300-715問題集PDFは最新 [2024年最新] 究極な学習ガイド
300-715試験問題集PDFは更新された問題集でしかも合格保証付き
質問 # 96
Which two values are compared by the binary comparison (unction in authentication that is based on Active Directory?
- A. user-presented password hash and a hash stored in Active Directory
- B. MS-CHAPv2 provided machine credentials and credentials stored in Active Directory
- C. subject alternative name and the common name
- D. user-presented certificate and a certificate stored in Active Directory
正解：C
解説：
Reference:
Basic certificate checking does not require an identity source. If you want binary comparison checking for the certificates, you must select an identity source. If you select Active Directory as an identity source, subject and common name and subject alternative name (all values) can be used to look up a user. https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/ b_ise_admin_guide_sample_chapter_01110.html
質問 # 97
Which personas can a Cisco ISE node assume'?
- A. policy service, gatekeeping, and monitoring
- B. administration, policy service, and monitoring
- C. administration, monitoring, and gatekeeping
- D. administration, policy service, gatekeeping
正解：B
解説：
Explanation
https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html The persona or personas of a node determine the services provided by a node. An ISE node can assume any or all of the following personas: Administration, Policy Service, and Monitoring. The menu options that are available through the administrative user interface are dependent on the role and personas that an ISE node assumes. See Cisco ISE Nodes and Available Menu Options for more information.
質問 # 98
A user is attempting to register a BYOD device to the Cisco ISE deployment, but needs to use the onboarding policy to request a digital certificate and provision the endpoint. What must be configured to accomplish this task?
- A. A native supplicant provisioning policy to redirect them to the BYOD portal for onboarding
- B. The Cisco AnyConnect provisioning policy to provision the endpoint for onboarding
- C. The BYOD flow to ensure that the endpoint will be provisioned prior to registering
- D. The posture provisioning policy to give the endpoint all necessary components prior to registering
正解：A
質問 # 99
An administrator is adding a switch to a network that is running Cisco ISE and is only for IP Phones The phones do not have the ability to authenticate via 802 1X Which command is needed on each switch port for authentication?
- A. mab
- B. enable bypass-mac
- C. enable network-authentication
- D. dot1x system-auth-control
正解：A
解説：
https://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_aaa/configuration/15-2mt/sec-config-mab.html
質問 # 100
An organization is hosting a conference and must make guest accounts for several of the speakers attending.
The conference ended two days early but the guest accounts are still being used to access the network. What must be configured to correct this?
- A. Create an authorization rule denying guest access.
- B. Create an authorization rule denying sponsored guest access.
- C. Navigate to the Sponsor Portal and suspend the guest accounts.
- D. Navigate to the Guest Portal and delete the guest accounts.
正解：C
質問 # 101
A user reports that the RADIUS accounting packets are not being seen on the Cisco ISE server.
Which command is the user missing in the switch's configuration?
- A. aaa accounting exec default start-stop group radios
- B. aaa accounting network default start-stop group radius
- C. aaa accounting resource default start-stop group radius
- D. radius-server vsa send accounting
正解：D
質問 # 102
Which types of design are required in the Cisco ISE ATP program?
- A. preliminary and final
- B. top down and bottom up
- C. schematic and detailed
- D. high-level and low-level designs
正解：D
質問 # 103
An administrator adds a new network device to the Cisco ISE configuration to authenticate endpoints to the network. The RADIUS test fails after the administrator configures all of the settings in Cisco ISE and adds the proper configurations to the switch. What is the issue"?
- A. The endpoint profile is showing as "unknown."
- B. The endpoint does not have the appropriate credentials for network access.
- C. The shared secret is incorrect on the switch or on Cisco ISE.
- D. The certificate on the switch is self-signed not a CA-provided certificate.
正解：B
質問 # 104
Which protocol must be allowed for a BYOD device to access the BYOD portal?
- A. HTTPS
- B. SSH
- C. HTTP
- D. SMTP
正解：A
質問 # 105
What are two benefits of TACACS+ versus RADIUS for device administration? (Choose two )
- A. TACACS+ uses UDP, and RADIUS uses TCP
- B. TACACS+ encrypts the whole payload, and RADIUS encrypts only the password.
- C. TACACS+ has command authorization, and RADIUS does not.
- D. TACACS+ provides the service type, and RADIUS does not
- E. TACACS+ supports 802.1X, and RADIUS supports MAB
正解：B、C
質問 # 106
Drag and drop the description from the left onto the protocol on the right that is used to carry out system authentication, authentication, and accounting.
正解：
解説：
質問 # 107
Which two Cisco ISE deployment models require two nodes configured with dedicated PAN and MnT personas? (Choose two.)
