NEW QUESTION 1
Which type of SGT propagation does a WLC in a data center require?

• A. SXP
• B. SGT
• C. SGT inline
• D. SGT Reflector

Answer: A

NEW QUESTION 2
A security engineer must provision dynamic TrustSec classifications. Which two classification options must the engineer select to accomplish this task? (Choose two.)

• A. interface
• B. 802.1X
• C. MAB
• D. IP subnet
• E. VLAN

Answer: BE

NEW QUESTION 3
The Secure-X company has started to tested the 802.1X authentication deployment using the Cisco Catalyst 3560-X layer 3 switch and the Cisco ISEvl2 appliance. Each employee desktop will be connected to the 802.1X enabled switch port and will use the Cisco AnyConnect NAM 802.1X supplicant to log in and connect to the network.
Your particular tasks in this simulation are to create a new identity source sequence named AD_internal which will first use the Microsoft Active Directory (AD1) then use the ISE Internal User database. Once the new identity source sequence has been configured, edit the existing DotlX authentication policy to use the new AD_internal identity source sequence.
The Microsoft Active Directory (AD1) identity store has already been successfully configured, you just need to reference it in your configuration.

In addition to the above, you are also tasked to edit the IT users authorization policy so IT users who successfully authenticated will get the permission of the existing IT_Corp authorization profile.
Perform this simulation by accessing the ISE GUI to perform the following tasks:
• Create a new identity source sequence named AD_internal to first use the Microsoft Active Directory (AD1) then use the ISE Internal User database
• Edit the existing Dot1X authentication policy to use the new AD_internal identity source sequence:
• If authentication failed-reject the access request
• If user is not found in AD-Drop the request without sending a response
• If process failed-Drop the request without sending a response
• Edit the IT users authorization policy so IT users who successfully authenticated will get the permission of the existing IT_Corp authorization profile.
To access the ISE GUI, click the ISE icon in the topology diagram. To verify your configurations, from the ISE GUI, you should also see the Authentication Succeeded event for the it1 user after you have successfully defined the DotlX authentication policy to use the Microsoft Active Directory first then use the ISE Internal User Database to authenticate the user. And in the Authentication Succeeded event, you should see the IT_Corp authorization profile being applied to the it1 user. If your configuration is not correct and ISE can't authenticate the user against the Microsoft Active Directory, you should see the Authentication Failed event instead for the it1 user.
Note: If you make a mistake in the Identity Source Sequence configuration, please delete the Identity Source
Sequence then re-add a new one. The edit Identity Source Sequence function is not implemented in this simulation.

Answer:

Explanation: Step 1: create a new identity source sequence named AD_internal which will first use the Microsoft Active Directory (AD1) then use the ISE Internal User database as shown below:

Step 2: Edit the existing Dot1x policy to use the newly created Identity Source:

Then hit Done and save.

NEW QUESTION 4
With which two appliance-based products can Cisco Prime Infrastructure integrate to perform centralized management? (Choose two.)

• A. Cisco Managed Services Engine
• B. Cisco Email Security Appliance
• C. Cisco Wireless Location Appliance
• D. Cisco Content Security Appliance
• E. Cisco ISE

Answer: AE

Explanation: In addition, Cisco Prime Infrastructure integrates with the Cisco® Identity Services Engine (ISE)
to extend visibility into security and policy-related problems, presenting a complete view of client access issues with a clear path to solving them.
It also integrates with the Cisco Mobility Services Engine (MSE)
Cisco Prime Infrastructure when integrated with Cisco Mobility Service Engine can provide a single unified view by extracting location and posture information of managed clients.

NEW QUESTION 5
Scenario:
Currently, many users are expehecing problems using their AnyConnect NAM supplicant to login to the
network. The rr desktop support staff have already examined and vehfed the AnyConnect NAM configuration is correct.
In this simulation, you are tasked to examine the various ISE GUI screens to determine the ISE current configurations to help isolate the problems. Based on the current ISE configurations, you will need to answer three multiple choice questions.
To access the ISE GUI, click on the ISE icon in the topology diagram to access the ISE GUI.
Not all the ISE GUI screen are operational in this simulation and some of the ISE GUI operations have been reduced in this simulation.
Not all the links on each of the ISE GUI screen works, if some of the links are not working on a screen, click Home to go back to the Home page first. From the Home page, you can access all the required screens.
To view some larger GUI screens, use the simulation window scroll bars. Some of the larger GUI screens only shows partially but will include all information required to complete this simulation.


Which of the following statement is correct?

• A. Currently,IT users who successfully authenticate will have their packets tagged withaSGTof3.
• B. Currently,ITusers who successfully authenticate will be assigned to VLAN 9.
• C. Currently, any domain administrator who successfully authenticate will be assigned to VLAN 10.
• D. Computers belonging to the secure-x domain which passes machine authentication but failed user authentication will have the Employee_Restricted_DACL applied.
• E. Print Servers matching the Linksys-PrintServer identity group will have the following access restrictions:permit icmp any host 10.10.2.20 permit tcp any host 10.10.2.20 eq 80 permit icmp any host10.10.3.20 permit tcp any host 10.10.3.20 eq 80 deny ip any any

Answer: C

NEW QUESTION 6
Which two options enable security group tags to the assigned to a session?

