Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) (SISE) — Questions 151–225

Which TWO of the following are necessary to successfully profile devices using the SNMP Query probe?

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

You are configuring a 'Registry' check as part of a posture requirement. The goal is to ensure a specific registry key exists to prove a corporate application is configured correctly. What is the correct way to specify the path if the key is located in HKEY_LOCAL_MACHINE?

Which menu path in Cisco ISE is used to define a new Network Device Group?

Where do you customize the visual look and feel of the guest portal, such as logos and background colors?

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

You need to ensure that only specific ISE nodes perform the NMAP scan probe. Where is this configured?

When using Local Web Authentication (LWA) on a WLC, which entity performs the actual credentials check against Cisco ISE?

Which TWO of the following are true regarding TACACS+ command sets? (Choose two)

You are configuring a Network Device Group in Cisco ISE to organize devices by geographical location. Which menu path should you navigate to in order to create a new Network Device Group?

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

An administrator notices that TACACS+ authentication is failing for devices. The logs show 'RADIUS request received'. What is the most likely cause?

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

Which THREE components are required to successfully deploy a Scalable Group Access (SGA) policy for SGT enforcement?

You are implementing Cisco TrustSec and need to restrict traffic between two different SGTs on a Cisco Catalyst switch. Which policy component enforces this communication restriction?

Which THREE of the following items are verified by ISE when a guest attempts to authenticate?

An administrator is troubleshooting a posture failure where the AnyConnect agent is installed but ISE reports the endpoint as 'Unknown'. Which configuration setting in the Posture Policy is most likely misconfigured?

A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

When configuring a Shell Profile, what is the purpose of the 'Common Tasks' section?

Which THREE of the following are necessary to configure CWA (Centralized Web Authentication)?

You want to implement a 'Change of Authorization' (CoA) after a user changes their location. How is the CoA triggered by ISE?

Where do you view the 'Context Visibility' of endpoints in Cisco ISE?

Which TWO of the following are valid ways to provide access to a guest user?

When creating a Policy Condition in Cisco ISE, which attribute is most commonly used to identify a user's location?

Which TWO of the following are true about Monitor Mode?

Which TWO of the following are valid ways to restrict access based on posture status in ISE?

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

What is the purpose of an Authorization Profile's 'Common Tasks'?

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

You have created a custom profiler condition that is not matching endpoints correctly. Where should you check the live authentication and profiling logs to verify if the attribute is being received by ISE?

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

You are troubleshooting an issue where IP phones are not being profiled. The SNMP read community string on the switch does not match the one configured in ISE. What is the expected behavior?

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Which TWO of the following are valid ways to assign a VLAN in an ISE Authorization Profile?

Which of the following is NOT a valid probe type in Cisco ISE?

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

Which THREE features are configured at the node level in the ISE Administration console?

Which TWO of the following are true regarding the use of 'Endpoint Identity Groups' in Cisco ISE?

Which TWO settings in an Authorization Profile are commonly used to restrict a client's network access?

Where do you upload the AnyConnect posture agent packages to make them available for Client Provisioning?

Which THREE of the following are valid actions when configuring a Command Set for a user? (Choose three)

When a new device connects, you notice it stays in the 'Unknown' profile state. You have confirmed the probes are active. What is the most likely step to fix this?

Which THREE of the following are valid operators for a Registry Condition?

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

If a user is assigned a Shell Profile with a specific 'Auto-Command' configured, what happens when they log into the network device?

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

Which THREE of the following items are configured in an AnyConnect Posture Requirement?

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

Which THREE of the following are valid remediation actions?

A customer is planning a large campus deployment with 50,000 concurrent endpoints. Which persona should be dedicated to handle the authentication load to ensure high performance?

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

What is the primary function of the 'Client Provisioning' policy in the context of BYOD?

You are configuring EAP-TLS for BYOD. What must be included in the 'Allowed Protocols' list in ISE?

An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?

Which of the following is required for AnyConnect to perform posture assessment on a Mac endpoint?

You are troubleshooting a scenario where guest users are not being redirected when connecting to an open SSID. The WLC reports that the client is stuck in the 'Webauth' state but the portal never loads. Which component should you verify first?

You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?

When configuring an Authorization Policy for BYOD, which condition should be used to ensure the device has successfully performed BYOD registration?

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

Which THREE of the following are considered 'probes' in the Cisco ISE Profiling architecture?

Which attribute is used by the MAC OUI probe to determine the device manufacturer?

How do you verify the current licensing status and consumption on your ISE deployment?

Which statement best describes the role of the TACACS+ 'Accounting' feature?

You need to allow users to run commands that start with 'show' but deny any 'show' commands that contain 'password'. How should the Command Set be configured?

Which THREE items are configurable within a TACACS+ Shell Profile in Cisco ISE?

You need to create a posture condition to verify that the 'Cisco AnyConnect' service is running. Which condition type should you select?

Which THREE resources are monitored via the ISE dashboard to ensure deployment health?

In a CWA flow, what is the significance of the 'cisco-av-pair = url-redirect-acl' attribute?

You want to improve profiling accuracy for endpoints that do not send DHCP options. You decide to use SNMP Trap profiling. What is a critical prerequisite for this to function?

During the BYOD onboarding process, a user is successfully redirected to the portal, but the certificate installation fails because the client cannot trust the root CA. Which configuration is required to resolve this?

Which TWO of the following are potential sources of information for the DHCP probe?

Which THREE of the following are valid components of a RADIUS-based Authorization Policy rule in Cisco ISE?

Which TWO of the following are valid components of an ISE Posture Policy?