[2023年更新]300-715まとめセット試験ガイド練習からあなたの300-715試験を合格させます！
準備300-715試験2023年最新のCCNP Security無制限240問題
質問 # 47
Which two components are required for creating a Native Supplicant Profile within a BYOD flow?
(Choose two )
- A. Redirect ACL Operating System
- B. Windows Settings
- C. iOS Settings
- D. Connection Type
正解：B、C
質問 # 48
An engineer is designing a BYOD environment utilizing Cisco ISE for devices that do not support native supplicants Which portal must the security engineer configure to accomplish this task?
- A. My devices
- B. Client provisioning
- C. BYOD
- D. MDM
正解：A
解説：
https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01111.html
質問 # 49
Drag the steps to configure a Cisco ISE node as a primary administration node from the left into the correct order on the night.
正解：
解説：
Explanation
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide Step 1 Choose Administration > System The Register button will be disabled initially. To enable this button, you must configure a Primary PAN.
Step 2
Check the check box next to the current node, and click
Step 3
Click Make Primary to configure your Primary PAN.
Step 4
Enter data on the General Settings tab.
Step 5
Click Save to save the node configuration.
質問 # 50
Which two values are compared by the binary comparison (unction in authentication that is based on Active Directory?
- A. subject alternative name and the common name
- B. MS-CHAPv2 provided machine credentials and credentials stored in Active Directory
- C. user-presented certificate and a certificate stored in Active Directory
- D. user-presented password hash and a hash stored in Active Directory
正解：A
解説：
Reference:
Basic certificate checking does not require an identity source. If you want binary comparison checking for the certificates, you must select an identity source. If you select Active Directory as an identity source, subject and common name and subject alternative name (all values) can be used to look up a user. https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/ b_ise_admin_guide_sample_chapter_01110.html
質問 # 51
What must be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?
- A. drop
- B. reject
- C. continue
- D. pass
正解：C
解説：
https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_id_stores.html
質問 # 52
A network engineer is configuring Cisco TrustSec and needs to ensure that the Security Group Tag is being transmitted between two devices Where in the Layer 2 frame should this be verified?
- A. CMD filed
- B. 802.1 AE header
- C. 802.1Q filed
- D. Payload
正解：A
解説：
Explanation
https://www.cisco.com/c/dam/global/en_ca/assets/ciscoconnect/2014/pdfs/policy_defined_segmentation_with_tr (slide 25)
質問 # 53
A laptop was stolen and a network engineer added it to the block list endpoint identity group What must be done on a new Cisco ISE deployment to redirect the laptop and restrict access?
- A. Ensure that access to port 8444 is allowed within the ACL.
- B. Select DROP under If Auth fail within the authentication policy.
- C. Ensure that access to port 8443 is allowed within the ACL.
- D. Select DenyAccess within the authorization policy.
正解：B
質問 # 54
An organization wants to improve their BYOD processes to have Cisco ISE issue certificates to the BYOD endpoints. Currently, they have an active certificate authority and do not want to replace it with Cisco ISE.
What must be configured within Cisco ISE to accomplish this goal?
- A. Create an SCEP profile to link Cisco ISE with the root certificate authority.
- B. Add an OCSP profile and configure the root certificate authority as secondary.
- C. Add the root certificate authority to the trust store and enable it for authentication.
- D. Create a certificate signing request and have the root certificate authority sign it.
正解：A
質問 # 55
What is a function of client provisioning?
- A. Client provisioning ensures an application process is running on the endpoint.
- B. Client provisioning ensures that endpoints receive the appropriate posture agents.
- C. Client provisioning checks the existence, date, and versions of the file on a client.
- D. Client provisioning checks a dictionary attribute with a value.
正解：B
解説：
https://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_client_prov.html#:~:text=After%20Cisco%20ISE%20classifies%20a,packages%20and%20profiles%2C%20if%20necessary.
質問 # 56
What does a fully distributed Cisco ISE deployment include?
- A. PAN and PSN on the same node while MnTs are on their own dedicated nodes.
- B. PAN and MnT on the same node while PSNs are on their own dedicated nodes.
- C. All Cisco ISE personas on their own dedicated nodes.
- D. All Cisco ISE personas are sharing the same node.
正解：B
質問 # 57
When setting up profiling in an environment using Cisco ISE for network access control, an organization must use non-proprietary protocols for collecting the information at layer 2. Which two probes will provide this information without forwarding SPAN packets to Cisco ISE? {Choose two.)
- A. DNS probe
- B. RADIUS probe
- C. NetFlow probe
- D. DHCP SPAN probe
- E. SNMP query probe
正解：B、E
解説：
https://ciscocustomer.lookbookhq.com/iseguidedjourney/ISE-profiling-design
質問 # 58
A network engineer is configuring guest access and notices that when a guest user registers a second device for access, the first device loses access What must be done to ensure that both devices for a particular user are able to access the guest network simultaneously?
