PrepAway - Latest Free Exam Questions & Answers

64 Comments on “Which AAA authentication method should be selected?”

  1. Ivo says:

    There seems to be no difference between 300-208v2 and this “new” version 3. It is still not valid for the exam. I wonder what the point of just changing the version number is?




    0



    0
  5. Pongo says:

    New questions :

    – Commands IOS permit in Tacacas configuration ISE 2.0 Refer to the exhibit..
    – ACL Redirect-CWA
    – ACL redidirect Remédition
    – What is l’URL of remediation
    – nb bits SGT
    – purge Radius if no stop session
    – ISE 1.3 portal CA feature
    – ISE 1.3 portal spnsor news feature
    – In the tool Dump where is the field hostname in the board resume dump
    – CAK MAC SECUR
    -New simulation whith 4 questions Authent/Author/Posture
    -….




    0



    0
  7. Venelopy says:

    Took the exam at 16.02.2016 here are all question that I can remeber

    1. How may bits there are in the SGT value field in TrustSEC Header?
    A: 16bits
    2. Refer to the exibit: Tacacs profile default access level 9 and maximum access 10
    http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo_TACACS_for_IOS.pdf
    3. Refer to the exibit: Tacacs commands set configuration
    http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200208-Configure-ISE-2-0-IOS-TACACS-Authentic.html
    http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo_TACACS_for_IOS.pdf
    4. BYOD with two SSIDs from the ISE GUI
    A: ?
    5. Which operating system has to have internet connection in order to download its supplicant.
    A: Android has to access the Appstore in order to download the NSA
    6. Refer to the exibit: EAP/PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate
    A: The client has to either trust the rootCA that signed the ISE certificate or uncheck the “validate server certificate”

    7. Which of the devices can accept environmental variables and use SGT tags for SGFW
    A: Cisco ASA
    8. redirect and dynamic asl configuration with different posture application server and ise server
    A:
    dynamic-ACL
    permit dhcp
    permit dns
    permit access to ISE
    permit access to Rem server
    deny all
    redirect-ACL
    deny dhcp
    deny dns
    deny access to ISE
    deny access to Rem server
    permit all
    9. What is the pushed url from the ISE to the switch?
    A:https://atw-cp-ise02.ise.local:8443/guestportal/gateway?sessionId=0A742B860000004E1047F6F4&action=cpp – the cpp is the important part
    10. What is CAK in MACSEC?
    A: connectivity association key (CAK) – key that secures control plane traffic
    secure association key (SAK) – randomly-generated key that secures data plane traffic
    https://www.juniper.net/documentation/en_US/junos14.1/topics/concept/macsec.html
    11. which operating system support nativly SPW?
    A:iOS
    http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Design_Guide/BYOD_ISE.html
    12. How is the default dynamic ACL configured in ISE
    A:?
    13. How to enable Tacacs on ISE?
    Enable Device Admin services
    http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200208-Configure-ISE-2-0-IOS-TACACS-Authentic.html#anc12
    14. What are the 2 modes that 802.1x can set a port after violation?
    A1: Shutdown—Errdisables the port; the default behavior on a port.
    A2: Restrict—The port state is unaffected. However the platform is notified to restrict the traffic from offending MAC-address.
    http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/50sg/configuration/guide/Wrapper-46SG/dot1x.html#wp1376150
    15. How many days after the guest account has experied the RADIUS server purges it?
    A: 15days
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_guest_pol.html#pgfId-1595622
    16. The Radius server purges sessions from active session after how many days?
    A: should be 7 days
    http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_mnt.html

    The MAB and ISE sumulations are the same




    0



    0
    2. pongo says:

      Hi,

      My questions that I can remeber.

      I await your return

      Thank

      1- What is the right-redirect ACL?

      Doc CISCO :
      ip access-list extended redirect
      deny udp any any eq domain
      deny ip any host 192.168.131.1
      permit tcp any any eq www
      permit tcp any any eq 443

      2- What is the « ACL-POSTURE-REDIRECT REMEDIATION » ?
      ISE 10.1.1.1 SRV remed 10.2.2.2.

