Q3. Which type of access list is the most scalable that Cisco ISE can use to implement network authorization enforcement for a large number of users?

A. downloadable access lists

B. named access lists

C. VLAN access lists

D. MAC address access lists

View Answer

Q4. A network administrator must enable which protocol to utilize EAP-Chaining?

A. EAP-FAST

B. EAP-TLS

C. MSCHAPv2

D. PEAP

View Answer

Q5. Which option describes the purpose of configuring Native Supplicant Profile on the Cisco ISE?

A. It helps employees add and manage new devices by entering the MAC address for the device.

B. It is used to register personal devices on the network.

C. It enforces the use of MSCHAPv2 or EAP-TLS for 802.1X authentication.

D. It provides posture assessments and remediation for devices that are attempting to gain access to the corporate network.

View Answer

Q6. An engineer of Company A wants to know what kind of devices are connecting to the network. Which service can be enabled on the Cisco ISE node?

A. central web authentication

B. posture

C. MAB

D. profiling

View Answer

Q7. What two values does Cisco recommend you adjust and test to set the optimal timeout value for your networku2021s

specific 802.1X MAB deployment?

A. Max-reath-req

B. Supp-timeout

C. Max-req

D. Tx-period

E. Server-timeout

View Answer

Q8. An engineer must limit the configuration parameters that can be executed on the Cisco ASAs deployed throughout the network. Which command allows the engineer to complete this task?

A. AAA-server tacacs1(inside) host 10.5.109.18

$3cr37 timeout2

!

aaa authorization command tacacs1

B. AAA-server tacacs1(inside) host 10.5.109.18

$3cr37 timeout2

!

aaa authentication ssh console tacacs1

C. AAA-server tacacs1(inside) host 10.5.109.18

$3cr37 timeout2

!

aaa authorization exec authentication-server

D. AAA-server tacacs1(inside) host 10.5.109.18

$3cr37 timeout2

!

aaa authentication exclude ssh

View Answer

Q9. Which devices support download of environmental data and IP from Cisco ISE to SGT bindings in their SGFW implementation?

A. Cisco ASA devices

B. Cisco ISR G2 and later devices with ZBFW

C. Cisco ISR G3 devices with ZBFW

D. Cisco ASR devices with ZBFW

View Answer

Q10. From which location can you run reports on endpoint profiling?

A. Reports > Operations > Catalog > Endpoint

B. Operations > Reports > Catalog > Endpoint

C. Operations > Catalog > Reports > Endpoint

D. Operations > Catalog > Endpoint

View Answer

Q11. Which two options are valid for configuring IEEE 802.1AE MACSec between switches in a TrustSec network? (Choose two.)

A. manually on links between supported switches

B. in the Cisco Identity Services Engine

C. in the global configuration of a TrustSec non-seed switch

D. dynamically on links between supported switches

E. in the Cisco Secure Access Control System

F. in the global configuration of a TrustSec seed switch

View Answer

Q12. When using CA for identity source, which method can be used to provide real-time certificate validation?

A. X.509

B. PKI

C. OCSP

D. CRL

View Answer