NEW QUESTION 1
In Cisco ISE, which probe must be enabled to collect profiling data using Device Sensor?

• A. RADIUS
• B. SNMPQuery
• C. SNMPTrap
• D. Network Scan
• E. Syslog

Answer: A

NEW QUESTION 2
An organization has recently deployed ISE with the latest models of Cisco switches, and it plans to deploy
Trustsec to secure its infrastructure. The company also wants to allow different network access policies for different user groups (e.g., administrators). Which solution is needed to achieve these goals?

• A. Cisco Security Group Access Policies in order to use SGACLs to control access based on SGTs assigned to different users
• B. MACsec in Multiple-Host Mode in order to open or close a port based on a single authentication
• C. Identity-based ACLs on the switches with user identities provided by ISE
• D. Cisco Threat Defense for user group control by leveraging Netflow exported from the switches and login information from ISE

Answer: A

NEW QUESTION 3
Which two portals can be configured to use portal FQDN? (Choose two.)

• A. admin
• B. sponsor
• C. guest
• D. my devices
• E. monitoring and troubleshooting

Answer: BD

NEW QUESTION 4
Where would a Cisco ISE administrator define a named ACL to use in an authorization policy?

• A. In the conditions of an authorization rule.
• B. In the attributes of an authorization rule.
• C. In the permissions of an authorization rule.
• D. In an authorization profile associated with an authorization rule.

Answer: D

NEW QUESTION 5
Where is client traffic decrypted in a controller-based wireless network protected with WPA2 Security?

• A. Access Point
• B. Switch
• C. Wireless LAN Controller
• D. Authentication Server

Answer: A

NEW QUESTION 6
An engineer has created a redirect ACL to forward traffic to Cisco ISE. Which TCP port is used for the guest portal On ISE?

• A. 8080
• B. 443
• C. 8021
• D. 8443

Answer: D

NEW QUESTION 7
Drag and drop each posture assessment outcome from the left onto the appropriate definition on the right.

Answer:

Explanation: Noncompliant = NAC agent determined something on the endpoint is in violation of the defined security policy
Compliant = NAC agent on the endpoint determined that the software assessment on the endpoint adheres to the security policy
Unknown = The endpoint failed to report a posture assessment to ISE.

NEW QUESTION 8
if user want to use his corporate laptop in another network ,what is only agent can work with this environment?

Answer:

Explanation: Cisco NAC agent.

NEW QUESTION 9
A user configured a Cisco Identity Service Engine and switch to work with downloadable access list for wired dot1x users, though it is failing to work. Which command must be added to address the issue?

• A. ip dhcp snooping
• B. ip device tracking
• C. dot1x pae authenticator
• D. aaa authentication dot1x default group radius

Answer: B

NEW QUESTION 10
In the command 'aaa authentication default group tacacs local', how is the word 'default' defined?

• A. Command set
• B. Group name
• C. Method list
• D. Login type

Answer: C

NEW QUESTION 11
When performing NAT, which of these is a limitation you need to account for?

• A. exhaustion of port number translations
• B. embedded IP addresses
• C. security payload identifiers
• D. inability to provide mutual connectivity to networks with overlapping address spaces

Answer: B

NEW QUESTION 12
Which remediation type ensures that Automatic Updates configuration is turned on Windows clients per security policy to remediate Windows clients for posture compliance?

• A. AS Remediation
• B. File Remediation
• C. Launch Program Remediation
• D. Windows Update Remediation
• E. Windows Server Update Services Remediation

Answer: C

NEW QUESTION 13
Scenario:
Currently, many users are expehecing problems using their AnyConnect NAM supplicant to login to the network. The rr desktop support staff have already examined and vehfed the AnyConnect NAM configuration is correct.
In this simulation, you are tasked to examine the various ISE GUI screens to determine the ISE current configurations to help isolate the problems. Based on the current ISE configurations, you will need to answer three multiple choice questions.
To access the ISE GUI, click on the ISE icon in the topology diagram to access the ISE GUI.
Not all the ISE GUI screen are operational in this simulation and some of the ISE GUI operations have been reduced in this simulation.
Not all the links on each of the ISE GUI screen works, if some of the links are not working on a screen, click Home to go back to the Home page first. From the Home page, you can access all the required screens.
To view some larger GUI screens, use the simulation window scroll bars. Some of the larger GUI screens only shows partially but will include all information required to complete this simulation.


Determine which can be two reasons why many users like the Sales and fT users are not able to authenticate and access the network using their AnyConnect NAM client with EAP-FAST.(Choose two.)

• A. The DotlX authentication policy is not allowing the EAP-FAST protocol.
• B. The rr_Corp authorization profile has the wrong Access Type configured.
• C. The authorization profile used for the Sales users is misconfigured.
• D. The order for the MAB authentication policy and the DotlX authentication policy should be reversed.
• E. Many of the fT Sales and fT user machines are not passing the ISE posture accessment.
• F. he PERMrr_ALL_TRAFFICDACL is missing the permit ip any any statement it the end.
• G. The Employee_FullAccess_DACL DACL is missing the permit ip any any statement in the end.

Answer: AD

NEW QUESTION 14
What are the initial steps to configure an ACS as a TACACS server?

• A. 1. Choose Network Devices and AAAClients > Network Resources.2. Click Create.
• B. 1. Choose Network Resources > Network Devices and AAAClients.2. Click Create.
• C. 1. Choose Network Resources > Network Devices and AAAClients.2. Click Manage.
• D. 1. Choose Network Devices and AAAClients > Network Resources.2. Click Install.

Answer: B

NEW QUESTION 15
Which network component would issue the CoA?

• A. switch
• B. endpoint
• C. Admin Node
• D. Policy Service Node

Answer: D

NEW QUESTION 16
What are the initial steps to configure an ACS as a TACACS server?

• A. 1. Choose Network Devices and AAAClients > Network Resources.2. Click Create.
• B. 1. Choose Network Resources > Network Devices and AAAClients.2. Click Create.
• C. 1. Choose Network Resources > Network Devices and AAAClients.2. Click Manage.
• D. 1. Choose Network Devices and AAAClients > Network Resources.2. Click Install.

Answer: B

NEW QUESTION 17
Which two answers are potential results of an attacker that is performing a DHCP server spoofing attack? (Choose two.)

• A. ability to selectively change DHCP options fields of the current DHCP server, such as the giaddr field.
• B. DoS
• C. excessive number of DHCP discovery requests
• D. ARP cache poisoning on the router
• E. client unable to access network resources

Answer: BE

NEW QUESTION 18
What are the four code fields which identify the type of an EAP packet?

• A. Request, Reply, Accept, Reject
• B. Request, Reply, Success, Failure
• C. Request, Response, Success, Failure
• D. Request, Respons
• E. Accept Reject

Answer: C

NEW QUESTION 19
Which two identity databases are supported when PEAP-MSCHAPv2 is used as EAP type? (Choose two.)

• A. Windows Active Directory
• B. LDAP
• C. RADIUS token server
• D. internal endpoint store
• E. internal user store
• F. certificate authentication profile
• G. RSA SecurID

Answer: AE