Guaranteed CCNP Security 300-208 practice test

New Questions 8

Which port does Cisco ISE use for native supplicant provisioning of a Windows machine?

A. TCP 8443

B. TCP/UDP 8905

C. TCP/UDP 8909

D. TCP 443

View Answer

New Questions 9

Which two profile attributes can be collected by a Cisco Catalyst Switch that supports Device Sensor? (Choose two.)

A. LLDP agent information

B. user agent

C. DHCP options

D. open ports

E. operating system

F. trunk ports

View Answer

New Questions 10

Which mechanism does Cisco ISE use to force a device off the network if it is reported lost or stolen?

A. CoA

B. dynamic ACLs

C. SGACL

D. certificate revocation

View Answer

New Questions 11

Which method does Cisco prefer to securely deploy guest wireless access in a BYOD implementation?

A. deploying a dedicated Wireless LAN Controller in a DMZ

B. configuring a guest SSID with WPA2 Enterprise authentication

C. configuring guest wireless users to obtain DHCP centrally from the corporate DHCP server

D. disabling guest SSID broadcasting

View Answer

New Questions 12

Which 2 options are functional components of the posture service?

A. Quarantined policy

B. Posture policy

C. Client provisioning

D. Network provisioning

View Answer

New Questions 13

When you configure an endpoint profiling policy rule, which option describes the purpose of the minimum certainty factor?

A. It is compared to the total certainty metric of an individual endpoint to determine whether the endpoint can be trusted.

B. It is compared to the assigned certainty value of an individual endpoint in a device database to determine whether the endpoint can be trusted.

C. It is used to compare the policy condition to other active policies.

D. It is used to determine the likelihood that an endpoint is an active, trusted device on the network.

View Answer

New Questions 14

You configured wired 802.1X with EAP-TLS on Windows machines. The ISE authentication detail report shows "EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain." What is the most likely cause of this error?

A. The ISE certificate store is missing a CA certificate.

B. The Wireless LAN Controller is missing a CA certificate.

C. The switch is missing a CA certificate.

D. The Windows Active Directory server is missing a CA certificate.

View Answer

New Questions 15

A network administrator needs to determine the ability of existing network devices to deliver key BYOD services. Which tool will complete a readiness assessment and outline hardware and software capable and incapable devices?

A. Prime Infrastructure

B. Network Control System

C. Cisco Security Manager

D. Identity Services Engine

View Answer

New Questions 16

Cisco 802.1X phasing enables flexible deployments through the use of open, low-impact, and closed modes. What is a unique characteristic of the most secure mode?

A. Granular ACLs applied prior to authentication

B. Per user dACLs applied after successful authentication

C. Only EAPoL traffic allowed prior to authentication

D. Adjustable 802.1X timers to enable successful authentication

View Answer

New Questions 17

You are configuring SGA on a network device that is unable to perform SGT tagging. How can the device propagate SGT information?

A. The device can use SXP to pass IP-address-to-SGT mappings to a TrustSec-capable hardware peer.

B. The device can use SXP to pass MAC-address-to-STG mappings to a TrustSec-capable hardware peer.

C. The device can use SXP to pass MAC-address-to-IP mappings to a TrustSec-capable hardware peer.

D. The device can propagate SGT information in an encapsulated security payload.

E. The device can use a GRE tunnel to pass the SGT information to a TrustSec-capable hardware peer.

View Answer