      Doc CISCO :
      ip access-list extended ACL-POSTURE-REDIRECT
      deny udp any eq bootpc any eq bootps
      deny udp any any eq domain
      deny udp any host eq 8905
      deny tcp any host eq 8905
      deny tcp any host eq 8909
      deny udp any host eq 8909
      deny tcp any host eq 8443
      deny ip any host
      deny ip any host 192.230.240.8 (one of the ip of CLAMwin database virus Definitions)
      permit ip any any

      3- What is the URL remediation from CWA Authent(?) ?

      • https:// ip:8443/guestportal/gateway?sessionId=SessionIdValue@action=cppcisco:cisco-av-pair=url-redirect (802.1x-authent/NAC Agent)

      • https://ip:8443/guestportal/gateway?sessionId=SessionIdValue@action=cwa cisco:cisco-av-pair=url-redirect (web-Authent/Web Agent)

      • https://ip:8443/guestportal/gateway?sessionId=SessionIdValue@action=mdm cisco:cisco-av-pair=url-redirect

      4- Number of days before purge session radius with “start” but without “stop” de session ?
      • Sessions without RADIUS activity are automatically purged from Active Session list every 5 days or if the endpoint is deleted from the system.
       

      5- Default Radius logs ?
      Default 90 days Radius data purge ??

      6- IOS authorized commands with Tacacs on ISE 2.0?

      Configuration ISE TACACAS :
      Permit : ping .*
      Deny show r.*
      Permit s*h .*
      Deny_always ping

      What are possible commands?
      • Show run
      • Show clock
      • Ping 10.1.1.1
      • Sh interface ip …
      • Conf terminal

      7- what is the pre-requisites for activation TACACS ISE 2.0
      • Have a licence “Management Device”
      • Active the « service Device Admin »
      • Configure « Indentity Store »
      • Configure the switch NAD
      • …

      8- Nomber of bits field SGT ?
      – 16

      9- In which “Report Log” column is the value field “Host Name:” in the dialog box dump tool?
      • ISE NODE <
      • Server
      • Endpoint

      10- What is the default ACL applied by ISE?
      • All TCP
      • Management traffic
      • only admin to ISE
      • All IP <

      11- The presence of any command line takes it to the conf of a switch if a DACL is not sent?

      • aaa authorization network default group radius
      • …

      12- Command IOS for sent stat authentications to Radius ?
      • aaa accounting resource start-stop group (à verifier)
      • aaa authentication login default group

      13- Command IOS RADIUS for ignore the AUP ?
      ?
      14- Signification of CAK ?
      http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/deploy_guide_c17-663760.html

      15- What are the possibility from sponsor portal ISE 1.3 to the client?
      • Monthly
      • Delete
      • Rename guest
      • Daily
      • Weekly
      • Contractor (year).
      http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/sponsor_guide/b_spons_SponsorPortalUserGuide_13/b_spons_SponsorPortalUserGuide_13_chapter_00.html#concept_8EFC1F4B42CC47BFB5D7F072125CCD26

      16- What are the possibility from CA portal ISE 1.3 ?
      • Revoke <
      • unrevoke
      • import <
      • Delete <
      http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_01000.html#concept_8B6D9760C14344EC972B2DD81876328B
       

      17- What are the situations of port 802.1x with « Security-Violation » ?
      • Error disable
      • traffic from that MAC address is dropped.

      18- No-Authorized with profil-TACACAS 5 to 9 configured on ISE 2.0 ?
      • Show run
      • Conf t
      • Show interface
      • Show ip route
      • enable

      19- What which allows to convey the SGT value in a network?
      • ISE
      • switch
      • SGT Exchange Protocol
      • …

      20- Comment un BYOD peut mettre en œuvre un supplicant?
      • From native supplicant
      • on Cisco.com
      • Direct from ISE…

      21- What is the information from http PROBE ?
      • User name
      • http request
      • ip-frame
      • Mac user
      • User-Agent Network Resources. 2. Click Create.
      B. 1. Choose Network Resources > Network Devices and AAA Clients. 2. Click Create.
      C. 1. Choose Network Resources > Network Devices and AAA Clients. 2. Click Manage.
      D. 1. Choose Network Devices and AAA Clients > Network Resources. 2. Click Install.
      Answer: B

      26- What is the function of the SGACL policy matrix on a Cisco TrustSec domain with SGT Assignment?
      A. It determines which access policy to apply to the endpoint.
      B. It determines which switches are trusted within the TrustSec domain.
      C. It determines the path the SGT of the packet takes when entering the Cisco TrustSec domain. D. It lists all servers that are permitted to participate in the TrustSec domain.
      E. It lists all hosts that are permitted to participate in the TrustSec domain.
      Answer: A

      27- Simulations from DUMP : 171, 172, 173, 174 et 175

      28- Le LAB n°170 du DUMP

      29- Le LAB n°169 du DUMP

      A new simulation with 4 questions to be answered debug by connecting to the ISE but without access to the tab “Operations” …
      These 2 types of users “Sales” and “IT-Users” deployed from NAM.

