Summer Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exc65

Wireless network users authenticate to Cisco ISE using 802.1X through a Cisco Catalyst switch. An engineer must create an updated configuration to assign a security group tag to the user's traffic using inline tagging to prevent unauthenticated users from accessing a restricted server. The configurations were performed:

• configured Cisco ISE as a Cisco TrustSec AAA server

• configured the switch as a RADIUS device in Cisco ISE

• configured the wireless LAN controller as a TrustSec device in Cisco ISE

• created a security group tog for the wireless users

• created a certificate authentication profile

■ created an identity source sequence

• assigned an appropriate security group tag to the wireless users

• defined security group access control lists to specify an egress policy

• enforced the access control lists on the TrustSec policy matrix in Cisco ISE

• configured TrustSec on the switch

• configured TrustSec on the wireless LAN controller

Which two actions must be taken to complete the configuration? (Choose two.)

A.

Configure Security Group Tag Exchange Protocol on the wireless LAN controller.

B.

Configure Security Group Tag Exchange Protocol to distribute IP to security group tags on Cisco ISE.

C.

Configure inline tag propagation on the switch and wireless LAN controller.

D.

Create static IP-to-SGT mapping for the restricted web server.

E.

Configure Security Group Tag Exchange Protocol on the switch.

A network engineer has been tasked with enabling a switch to support standard web authentication for Cisco ISE. This must include the ability to provision for URL redirection on authentication Which two commands must be entered to meet this requirement? (Choose two)

A.

Ip http secure-authentication

B.

Ip http server

C.

Ip http redirection

D.

Ip http secure-server

E.

Ip http authentication

An engineer is using Cisco ISE and configuring guest services to allow wireless devices to access the network. Which action should accomplish this task?

A.

Create the redirect ACL on the WLC and add it to the WLC policy

B.

Create the redirect ACL on the WLC and add it to the Cisco ISE policy.

C.

Create the redirect ACL on Cisco ISE and add it to the WLC policy

D.

Create the redirect ACL on Cisco ISE and add it to the Cisco ISE Policy

Refer to the exhibit Which component must be configured to apply the SGACL?

A.

egress router

B.

host

C.

secure server

D.

ingress router

Which controller option allows a user to switch from the provisioning SSID to the employee SSID after registration?

A.

AP SSID Fallback

B.

AAA Override

C.

Fast SSID Change

D.

User Idle Timeout

An organization has a fully distributed Cisco ISE deployment When implementing probes, an administrator must scan for unknown endpoints to learn the IP-to-MAC address bindings. The scan is complete on one FPSN. but the information is not available on the others. What must be done to make the information available?

A.

Scanning must be initiated from the PSN that last authenticated the endpoint

B.

Cisco ISE must learn the IP-MAC binding of unknown endpoints via DHCP profiling, not via scanning

C.

Scanning must be initiated from the MnT node to centrally gather the information

D.

Cisco ISE must be configured to learn the IP-MAC binding of unknown endpoints via RADIUS authentication, not via scanning

A network engineer needs to ensure that the access credentials are not exposed during the 802.1x authentication among components. Which two protocols should complete this task?

A.

PEAP

B.

EAP-MD5

C.

LEAP

D.

EAP-TLS

E.

EAP-TTLS

Which two external identity stores are supported by Cisco ISE for password types? (Choose two.)

A.

LDAP

B.

OBDC

C.

RADIUS Token Server

D.

TACACS+ Token Server

E.

SOL

What must be configured on the WLC to configure Central Web Authentication using Cisco ISE and a WLC?

A.

Set the NAC State option to SNMP NAC.

B.

Set the NAC State option to RADIUS NAC.

C.

Use the radius-server vsa send authentication command.

D.

Use the ip access-group webauth in command.

A new employee just connected their workstation to a Cisco IP phone. The network administrator wants to ensure that the Cisco IP phone remains online when the user disconnects their Workstation from the corporate network Which CoA configuration meets this requirement?

A.

Port Bounce

B.

Reauth

C.

NoCoA

D.

Disconnect