QUESTION: 61

An organization has a fully distributed Cisco ISE deployment.
When implementing probes, an administrator must scan for unknown endpoints to learn the IP-to
MAC address bindings. The scan is complete on one PSN, but the information is not available on the others.
What must be done to make the information available?

Cisco ISE must be configured to learn the IP-MAC binding of unknown endpoints via RADIUS authentication, not via scanning.
Cisco ISE must learn the IP-MAC binding of unknown endpoints via DHCP profiling, not via scanning.
Scanning must be initiated from the MnT node to centrally gather the information.
Scanning must be initiated from the PSN that last authenticated the endpoint.

Answer(s): D

Reference:

https://community.cisco.com/t5/security-documents/ise-profiling-design-guide/ta-p/3739456

Reveal Solution Next Question

QUESTION: 62

An administrator is configuring a switch port for use with 802.1X.
What must be done so that the port will allow voice and multiple data endpoints?

Connect a hub to the switch port to allow multiple devices access after authentication.
Configure the port with the authentication host-mode multi-auth command.
Connect the data devices to the port, then attach the phone behind them.
Use the command authentication host-mode multi-domain on the port.

Answer(s): B

Reference:

https://networklessons.com/cisco/ccie-routing-switching-written/mac-authentication-bypass-mab

Reveal Solution Next Question

QUESTION: 63

An administrator is troubleshooting an endpoint that is supposed to bypass 802.1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB, however the endpoint cannot communicate because it cannot obtain an IP address.
What is the problem?

The endpoint is using the wrong protocol to authenticate with Cisco ISE.
The 802.1X timeout period is too long.
The DHCP probe for Cisco ISE is not working as expected.
An ACL on the port is blocking HTTP traffic.

Answer(s): B

Reveal Solution Next Question

QUESTION: 64

A Cisco ISE administrator must restrict specific endpoints from accessing the network while in closed mode. The requirement is to have Cisco ISE centrally store the endpoints to restrict access from.
What must be done to accomplish this task?

Create a profiling policy for each endpoint with the cdpCacheDeviceId attribute.
Create a logical profile for each device's profile policy and block that via authorization policies.
Add each MAC address manually to a blocklist identity group and create a policy denying access.
Add each IP address to a policy denying access.

Answer(s): C

Reveal Solution Next Question

Free 300-715 Exam Braindumps (page: 16)

QUESTION: 61

Reference:

QUESTION: 62

Reference:

QUESTION: 63

QUESTION: 64