SISAS 300-208 Practice Test

Question 1 / 55 - Mode : Exam
Where is the SGACL source and destination information specified? A. Permissions matrix B. MACsec C. ACL entry D. SGFW policy An administrator has configured the switch for 802.1X monitor mode. His configuration is shown in the output below. Which is true regarding the configuration? (Choose two) A. MAB is enabled on the interface B. Open access mode is being used C. Auto access mode is enabled D. 802.1X is preferred over MAB Without assigning excessive administrative privileges, which Cisco ISE admin group role should you assign to a user if they are only required to view alarms and run reports? A. Helpdesk Admin B. Identity Admin C. Monitoring Admin D. RBAC Admin What occurs when an EAPOL packet is detected on a MAB enabled port? A. WebAuth is used. B. 802.1X authentication is used. C. The port is disabled. D. The posture service is initiated. Which statement regarding the dual SSID design model is true when compared to the single SSID design model? A. Easiest to deploy and manage B. Does not work for guests C. Can use open SSID for provisioning D. Least common design Which solution is used to classify packets using device and user identity to provide enhanced access control capability? A. SGA B. CoA C. dACL D. QoS Which is an access issue not covered in the guest services? A. Lifetime of a guest account B. Customizable guest portals C. Sponsor account privileges D. Password hashing Which 802.1X host mode provides independent authentication of an IP phone and a computer, and only allows one MAC address per VLAN? A. Multiple host mode B. Multiple authentication mode C. MDA mode D. Single host mode Which Cisco ISE component is used to check the health of endpoints? A. QoS B. Posture service C. MAB D. Profiler service Which command is use to verify traffic redirection to a client provisioning portal on a switch? A. show authentication session interface B. \|b debug radius authentication \|p C. \|b show wccp \|p D. \|b show authentication interface \|p What information is not used in conjunction with Security Group information for SGFW enforcement? A. IP version B. Destination IP address C. Port numbers D. Protocol numbers Which posture service functional area automates NAC agent deployment? A. Posture policy B. Client provisioning C. 802.1X low-impact mode D. Authorization policy For what purposes do enterprises deploy the Cisco ISE profiler service? (Choose two) A. To allow characteristics of the physical endpoint security posture to be interrogated B. To create a learned inventory C. To determine the applicable endpoint identity group D. To provide customizable portals What features are available to the Rule-based Policy type versus the Simple Policy type for the ISE Authentication Policies? (Choose three) A. You can use different identity sources for different policies B. You can define one or more conditions using attributes from the ISE dictionary C. You can define conditions to allow ISE to dynamically choose protocols D. You can define allowed static protocols and identify rule sources Which two fields within LDAP connection settings need to be configured if authentication access is enabled in the Access field? (Choose two) A. Secure authentication B. Password C. Root CA D. Admin DN During a phased mode deployment of 802.1X, which deployment mode will be utilized first? A. Closed B. Single host mode C. Monitor D. Low impact What features describe EAP Chaining? (Choose two) A. Uses Identity-Type TLV as an optional third phase of the authentication B. Supports authentication of machine and user inside the same TLS outer tunnel C. Was first implemented in EAP-FASTv2 D. It is an IETF standard called TLV-TEAP What are the two steps required to validate the ISE certificate? (Choose two) A. Second, verify the server certificate B. Second, verify the server signature C. First, verify the server signature D. First, verify the server certificate When connecting an Active Directory, or AD source to Cisco ISE the connection does not automatically join the AD. What must you also do to complete the connection? A. Refresh the Active Directory configuration page B. Test the connection C. You must select the "Auto-join" checkbox D. Click the Join button Which AAA authentication feature specifies a set of MAC addresses that are allowed to skip authentication? A. Web authentication B. MAB C. 802.1X D. VPN authentication For Cisco switches, on which ports can MACsec be used? (Choose two) A. Switch-to-switch B. Downlink C. Trunk D. Router-to-switch What will an employee endpoint device have after successfully being provisioned? (Choose three) A. Wi-Fi profile B. Certificate C. Native supplicant D. WPA2 shared password Which is an optional set when configuring guest services? A. Assign users to sponsor B. Provision guest accounts C. Configure portal HTTPS ports D. Configure guest authorization What is the Cisco ISE profiler service capable of performing when CoA is not supported? A. Monitoring of endpoints B. Ascertaining the compliance state of connecting endpoints C. Changing the authorization policy assignment D. Enabling access for users without an 802.1X supplicant What option simplifies ACL management? A. dACLs B. VLANs C. Security Group Access Identify the features of the accounting service. (Choose three) A. It is used to identify a user or endpoint B. It gathers information for client billing and auditing C. It determines when a session terminates D. It tracks services used by users Which statement describes SGT tagging? A. Only statically assigns classifications B. Policy is applied via SGACL or SGFW C. It is propagated via offline tagging D. Classification assigned on outbound Which best describes a feature of the General user name policy? A. Use any letter B. Use any number C. Use email D. Allow special characters What event would you expect to see in the details for an EAP-TLS connection if the user authentication was successful on the ISE server? A. 5440 Endpoint started a new session B. 5200 Authentication succeeded C. 200 EAP-TLS Authentication successful D. 5400 Authenticated Which protocol can be used for accessing an X.500-based directory server? A. AD B. PKI C. OTP D. LDAP Which