NEW QUESTION 1
Which two values are compared by the binary comparison function in authentication that is based on Active Directory?

• A. user-presented certificate and a certificate stored in Active Directory
• B. MS-CHAPv2 provided machine credentials and credentials stored in Active Directory
• C. user-presented password hash and a hash stored in Active Directory
• D. subject alternative name and the common name

Answer: D

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/ISE-ADIntegrationDoc/b_ISE-ADIntegration.html

NEW QUESTION 2
Which two components are required for creating a Native Supplicant Profile within a BYOD flow? (Choose two.)

• A. Redirect ACL
• B. Connection Type
• C. Operating System
• D. Windows Settings
• E. iOS Settings

Answer: CE

NEW QUESTION 3
What is the minimum certainty factor when creating a profiler policy?

• A. the minimum number that a predefined condition provides
• B. the maximum number that a predefined condition provides
• C. the minimum number that a device certainty factor must reach to become a member of the profile
• D. the maximum number that a device certainty factor must reach to become a member of the profile

Answer: C

NEW QUESTION 4
Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

• A. TCP 8905
• B. TCP 8909
• C. TCP 443
• D. UDP 1812

Answer: B

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010101.html

NEW QUESTION 5
Which two probes must be enabled for the ARP cache to function in the Cisco ISE profiling service so that a user can reliably bind the IP addresses and MAC addresses of endpoints? (Choose two.)

• A. SNMP
• B. HTTP
• C. RADIUS
• D. DHCP
• E. NetFlow

Answer: CD

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010100.html

NEW QUESTION 6
Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

• A. addition of endpoint to My Devices Portal
• B. endpoint marked as lost in My Devices Portal
• C. updating of endpoint dACL
• D. endpoint profile transition from Apple-device to Apple-iPhone
• E. endpoint profile transition from Unknown to Windows10-Workstation

Answer: DE

NEW QUESTION 7
What must match between Cisco ISE and the network access device to successfully authenticate endpoints?

• A. shared secret
• B. profile
• C. certificate
• D. SNMP version

Answer: A

Explanation:
Reference: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_network_devices.html

NEW QUESTION 8
A user reports that the RADIUS accounting packets are not being seen on the Cisco ISE server. Which command is the user missing in the switch’s configuration?

• A. aaa accounting resource default start-stop group radius
• B. radius-server vsa send accounting
• C. aaa accounting network default start-stop group radius
• D. aaa accounting exec default start-stop group radius

Answer: B

Explanation:
Reference: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_sw_cnfg.pdf

NEW QUESTION 9
Which are two characteristics of TACACS+? (Choose two.)

• A. It separates authorization and authentication functions.
• B. It combines authorization and authentication functions.
• C. It uses UDP port 49.
• D. It encrypts the password only.
• E. It uses TCP port 49.

Answer: AE

Explanation:
Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.html

NEW QUESTION 10
What are two benefits of TACACS+ versus RADIUS for device administration? (Choose two.)

• A. TACACS+ has command authorization, and RADIUS does not.
• B. TACACS+ uses UDP, and RADIUS uses TCP.
• C. TACACS+ supports 802.1X, and RADIUS supports MAB.
• D. TACACS+ provides the service type, and RADIUS does not.
• E. TACACS+ encrypts the whole payload, and RADIUS encrypts only the password.

Answer: AE

NEW QUESTION 11
Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two.)

• A. TCP 80
• B. TCP 8905
• C. TCP 8443
• D. TCP 8906
• E. TCP 443

Answer: BC

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/installation_guide/b_ise_InstallationGuide20/Cisco_SNS_3400_Series_Appliance_Ports_Reference.html

NEW QUESTION 12
What is the purpose of the ip http server
command on a switch?

• A. It enables the https server for users for web authentication.
• B. It enables dot1x authentication on the switch.
• C. It enables MAB authentication on the switch.
• D. It enables the switch to redirect users for web authentication.

Answer: C

NEW QUESTION 13
Which two fields are available when creating an endpoint on the context visibility page of Cisco ISE? (Choose two.)

• A. Security Group Tag
• B. Endpoint Family
• C. Policy Assignment
• D. Identity Group Assignment
• E. IP Address

Answer: CD

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010101.html

NEW QUESTION 14
Which supplicant(s) and server(s) are capable of supporting EAP-CHAINING?

• A. Cisco Secure Services Client and Cisco Access Control Server
• B. Cisco AnyConnect NAM and Cisco Identity Service Engine
• C. Cisco AnyConnect NAM and Cisco Access Control Server
• D. Windows Native Supplicant and Cisco Identity Service Engine

Answer: B

Explanation:
Reference: https://www.cisco.com/c/en/us/support/docs/wireless-mobility/eap-fast/200322-Understanding-EAP-FAST-and-Chaining-imp.html

NEW QUESTION 15
Which portal is used to customize the settings for a user to log in and download the compliance module?

• A. Client Provisioning
• B. Client Endpoint
• C. Client Profiling
• D. Client Guest

Answer: A

NEW QUESTION 16
Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles? (Choose two.)

• A. ASA
• B. Firepower
• C. Shell
• D. WLC
• E. IOS

Answer: CD

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2--1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_0100010.html

NEW QUESTION 17
What does the dot1x system-auth-control command do?

• A. globally enables 802.1x
• B. causes a network access switch not to track 802.1x sessions
• C. enables 802.1x on a network access device interface
• D. causes a network access switch to track 802.1x sessions

Answer: A

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-8-0E/15-24E/configuration/guide/xe-380-configuration/dot1x.html

NEW QUESTION 18
Which interface-level command is needed to turn on 802.1X authentication?

• A. dot1x system-auth-control
• B. dot1x pae authenticator
• C. aaa server radius dynamic-author
• D. authentication host-mode single- host

Answer: B

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sg/configuration/guide/conf/dot1x.html

NEW QUESTION 19
DRAG DROP
Drag the steps to configure a Cisco ISE node as a primary administration node from the left into the correct order on the right.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Reference: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html

NEW QUESTION 20
If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

• A. Client Provisioning
• B. BYOD
• C. Guest
• D. Blacklist

Answer: D

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_010000.html

NEW QUESTION 21
In which two ways can users and endpoints be classified for TrustSec? (Choose two.)

• A. VLAN
• B. dynamic
• C. QoS
• D. SGACL
• E. SXP

Answer: AD

NEW QUESTION 22
Which permission is common to the Active Directory Join and Leave operations?

• A. Remove the Cisco ISE machine account from the domain.
• B. Search Active Directory to see if a Cisco ISE machine account already exists.
• C. Set attributes on the Cisco ISE machine account.
• D. Create a Cisco ISE machine account in the domain if the machine account does not already exist.

Answer: B

NEW QUESTION 23
......