- A. Configure the sponsor group to increase the number of logins.
- B. Use a custom portal to increase the number of logins
- C. Modify the guest type to increase the number of maximum devices
- D. Create an Adaptive Network Control policy to increase the number of devices
正解：C
解説：
Reference:
https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_admin_guide_27/b_ise_admin_guide_27_chapter_01111.html.xml
質問 # 59
Refer to the exhibit:
Which command is typed within the CLI of a switch to view the troubleshooting output?
- A. show authentication registrations
- B. show authentication interface gigabitethemet2/0/36
- C. show authentication sessions mac 000e.84af.59af details
- D. show authentication sessions method
正解：C
質問 # 60
Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles? (Choose two.)
- A. Shell
- B. ASA
- C. IOS
- D. WLC
- E. Firepower
正解：A、D
解説：
Section: Network Access Device Administration
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2--1/admin_guide/b_ise_admin_guide_21/ b_ise_admin_guide_20_chapter_0100010.html
質問 # 61
An organization wants to enable web-based guest access for both employees and visitors The goal is to use a single portal for both user types Which two authentication methods should be used to meet this requirement? (Choose two )
- A. LOCAL
- B. MAC based
- C. LDAP
- D. 802 1X
- E. Certificate-based
正解：A、B
質問 # 62
What is a characteristic of the UDP protocol?
- A. UDP can detect when a server is slow
- B. UDP offers best-effort delivery
- C. UDP offers information about a non-existent server
- D. UDP can detect when a server is down.
正解：B
解説：
Explanation
https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-1
質問 # 63
An engineer is configuring a virtual Cisco ISE deployment and needs each persona to be on a different node. Which persona should be configured with the largest amount of storage in this environment?
- A. Primary Administration
- B. Monitoring and Troubleshooting
- C. policy Services
- D. Platform Exchange Grid
正解：B
質問 # 64
Which two probes must be enabled for the ARP cache to function in the Cisco ISE profile service so that a user can reliably bind the IP address and MAC addresses of endpoints? (Choose two.)
- A. DHCP
- B. SNMP
- C. RADIUS
- D. NetFlow
- E. HTTP
正解：A、C
解説：
Reference:
Cisco ISE implements an ARP cache in the profiling service, so that you can reliably map the IP addresses and the MAC addresses of endpoints. For the ARP cache to function, you must enable either the DHCP probe or the RADIUS probe. The DHCP and RADIUS probes carry the IP addresses and the MAC addresses of endpoints in the payload data. The dhcp-requested address attribute in the DHCP probe and the Framed-IP-address attribute in the RADIUS probe carry the IP addresses of endpoints, along with their MAC addresses, which can be mapped and stored in the ARP cache.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html
質問 # 65
Which statement is not correct about the Cisco ISE Monitoring node?
- A. The local collector buffers transport the collected data to designated Cisco ISE Monitoring nodes as syslog; once Monitoring nodes are globally defined via Administration, ISE nodes automatically send logs to one or both of the configured Monitoring nodes.
- B. The local collector agent process runs only the Inline Posture node.
- C. The local collector agent collects logs locally from itself and from any NAD that is configured to send logs to the Policy Service node.
- D. Cisco ISE supports distributed log collection across all nodes to optimize local data collection, aggregation, and centralized correlation and storage.
正解：B
質問 # 66
Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.
正解：
解説：
質問 # 67
A customer wants to set up the Sponsor portal and delegate the authentication flow to a third party for added security while using Kerberos Which database should be used to accomplish this goal?
- A. RSA Token Server
- B. LDAP
- C. Local Database
- D. Active Directory
正解：D
解説：
https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_01111.html#concept_srz_bkb_4db
質問 # 68
What is needed to configure wireless guest access on the network?
- A. Captive Portal Bypass turned on
- B. endpoint already profiled in ISE
- C. valid user account in Active Directory
- D. WEBAUTH ACL for redirection
正解：A
解説：
Section: Web Auth and Guest Services
質問 # 69
What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?
- A. Network Access Control
- B. Application Visibility and Control
- C. My Devices Portal
- D. Supplicant Provisioning Wizard
正解：C
質問 # 70
......
Cisco 300-715試験は、ネットワーク認証、認可、およびアカウンティング（AAA）プロトコルについて良好な理解を持つネットワークプロフェッショナルを対象としています。候補者は、有線、無線、VPNなど、様々な環境でCisco ISEを実装する経験も必要です。
注目の300-715まとめセット試験ガイドは最速合格できます：https://jp.fast2test.com/300-715-premium-file.html
練習する300-715にはFast2test明確な練習であなたをImplementing and Configuring Cisco Identity Services Engine試験合格させます：https://drive.google.com/open?id=1x0Ce0kXOoBNVYasSALfw9a43GewLsqr7