policy provided by authentication server
- DD. Hosts a central web authentication page
- EE. Confirms supplicant protocol compliance
- FF. Validates authentication credentials
71Which two Cisco Catalyst switch interface commands allow only a single voice device and a single data
device to be connected to the IEEE 802.1X-enabled interface? (Choose two.)- AA. authentication host-mode single-host
- BB. authentication host-mode multi-domain
- CC. authentication host-mode multi-host
- DD. authentication host-mode multi-auth
72Which feature enables the Cisco ISE DHCP profiling capabilities to determine and enforce authorization
policies on mobile devices?- AA. disabling the DHCP proxy option
- BB. DHCP option 42
- CC. DHCP snooping
- DD. DHCP spoofing
73Which set of commands allows IPX inbound on all interfaces?
- AA. ASA1(config)# access-list IPX-Allow ethertype permit ipxASA1(config)# access-group IPX-Allow in
interface global - BB. ASA1(config)# access-list IPX-Allow ethertype permit ipxASA1(config)# access-group IPX-Allow in
interface inside - CC. ASA1(config)# access-list IPX-Allow ethertype permit ipxASA1(config)# access-group IPX-Allow in
interface outside - DD. ASA1(config)# access-list IPX-Allow ethertype permit ipxASA1(config)# access-group IPX-Allow out
interface global
- AA. ASA1(config)# access-list IPX-Allow ethertype permit ipxASA1(config)# access-group IPX-Allow in
74What three changes require restarting the application service on an ISE node? (Choose three.)
- AA. Registering a node.
- BB. Changing the primary node to standalone.
- CC. Promoting the administration node.
- DD. Installing the root CA certificate.
- EE. Changing the guest portal default port settings.
- FF. Adding a network access device.
75Which feature must you configure on a switch to allow it to redirect wired endpoints to Cisco ISE?
- AA. the http secure-server command
- BB. RADIUS Attribute 29
- CC. the RADIUS VSA for accounting
- DD. the RADIUS VSA for URL-REDIRECT
76Which authorization method is the Cisco best practice to allow endpoints access to the Apple App store or
Google Play store with Cisco WLC software version 7.6 or newer?- AA. dACL
- BB. DNS ACL
- CC. DNS ACL defined in Cisco ISE
- DD. redirect ACL
77In the command 'aaa authentication default group tacacs local', how is the word 'default' defined?
- AA. Command set
- BB. Group name
- CC. Method list
- DD. Login type
78What two values does Cisco recommend you adjust and test to set the optimal timeout value for your
network's specific 802.1X MAB deployment?- AA. Max-reath-req
- BB. Supp-timeout
- CC. Max-req
- DD. Tx-period
- EE. Server-timeout
79From which location can you run reports on endpoint profiling?
- AA. Reports > Operations > Catalog > Endpoint
- BB. Operations > Reports > Catalog > Endpoint
- CC. Operations > Catalog > Reports > Endpoint
- DD. Operations > Catalog > Endpoint
80Which devices support download of environmental data and IP from Cisco ISE to SGT bindings in their
SGFW implementation?- AA. Cisco ASA devices
- BB. Cisco ISR G2 and later devices with ZBFW
- CC. Cisco ISR G3 devices with ZBFW
- DD. Cisco ASR devices with ZBFW
81Changes were made to the ISE server while troubleshooting, and now all wireless certificate
authentications are failing. Logs indicate an EAP failure. What are the two possible causes of the problem?
(Choose two.)- AA. EAP-TLS is not checked in the Allowed Protocols list
- BB. Client certificate is not included in the Trusted Certificate Store
- CC. MS-CHAPv2-is not checked in the Allowed Protocols list
- DD. Default rule denies all traffic
- EE. Certificate authentication profile is not configured in the Identity Store
82What is a feature of Cisco WLC and IPS synchronization?
- AA. Cisco WLC populates the ACLs to prevent repeat intruder attacks.
- BB. The IPS automatically send shuns to Cisco WLC for an active host block.
- CC. Cisco WLC and IPS synchronization enables faster wireless access.
- DD. IPS synchronization uses network access points to provide reliable monitoring
83Which two protocols does Cisco Prime Infrastructure use for device discovery? (Choose two.)
- AA. SNAP
- BB. LLDP
- CC. RARP
- DD. DNS
- EE. LACP
84A company has implemented a dual SSID BYOD design. A provisioning SSID is used for user registration, and an employee SSID is used for company network access.
Which controller option must be enabled to allow a user to switch immediately from the provisioning SSID to the employee SSID after registration has been completed?- AA. AAA override
- BB. User Idle Timeout
- CC. Fast SSID Change
- DD. AP Fallback
85Which three personas can a Cisco ISE assume in a deployment? (Choose three.)
- AA. connection
- BB. authentication
- CC. administration
- DD. testing
- EE. policy service
- FF. monitoring
86Which two accounting types are used to implement accounting with RADIUS? (Choose two.)
- AA. Network
- BB. User
- CC. Attribute
- DD. Device
- EE. Resource
87You have configured a Cisco ISE1.2 deployment for self registration of guest users. What two options can
you select from to determine when the account duration timer begins(Choose two)?- AA. Createtime
- BB. Firstlogin
- CC. Approvaltime
- DD. Custom
- EE. Starttime
88When you add a new PSN for guest access services, which two options must be enabled under deployment settings? (Choose two.)
- AA. Admin
- BB. Monitoring
- CC. Policy Service
- DD. Session Services
- EE. Profiling
89Which five portals are provided by PSN? (Choose five.)
- AA. guest
- BB. sponsor
- CC. my devices
- DD. blacklist
- EE. client provisioning
- FF. admin
- GG. monitoring and troubleshooting
90Which ISE flow mode does this diagram represent?
