Question 1

An organization has a SGACL locally configured on a switch port, but when a user in the Executives group connects to the network, they receive a different level of network access than expected. When Cisco ISE pushes SGACLs to the switch after the authorization phase, how does the switch decide which access to grant the user?

Options :

A : Dynamically downloaded policies override local policies in all cases.

B : Local policies override dynamically downloaded policies in all cases.

C : The policies are merged, but local policies receive priority.

D : The policies are merged, but dynamically downloaded policies receive priority.

Answer: A

Question 2

An administrator made changes in Cisco ISE and needs to apply new permissions for endpoints that have already been authenticated by sending a CoA packet to the network devices. Which IOS command must be configured on the devices to accomplish this goal?

Options :

A : aaa server radius dynamic-author

B : authentication command bounce-port

C : authentication command disable-port

D : aaa nas port extended

Answer: A

Question 3

There is a need within an organization for a new policy to be created in Cisco ISE. It must validate that a specific anti-virus application is not only installed, but running on a machine before it is allowed access to the network. Which posture condition should the administrator configure in order for this policy to work?

Options :

A : file

B : registry

C : application

D : service

Answer: C

Question 4

A network engineer has recently configured a remote branch router to authenticate to a centralized Cisco ISE server behind the corporate firewall using TACACS+. After making this configuration change, the engineer opened another SSH session to the router in order to verity that login attempts are now being sent to Cisco ISE, however that login attempt was unsuccessful. There are no connection attempts showing in the TACACS live log in Cisco ISE and the firewall administrator has verified that they see syslog and SNMP traffic destinated for the IP address of Cisco ISE, but no TACACS+ traffic. Which misconfiguration is the cause of the failed login?

Options :

A : The router is missing a route to the Cisco ISE server.

B : The tacacs source-interface command on the router references the wrong interface.

C : No hosts have been defined under the aaa server group on the router.

D : The shared secret entered on the router for the Cisco ISE server is incorrect.

Answer: C

Question 5

A company is attempting to improve their BYOD policies and restrict access based on certain criteri

a. The company's subnets are organized by building. Which attribute should be used in order to gain access based on location?

Options :

A : static group assignment

B : IP address

C : device registration status

D : MAC address

Answer: A

Free 300-715 Mock Exam – Practice Online Confidently

Buying Options: