QUESTION: 89

A network administrator is currently using Cisco ISE to authenticate devices and users via 802.1X. There is now a need to also authorize devices and users using EAP-TLS.
Which two additional components must be configured in Cisco ISE to accomplish this? (Choose two.)

Certificate Authentication Profile
EAP Authorization Profile
Network Device Group
Common Name attribute that maps to an identity store
Serial Number attribute that maps to a CA Server

Answer(s): A,B

Reveal Solution Next Question

QUESTION: 90

An engineer is configuring Cisco ISE policies to support MAB for devices that do not have 802.1X capabilities. The engineer is configuring new endpoint identity groups as conditions to be used in the AuthZ policies, but noticed that the endpoints are not hitting the correct policies.
What must be done in order to get the devices into the right policies?

Create an AuthZ policy to identify Unknown devices and provide partial network access prior to profiling.
Add an identity policy to dynamically add the IP address of the devices to their endpoint identity groups.
Identify the non 802.1X supported device types and create custom profiles for them to profile into.
Manually add the MAC addresses of the devices to endpoint ID groups in the context visibility database.

Answer(s): D

Reveal Solution Next Question

QUESTION: 91

During an 802.1X deployment, an engineer must identify failed authentications without causing problems for the connected endpoint.
Which command will successfully achieve this?

authentication open
dot1x pae authenticator
authentication port-control auto
dot1x system-auth-control

Answer(s): A

Reveal Solution Next Question

QUESTION: 92

An engineer is creating a new authorization policy to give the endpoints access to VLAN 310 upon successful authentication. The administrator tests the 802.1X authentication for the endpoint and sees that it is authenticating successful.
What must be done to ensure that the endpoint is placed into the correct VLAN?

Configure the switchport access vlan 310 command on the switch port.
Add VLAN 310 in the common tasks of the authorization profile.
Ensure that the endpoint is using the correct policy set.
Ensure that the security group is not preventing the endpoint from being in VLAN 310.

Answer(s): B

Reveal Solution Next Question

Free 300-715 Exam Braindumps (page: 24)

QUESTION: 89

QUESTION: 90

QUESTION: 91

QUESTION: 92

Exam Discussions & Posts