An organization wants to improve their BYOD processes to have Cisco ISE issue
certificates to the BYOD endpoints. Currently, they have an active certificate authority and do not want to replace it with Cisco ISE. What must be configured within Cisco ISE to accomplish this goal?

A.

Create a certificate signing request and have the root certificate authority sign it.

B.

Add the root certificate authority to the trust store and enable it for authentication.

C.

Create an SCEP profile to link Cisco ISE with the root certificate authority.

D.

Add an OCSP profile and configure the root certificate authority as secondary.

An administrator is configuring new probes to use with Cisco ISE and wants to use metadata to help profile the endpoints. The metadata must contain traffic information relating to the endpoints instead of industry-standard protocol information Which probe should be enabled to meet these requirements?

A.

NetFlow probe

B.

DNS probe

C.

DHCP probe

D.

SNMP query probe

A network engineers configuring the switch to accept downloadable ACLs from a Cisco ISC server Which two commands should be run to complete the configuration? (Choose two)

A.

aaa authorization auth-proxy default group radius

B.

radius server vsa sand authentication

C.

radius-server attribute 8 include-in-access-req

D.

ip device tracking

E.

dot1x system-auth-control

An engineer is implementing Cisco ISE and needs to configure 802.1X. The port settings are configured for port-based authentication. Which command should be used to complete this configuration?

A.

dot1x pae authenticator

B.

dot1x system-auth-control

C.

authentication port-control auto

D.

aaa authentication dot1x default group radius

An engineer is creating a new TACACS* command set and cannot use any show
commands after togging into the device with this command set authorization Which configuration is causing this issue?

A.

Question marks are not allowed as wildcards for command sets.

B.

The command set is allowing all commands that are not in the command list

C.

The wildcard command listed is in the wrong format

D.

The command set is working like an ACL and denying every command.

In a standalone Cisco ISE deployment, which two personas are configured on a node? (Choose two )

A.

publisher

B.

administration

C.

primary

D.

policy service

E.

subscriber

What is a function of client provisioning?

A.

Client provisioning ensures that endpoints receive the appropriate posture agents.

B.

Client provisioning checks a dictionary attribute with a value.

C.

Client provisioning ensures an application process is running on the endpoint.

D.

Client provisioning checks the existence, date, and versions of the file on a client.

When planning for the deployment of Cisco ISE, an organization's security policy dictates that they must use network access authentication via RADIUS. It also states that the deployment provide an adequate amount of security and visibility for the hosts on the network. Why should the engineer configure MAB in this situation?

A.

The Cisco switches only support MAB.

B.

MAB provides the strongest form of authentication available.

C.

The devices in the network do not have a supplicant.

D.

MAB provides user authentication.

An engineer is configuring Cisco ISE to reprofile endpoints based only on new requests of INIT-REBOOT and SELECTING message types. Which probe should be used to accomplish this task?

A.

MMAP

B.

DNS

C.

DHCP

D.

RADIUS

A policy is being created in order to provide device administration access to the switches on a network. There is a requirement to ensure that if the session is not actively being used, after 10 minutes, it will be disconnected. Which task must be configured in order to meet this requirement?

A.

session timeout

B.

idle time

C.

monitor

D.

set attribute as

A network administrator is setting up wireless guest access and has been unsuccessful in testing client access. The endpoint is able to connect to the SSID but is unable to grant access to the guest network through the guest portal. What must be done to identify the problem?

A.

Use context visibility to verify posture status.

B.

Use the endpoint ID to execute a session trace.

C.

Use the identity group to validate the authorization rules.

D.

Use traceroute to ensure connectivity.

A laptop was stolen and a network engineer added it to the block list endpoint identity group What must be done on a new Cisco ISE deployment to redirect the laptop and restrict access?

A.

Select DenyAccess within the authorization policy.

B.

Ensure that access to port 8443 is allowed within the ACL.

C.

Ensure that access to port 8444 is allowed within the ACL.

D.

Select DROP under If Auth fail within the authentication policy.