Pre-Winter Sale Special - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sntaclus

Which three default endpoint identity groups does cisco ISE create? (Choose three)

A.

Unknown

B.

whitelist

C.

end point

D.

profiled

E.

blacklist

An engineer is configuring the remote access VPN to use Cisco ISE for AAA and needs to conduct posture checks on the connecting endpoints After the endpoint connects, it receives its initial authorization result and continues onto the compliance scan What must be done for this AAA configuration to allow compliant access to the network?

A.

Configure the posture authorization so it defaults to unknown status

B.

Fix the CoA port number

C.

Ensure that authorization only mode is not enabled

D.

Enable dynamic authorization within the AAA server group

A Cisco device has a port configured in multi-authentication mode and is accepting connections only from hosts assigned the SGT of SGT_0422048549 The VLAN trunk link supports a maximum of 8 VLANS What is the reason for these restrictions?

A.

The device is performing inline tagging without acting as a SXP speaker

B.

The device is performing mime tagging while acting as a SXP speaker

C.

The IP subnet addresses are dynamically mapped to an SGT.

D.

The IP subnet addresses are statically mapped to an SGT

A network administrator is configuring authorization policies on Cisco ISE There is a requirement to use AD group assignments to control access to network resources After a recent power failure and Cisco ISE rebooting itself, the AD group assignments no longer work What is the cause of this issue?

A.

The AD join point is no longer connected.

B.

The AD DNS response is slow.

C.

The certificate checks are not being conducted.

D.

The network devices ports are shut down.

An engineer is configuring static SGT classification. Which configuration should be used when authentication is disabled and third-party switches are in use?

A.

VLAN to SGT mapping

B.

IP Address to SGT mapping

C.

L3IF to SGT mapping

D.

Subnet to SGT mapping

Which statement about configuring certificates for BYOD is true?

A.

An Android endpoint uses EST, whereas other operating systems use SCEP for enrollment

B.

The SAN field is populated with the end user name.

C.

An endpoint certificate is mandatory for the Cisco ISE BYOD

D.

The CN field is populated with the endpoint host name

Which CLI command must be configured on the switchport to immediately run the MAB process if a non-802.1X capable endpoint connects to the port?

A.

authentication order mab dot1x

B.

authentication fallback

C.

dot1x pae authenticator

D.

access-session port-control auto

Refer to the exhibit.

An engineer must configure a Cisco switch to send DHCP probes to a Cisco ISE Policy Service Node with IP address 10.1.100.6 on interface VLAN 10. Which code snippet completes the configuration?

A.

ip helper-address 10.1.100.6

B.

ip dhcp-address 10.1.100.6

C.

ip dhcp-relay 10.1.100.6

D.

ip helper-address 10.1.10.6

An engineer must use Cisco ISE profiler services to provide network access to Cisco IP phones that cannot support 802.1X. Cisco ISE is configured to use the access switch device sensor information — system-description and platform-type — to profile Cisco IP phones and allow access.

Which two protocols must be configured on the switch to complete the configuration? (Choose two.)

A.

LLDP

B.

CDP

C.

EAPOL

D.

SNMP

E.

STP

An engineer is working on a switch and must tag packets with SGT values such that it learns via SXP. Which command must be entered to meet this requirement?

A.

ip source guard

B.

ip dhcp snooping

C.

ip device tracking maximum

D.

ip arp inspection