300-715 Certification Exam Questions with AI Explanations

QUESTION: 61

An organization has a fully distributed Cisco ISE deployment.
When implementing probes, an administrator must scan for unknown endpoints to learn the IP-to
MAC address bindings. The scan is complete on one PSN, but the information is not available on the others.
What must be done to make the information available?

Cisco ISE must be configured to learn the IP-MAC binding of unknown endpoints via RADIUS authentication, not via scanning.
Cisco ISE must learn the IP-MAC binding of unknown endpoints via DHCP profiling, not via scanning.
Scanning must be initiated from the MnT node to centrally gather the information.
Scanning must be initiated from the PSN that last authenticated the endpoint.

Answer(s): D

Reference:

https://community.cisco.com/t5/security-documents/ise-profiling-design-guide/ta-p/3739456

Reveal Solution Next Question

QUESTION: 62

An administrator is configuring a switch port for use with 802.1X.
What must be done so that the port will allow voice and multiple data endpoints?

Connect a hub to the switch port to allow multiple devices access after authentication.
Configure the port with the authentication host-mode multi-auth command.
Connect the data devices to the port, then attach the phone behind them.
Use the command authentication host-mode multi-domain on the port.

Answer(s): B

Reference:

https://networklessons.com/cisco/ccie-routing-switching-written/mac-authentication-bypass-mab

Reveal Solution Next Question

QUESTION: 63

An administrator is troubleshooting an endpoint that is supposed to bypass 802.1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB, however the endpoint cannot communicate because it cannot obtain an IP address.
What is the problem?

The endpoint is using the wrong protocol to authenticate with Cisco ISE.
The 802.1X timeout period is too long.
The DHCP probe for Cisco ISE is not working as expected.
An ACL on the port is blocking HTTP traffic.

Answer(s): B

Reveal Solution Next Question

QUESTION: 64

A Cisco ISE administrator must restrict specific endpoints from accessing the network while in closed mode. The requirement is to have Cisco ISE centrally store the endpoints to restrict access from.
What must be done to accomplish this task?

Create a profiling policy for each endpoint with the cdpCacheDeviceId attribute.
Create a logical profile for each device's profile policy and block that via authorization policies.
Add each MAC address manually to a blocklist identity group and create a policy denying access.
Add each IP address to a policy denying access.

Answer(s): C

Reveal Solution Next Question

QUESTION: 65

An engineer is using profiling to determine what access an endpoint must receive. After configuring both Cisco ISE and the network devices for 802.1X and profiling, the endpoints do not profile prior to authentication.
What are two reasons this is happening? (Choose two.)

Closed mode is restricting the collection of the attributes prior to authentication.
The HTTP probe is malfunctioning due to closed mode being enabled.
The SNMP probe is not enabled.
NetFlow is not enable on the switch, so the attributes will not be collected.
The switch is collecting the attributes via RADIUS but the probes are not sending them.

Answer(s): A,E

Reveal Solution Next Question

Cisco Implementing and Configuring Identity Services Engine (300-715 SISE) 300-715 Dumps in PDF

Free Cisco 300-715 Real Questions (page: 35)

QUESTION: 61

Reference:

QUESTION: 62

Reference:

QUESTION: 63

QUESTION: 64

QUESTION: 65