問題一覧
1
Which personas can a Cisco ISE node assume?
administration, policy service, and monitoring
2
What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?
The secondary node restarts.
3
Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose two.)
new AD user 802.1X authentication, posture
4
Which supplicant(s) and server(s) are capable of supporting EAP-CHAINING?
Cisco AnyConnect NAM and Cisco Identity Service Engine
5
What is a requirement for Feed Service to work?
Cisco ISE has Internet access to download feed update.
6
What is a method for transporting security group tags throughout the network?
by the Security Group Tag Exchange Protocol
7
Drag the steps to configure a Cisco ISE node as a primary administration node from the left into the correct order on the right.
3 - 1 - 4 - 2
8
An engineer is configuring a virtual Cisco ISE deployment and needs each persona to be on a different node. Which persona should be configured with the largest amount of storage in this environment?
Monitoring and Troubleshooting
9
In a standalone Cisco ISE deployment, which two personas are configured on a node? (Choose two.)
administration, policy service
10
A network engineer must enforce access control using special tags, without re-engineering the network design. Which feature should be configured to achieve this in a scalable manner?
SGT
11
A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed interface. Which command should be used to accomplish this task?
cts role-based enforcement
12
In a Cisco ISE split deployment model, which load is split between the nodes?
AAA
13
What is the deployment mode when two Cisco ISE nodes are configured in an environment?
distributed
14
An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened. From which Cisco ISE persona should this traffic be originating?
policy service
15
What does a fully distributed Cisco ISE deployment include?
All Cisco ISE personas on their own dedicated nodes.
16
An engineer is configuring 802.1X and wants it to be transparent from the users' point of view. The implementation should provide open authentication on the switch ports while providing strong levels of security for non-authenticated devices. Which deployment mode should be used to achieve this?
low-impact
17
A network administrator changed a Cisco ISE deployment from pilot to production and noticed that the JVM memory utilization increased significantly. The administrator suspects this is due to replication between the nodes. What must be configured to minimize performance degradation?
Enable the endpoint attribute filter.
18
An administrator is attempting to replace the built-in self-signed certificates on a Cisco ISE appliance. The CA is requesting some information about the appliance in order to sign the new certificate. What must be done in order to provide the CA this information?
Generate the CSR.
19
An administrator is adding network devices for a new medical building into Cisco ISE. These devices must be in a network device group that is identifying them as `Medical Switch` so that the policies can be made separately for the endpoints connecting through them. Which configuration item must be changed in the network device within Cisco ISE to accomplish this goal?
Change the device type to Medical Switch.
20
An organization wants to split their Cisco ISE deployment to separate the device administration functionalities from the main deployment. For this to work, the administrator must deregister any nodes that will become a part of the new deployment, but the button for this option is grayed out. Which configuration is causing this behavior?
One of the nodes is the Primary PAN.
21
A network administrator must configure Cisco ISE Personas in the company to share session information via syslog. Which Cisco ISE personas must be added to syslog receivers to accomplish this goal?
monitor
22
What is the maximum number of PSN nodes supported in a medium-sized deployment?
five
23
How is policy services node redundancy achieved in a deployment?
by creating a node group
24
Which two fields are available when creating an endpoint on the context visibility page of Cisco ISE? (Choose two.)
Policy Assignment , Identity Group Assignment
25
In which two ways can users and endpoints be classified for TrustSec? (Choose two.)
VLAN, Dynamic
26
When configuring Active Directory groups, what does the Cisco ISE use to resolve ambiguous group names?
SID
27
Which permission is common to the Active Directory Join and Leave operations?
Search Active Directory to see if a Cisco ISE machine account already exists.
