Introducing The New!
Surepassexam Collection
Get Unlimited Access to all
Surepassexam's PREMIUM files
Q1. An administrator can leverage which attribute to assign privileges based on Microsoft Active Directory user groups?
A. member of
B. group
C. class
D. person
Answer: A
Q2. What is a required step when you deploy dynamic VLAN and ACL assignments?
A. Configure the VLAN assignment.
B. Configure the ACL assignment.
C. Configure Cisco IOS Software 802.1X authenticator authorization.
D. Configure the Cisco IOS Software switch for ACL assignment.
Answer: C
Q3. Which Cisco ISE feature can differentiate a corporate endpoint from a personal device?
A. EAP chaining
B. PAC files
C. authenticated in-band provisioning
D. machine authentication
Answer: A
Q4. Where is dynamic SGT classification configured?
A. Cisco ISE
B. NAD
C. supplicant
D. RADIUS proxy
Answer: A
Q5. Which effect does the ip http secure-server command have on a Cisco ISE?
A. It enables the HTTP server for users to connect on the command line.
B. It enables the HTTP server for users to connect by using web-based authentication.
C. It enables the HTTPS server for users to connect by using web-based authentication.
D. It enables the HTTPS server for users to connect on the command line.
Answer: C
Q6. A user is on a wired connection and the posture status is noncompliant.
Which state will their EPS session be placed in?
A. disconnected
B. limited
C. no access
D. quarantined
Answer: D
Q7. A network administrator must enable which protocol extension to utilize EAP-Chaining?
A. EAP-FAST
B. EAP-TLS
C. MSCHAPv2
D. PEAP
Answer: A
Q8. Which statement about Cisco ISE BYOD is true?
A. Dual SSID allows EAP-TLS only when connecting to the secured SSID.
B. Single SSID does not require endpoints to be registered.
C. Dual SSID allows BYOD for guest users.
D. Single SSID utilizes open SSID to accommodate different types of users.
E. Single SSID allows PEAP-MSCHAPv2 for native supplicant provisioning.
Answer: E
Q9. What is a required configuration step for an 802.1X capable switch to support dynamic
VLAN and ACL assignments?
A. Configure the VLAN assignment.
B. Configure the ACL assignment.
C. Configure 802.1X authenticator authorization.
D. Configure port security on the switch port.
Answer: C
Q10. What steps must you perform to deploy a CA-signed identity certificate on an ISE device?
A. 1. Download the CA server certificate and install it on ISE.
2. Generate a signing request and save it as a file.
3. Access the CA server and submit the CA request.
4. Install the issued certificate on the ISE.
B. 1. Download the CA server certificate and install it on ISE.
2. Generate a signing request and save it as a file.
3. Access the CA server and submit the CSR.
4. Install the issued certificate on the CA server.
C. 1. Generate a signing request and save it as a file.
2. Download the CA server certificate and install it on ISE.
3. Access the ISE server and submit the CA request.
4. Install the issued certificate on the CA server.
D. 1. Generate a signing request and save it as a file.
2. Download the CA server certificate and install it on ISE.
3. Access the CA server and submit the CSR.
4. Install the issued certificate on the ISE.
Answer: D
Q11. Which two options are EAP methods supported by Cisco ISE? (Choose two.)
A. EAP-FAST
B. EAP-TLS
C. EAP-MS-CHAPv2
D. EAP-GTC
Answer: A,B
Q12. In a split ACS deployment with primary and secondary servers, which three statements about AAA load handling are true? (Choose three.)
A. During normal operations, each server processes the full workload of both servers.
B. If a AAA connectivity problem occurs, the servers split the full load of authentication requests.
C. If a AAA connectivity problem occurs, each server processes the full workload of both servers.
D. During normal operations, the servers split the full load of authentication requests.
E. During normal operations, each server is used for specific operations, such as device administration and network admission.
F. The primary servers are used to distribute policy information to other servers in the enterprise.
Answer: C,D,E
Q13. Which two Cisco Catalyst switch interface commands allow only a single voice device and a single data device to be connected to the IEEE 802.1X-enabled interface? (Choose two.)
A. authentication host-mode single-host
B. authentication host-mode multi-domain
C. authentication host-mode multi-host
D. authentication host-mode multi-auth
Answer: A,B
Q14. Which configuration must you perform on a switch to deploy Cisco ISE in low-impact mode?
A. Configure an ingress port ACL on the switchport.
B. Configure DHCP snooping globally.
C. Configure IP-device tracking.
D. Configure BPDU filtering.
Answer: A
Q15. In a multi-node ISE deployment, backups are not working on the MnT node. Which ISE CLI option would help mitigate this issue?
A. repository
B. ftp-url
C. application-bundle
D. collector
Answer: A
Q16. Which three posture states can be used for authorization rules? (Choose three.)
A. unknown
B. known
C. noncompliant
D. quarantined
E. compliant
F. no access
G. limited
Answer: A,C,E
Q17. When you select Centralized Web Auth in the ISE Authorization Profile, which two components host the web authentication portal? (Choose two.)
A. ISE
B. the WLC
C. the access point
D. the switch
E. the endpoints
Answer: B,D