      The questions relate to authentication problems, authorization and Profiling.




      0



      0
  9. Venelopy says:

    Hi Guys

    I got additional information on two of the question above. I have no idea what are the answer for both of them. I searched a lot but I wasnt able to find anything relevant. It would be great if someone knows the answer or find any guide documents on the topics:

    Please write me if you decide to look for the answer on the net and find it!
    —————————————————————————————–
    Q. How is the default dynamic ACL configured in ISE
    Permit UDP
    Permit All
    Permit TCP
    Permit only management
    Q. After what time will ISE purge authentication session without receiving RADIUS Accounting Stop message.
    1
    5
    10
    15
    ————————————————————————————–




    0



    0
  10. pongo says:

    Q. How is the default dynamic ACL configured in ISE

    All IP

    Q. After what time will ISE purge authentication session without receiving RADIUS Accounting Stop message.

    Sessions without RADIUS activity are automatically purged from Active Session list every 5 days or if the endpoint is deleted from the system.




    0



    0
  11. zozo says:

    !!!!!!!!!!!!Attention ExamCollection false advertising!!!!!

    The dump 300-208 211q is a fake !! on Website there are 211 question but after buy and download there are only 174, it’s a old dump.




    0



    0
  28. Krishna says:

    I took this exam recently and failed. This dump is not valid anymore. Around 20 to 30 new questions and a new simulation as well. Be prepare and prepare very well before you write, oterwise just reschedule. The official Certification guide for SISAS is a shit and clearly that alone will not help the candidate to get the pass score. I think cisco needs to release a new book for SISAS with all topic covered and a sigle point of reference. Otherwise the quetions asked in these exams are really broad and tough. Good luck.




    0



    0
  29. Giannis Papadopoulos says:

    I took this exam 2 days ago and i failed with score 779.
    Simulation & HOT Spots are valid but there are at least 20 new questions.
    A lot of them focused in BYOD. I will try to remember some questions and post them here.




    0



    0
  31. Giannis Papadopoulos says:

    Hi all,
    Here are some Questions that i can recall:

    1)What RADIUS attribute can be used to dynamically assign the Inactivity active timer for MAC users from the Cisco ISE?
    A. idle-timeout attribute
    B. session-timeout
    C. radius-server
    D. termination-action
    Answer: ?

    2)A malicious user gained network access by spoofing printer connections that were authorized using MAB on four different switch ports. What Cisco Catalyst switch security features will prevent further violations?[choose two]
    A. ip device tracking
    B. Private VLANs
    C. Port Security
    D. DHCP Snooping
    E. Dynamic ARP inspection
    F. 802.1AE MacSec
    Answer: ?

    3) Which tree statement about Windows Server Update Services remediation are true?
    A. WSUS can install the latest service pack available
    B. WSUS checks for automatic update configuration on the Windows Client
    C. WSUS checks for client behavioral anomalies
    D. WSUS remediates Windows client from a locally manage WSUS server
    E. WSUS remediates Windows client from a Microsoft manage WSUS server
    F. WSUS provides links to update AV/AS
    Answer: ?

    4) Which three EAP methods use tunnel to encapsulate EAP traffic? (Choose three).
    A. EAP-MD5
    B. EAP-FAST
    C. EAP-TTLS
    D. PEAP
    E. EAP-TLS
    Answer: B,D,E

    5) A security engineer has configured separate Policy Service and Admin Node. What will occur when the Admin Node is offline?
    A. AUP is shown at every login
    B. Maximum Failed login in enforced
    C. Change password becomes available
    D. Device Registration is allowed
    Answer: ?

    6) What are the 3 portal provided by PSN? (Choose three).
    A. Sponsor
    B. admin
    C. My devices
    D. Monitoring
    E. Guest
    F. Troubleshooting
    Answer: ?