28
Which interface-level command is needed to turn on 802.1X authentication?
dot1x pae authenticator
29
Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?
idle-timeout
30
What does the dot1x system-auth-control command do?
globally enables 802.1x
31
What should be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?
continue
32
Which command displays all 802.1X/MAB sessions that are active on the switch ports of a Cisco Catalyst switch?
show authentication sessions
33
What are two requirements of generating a single certificate in Cisco ISE by using a certificate provisioning portal, without generating a certificate signing request? (Choose two.)
Enter the common name., Select the certificate template.
34
Refer to the exhibit. Which command is typed within the CLI of a switch to view the troubleshooting output?
show authentication sessions mac 000e.84af.59af details
35
What gives Cisco ISE an option to scan endpoints for vulnerabilities?
authorization profile
36
Which two values are compared by the binary comparison function in authentication that is based on Active Directory?
user-presented certificate and a certificate stored in Active Directory
37
What happens when an internal user is configured with an external identity store for authentication, but an engineer uses the Cisco ISE admin portal to select an internal identity store as the identity source?
Authentication fails.
38
Which two actions occur when a Cisco ISE server device administrator logs in to a device? (Choose two.)
The Cisco ISE server queries the internal identity store., The Cisco ISE server queries the external identity store.
39
An engineer is configuring a guest password policy and needs to ensure that the password complexity requirements are set to mitigate brute force attacks. Which two requirements should be included in this policy? (Choose two.)
password expiration period, minimum password length
40
An engineer is using the low-impact mode for a phased deployment of Cisco ISE and is trying to connect to the network prior to authentication. Which access will be denied in this deployment?
HTTP
41
An administrator needs to connect ISE to Active Directory as an external authentication source and allow the proper ports through the firewall. Which two ports should be opened to accomplish this task? (Choose two.)
LDAP: 389, MSRPC:445
42
An engineer is implementing Cisco ISE and needs to configure 802.1X. The port settings are configured for port-based authentication. Which command should be used to complete this configuration?
dot1x system-auth-control
43
An organization wants to implement 802.1X and is debating whether to use PEAP-MSCHAPv2 or PEAP-EAP-TLS for authentication. Drag the characteristics on the left to the corresponding protocol on the right.
PEAP-MSCHAPv2 uses username and password changes credentials throught the admin portal supports fragmentation after the tunnel is established PEAP-EAP-TLS uses certificates for authentication uses the X.509 format support autoenrolment for obtaining credentials
44
DRAG DROP - Drag the descriptions on the left onto the components of 802.1X on the right. Select and Place:
Device that controls physical access to the network based on the endpoint authentication status Software on the endpoint that communicates with EAP at layer 2 Device that validates the identity of the endpoint and provides results to another device
45
A network engineer is configuring Cisco TrustSec and needs to ensure that the Security Group Tag is being transmitted between two devices. Where in the Layer 2 frame should this be verified?
CMD field
46
A network administrator must configure endpoints using an 802.1X authentication method with EAP identity certificates that are provided by the Cisco ISE. When the endpoint presents the identity certificate to Cisco ISE to validate the certificate, endpoints must be authorized to connect to the network. Which EAP type must be configured by the network administrator to complete this task?
EAP-TLS
47
An organization wants to standardize the 802.1X configuration on their switches and remove static ACLs on the switch ports while allowing Cisco ISE to communicate to the switch what access to provide. What must be configured to accomplish this task?
dynamic access list within the authorization profile
48
Refer to the exhibit. In which scenario does this switch configuration apply?
when allowing a hub with multiple clients connected
49
Refer to the exhibit. Which switch configuration change will allow only one voice and one data endpoint on each port?
multi-auth to multi-domain
50
A network security engineer needs to configure 802.1X port authentication to allow a single host to be authenticated for data and another single host to be authenticated for voice. Which command should the engineer run on the interface to accomplish this goal?
authentication host-mode multi-domain
51
An administrator connects an HP printer to a dot1x enable port, but the printer is nor accessible. Which feature must the administrator enable to access the printer?
