Q1. Which three algorithms should be avoided due to security concerns? (Choose three.) 

A. DES for encryption 

B. SHA-1 for hashing 

C. 1024-bit RSA 

D. AES GCM mode for encryption 

E. HMAC-SHA-1 

F. 256-bit Elliptic Curve Diffie-Hellman 

G. 2048-bit Diffie-Hellman 

View Answer

Q2. Which three statements about the Cisco ISE profiler are true? (Choose three.) 

A. It sends endpoint data to AAA servers. 

B. It collects endpoint attributes. 

C. It stores MAC addresses for endpoint systems. 

D. It monitors and polices router and firewall traffic. 

E. It matches endpoints to their profiles. 

F. It stores endpoints in the Cisco ISE database with their profiles. 

View Answer

Q3. What is the effect of the ip http secure-server command on a Cisco ISE? 

A. It enables the HTTP server for users to connect on the command line. 

B. It enables the HTTP server for users to connect using Web-based authentication. 

C. It enables the HTTPS server for users to connect using Web-based authentication. 

D. It enables the HTTPS server for users to connect on the command line. 

View Answer

Q4. Which two Cisco Catalyst switch interface commands allow only a single voice device and a single data device to be connected to the IEEE 802.1X-enabled interface? (Choose two.) 

A. authentication host-mode single-host 

B. authentication host-mode multi-domain 

C. authentication host-mode multi-host 

D. authentication host-mode multi-auth 

View Answer

Q5. A network administrator needs to implement a service that enables granular control of IOS commands that can be executed. Which AAA authentication method should be selected? 

A. TACACS+ 

B. RADIUS 

C. Windows Active Directory 

D. Generic LDAP 

View Answer

Q6. Which setting provides the best security for a WLAN and authenticates users against a centralized directory store? 

A. WPA2 AES-CCMP and 801.X authentication 

B. WPA2 AES-CCMP and PSK authentication 

C. WPA2 TKIP and PSK authentication 

D. WPA2 TKIP and 802.1X authentication 

View Answer

Q7. A network administrator needs to determine the ability of existing network devices to deliver key BYOD services. Which tool will complete a readiness assessment and outline hardware and software capable and incapable devices? 

A. Prime Infrastructure 

B. Network Control System 

C. Cisco Security Manager 

D. Identity Services Engine 

View Answer

Q8. Which two fields are characteristics of IEEE 802.1AE frame? (Choose two.) 

A. destination MAC address 

B. source MAC address 

C. 802.1AE header in EtherType 

D. security group tag in EtherType 

E. integrity check value 

F. CRC/FCS 

View Answer

Q9. Which statement about Cisco ISE BYOD is true? 

A. Dual SSID allows EAP-TLS only when connecting to the secured SSID. 

B. Single SSID does not require endpoints to be registered. 

C. Dual SSID allows BYOD for guest users. 

D. Single SSID utilizes open SSID to accommodate different types of users. 

E. Single SSID allows PEAP-MSCHAPv2 for native supplicant provisioning. 

View Answer

Q10. Which two switchport commands enable MAB and allow non-802.1X capable devices to immediately run through the MAB process? (Choose two.) 

A. authentication order mab dot1x 

B. authentication order dot1x mab 

C. no authentication timer 

D. dot1x timeout tx-period 

E. authentication open 

F. mab 

View Answer