Question 1

What are two components of the posture requirement when configuring Cisco ISE posture? (Choose two.)

Accepted Answer

A)  Client Provisioning portal 
B)  remediation actions 
C)  updates 
D)  access policy 
E)  conditions

Question 2

If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

Accepted Answer

A)  Client Provisioning 
B)  BYOD 
C)  Guest 
D)  Block list

Question 3

An engineer is configuring a guest password policy and needs to ensure that the password complexity requirements are set to mitigate brute force attacks. Which two requirements should be included in this policy? (Choose two.)

Accepted Answer

A)  active username limit 
B)  password expiration period 
C)  access code control 
D)  username expiration date 
E)  minimum password length

Question 4

Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles? (Choose two.)

Accepted Answer

A)  ASA 
B)  Firepower 
C)  Shell 
D)  WLC 
E)  IOS

Question 5

An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port. Which command should be used to accomplish this task?

Accepted Answer

A) permit tcp any any eq B) ip http port C) aaa group server radius D) aaa group server radius proxy

Question 6

In which two ways can users and endpoints be classified for TrustSec? (Choose two.)

Accepted Answer

A)  VLAN 
B)  dynamic 
C)  QoS 
D)  SGACL 
E)  SXP

Question 7

What is needed to configure wireless guest access on the network?

Accepted Answer

A)  endpoint already profiled in ISE 
B)  WEBAUTH ACL for redirection 
C)  Captive Portal Bypass turned on 
D)  valid user account in Active Directory

Question 8

Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two.)

Accepted Answer

A)  TCP 80 
B)  TCP 8905 
C)  TCP 8443 
D)  TCP 8906 
E)  TCP 443

Question 9

What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?

Accepted Answer

A)  Application Visibility and Control 
B)  Supplicant Provisioning Wizard 
C)  My Devices Portal 
D)  Network Access Control

Question 10

Which two responses from the RADIUS server to NAS are valid during the authentication process? (Choose two.)

Accepted Answer

A)  access-challenge 
B)  access-accept 
C)  access-request 
D)  access-reserved 
E)  access-response

Question 11

Which profiling probe collects the user-agent string?

Accepted Answer

A)  DHCP 
B)  HTTP 
C)  NMAP 
D)  AD

Question 12

What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?

Accepted Answer

A)  State attribute 
B)  Class attribute 
C)  Event 
D)  Cisco-av-pair

Question 13

During BYOD flow, from where does a Microsoft Windows PC download the Network Setup Assistant?

Accepted Answer

A)  Microsoft App Store 
B)  Cisco App Store 
C)  Cisco ISE directly 
D)  Native OTA functionality

Question 14

What are two requirements of generating a single certificate in Cisco ISE by using a certificate provisioning portal, without generating a certificate signing request? (Choose two.)

Accepted Answer

A)  Enter the IP address of the device. 
B)  Enter the common name. 
C)  Choose the hashing method. 
D)  Locate the CSV file for the device MAC. 
E)  Select the certificate template.

Question 15

Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

Accepted Answer

A)  qualys 
B)  posture 
C)  personas 
D)  nexpose

Question 16

During BYOD flow, where does a Microsoft Windows PC download the Network Setup Assistant?

Accepted Answer

A)  Microsoft App Store 
B)  Cisco App Store 
C)  Cisco ISE directly 
D)  Native OTA functionality

Question 17

Which personas can a Cisco ISE node assume?

Accepted Answer

A)  policy service, gatekeeping, and monitoring 
B)  administration, monitoring, and gatekeeping 
C)  administration, policy service, and monitoring 
D)  administration, policy service, gatekeeping

Question 18

Which permission is common to the Active Directory Join and Leave operations?

Accepted Answer

A)  Remove the Cisco ISE machine account from the domain. 
B)  Search Active Directory to see if a Cisco ISE machine account already exists. 
C)  Set attributes on the Cisco ISE machine account. 
D)  Create a Cisco ISE machine account in the domain if the machine account does not already exist.

Question 19

If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

Accepted Answer

A)  Client Provisioning 
B)  BYOD 
C)  Guest 
D)  Blacklist

Question 20

Which are two characteristics of TACACS+? (Choose two.)

Accepted Answer

A)  It separates authorization and authentication functions. 
B)  It combines authorization and authentication functions. 
C)  It uses UDP port 49. 
D)  It encrypts the password only. 
E)  It uses TCP port 49.

Exam 24: Securing Email with Cisco Email Security Appliance (300-720 SESA)

What are two components of the posture requirement when configuring Cisco ISE posture? (Choose two.)

If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

An engineer is configuring a guest password policy and needs to ensure that the password complexity requirements are set to mitigate brute force attacks. Which two requirements should be included in this policy? (Choose two.)

Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles? (Choose two.)

An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port. Which command should be used to accomplish this task?

In which two ways can users and endpoints be classified for TrustSec? (Choose two.)

What is needed to configure wireless guest access on the network?

Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two.)

What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?

Which two responses from the RADIUS server to NAS are valid during the authentication process? (Choose two.)

Which profiling probe collects the user-agent string?

What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?

During BYOD flow, from where does a Microsoft Windows PC download the Network Setup Assistant?

What are two requirements of generating a single certificate in Cisco ISE by using a certificate provisioning portal, without generating a certificate signing request? (Choose two.)

Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

During BYOD flow, where does a Microsoft Windows PC download the Network Setup Assistant?

Which personas can a Cisco ISE node assume?

Which permission is common to the Active Directory Join and Leave operations?

If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

Which are two characteristics of TACACS+? (Choose two.)