MAC authentication bypass
52
When configuring an authorization policy, an administrator cannot see specific Active Directory groups present in their domain to be used as a policy condition. However, other groups that are in the same domain are seen. What is causing this issue?
The groups are not added to Cisco ISE under the AD join point.
53
An engineer is implementing network access control using Cisco ISE and needs to separate the traffic based on the network device ID and use the IOS device sensor capability. Which probe must be used to accomplish this task?
RADIUS probe
54
What is an advantage of using EAP-TLS over EAP-MS-CHAPv2 for client authentication?
EAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not.
55
What must be configured on the WLC to configure Central Web Authentication using Cisco ISE and a WLC?
Set the NAC State option to RADIUS NAC.
56
A network administrator is configuring authorization policies in Cisco ISE. There is a requirement to use AD group assignments to control access to network resources. After a recent power failure and Cisco ISE rebooting itself, the AD group assignments no longer work. What is the cause of this issue?
The AD join point is no longer connected.
57
Refer to the exhibit. Which component must be configured to apply the SGACL?
egress router
58
A laptop was stolen and a network engineer added it to the block list endpoint identity group. What must be done on a new Cisco ISE deployment to redirect the laptop and restrict access?
Select DenyAccess within the authentication policy.
59
When creating a policy within Cisco ISE for network access control, the administrator wants to allow different access restrictions based upon the wireless SSID to which the device is connecting. Which policy condition must be used in order to accomplish this?
Radius Called-Station-ID CONTAINS <SSID Name>
60
A company manager is hosting a conference. Conference participants must connect to an open guest SSID and only use a preassigned code that they enter into the guest portal prior to gaining access to the network. How should the manager configure Cisco ISE to accomplish this goal?
Create an access code to be entered in the AUP mode.
61
An organization has a fully distributed Cisco ISE deployment. When implementing probes, an administrator must scan for unknown endpoints to learn the IP-to- MAC address bindings. The scan is complete on one PSN, but the information is not available on the others. What must be done to make the information available?
Scanning must be initiated from the PSN that last authenticated the endpoint.
62
An administrator is configuring a switch port for use with 802.1X. What must be done so that the port will allow voice and multiple data endpoints?
Configure the port with the authentication host-mode multi-auth command.
63
An administrator is troubleshooting an endpoint that is supposed to bypass 802.1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB, however the endpoint cannot communicate because it cannot obtain an IP address. What is the problem?
The 802.1X timeout period is too long.
64
A Cisco ISE administrator must restrict specific endpoints from accessing the network while in closed mode. The requirement is to have Cisco ISE centrally store the endpoints to restrict access from. What must be done to accomplish this task?
Add each MAC address manually to a blocklist identity group and create a policy denying access.
65
An engineer is using profiling to determine what access an endpoint must receive. After configuring both Cisco ISE and the network devices for 802.1X and profiling, the endpoints do not profile prior to authentication. What are two reasons this is happening? (Choose two.)
Closed mode is restricting the collection of the attributes prior to authentication., The switch is collecting the attributes via RADIUS but the probes are not sending them.
66
Which two external identity stores support EAP-TLS and PEAP-TLS? (Choose two.)
Active Directory , LDAP
67
An engineer deploys Cisco ISE and must configure Active Directory to then use information from Active Directory in an authorization policy. Which two components must be configured, in addition to Active Directory groups, to achieve this goal? (Choose two.)
Active Directory External Identity Sources, Library Condition for External Identity: External Groups
68
Which deployment mode allows for one or more policy service nodes to be used for session failover?
distributed
69
A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group. Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?
Create and manage guest user accounts.
70
What is needed to configure wireless guest access on the network?
WEBAUTH ACL for redirection
71
Which two methods should a sponsor select to create bulk guest accounts from the sponsor portal? (Choose two.)
Imported, Random
72
What is a valid guest portal type?
Sponsored-Guest
73
What is the purpose of the ip http server command on a switch?
It enables the switch to redirect users for web authentication.
74
Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?
AAA override
75
Which configuration is required in the Cisco ISE authentication policy to allow Central Web Authentication?
MAB and if user not found, continue
76
An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port. Which command should be used to accomplish this task?
ip http port <port number>
77
An engineer is using Cisco ISE and configuring guest services to allow wireless devices to access the network. Which action accomplishes this task?
Create the redirect ACL on the WLC and add it to the Cisco ISE policy.
78
An engineer is configuring web authentication and needs to allow specific protocols to permit DNS traffic. Which type of access list should be used for this configuration?
extended ACL
79
An administrator is adding a switch to a network that is running Cisco ISE and is only for IP Phones. The phones do not have the ability to authenticate via 802.1X. Which command is needed on each switch port for authentication?
mab
80
A network engineer needs to ensure that the access credentials are not exposed during the 802.1X authentication among components. Which two protocols should be configured to accomplish this task? (Choose two.)
PEAP, EAP-TLS
81
A network engineer is configuring guest access and notices that when a guest user registers a second device for access, the first device loses access. What must be done to ensure that both devices for a particular user are able to access the guest network simultaneously?
Modify the guest type to increase the number of maximum devices.
82
A Cisco ISE administrator needs to ensure that guest endpoint registrations are only valid for 1 day. When testing the guest policy flow, the administrator sees that the Cisco ISE does not delete the endpoint in the GuestEndpoints identity store after 1 day and allows access to the guest network after that period. Which configuration is causing this problem?
The Endpoint Purge Policy is set to 30 days for guest devices.
83
A network administrator is setting up wireless guest access and has been unsuccessful in testing client access. The endpoint is able to connect to the SSID but is unable to gain access to the guest network through the guest portal. What must be done to identify the problem?
Use the endpoint ID to execute a session trace.
84
An organization is hosting a conference and must make guest accounts for several of the speakers attending. The conference ended two days early but the guest accounts are still being used to access the network. What must be configured to correct this?
Navigate to the Sponsor Portal and suspend the guest accounts.
85
An organization is migrating its current guest network to Cisco ISE and has 1000 guest users in the current database. There are no resources to enter this information into the Cisco ISE database manually. What must be done to accomplish this task efficiently?
Use a CSV file to import the guest accounts.
86
A customer wants to set up the Sponsor portal and delegate the authentication flow to a third party for added security while using Kerberos. Which database should be used to accomplish this goal?
Active Directory
87
Which two default guest portals are available with Cisco ISE? (Choose two.)
self-registered, sponsored
88
What is the minimum certainty factor when creating a profiler policy?
the minimum number that a device certainty factor must reach to become a member of the profile
89
What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?
Cisco-av-pair
90
Which profiling probe collects the user-agent string?
HTTP
91
Which use case validates a change of authorization?
An endpoint profiling policy is changed for authorization policy.
92
Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?
unknown
93
What service can be enabled on the Cisco ISE node to identify the types of devices connecting to a network?
profiling
94
Which two probes must be enabled for the ARP cache to function in the Cisco ISE profiling service so that a user can reliably bind the IP addresses and MAC addresses of endpoints? (Choose two.)
RADIUS, DHCP
95
Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)
endpoint profile transition from Apple-device to Apple-iPhone, endpoint profile transition from Unknown to Windows10-Workstation
96
Which two ports do network devices typically use for CoA? (Choose two.)
3799, 1700
97
Which three default endpoint identity groups does Cisco ISE create? (Choose three.)
unknown, block list, profiled
98
An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network. Which node should be used to accomplish this task?
policy service
99
An engineer is configuring Cisco ISE to reprofile endpoints based only on new requests of INIT-REBOOT and SELECTING message types. Which probe should be used to accomplish this task?
DHCP
100
An engineer is configuring Cisco ISE and needs to dynamically identify the network endpoints and ensure that endpoint access is protected. Which service should be used to accomplish this task?
profiling