An engineer is configuring a new Cisco ISE node. Context-sensitive information must be shared between the Cisco ISE and a Cisco ASA. Which persona must be enabled?
Answer(s): A
To share context-sensitive information, such as user identity, device posture, or Security Group Tags (SGTs), between Cisco ISE and a Cisco ASA, the pxGrid (Platform Exchange Grid) persona must be enabled. pxGrid allows Cisco ISE to exchange contextual data with external systems, including Cisco ASA, enabling the enforcement of dynamic security policies.Use Case:Cisco ASA can use pxGrid to retrieve real-time context from Cisco ISE, such as user identities or device compliance posture, to apply granular security rules and ensure proper network segmentation.pxGrid also facilitates seamless integration for dynamic policy enforcement based on context, such as threat intelligence or user roles.
DRAG DROP (Drag and Drop is not supported)A security engineer configures a Cisco Catalyst switch to use Cisco TrustSec. The engineer must define the PAC key to authenticate the switch to Cisco ISE. Drag and drop the commands from the left into sequence on the right. Not all options are used.Select and Place:
An engineer must use Cisco ISE to provide network access to endpoints that cannot support 802.1X. The endpoint MAC addresses must be allowlisted by configuring an endpoint identity group. These configurations were performed:configured an identity group named allowlistconfigured the endpoints to use the MAC address of incompatible 802.1X devices added the endpoints to the allowlist identity groupconfigured an authentication policy for MAB users What must be configured?
Answer(s): C
Since the endpoints cannot support 802.1X, they must be authenticated using MAC Authentication Bypass (MAB). The authentication policy has already been configured for MAB users, meaning ISE will attempt to authenticate based on the MAC address. However, to grant network access to these devices, an authorization policy is required.Authorization Policy determines what level of access should be granted after authentication. The policy must match devices in the allowlist identity group and apply the PermitAccess permission, allowing them onto the network.
Wireless network users authenticate to Cisco ISE using 802.1X through a Cisco Catalyst switch. An engineer must create an updated configuration to assign a security group tag to the user’s traffic using inline tagging to pr server. The configurations were performed:configured the switch as a RADIUS device in Cisco ISEconfigured the wireless LAN controller as a TrustSec device in Cisco ISE created a security group tag for the wireless userscreated a certificate authentication profile created an identity source sequenceassigned an appropriate security group tag to the wireless users defined security group access control lists to specify an egress policyenforced the access control lists on the TrustSec policy matrix in Cisco ISE configured TrustSec on the switchconfigured TrustSec on the wireless LAN controllerWhich two actions must be taken to complete the configuration? (Choose two.)
Answer(s): A,B
In this TrustSec deployment scenario, the objective is to ensure that wireless network users are tagged with a security group tag (SGT) and that their traffic is properly marked using inline tagging. This allows Cisco ISE to enforce policies - such as preventing unauthenticated users from accessing a restricted server.The configurations already performed include setting up Cisco ISE as the TrustSec AAA server, configuring TrustSec on both the Catalyst switch and the wireless LAN controller (WLC), and creating the necessary SGT and policies for wireless users.Two additional actions are required:1. Static IP-to-SGT Mapping for the Restricted Web Server (Option A):The restricted server is likely a non-authenticating endpoint. To enforce security policies (for example, denying access to unauthenticated users), Cisco ISE must be aware of the server’s SGT. This is achieved by creating a static mapping of the server's IP address to an SGT. With this static mapping in place, the network devices can tag traffic originating from or destined for the server with the appropriate SGT, ensuring that the policy enforced by the TrustSec policy matrix is correctly applied.2. Inline Tag Propagation on the Switch and Wireless LAN Controller (Option B):Inline tagging is required to propagate the SGT in the data traffic. Although TrustSec has been configured on the switch and WLC, explicit configuration of inline tag propagation ensures that the SGT assigned by ISE is inserted into the packets as they traverse the network. This tagging is crucial for the downstream enforcement of security policies based on SGTs.
An administrator is responsible for configuring network access for a temporary network printer. The administrator must only use the printer MAC address 50:40:16:89:0:AB for authentication. Which authentication method will accomplish the task?
MAC Authentication Bypass (MAB) is the authentication method that uses the MAC address of a device (such as a printer) to grant network access when 802.1X is not supported. The administrator can configure ISE to authenticate the printer using its MAC address.
Post your Comments and Discuss Cisco 300-715 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 300-715 content, but please register or login to continue.