NEW QUESTION 1
What happens when an internal user is configured with an external identity store for authentication, but an engineer uses the Cisco ISE admin portal to select an internal identity store as the identity source?

• A. Authentication is redirected to the internal identity source.
• B. Authentication is redirected to the external identity source.
• C. Authentication is granted.
• D. Authentication fails.

Answer: D

NEW QUESTION 2
What must be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

• A. pass
• B. reject
• C. drop
• D. continue

Answer: D

Explanation:
https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_id_stores.html

NEW QUESTION 3
A security administrator is using Cisco ISE to create a BYOD onboarding solution for all employees who use personal devices on the corporate network. The administrator generates a Certificate Signing Request and signs the request using an external Certificate Authority server. Which certificate usage option must be selected when importing the certificate into ISE?

• A. RADIUS
• B. DLTS
• C. Portal
• D. Admin

Answer: C

NEW QUESTION 4
Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

• A. personas
• B. qualys
• C. nexpose
• D. posture

Answer: D

Explanation:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide Posture is a service in Cisco Identity Services Engine (Cisco ISE) that allows you to check the state, also known as posture, of all the endpoints that are connecting to a network for compliance with corporate security policies. This allows you to control clients to access protected areas of a network.

NEW QUESTION 5
An engineer is implementing network access control using Cisco ISE and needs to separate the traffic based on the network device ID and use the IOS device sensor capability. Which probe must be used to accomplish this task?

• A. HTTP probe
• B. NetFlow probe
• C. network scan probe
• D. RADIUS probe

Answer: D

Explanation:
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200292-Configure-Device-Sensor http://www.network-node.com/blog/2016/1/2/ise-20-profiling

NEW QUESTION 6
Which two methods should a sponsor select to create bulk guest accounts from the sponsor portal? (Choose two )

• A. Random
• B. Monthly
• C. Daily
• D. Imported
• E. Known

Answer: AD

NEW QUESTION 7
What are two components of the posture requirement when configuring Cisco ISE posture? (Choose two)

• A. updates
• B. remediation actions
• C. Client Provisioning portal
• D. conditions
• E. access policy

Answer: BD

NEW QUESTION 8
Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?

• A. DHCP server
• B. static IP tunneling
• C. override Interface ACL
• D. AAA override

Answer: D

NEW QUESTION 9
A network administrator is configuring client provisioning resource policies for client machines and must ensure that an agent pop-up is presented to the client when attempting to connect to the network Which configuration item needs to be added to allow for this'?

• A. the client provisioning URL in the authorization policy
• B. a temporal agent that gets installed onto the system
• C. a remote posture agent proxying the network connection
• D. an API connection back to the client

Answer: C

NEW QUESTION 10
An engineer needs to export a file in CSV format, encrypted with the password C1$c0438563935, and contains users currently configured in Cisco ISE. Drag and drop the steps from the left into the sequence on the right to complete this task.

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 11
An organization is adding new profiling probes to the system to improve profiling on Oseo ISE The probes must support a common network management protocol to receive information about the endpoints and the ports to which they are connected What must be configured on the network device to accomplish this goal?

• A. ARP
• B. SNMP
• C. WCCP
• D. ICMP

Answer: B

Explanation:
https://community.cisco.com/t5/security-documents/ise-profiling-design-guide/ta-p/3739456#toc-hId-79034313

NEW QUESTION 12
In which two ways can users and endpoints be classified for TrustSec? (Choose Two.)

• A. VLAN
• B. SXP
• C. dynamic
• D. QoS
• E. SGACL

Answer: AE

NEW QUESTION 13
An engineer is unable to use SSH to connect to a switch after adding the required CLI commands to the device to enable TACACS+. The device administration license has been added to Cisco ISE, and the required policies have been created. Which action is needed to enable access to the switch?

• A. The ip ssh source-interface command needs to be set on the switch
• B. 802.1X authentication needs to be configured on the switch.
• C. The RSA keypair used for SSH must be regenerated after enabling TACACS+.
• D. The switch needs to be added as a network device in Cisco ISE and set to use TACACS+.

Answer: D

NEW QUESTION 14
An employee must access the internet through the corporate network from a new mobile device that does not support native supplicant provisioning provided by Cisco ISE. Which portal must the employee use to provision to the device?

• A. BYOD
• B. Personal Device
• C. My Devices
• D. Client Provisioning

Answer: C

NEW QUESTION 15
What is the minimum certainty factor when creating a profiler policy?

• A. the minimum number that a predefined condition provides
• B. the maximum number that a predefined condition provides
• C. the minimum number that a device certainty factor must reach to become a member of the profile
• D. the maximum number that a device certainty factor must reach to become a member of the profile

Answer: C

NEW QUESTION 16
Which two features must be used on Cisco ISE to enable the TACACS. feature? (Choose two)

• A. Device Administration License
• B. Server Sequence
• C. Command Sets
• D. Enable Device Admin Service
• E. External TACACS Servers

Answer: AD

NEW QUESTION 17
A Cisco ISE server sends a CoA to a NAD after a user logs in successfully using CWA Which action does the CoA perform?

• A. It terminates the client session
• B. It applies the downloadable ACL provided in the CoA
• C. It applies new permissions provided in the CoA to the client session.
• D. It triggers the NAD to reauthenticate the client

Answer: B

Explanation:
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/113362-config-web-auth-ise-00.ht

NEW QUESTION 18
An engineer needs to configure a Cisco ISE server to issue a CoA for endpoints already authenticated to access the network. The CoA option must be enforced on a session, even if there are multiple active sessions on a port. What must be configured to accomplish this task?

• A. the Reauth CoA option in the Cisco ISE system profiling settings enabled
• B. an endpoint profiling policy with the No CoA option enabled
• C. an endpoint profiling policy with the Port Bounce CoA option enabled
• D. the Port Bounce CoA option in the Cisco ISE system profiling settings enabled

Answer: A

NEW QUESTION 19
......