- A. two PSN nodes with one PxGrid node
- B. three PSN nodes
- C. six PSN nodes
- D. five PSN nodes with one PxGrid node
- E. seven PSN nodes with one PxGrid node
正解：A、D
質問 # 108
An administrator is configuring TACACS+ on a Cisco switch but cannot authenticate users with Cisco ISE. The configuration contains the correct key of Cisc039712287. but the switch is not receiving a response from the Cisco ISE instance What must be done to validate the AAA configuration and identify the problem with the TACACS+ servers?
- A. Confirm the authorization policies are correct using the test aaa authorization admin drop legacy command.
- B. Test the user account on the server using the test aaa group radius server CUCS user admin pass <key> legacy command.
- C. Check for server reachability using the test aaa group tacacs+ admin <key> legacy command.
- D. Validate that the key value is correct using the test aaa authentication admin <key> legacy command.
正解：C
解説：
Reference:
https://medium.com/training-course-ccna-security-210-260/ccna-security-part-3-implementing-aaa-in-cisco-ios-4b13ab285f51
質問 # 109
An administrator is adding a switch to a network that is running Cisco ISE and is only for IP Phones. The phones do not have the ability to auto switch port for authentication?
- A. mab
- B. enable bypass-MAC
- C. enable network-authentication
- D. dot1x system-auth-control
正解：A
質問 # 110
An organization wants to implement 802.1X and is debating whether to use PEAP-MSCHAPv2 or PEAP-EAP-TLS for authentication. Drag the characteristics on the left to the corresponding protocol on the right.
正解：
解説：
質問 # 111
Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?
- A. CUDP 1812
- B. TCP 8909
- C. TCP 8905
- D. TCP 443
正解：B
質問 # 112
Which two features should be used on Cisco ISE to enable the TACACS+ feature? (Choose two )
- A. External TACACS Servers
- B. Server Sequence
- C. Command Sets
- D. Device Admin Service
- E. Device Administration License
正解：D、E
質問 # 113
What is needed to configure wireless guest access on the network?
- A. endpoint already profiled in ISE
- B. WEBAUTH ACL for redirection
- C. valid user account in Active Directory
- D. Captive Portal Bypass turned on
正解：D
質問 # 114
What is the deployment mode when two Cisco ISE nodes are configured in an environment?
- A. active
- B. distributed
- C. standalone
- D. standard
正解：C
質問 # 115
Which type of identity store allows for creating single-use access credentials in Cisco ISE?
- A. Local
- B. RSA SecurID
- C. PKI
- D. OpenLDAP
正解：B
質問 # 116
An engineer is implementing network access control using Cisco ISE and needs to separate the traffic based on the network device ID and use the IOS device sensor capability. Which probe must be used to accomplish this task?
- A. network scan probe
- B. RADIUS probe
- C. HTTP probe
- D. NetFlow probe
正解：B
解説：
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200292-Configure-Device-Sensor-for-ISE-Profilin.html
http://www.network-node.com/blog/2016/1/2/ise-20-profiling
質問 # 117
An engineer builds a five-node distributed Cisco ISE deployment The first two deployed nodes are responsible for the primary and secondary administration and monitoring personas Which persona configuration is necessary to have the remaining three Cisco ISE nodes serve as dedicated nodes in the Cisco ISE cube that is responsible only for handling the RADIUS and TACACS+ authentication requests, identity lookups, and policy evaluation?
A)
B)
C)
D)
- A. Option B
- B. Option C
- C. Option A
- D. Option D
正解：D
質問 # 118
What must match between Cisco ISE and the network access device to successfully authenticate endpoints?
- A. certificate
- B. shared secret
- C. SNMP version
- D. profile
正解：B
解説：
Section: Endpoint Compliance
Explanation/Reference: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_network_devices.html
質問 # 119
An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE. but the devices do not change their access due to the new profile. What is the problem'?
- A. The profiling probes are not able to collect enough information to change the device profile
- B. In closed mode, profiling does not work unless CDP is enabled.
- C. The default profiler configuration is set to No CoA for the reauthentication setting
- D. The profiler feed is not downloading new information so the profiler is inactive
正解：C
質問 # 120
......
シスコ300-715試験に合格するためには、ネットワークセキュリティ原則の強い理解と、Cisco TrustSec、Cisco AnyConnect、Cisco Identity Services Engine（ISE）などのCiscoテクノロジに精通している必要があります。合格者は、Ciscoテクノロジとベストプラクティスを使用して安全なネットワークインフラストラクチャを設計および展開し、ネットワークセキュリティおよびアクセス制御に関連する問題を効果的にトラブルシューティングできるようになります。
あなたを合格させるCisco試験には300-715試験問題集：https://jp.fast2test.com/300-715-premium-file.html
300-715試験問題集でCisco練習テスト問題：https://drive.google.com/open?id=1wuplOC7d9IhZ1qXa7M7F4n7CzkBiFHzR