two statements are true when redirecting traffic to the client provisioning portal? (Choose two) A. Endpoint redirection to the client provisioning portal must solely be configured on the Cisco ISE. B. The redirect ACL configured on the switch is referenced by an authorization policy rule. C. A redirect ACL on the switch will typically deny basic services. D. The ACL name defined on the ISE must match the local ACL defined on the switch. While verifying the Authentication Failure Report on the Administration ISE node, you notice that there are authentication failure messages. In addition, the Cisco ISE node cannot authenticate with AD. What could have caused this issue? (Choose two) A. The authentication interval is not configured correctly on the switch. B. The DACL syntax configured in the Cisco ISE is incorrect. C. The password of the account used to join Cisco ISE to the AD domain has expired. D. After joining the Cisco ISE node to the AD domain, the account AD password was not changed. What is used to propagate SGT within the network? (Choose two) A. Inline tagging B. SGFW C. SGACL D. SXP Which RADIUS role are LAN switches and wireless LAN controllers considered? A. Authenticator B. TrustSec C. Supplicant D. Authentication server Select the features that apply to the TACACS protocol. (Choose two) A. It only protects the actual credentials B. It is primarily used for authenticating devices and users across a network access device C. It carries authentication and authorization results in one message D. It uses TCP instead of UDP Which three statements are true regarding MAB? (Choose three) A. The MAC address is sent in a RADIUS Access-Request message. B. It is commonly configured with network printers. C. It uses certificates in the authentication process. D. It uses EAP to authenticate users. E. It allows exemptions from 802.1X authentication. How many rules are applied as part of a default ISE authentication policy? A. One B. None C. Two D. Three Which of the following commands can be used to troubleshoot a RADIUS peering problem on Cisco ISE? A. debug radius authorization B. debug radius brief C. op auth debug D. debug dot1x What type of VLAN is assigned if the authentication server is unavailable? A. Critical VLAN B. Assigned VLAN C. Restricted VLAN D. Guest VLAN Which two statements are true regarding the client provisioning policy? (Choose two) A. It can redirect endpoints to a client provisioning portal. B. It maps resources to device types. C. It defines the compliance requirements. D. It is responsible for the automatic update of installed NAC agent software. E. It needs to be adjusted to reflect the Compliant, Noncompliant, and Unknown endpoint states. Which is not a policy function of the Cisco TrustSec architecture? A. Classify B. Enforce C. Transport D. Create What are some common potential profiler problems? (Choose three) A. Lack of support for CoA on NAD B. Mismatched ACL name for traffic redirection C. Missing MAC-to-IP address binding D. Mismatched settings of network probes and the ISE Within the authentications view of Cisco ISE, one of the record details state the following: - 24210 Looking up User in Internal Users IDStore-test-radius - 24242 Found User in Internal Users IDStore - 220040 Wrong password or invalid secret key What should be done to solve this issue? (Choose three) A. Ensure the authentication interval is correctly configured on the client machines. B. Ensure the NAD IP address is correctly configured. C. Ensure the RADIUS shared secret is correctly configured in the NAD. D. Ensure the client user credentials are correctly configured. E. Ensure the RADIUS shared secret is correctly configured in the Cisco ISE. You want to implement CoA with the Cisco ISE to provide the profiler service more control over endpoints. Which option will be used with a CoA if there are multiple active sessions on a single switch port? A. Reauth B. No CoA C. Network Scan (NMAP) Action D. Port Bounce What are the two separate, independent EAP procedures that can be used for authentication? (Choose two) A. Path B. User C. Machine D. Supplicant What needs to be done to authenticate Active Directory users with Cisco ISE? A. Configure a local source. B. Configure an identity source sequence. C. Configure an external source. D. Download the appropriate groups into the dictionary. What are the four components of an ISE Authorization Rule? (Choose four) A. Conditions B. Permissions C. Rule Name D. CoA E. Identity Group F. External Identity Source In which configuration setting is the sequence of identity sources configured? A. Advanced Search List Setting B. Authentication Policy C. Authentication Search List D. Certificate Based Authentication Which best describes the handling of SGT tags through the classification, transportation, and enforcement functions? A. Dynamic tagging uses VLAN to SGT B. SXP propagates IP addresses C. SGFW managed through devices D. SGT embedded in the ETYPE field You need to verify that an endpoint is using the latest profile. Which report should you run? A. Endpoint Profile Changes B. Registered Endpoints C. Profiled Endpoint Summary D. Top Authorizations by Endpoint What type of frame is sent by the supplicant during the initial stage of 802.1X message flow? A. EAPOL-Start frame B. EAPOL-logoff frame C. Negative Acknowledgement D. EAPOL-Encapsulated-ASF-Alert What tool is used for policy administration? A. ISE B. ESA C. NFP D. WSA Which two services can be carried out through Cisco ISE Guest Services Sponsor portal? (Choose two) A. Register a device B. Create guest accounts C. Modify guest accounts D. Policy configuration Which options are examples of statically assigned SGT classifications? (Choose two) A. IP host to SGT B. VLAN to SGT C. 802.1x D. Web Authentication E. MAC to SGT What is the default behavior if an Identity source cannot be accessed? A. Processing stops on this store and the internal ISE database is checked B. Treat it as if the user was not found and proceed to the next store in the sequence C. Sets the Authentication Status to "Server Unavailable" and removes the Server from the Identity source sequence D. Processing stops and it sets the Authentication Status to "Process Error"

