Question 1

Which two features must be used on Cisco ISE to enable the TACACS+ feature? (Choose two.)

Accepted Answer

A)  Command Sets 
B)  Server Sequence 
C)  Device Administration License 
D)  External TACACS Servers 
E)  Device Admin Service 
A)  Command Sets 
B)  Server Sequence 
C)  Device Administration License 
D)  External TACACS Servers 
E)  Device Admin Service

Question 2

Which interface-level command is needed to turn on 802.1X authentication?

Accepted Answer

A)  dot1x system-auth-control 
B)  dot1x pae authenticator 
C)  aaa server radius dynamic-author 
D)  authentication host-mode single-host 
A)  dot1x system-auth-control 
B)  dot1x pae authenticator 
C)  aaa server radius dynamic-author 
D)  authentication host-mode single-host

Question 3

A network engineer must enforce access control using special tags, without re-engineering the network design. Which feature should be configured to achieve this in a scalable manner?

Accepted Answer

A)  RBAC 
B)  dACL 
C)  SGT 
D)  VLAN 
A)  RBAC 
B)  dACL 
C)  SGT 
D)  VLAN

Question 4

Which portal is used to customize the settings for a user to log in and download the compliance module?

Accepted Answer

A)  Client Provisioning 
B)  Client Endpoint 
C)  Client Profiling 
D)  Client Guest 
A)  Client Provisioning 
B)  Client Endpoint 
C)  Client Profiling 
D)  Client Guest

Question 5

Which command displays all 802.1X/MAB sessions that are active on the switch ports of a Cisco Catalyst switch?

Accepted Answer

A)  show authentication sessions interface Gi1/0/x output 
B)  show authentication sessions 
C)  show authentication sessions output 
D)  show authentication sessions interface Gi 1/0/x 
A)  show authentication sessions interface Gi1/0/x output 
B)  show authentication sessions 
C)  show authentication sessions output 
D)  show authentication sessions interface Gi 1/0/x

Question 6

Which use case validates a change of authorization?

Accepted Answer

A)  An endpoint that is disconnected from the network is discovered. 
B)  Endpoints are created through device registration for the guests. 
C)  An endpoint profiling policy is changed for authorization policy. 
D)  An authenticated, wired EAP-capable endpoint is discovered. 
A)  An endpoint that is disconnected from the network is discovered. 
B)  Endpoints are created through device registration for the guests. 
C)  An endpoint profiling policy is changed for authorization policy. 
D)  An authenticated, wired EAP-capable endpoint is discovered.

Question 7

What should be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

Accepted Answer

A)  continue 
B)  pass 
C)  drop 
D)  reject 
A)  continue 
B)  pass 
C)  drop 
D)  reject

Question 8

A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group. Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?

Accepted Answer

A)  Keep track of guest user activities. 
B)  Create and manage guest user accounts. 
C)  Configure authorization settings for guest users. 
D)  Authenticate guest users to Cisco ISE. 
A)  Keep track of guest user activities. 
B)  Create and manage guest user accounts. 
C)  Configure authorization settings for guest users. 
D)  Authenticate guest users to Cisco ISE.

Question 9

Which two probes must be enabled for the ARP cache to function in the Cisco ISE profiling service so that a user can reliably bind the IP addresses and MAC addresses of endpoints? (Choose two.)

Accepted Answer

A)  SNMP 
B)  HTTP 
C)  RADIUS 
D)  DHCP 
E)  NetFlow 
A)  SNMP 
B)  HTTP 
C)  RADIUS 
D)  DHCP 
E)  NetFlow

Question 10

Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?

Accepted Answer

A)  DHCP server 
B)  override Interface ACL 
C)  static IP tunneling 
D)  AAA override 
A)  DHCP server 
B)  override Interface ACL 
C)  static IP tunneling 
D)  AAA override

Question 11

Which two endpoint compliance statuses are possible? (Choose two.)

Accepted Answer

A)  compliant 
B)  valid 
C)  unknown 
D)  known 
E)  invalid 
A)  compliant 
B)  valid 
C)  unknown 
D)  known 
E)  invalid

Question 12

Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?

Accepted Answer

A)  block list 
B)  unknown 
C)  allow list 
D)  profiled 
E)  endpoint 
A)  block list 
B)  unknown 
C)  allow list 
D)  profiled 
E)  endpoint

Question 13

Which protocol must be allowed for a BYOD device to access the BYOD portal?

Accepted Answer

A)  HTTPS 
B)  HTTP 
C)  SSH 
D)  SMTP 
A)  HTTPS 
B)  HTTP 
C)  SSH 
D)  SMTP

Question 14

What must match between Cisco ISE and the network access device to successfully authenticate endpoints?