• A. Firewall
• B. DHCP
• C. ACL
• D. Source VLAN
• E. ISE

Answer: AE

NEW QUESTION 7
In the command 'aaa authentication default group tacacs local', how is the word 'default' defined?

• A. Command set
• B. Group name
• C. Method list
• D. Login type

Answer: C

NEW QUESTION 8
An engineer of Company A wants to know what kind of devices are connecting to the network. Which service can be enabled on the Cisco ISE node?

• A. central web authentication
• B. posture
• C. MAB
• D. profiling

Answer: D

Explanation: Cisco ISE Profiling Services provides dynamic detection and classification of endpoints connected to the network.Using MAC addresses as the unique identifier, ISE collects various attributes for each network
endpoint to build an internal endpoint database.

NEW QUESTION 9
Which two are valid ISE posture conditions? (Choose two.)

• A. Dictionary
• B. memberOf
• C. Profile status
• D. File
• E. Service

Answer: DE

NEW QUESTION 10
What is a feature of Cisco WLC and IPS synchronization?

• A. Cisco WLC populates the ACLs to prevent repeat intruder attacks.
• B. The IPS automatically send shuns to Cisco WLC for an active host block.
• C. Cisco WLC and IPS synchronization enables faster wireless access.
• D. IPS synchronization uses network access points to provide reliable monitoring.

Answer: B

NEW QUESTION 11
Which three statements about the Cisco ISE profiler are true? (Choose three.)

• A. It sends endpoint data to AAA servers.
• B. It collects endpoint attributes.
• C. It stores MAC addresses for endpoint systems.
• D. It monitors and polices router and firewall traffic.
• E. It matches endpoints to their profiles.
• F. It stores endpoints in the Cisco ISE database with their profiles.

Answer: BEF

NEW QUESTION 12
Which identity store option allows you to modify the directory services that run on TCP/IP?

• A. Lightweight Directory Access Protocol
• B. RSA SecurID server
• C. RADIUS
• D. Active Directory

Answer: A

NEW QUESTION 13
Which default identity source is used by the MyDevices_Portal_Sequence identity source sequence?

• A. internal users
• B. guest users
• C. Active Directory
• D. internal endpoints
• E. RADIUS servers

Answer: A

NEW QUESTION 14
Which advanced authentication setting is needed to allow an unknown device to utilize Central WebAuth?

• A. If Authentication failed > Continue
• B. If Authentication failed > Drop
• C. If user not found > Continue
• D. If user not found > Reject

Answer: C

NEW QUESTION 15
Which action does the command private-vlan association 100,200 take?

• A. configures VLANs 100 and 200 and associates them as a community
• B. associates VLANs 100 and 200 with the primary VLAN
• C. creates two private VLANs with the designation of VLAN 100 and VLAN 200
• D. assigns VLANs 100 and 200 as an association of private VLANs

Answer: B

NEW QUESTION 16
In AAA, what function does authentication perform?

• A. It identifies the actions that the user can perform on the device.
• B. It identifies the user who is trying to access a device.
• C. It identifies the actions that a user has previously taken.
• D. It identifies what the user can access.

Answer: B

NEW QUESTION 17
When is it most appropriate to choose IPS functionality based on Cisco IOS software?

• A. when traffic rates are low and a complete signature is not required
• B. when accelerated, integrated performance is required using hardware ASIC-based IPS inspections
• C. when integrated policy virtualization is required
• D. when promiscuous inspection meets security requirements

Answer: A

NEW QUESTION 18
Which action do you take to define the global authorization exception policy by using a Device Admin Policy Set?

• A. Configure the policy by using Proxy Sequence mode.
• B. Configure a rule-based condition in a policy set.
• C. Define the policy for each group of devices.
• D. Define the policy by configuring a standard profile

Answer: B

NEW QUESTION 19
Which two statements about administrative access to the ACS Solution Engine are true? (Choose two.)

• A. The ACS Solution Engine supports command-line connections through a serial-port connection.
• B. For GUI access, an administrative GUI user must be created with the add-guiadmin command.
• C. The ACS Solution Engine supports command-line connections through an Ethernet interface.
• D. An ACL-based policy must be configured to allow administrative-user access.
• E. GUI access to the ACS Solution Engine is not supported.

Answer: AB

Explanation: who possess the proper administrative credentials.
The CLI administrator does not have access to the ACS web GUI.
To create an initial GUI administrator account that allows web access to the ACS SE GUI, use the add-guiadmin command to create a GUI account.
add-guiadmin :
Adds a GUI account that allows access to the SE using the ACS web GUI.