QUESTION 141
A Cisco ISE engineer is creating a certificate authentication profile to be used with machine authentication for the network. The engineer wants to be able to compare the user-presented certificate with a certificate stored in Active Directory. What must be done to accomplish this?

A. Add the subject alternative name and the common name to the CAP.
B. Use MS-CHAPv2 since it provides machine credentials and matches them to credentials stored in Active Directory
C. Configure the user-presented password hash and a hash stored in Active Directory for comparison
D. Enable the option for performing binary comparison.

Correct Answer: D

QUESTION 142
A network engineer has recently configured a remote branch router to authenticate to a centralized Cisco ISE server behind the corporate firewall using TACACS+. After making this configuration change, the engineer opened another SSH session to the router in order to verify that login attempts are now being sent to Cisco ISE, however that login attempt was unsuccessful. There are no connection attempts showing in the TACACS live log in Cisco ISE and the firewall administrator has verified that they see syslog and SNMP traffic destinated for the IP address of Cisco ISE, but no TACACS+ traffic. Which misconfiguration is the cause of the failed login?

A. The tacacs source-interface command on the router references the wrong interface.
B. The shared secret entered on the router for the Cisco ISE server is incorrect.
C. The router is missing a route to the Cisco ISE server.
D. No hosts have been defined under the aaa server group on the router.

Correct Answer: B

QUESTION 143
An engineer is configuring a new switch to deploy in the campus network. The task is to configure TACACS+ and RADIUS authentications using the new switch and Cisco ISE. What is the procedure for adding this new switch on the network resources page?

A. default device > add
B. network devices groups > add
C. network devices profiles > add
D. network devices > add

Correct Answer: D

QUESTION 144
A network engineer is in the predeployment discovery phase of a Cisco ISE deployment and must discover the network. There is an existing NMS in the network. Which type of probe must be configured to gather the information?

A. SNMP
B. RADIUS
C. NetFlow
D. NMAP

Correct Answer: A

QUESTION 145
A new Cisco ISE infrastructure is being built to provide network access control. If Cisco Discovery Protocol is used, what information is being gathered in relation to profiling with Cisco ISE?

A. DHCP session attributes
B. device ID
C. RADIUS session attributes
D. IdentityGroup

Correct Answer: B

QUESTION 146
Which file setup method is supported by ZTP on physical appliances?

A. cfg
B. iso
C. img
D. ova

Correct Answer: C

QUESTION 147
An engineer must configure guest access on Cisco ISE for company visitors. Which step must be taken on the Cisco ISE PSNs before a guest portal is configured?

A. Enable profiling services.
B. Create a node group.
C. Enable session services.
D. Install SSL certificates.

Correct Answer: C

QUESTION 148
An engineer must organize endpoints in a Cisco ISE identity management store to improve the operational management of IP phone endpoints. The endpoints must meet these requirements:
1. classify endpoints for finance, sales, and marketing departments
2. tag each endpoint as profiled

Which action organizes the endpoints?

A. Add a tag for the endpoints of each department and use the identity group filter.
B. Create an endpoint identity group for each department with the profiled parent group.
C. Create an endpoint identity group for each department with the IP phone parent group.
D. Add a tag for the endpoints of each department and add an endpoint to profiled group.

Correct Answer: B

QUESTION 149
A network engineer is configuring a portal on Cisco ISE for employees. Employees must use this portal when registering personal devices with native supplicants. For onboarding devices connected with Cisco switches and Cisco wireless LAN controllers, the internal CA must be used. Which portal type must the engineer configure?

A. Personal Device portal
B. Bring Your Own Device portal
C. My Devices portal
D. Client Provisioning portal

Correct Answer: B

QUESTION 150
A customer requires a Cisco ISE deployment where guests must log in to a webpage with unique credentials in the form username: User1 and Password: A. Which deployment should the customer use?

A. mobile number field using the guest page
B. hotspot portal authentication
C. captcha protection self-registration
D. single credentials login to guest portal

Correct Answer: D

QUESTION 151
An engineer must configure web redirection for guests to a portal where no authentication is required and an Acceptable Use Policy must be accepted by the guest before network access is allowed. Which type of guest portal must be configured in Cisco ISE to meet the requirement?

A. Self Registered
B. Hotspot
C. Sponsored
D. Custom

Correct Answer: B

QUESTION 152
A security engineer has a new TrustSec project and must create a few static security group tag classifications as proof of concept. Which two classifications must the engineer configure? (Choose two.)

A. VLAN
B. interface
C. MAC address
D. switch ID
E. user ID

Correct Answer: AB

QUESTION 153
Which two statements are correct regarding the differences between RADIUS and TACACS+? (Choose two.)

A. RADIUS encrypts the entire packet, whereas TACACS+ only encrypts the password field.
B. RADIUS primary use is for network access, whereas TACACS+ primary use is for device administration.
C. RADIUS combines the authentication and authorization functions, whereas TACACS+ separates them.
D. RADIUS uses TCP as the transmission protocol, whereas TACACS+ uses both UDP and TCP protocols.
E. RADIUS supports full command logging, whereas TACACS+ does not provide any command logging.

Correct Answer: BC

QUESTION 154
An administrator in a health facility must assign a medical device to a static profiling policy. Under which settings group must it be configured?

A. CoA under global settings
B. global profiling settings
C. user-defined exception actions
D. system-defined exceptions actions

Correct Answer: C

QUESTION 155
What is configured to enforce the blocklist permissions and deny access to clients in the blocklist to protect against a lost or stolen device obtaining access to the network?

A. blocklist portal
B. My Devices portal
C. Authentication rule
D. Authorization rule

Correct Answer: D

QUESTION 156
An engineer has been tasked with using Cisco ISE to restrict network access at the switchport level using 802.1X authentication. Users who fail 802.1X authentication should be redirected via web redirection and have their access restricted via an ACL. What must be configured in Cisco ISE to accomplish this task?

A. an authorization profile
B. an authentication policy
C. an authentication profile
D. an authorization rule

Correct Answer: A

QUESTION 157
What is the difference between how RADIUS and TACACS+ handle encryption?

A. RADIUS encrypts only the username and password fields, whereas TACACS+ encrypts the entire packet.
B. RADIUS only encrypts the password field, whereas TACACS+ encrypts the entire packet
C. RADIUS encrypts the entire packet, whereas TACACS+ only encrypts the password field.
D. RADIUS encrypts the entire packet, whereas TACACS+ encrypts only the usename and password fields.

Correct Answer: B

QUESTION 158
An engineer is adding a new network device to be used with 802.1X authentication. After configuring the device, the engineer notices that no endpoints that connect to the switch are able to authenticate. What is the problem?

A. The command dot1x system-auth-control is not configured on the switch.
B. The switch’s supplicant is unable to establish a connection to Cisco ISE.
C. The command dot1x critical vlan 40 is not configured on the switch ports.
D. The endpoint firewalls are blocking the EAPoL traffic.

Correct Answer: A

QUESTION 159
Which platform does a Windows-based device download the Network Assistant from?

A. Cisco download site
B. Microsoft app store
C. Cisco ISE
D. native OS

Correct Answer: C

QUESTION 160
An engineer must configure posture updates. The task is to ensure the latest set of predefined checks and operating system information is updated. The checks must take place regularly. Where in the Cisco ISE interface would the engineer make the necessary changes to the compliance module?

A. Administration > System > Settings > Posture > Updates > Schedule
B. Administration > System > Settings > Updates > Posture
C. Administration > System > Settings > Posture > Updates
D. Administration > System > Settings > Updates > Schedule

Correct Answer: C