Accepted Answer

A)  shared secret 
B)  profile 
C)  certificate 
D)  SNMP version 
A)  shared secret 
B)  profile 
C)  certificate 
D)  SNMP version

Question 15

What is a valid guest portal type?

Accepted Answer

A)  Sponsor 
B)  Sponsored-Guest 
C)  Captive-Guest 
D)  My Devices 
A)  Sponsor 
B)  Sponsored-Guest 
C)  Captive-Guest 
D)  My Devices

Question 16

Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

Accepted Answer

A)  TCP 8905 
B)  TCP 8909 
C)  TCP 443 
D)  UDP 1812 
A)  TCP 8905 
B)  TCP 8909 
C)  TCP 443 
D)  UDP 1812

Question 17

What is a requirement for Feed Service to work?

Accepted Answer

A)  TCP port 8080 must be opened between Cisco ISE and the feed server. 
B)  Cisco ISE has access to an internal server to download feed update. 
C)  Cisco ISE has a base license. 
D)  Cisco ISE has Internet access to download feed update. 
A)  TCP port 8080 must be opened between Cisco ISE and the feed server. 
B)  Cisco ISE has access to an internal server to download feed update. 
C)  Cisco ISE has a base license. 
D)  Cisco ISE has Internet access to download feed update.

Question 18

What is a method for transporting security group tags throughout the network?

Accepted Answer

A)  by embedding the security group tag in the 802.1Q header 
B)  by the Security Group Tag Exchange Protocol 
C)  by enabling 802.1AE on every network device 
D)  by embedding the security group tag in the IP header 
A)  by embedding the security group tag in the 802.1Q header 
B)  by the Security Group Tag Exchange Protocol 
C)  by enabling 802.1AE on every network device 
D)  by embedding the security group tag in the IP header

Question 19

Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

Accepted Answer

A)  addition of endpoint to My Devices Portal 
B)  endpoint marked as lost in My Devices Portal 
C)  updating of endpoint dACL 
D)  endpoint profile transition from Apple-device to Apple-iPhone 
E)  endpoint profile transition from Unknown to Windows10-Workstation 
A)  addition of endpoint to My Devices Portal 
B)  endpoint marked as lost in My Devices Portal 
C)  updating of endpoint dACL 
D)  endpoint profile transition from Apple-device to Apple-iPhone 
E)  endpoint profile transition from Unknown to Windows10-Workstation

Question 20

Refer to the exhibit.   A network engineer is configuring the switch to accept downloadable ACLs from a Cisco ISE server. Which two commands should be run to complete the configuration? (Choose two.)

Accepted Answer

A)  radius-server attribute 8 include-in-access-req 
B)  ip device tracking 
C)  dot1x system-auth-control 
D)  radius server vsa send authentication 
E)  aaa authorization auth-proxy default group radius 
A)  radius-server attribute 8 include-in-access-req 
B)  ip device tracking 
C)  dot1x system-auth-control 
D)  radius server vsa send authentication 
E)  aaa authorization auth-proxy default group radius

Exam 24: Securing Email with Cisco Email Security Appliance (300-720 SESA)

Which two features must be used on Cisco ISE to enable the TACACS+ feature? (Choose two.)

Which interface-level command is needed to turn on 802.1X authentication?

A network engineer must enforce access control using special tags, without re-engineering the network design. Which feature should be configured to achieve this in a scalable manner?

Which portal is used to customize the settings for a user to log in and download the compliance module?

Which command displays all 802.1X/MAB sessions that are active on the switch ports of a Cisco Catalyst switch?

Which use case validates a change of authorization?

What should be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group. Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?

Which two probes must be enabled for the ARP cache to function in the Cisco ISE profiling service so that a user can reliably bind the IP addresses and MAC addresses of endpoints? (Choose two.)

Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?

Which two endpoint compliance statuses are possible? (Choose two.)

Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?

Which protocol must be allowed for a BYOD device to access the BYOD portal?

What must match between Cisco ISE and the network access device to successfully authenticate endpoints?

What is a valid guest portal type?

Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

What is a requirement for Feed Service to work?

What is a method for transporting security group tags throughout the network?

Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

Refer to the exhibit. A network engineer is configuring the switch to accept downloadable ACLs from a Cisco ISE server. Which two commands should be run to complete the configuration? (Choose two.)

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Automating Cisco Security Solutions (SAUTO)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Designing Cisco Unified Contact Center Enterprise (UCCED)

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters