最新 [2026年07月24日] 100%合格率を保証します素晴らしい300-715試験問題PDF [Q59-Q78]

質問 59
Which two features must be used on Cisco ISE to enable the TACACS. feature? (Choose two)

Device Administration License

Server Sequence

Command Sets

Device Admin Service

External TACACS Servers

質問 60
Which two default endpoint identity groups does Cisco ISE create? (Choose two )

block list

endpoint

profiled

allow list

unknown

https://www.cisco.com/c/en/us/td/docs/security/ise/2-
1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html Default Endpoint Identity Groups Created for Endpoints Cisco ISE creates the following five endpoint identity groups by default: Blacklist, GuestEndpoints, Profiled, RegisteredDevices, and Unknown. In addition, it creates two more identity groups, such as Cisco-IP-Phone and Workstation, which are associated to the Profiled (parent) identity group. A parent group is the default identity group that exists in the system. Cisco ISE creates the following endpoint identity groups:
Blacklist–This endpoint identity group includes endpoints that are statically assigned to this group in Cisco ISE and endpoints that are block listed in the device registration portal. An authorization profile can be defined in Cisco ISE to permit, or deny network access to endpoints in this group.
GuestEndpoints–This endpoint identity group includes endpoints that are used by guest users.
Profiled–This endpoint identity group includes endpoints that match endpoint profiling policies except Cisco IP phones and workstations in Cisco ISE.
RegisteredDevices–This endpoint identity group includes endpoints, which are registered devices that are added by an employee through the devices registration portal. The profiling service continues to profile these devices normally when they are assigned to this group. Endpoints are statically assigned to this group in Cisco ISE, and the profiling service cannot reassign them to any other identity group. These devices will appear like any other endpoint in the endpoints list.
You can edit, delete, and block these devices that you added through the device registration portal from the endpoints list in the Endpoints page in Cisco ISE. Devices that you have blocked in the device registration portal are assigned to the Blacklist endpoint identity group, and an authorization profile that exists in Cisco ISE redirects blocked devices to a URL, which displays
“Unauthorised Network Access”, a default portal page to the blocked devices.
Unknown–This endpoint identity group includes endpoints that do not match any profile in Cisco ISE.
In addition to the above system created endpoint identity groups, Cisco ISE creates the following endpoint identity groups, which are associated to the Profiled identity group:
Cisco-IP-Phone–An identity group that contains all the profiled Cisco IP phones on your network.
Workstation–An identity group that contains all the profiled workstations on your network.

質問 61
MacOS users are complaining about having to read through wordy instructions when remediating their workstations to gam access to the network Which alternate method should be used to tell users how to remediate?

URL link

message text

executable

file distribution

質問 62
An engineer needs to export a file in CSV format, encrypted with the password C1$c0438563935, and contains users currently configured in Cisco ISE. Drag and drop the steps from the left into the sequence on the right to complete this task.

質問 63
An engineer builds a five-node distributed Cisco ISE deployment The first two deployed nodes are responsible for the primary and secondary administration and monitoring personas Which persona configuration is necessary to have the remaining three Cisco ISE nodes serve as dedicated nodes in the Cisco ISE cube that is responsible only for handling the RADIUS and TACACS+ authentication requests, identity lookups, and policy evaluation?
A)

B)

C)

D)

Option A

Option B

Option C

Option D

質問 64
Which persona configuration feature is used when setting personas in Cisco ISE for a node that will give network access and receive RADIUS requests?

pxGrid Node

Monitoring Node

Policy Service Node

Policy Administration Node

質問 65
An engineer must develop a policy that utilizes AD group membership on Cisco ISE. Which type of policy element must the engineer configure to create an AD group within a policy?

conditions

results

dictionaries

smart conditions

質問 66
A security engineer configures a Cisco Catalyst switch to use Cisco TrustSec. The engineer must define the PAC key to authenticate the switch to Cisco IISE. Drag and drop the commands from the left into sequence on the right. Not all options are used.

質問 67
What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?

The primary node restarts

The secondary node restarts.

The primary node becomes standalone

Both nodes restart.

質問 68
Which use case validates a change of authorization?

An authenticated, wired EAP-capable endpoint is discovered

An endpoint profiling policy is changed for authorization policy.

An endpoint that is disconnected from the network is discovered

Endpoints are created through device registration for the guests

質問 69
When planning for the deployment of Cisco ISE, an organization’s security policy dictates that they must use network access authentication via RADIUS. It also states that the deployment provide an adequate amount of security and visibility for the hosts on the network. Why should the engineer configure MAB in this situation?

The Cisco switches only support MAB.

MAB provides the strongest form of authentication available.

The devices in the network do not have a supplicant.

MAB provides user authentication.

質問 70
What is a function of client provisioning?

Client provisioning ensures that endpoints receive the appropriate posture agents.

Client provisioning checks a dictionary attribute with a value.

Client provisioning ensures an application process is running on the endpoint.

Client provisioning checks the existence, date, and versions of the file on a client.

質問 71
A Cisco ISE administrator must authenticate users against Microsoft Active Directory. The solution must meet these requirements:
– Users and computers must be authenticated.
– User groups must be retrieved during authentication.
Which protocol must be added to the allowed protocols on the policy to authenticate the users?

EAP-TLS

EAP-GTC

MS-CHAPv2

LEAP

質問 72

Refer to the exhibit. An engineer needs to configure central web authentication on the Cisco Wireless LAN Controller to use Cisco ISE for all guests connected to the wireless network. The components are configured already:
* Cisco Wireless LAN Controller is fully configured
* authorization profile on the Cisco ISE
* authentication policy on the Cisco ISE
Which component would be configured next on Cisco ISE?

authorization policy

authentication profile

accounting profile

authorization rule

質問 73
An engineer configures Cisco ISE and Cisco Catalyst switches to enforce Cisco TrustSec policies. The engineer must use a nondisruptive deployment approach for new devices by deploying TrustSec policies in staging, preproduction, and production. Which action must be taken to complete the configuration?

Configure Security Group Tag Exchange Protocol on the new devices and integrate the devices in groups with Cisco ISE.

Configure policy matrices in Cisco ISE and assign the new devices to the policy matrices.

Integrate the new devices in staging, preproduction, and production network device groups.

Configure a different security group tag for the new devices in the staging, preproduction, and production stages.

質問 74
Which two responses from the RADIUS server to NAS are valid during the authentication process? (Choose two )

access-response

access-request

access-reserved

access-accept

access-challenge

質問 75
Which Cisco ISE node does not support automatic failover?

Inline Posture node

Monitoring node

Policy Services node

Admin node

質問 76
An engineer is designing a BYOD environment utilizing Cisco ISE for devices that do not support native supplicants. Which portal must the security engineer configure to accomplish this task?

MDM

Client provisioning

My devices

BYOD

質問 77
Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

personas

qualys

nexpose

posture

質問 78
Which profiling probe collects the user-agent string?

DHCP

HTTP