Our Recommended Premium CCNA Training Resources

These are the best CCNA training resources online:

Click Here to get the Cisco CCNA Gold Bootcamp, the most comprehensive and highest rated CCNA course online with a 4.8 star rating from over 30,000 public reviews. I recommend this as your primary study source to learn all the topics on the exam.

And click here for a free trial of AlphaPrep premium practice tests when youre ready to test your knowledge. They have the largest question bank, with adaptive tests and advanced reporting which tells you exactly when you are ready to pass the real exam.

The SISAS 300-208 is for the Cisco Implementing Cisco Secure Access Solutions (SISAS) exam. You can use the practice test to check your knowledge and improve your understanding in preparation for the Cisco CCNP 300-208 SISAS certification exam.

The Cisco CCNP 300-208 SISAS practice exams include questions to test your knowledge of Cisco secure access components and architecture. The Cisco SISAS 300-208 exam objectives include Cisco identity management and secure access such as TACACS+, RADIUS, MAC Authentication Bypass (MAB) and Cisco Identity Services Engine (ISE), threat defense, troubleshooting, monitoring and reporting tools, threat defense architectures, and identity management architectures.

The Cisco CCNP Security SISAS 300-208 exam is one of the Cisco certifications on CCNP security. It validates your network security engineer skills such as understanding endpoint control solutions, network threat mitigation, manage network access security, and many more.

SISAS 300-208 Practice Test

Complete this form to get your score report

Our Recommended Premium CCNA Training Resources