- AA. Closed mode
- BB. Monitor mode
- CC. Application mode
- DD. Low-impact mode
91Which three features should be enabled as best practices for MAB? (Choose three.)
- AA. MD5
- BB. IP source guard
- CC. DHCP snooping
- DD. storm control
- EE. DAI
- FF. URPF
92An administrator can leverage which attribute to assign privileges based on Microsoft Active Directory user
groups?- AA. member of
- BB. group
- CC. class
- DD. person
93A company has implemented a dual SSID BYOD design. A provisioning SSID is used for user registration, and an employee SSID is used for company network access. How is the layer 2 security of the provisioning SSID configured?
- AA. 802.1X
- BB. Open
- CC. WPA2
- DD. MAC filtering disabled
94When you configure an endpoint profiling policy rule, which option describes the purpose of the minimum
certainty factor?- AA. It is compared to the total certainty metric of an individual endpoint to determine whether the endpoint can be trusted.
- BB. It is compared to the assigned certainty value of an individual endpoint in a device database to determine whether the endpoint can be trusted.
- CC. It is used to compare the policy condition to other active policies.
- DD. It is used to determine the likelihood that an endpoint is an active, trusted device on the network.
95What EAP method supports mutual certificate-based authentication?
- AA. EAP-TTLS
- BB. EAP-MSCHAP
- CC. EAP-TLS
- DD. EAP-MD5
96What is the default posture status for non-agent capable devices, such as Linux and iDevices?
- AA. Unknown
- BB. Validated
- CC. Default
- DD. Compliant
97Security Group Access requires which three syslog messages to be sent to Cisco ISE? (Choose three.)
- AA. IOS-7-PROXY_DROP
- BB. AP-1-AUTH_PROXY_DOS_ATTACK
- CC. MKA-2-MACDROP
- DD. AUTHMGR-5-MACMOVE
- EE. ASA-6-CONNECT_BUILT
- FF. AP-1-AUTH_PROXY_FALLBACK_REQ
98During client provisioning on a Mac OS X system, the client system fails to renew its IP address. Which change can you make to the agent profile to correct the problem?
- AA. Enable the Agent IP Refresh feature.
- BB. Enable the Enable VLAN Detect Without UI feature.
- CC. Enable CRL checking.
- DD. Edit the Discovery Host parameter to use an IP address instead of an FQDN.
99What are two possible reasons why a scheduled nightly backup of ISE to a FTP repository would fail?
(Choose two.)- AA. ISE attempted to write the backup to an invalid path on the FTP server.
- BB. The ISE and FTP server clocks are out of sync.
- CC. The username and password for the FTP server are invalid
- DD. The server key is invalid or misconfigured.
- EE. TCP port 69 is disabled on the FTP server.
100Which configuration is required in the Cisco ISE Authentication policy to allow Central Web Authentication?
- AA. Dot1x and if authentication failed continue
- BB. MAB and if user not found continue
- CC. MAB and if authentication failed continue
- DD. Dot1x and if user not found continue
101Which interface-level command is needed to turn on dot1x authentication?
- AA. authentication pae authenticator
- BB. aaa server radius dynamic-author
- CC. authentication host-mode single-host
- DD. dot1x system-auth-control
102Which command on the switch ensures that the Service-Type attribute is sent with all RADIUS
authentication request?- AA. radius-server attribute 8 include-in-access-req
- BB. radius-server attribute 25 access-request include
- CC. radius-server attribute 6 on-for-login-auth
- DD. radius-server attribute 31 send nas-port-detail
103You are installing Cisco ISE on nodes that will be used in a distributed deployment. After the initial bootstrap process, what state will the Cisco ISE nodes be in?
- AA. Remote
- BB. Policy service
- CC. Administration
- DD. Standalone
104The NAC Agent uses which port and protocol to send discovery packets to an ISE Policy Service Node?
- AA. tcp/8905
- BB. udp/8905
- CC. http/80
- DD. https/443
105Which statement about the CAK is true?
- AA. It is the master key that generates the other keys that MACsec requires.
- BB. Failed MACsec connections fall back to MAB by default.
- CC. It is the key that is used to discover MACsec peers and perform key negotiation between the peers.
- DD. It is the secret key that encrypts traffic during the connection.
- EE. It is the key that is used to negotiate session encryption keys.
106Which functionality does the Cisco ISE BYOD flow provide?
- AA. It provides support for native supplicants, allowing users to connect devices directly to the network.
- BB. It provides the My Devices portal, allowing users to add devices to the network.
- CC. It provides support for users to install the Cisco NAC agent on enterprise devices.
- DD. It provides self-registration functionality to allow guest users to access the network.
107What are the initial steps must you perform to add the ISE to the WLC?
- AA. 1. With a Web browser, establish an HTTP connection to the WLC pod.
2. Navigate to Administration > Authentication > New.
3. Enter server values to begin the configuration. - BB. 1. With a Web browser, establish an FTP connection to the WLC pod.
2. Navigate to Security > Administration > New.
3. Add additional security features for FTP authentication. - CC. 1. With a Web browser, establish an HTTP connection to the WLC pod.
2. Navigate to Authentication > New.
3. Enter ACLs and Authentication methods to begin the configuration. - DD. 1. With a Web browser connect, establish an HTTPS connection to the WLC pod.
2. Navigate to Security > Authentication > New.
3. Enter server values to begin the configuration.
- AA. 1. With a Web browser, establish an HTTP connection to the WLC pod.
Informações
- Descrição
- Quiz sobre Access Solutions, criado por clau wen em 23-08-2018.
- Autor
- clau wen
- Idioma
- Español
- Visualizações
- 0
- Avaliação
- Ainda sem avaliações Avalie este quiz