NEW QUESTION 1
Which two features must be used on Cisco ISE to enable the TACACS+ feature? (Choose two.)

• A. Command Sets
• B. Server Sequence
• C. Device Administration License
• D. External TACACS Servers
• E. Device Admin Service

Answer: CE

NEW QUESTION 2
What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?

• A. State attribute
• B. Class attribute
• C. Event
• D. Cisco-av-pair

Answer: D

Explanation:
Reference: https://community.cisco.com/t5/network-access-control/ise-airespace-acl-wlc-problem/td-p/2110491

NEW QUESTION 3
Which two endpoint compliance statuses are possible? (Choose two.)

• A. compliant
• B. valid
• C. unknown
• D. known
• E. invalid

Answer: AC

NEW QUESTION 4
A user reports that the RADIUS accounting packets are not being seen on the Cisco ISE server. Which command is the user missing in the switch’s configuration?

• A. aaa accounting resource default start-stop group radius
• B. radius-server vsa send accounting
• C. aaa accounting network default start-stop group radius
• D. aaa accounting exec default start-stop group radius

Answer: B

Explanation:
Reference: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_sw_cnfg.pdf

NEW QUESTION 5
Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two.)

• A. TCP 80
• B. TCP 8905
• C. TCP 8443
• D. TCP 8906
• E. TCP 443

Answer: BC

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/installation_guide/b_ise_InstallationGuide20/Cisco_SNS_3400_Series_Appliance_Ports_Reference.html

NEW QUESTION 6
What is needed to configure wireless guest access on the network?

• A. endpoint already profiled in ISE
• B. WEBAUTH ACL for redirection
• C. Captive Portal Bypass turned on
• D. valid user account in Active Directory

Answer: C

NEW QUESTION 7
What does the dot1x system-auth-control command do?

• A. globally enables 802.1x
• B. causes a network access switch not to track 802.1x sessions
• C. enables 802.1x on a network access device interface
• D. causes a network access switch to track 802.1x sessions

Answer: A

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-8-0E/15-24E/configuration/guide/xe-380-configuration/dot1x.html

NEW QUESTION 8
Which portal is used to customize the settings for a user to log in and download the compliance module?

• A. Client Provisioning
• B. Client Endpoint
• C. Client Profiling
• D. Client Guest

Answer: A

NEW QUESTION 9
What is a characteristic of the UDP protocol?

• A. UDP can detect when a server is down.
• B. UDP can detect when a server is slow.
• C. UDP offers best-effort delivery.
• D. UDP offers information about a non-existent server.

Answer: C

NEW QUESTION 10
A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group. Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?

• A. Keep track of guest user activities.
• B. Create and manage guest user accounts.
• C. Configure authorization settings for guest users.
• D. Authenticate guest users to Cisco ISE.

Answer: B

NEW QUESTION 11
Which two components are required for creating a Native Supplicant Profile within a BYOD flow? (Choose two.)

• A. Redirect ACL
• B. Connection Type
• C. Operating System
• D. Windows Settings
• E. iOS Settings

Answer: CE

NEW QUESTION 12
Which interface-level command is needed to turn on 802.1X authentication?

• A. dot1x system-auth-control
• B. dot1x pae authenticator
• C. aaa server radius dynamic-author
• D. authentication host-mode single- host

Answer: B

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sg/configuration/guide/conf/dot1x.html

NEW QUESTION 13
Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?

• A. blacklist
• B. unknown
• C. whitelist
• D. profiled
• E. endpoint

Answer: B

Explanation:
Reference: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_identities.html

NEW QUESTION 14
During BYOD flow, from where does a Microsoft Windows PC download the Network Setup Assistant?

• A. Microsoft App Store
• B. Cisco App Store
• C. Cisco ISE directly
• D. Native OTA functionality

Answer: C

Explanation:
Reference: https://ciscocustomer.lookbookhq.com/iseguidedjourney/BYOD-configuration

NEW QUESTION 15
Which protocol must be allowed for a BYOD device to access the BYOD portal?

• A. HTTPS
• B. HTTP
• C. SSH
• D. SMTP

Answer: A

NEW QUESTION 16
When configuring Active Directory groups, what does the Cisco ISE use to resolve ambiguous group names?

• A. MIB
• B. SID
• C. MAB
• D. TGT

Answer: B

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/ise_active_directory_integration/b_ISE_AD_integration_2x.html

NEW QUESTION 17
Which permission is common to the Active Directory Join and Leave operations?

• A. Remove the Cisco ISE machine account from the domain.
• B. Search Active Directory to see if a Cisco ISE machine account already exists.
• C. Set attributes on the Cisco ISE machine account.
• D. Create a Cisco ISE machine account in the domain if the machine account does not already exist.

Answer: B

NEW QUESTION 18
Which two methods should a sponsor select to create bulk guest accounts from the sponsor portal? (Choose two.)

• A. Known
• B. Monthly
• C. Daily
• D. Imported
• E. Random

Answer: AE

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/sponsor_guide/b_spons_SponsorPortalUserGuide_13/b_spons_SponsorPortalUserGuide_13_chapter_01.html

NEW QUESTION 19
DRAG DROP
Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:

NEW QUESTION 20
What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?

• A. The secondary node restarts.
• B. The primary node restarts.
• C. Both nodes restart.
• D. The primary node becomes standalone.

Answer: C

NEW QUESTION 21
Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

• A. TCP 8905
• B. TCP 8909
• C. TCP 443
• D. UDP 1812

Answer: B

Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010101.html

NEW QUESTION 22
Refer to the exhibit.

Which command is typed within the CLI of a switch to view the troubleshooting output?

• A. show authentication sessions mac 000e.84af.59af details
• B. show authentication registrations
• C. show authentication interface gigabitethernet2/0/36
• D. show authentication sessions method

Answer: A

NEW QUESTION 23
Which are two characteristics of TACACS+? (Choose two.)

• A. It separates authorization and authentication functions.
• B. It combines authorization and authentication functions.
• C. It uses UDP port 49.
• D. It encrypts the password only.
• E. It uses TCP port 49.

Answer: AE

Explanation:
Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.html

NEW QUESTION 24
What is the minimum certainty factor when creating a profiler policy?

• A. the minimum number that a predefined condition provides
• B. the maximum number that a predefined condition provides
• C. the minimum number that a device certainty factor must reach to become a member of the profile
• D. the maximum number that a device certainty factor must reach to become a member of the profile

Answer: C

NEW QUESTION 25
Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

• A. addition of endpoint to My Devices Portal
• B. endpoint marked as lost in My Devices Portal
• C. updating of endpoint dACL
• D. endpoint profile transition from Apple-device to Apple-iPhone
• E. endpoint profile transition from Unknown to Windows10-Workstation

Answer: DE

NEW QUESTION 26
......