    0



    0
  33. Big D says:

    Guys I took the exam in October and again in Nov and failed both times. The Sims are the same but lots of new questions. Anybody have an update study guide that has passed the exam?




    0



    0
  35. Mx12 says:

    I scored above 950.

    The exam is truly difficult.

    Some of the questions have been changed a little, so other responses are valid, not the one published in dumps.

    The exam focuses on asking you the new, added questions, about 50% of them were the new one, only about 50% the old from previous dumps.

    Not all questions are in the latest dump, I had about 10 new ones.

    Examples, differences:

    – accounting is not working, what could be the reason: single choice, ans.: misconfigured authorization (I beleive 😉 )

    – q275 from PL which two components are required for creating native supplicant profile – choose two – ans.: Operating System, Connection type – wired/wireless

    – q143 from PL – which component hosts the CWA portal – single choice – ans.: the ISE

    – shown radius configuration, what is true about it – single choice – ans.: the authentication and authorization send in one packet

    – Cisco Any Connect must be installed, what OSes are supported – choose two from: Windows, Android, two Linux distributions, Apple iOS, I think Windows, Apple iOS

    – a few others – just stay calm and analyze, eliminate, choose and go on

    – one or two questions where I didn’t understand what the author had in mind, so I chose intuitively

    !ALL! the questions where you have to analyze ISE configuration and answer which statement is true are modified in such way, that different answers are valid, not the one marked in dumps. So dont learn these ones by heart, you have to analyze thoroughly and choose different answers, ex: q208 from PL – not AD, but in my case AC

    !ALL! the questions where you have to analyze detail of live log have the same valid answers as in dumps

    Good luck!




    0



    0
  41. Jack says:

    NEW QUESTION 288
    An engineer must ensure that all client operating systems have the AnyConnect Agent for an upcoming posture implementation. Which two versions of OS does the AnyConnect posture agent support? (Choose two.)

    A. Google Android
    B. Ubuntu
    C. Apple Mac OS X
    D. Microsoft Windows
    E. Red Hat Enterprise Linux

    Answer: C D

    Cisco AnyConnect Secure Mobility Client supports the following operating systems for its contained modules:
    Supported Operating Systems VPN Client Network Access Manager Cloud Web Security VPN Posture (HostScan) ISE Posture DART Customer Experience Feedback

    Windows 7, 8, 8.1, & 10

    x86(32-bit) and x64(64-bit)
    Yes Yes Yes Yes Yes Yes

    Mac OS X 10.8, 10.9, 10.10, 10.11
    Yes No Yes Yes Yes Yes

    Linux Red Hat 6, 7 & Ubuntu 12.04 (LTS), and 14.04 (LTS) (64-bit only)
    Yes No No Yes No Yes Yes




    0



    0
  42. Jack says:

    QUESTION 289
    Which command would be used in order to maintain a single open connection between a network
    access device and a tacacs server?
    A.tacacs-server host timeout
    B.tacacs-server host single-connection
    C.tacacs-server host
    C.tacacs-server host single-connection
    Answer:
    D




    0



    0
  43. Jack says:

    must be

    QUESTION 289
    Which command would be used in order to maintain a single open connection between a network
    access device and a tacacs server?
    A.tacacs-server host timeout
    B.tacacs-server host single-connection
    C.tacacs-server host
    C.tacacs-server host single-connection
    Answer:
    D




    0



    0
  44. Jack says:

    QUESTION 289
    Which command would be used in order to maintain a single open connection between a network
    access device and a tacacs server?
    A.tacacs-server host timeout
    B.tacacs-server host single-connection
    C.tacacs-server host
    D.tacacs-server host “” single-connection
    Answer:
    D




    0



    0
  45. Dante says:

    NEW QUESTION 290
    Refer to the exhibit. Which authentication method is being used?
    Evaluating Identity Policy
    15006 Matched Default Rule
    15013 Selected Identity Store C LDAP_TESTE
    22043 Current Identity Store does not support the authentication method; Skipping it

    A. PEAP-MSCHAP
    B. EAP-GTC
    C. EAP-TLS
    D. PEAP-TLS

    Answer: C

    In this question the answer is C, but I found that the answer is A. PEAP-MSCHAP

    https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/119149-configure-ise-00.html

    https://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.0/user/guide/o.html




    0



    0

Leave a Reply