Question 1

Which portal is used to customize the settings for a user to log in and download the compliance module?

Accepted Answer

Client Provisioning is the portal used to customize settings for users to log in and download necessary modules, such as compliance modules.

Question 2

An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network. Which node should be used to accomplish this task?

Accepted Answer

The policy service node in Cisco ISE is responsible for handling the profiling service, which includes collecting attributes from endpoints using network probes.

Question 3

Which protocol must be allowed for a BYOD device to access the BYOD portal?

Accepted Answer

HTTPS is the only protocol that is allowed for a BYOD device to access the BYOD portal. This is because HTTPS is a secure protocol that encrypts data in transit, which helps to protect the privacy of the user's data.

Question 4

Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?

Accepted Answer

In Cisco ISE, an endpoint that does not match any profile is placed in the "unknown" identity group by default.

Question 5

What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?

Accepted Answer

The My Devices Portal allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow.

Question 6

Which use case validates a change of authorization?

Accepted Answer

A change in the endpoint profiling policy can affect the authorization policy, necessitating a re-evaluation of the endpoint's authorization status.

Question 7

Which profiling probe collects the user-agent string?

Accepted Answer

The HTTP profiling probe collects the user-agent string, which is part of the HTTP request headers sent by a web browser or client.

Question 8

Which two probes must be enabled for the ARP cache to function in the Cisco ISE profiling service so that a user can reliably bind the IP addresses and MAC addresses of endpoints? (Choose two.)

Accepted Answer

The answer of Which two probes must be enabled for...

Question 9

An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port. Which command should be used to accomplish this task?

Accepted Answer

The command "ip http port <port number>" is used to configure the switch to listen for HTTP traffic on a non-standard port, allowing redirection of web authentication traffic to the correct port.

Question 10

An engineer is configuring Cisco ISE to reprofile endpoints based only on new requests of INIT-REBOOT and SELECTING message types. Which probe should be used to accomplish this task?

Accepted Answer

The DHCP probe is used to reprofile endpoints based on DHCP messages, such as INIT-REBOOT and SELECTING, which are part of the DHCP process.

Question 11

What should be considered when configuring certificates for BYOD?

Accepted Answer

The answer of What should be considered when configuring certificates...

Question 12

Which two components are required for creating a Native Supplicant Profile within a BYOD flow? (Choose two.)

Accepted Answer

The answer of Which two components are required for creating...

Question 13

What service can be enabled on the Cisco ISE node to identify the types of devices connecting to a network?

Accepted Answer

Profiling is a service on Cisco ISE that identifies and classifies devices connecting to the network by collecting various attributes and using them to determine the device type.

Question 14

What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?

Accepted Answer

The Cisco-av-pair is used to send specific attributes, such as redirect ACLs, back to the Cisco Wireless LAN Controller (WLC) as part of the authorization process.

Question 15

If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

Accepted Answer

The Block list portal is used to prevent a device from accessing the network while providing information about why the device is blocked.

Question 16

A network engineer needs to ensure that the access credentials are not exposed during the 802.1X authentication among components. Which two protocols should be configured to accomplish this task? (Choose two.)

Accepted Answer

The answer of A network engineer needs to ensure that...

Question 17

During BYOD flow, where does a Microsoft Windows PC download the Network Setup Assistant?

Accepted Answer

The Network Setup Assistant is downloaded directly from Cisco Identity Services Engine (ISE) during the BYOD onboarding process.

Question 18

Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

Accepted Answer

The Cisco ISE Posture service checks the compliance of endpoints to ensure they meet security policies before allowing them to connect to the network.

Question 19

What is the minimum certainty factor when creating a profiler policy?

Accepted Answer

The minimum certainty factor is the threshold that a device's certainty factor must meet or exceed to be considered a member of the profile.

Question 20

Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)

Accepted Answer

The answer of Which two events trigger a CoA for...

Exam 24: Securing Email with Cisco Email Security Appliance (300-720 SESA)