New Questions 9

Changes were made to the ISE server while troubleshooting, and now all wireless certificate authentications are failing. Logs indicate an EAP failure. What are the two possible causes of the problem? (Choose two.)

A. EAP-TLS is not checked in the Allowed Protocols list

B. Client certificate is not included in the Trusted Certificate Store

C. MS-CHAPv2-is not checked in the Allowed Protocols list

D. Default rule denies all traffic

E. Certificate authentication profile is not configured in the Identity Store

New Questions 10

You configured wired 802.1X with EAP-TLS on Windows machines. The ISE authentication detail report shows "EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain." What is the most likely cause of this error?

A. The ISE certificate store is missing a CA certificate.

B. The Wireless LAN Controller is missing a CA certificate.

C. The switch is missing a CA certificate.

D. The Windows Active Directory server is missing a CA certificate.

New Questions 11

Which statement about the Cisco ISE BYOD feature is true?

A. Use of SCEP/CA is optional.

B. BYOD works only on wireless access.

C. Cisco ISE needs to integrate with MDM to support BYOD.

D. Only mobile endpoints are supported.

New Questions 12

Which statement about a distributed Cisco ISE deployment is true?

A. It can support up to two monitoring Cisco ISE nodes for high availability.

B. It can support up to three load-balanced Administration ISE nodes.

C. Policy Service ISE nodes can be configured in a redundant failover configuration.

D. The Active Directory servers of Cisco ISE can be configured in a load-balanced configuration.

New Questions 13

What is a required step when you deploy dynamic VLAN and ACL assignments?

A. Configure the VLAN assignment.

B. Configure the ACL assignment.

C. Configure Cisco IOS Software 802.1X authenticator authorization.

D. Configure the Cisco IOS Software switch for ACL assignment.

New Questions 14

An engineer must enable SGACL policy globally for a Cisco TrustSec u2013enabled routed interface. Which

command must be used?

A. cts role-based monitor enable

B. cts role-based enfrocement

C. cts role-based sgt-caching with-enforcement

D. cts role-based monitor permissions from {sgt_num} to {dgt_num}][ipv4| ipv6]

New Questions 15

What three changes require restarting the application service on an ISE node? (Choose three.)

A. Registering a node.

B. Changing the primary node to standalone.

C. Promoting the administration node.

D. Installing the root CA certificate.

E. Changing the guest portal default port settings.

F. Adding a network access device.

New Questions 16

Which two profile attributes can be collected by a Cisco Wireless LAN Controller that supports Device Sensor? (Choose two.)

A. LLDP agent information

B. user agent

C. DHCP options

D. open ports

E. CDP agent information

F. FQDN

New Questions 17

A network administrator is seeing a posture status "unknown" for a single corporate machine on the Cisco ISE authentication report, whereas the other machines are reported as "compliant". Which option is the reason for machine being reported as "unknown"?

A. Posture agent is not installed on the machine.

B. Posture policy does not support the OS.

C. Posfure compliance condition is missing on the machine.

D. Posture service is disabled on Cisco ISE.

New Questions 18

In a basic ACS deployment consisting of two servers, for which three tasks is the primary server responsible? (Choose three.)

A. configuration

B. authentication

C. sensing

D. policy requirements

E. monitoring

F. repudiation