Vivid 300-208 Braindumps 2021

NEW QUESTION 1
You have configured a Cisco ISE 1.2 deployment for self-registration of guest users. What two options can you select from to determine when the account duration timer begins? (Choose two.)

• A. CreateTime
• B. FirstLogin
• C. BeginLogin
• D. StartTime

Answer: AB

NEW QUESTION 2
When configuring NAT, which three protocols that are shown may have limitations or complications when using NAT? (Choose three.)

• A. Kerberos
• B. HTTPS
• C. NTP
• D. SIP
• E. FTP
• F. SQL

Answer: ADE

NEW QUESTION 3
When 802.1X is implemented, how do the client (supplicant) and authenticator communicate?

• A. RADIUS
• B. TACACS+
• C. MAB
• D. EAPOL

Answer: D

NEW QUESTION 4
Which 802.1X command ignores Access-Reject during EAP authentication?

• A. dot1x pae authenticator
• B. switchport mode access
• C. authentication port-control auto
• D. authentication open
• E. authentication host-mode multi-domain

Answer: D

NEW QUESTION 5
You have configured a Cisco ISE1.2 deployment for self registration of guest users. What two options can you select from to determine when the account duration timer begins(Choose two)?

• A. Createtime
• B. Firstlogin
• C. Approvaltime
• D. Custom
• E. Starttime

Answer: AB

NEW QUESTION 6
When RADIUS NAC and AAA Override are enabled for a WLC on a Cisco ISE, which two statements about RADIUS NAC are true? (Choose two.)

• A. It returns an access-accept and sends the redirection URL for all users.
• B. It establishes secure connectivity between the RADIUS server and the Cisco ISE.
• C. It allows the Cisco ISE to send a CoA request that indicates when the user is authenticated.
• D. It is used for posture assessment, so the Cisco ISE changes the user profile based on posture result.
• E. It allows multiple users to authenticate at the same time.

Answer: CD

NEW QUESTION 7
How long are sessions kept in the ISE Monitoring and Troubleshooting node If there is authentication but no accounting?

• A. 5 hours
• B. 5 days
• C. 1 hour
• D. 1 day

Answer: C

Explanation: https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide

NEW QUESTION 8
Security Group Access requires which three syslog messages to be sent to Cisco ISE? (Choose three.)

• A. IOS-7-PROXY_DROP
• B. AP-1-AUTH_PROXY_DOS_ATTACK
• C. MKA-2-MACDROP
• D. AUTHMGR-5-MACMOVE
• E. ASA-6-CONNECT_BUILT
• F. AP-1-AUTH_PROXY_FALLBACK_REQ

Answer: BDF

NEW QUESTION 9
By default, how many days does Cisco ISE wait before it purges the expired guest accounts?

• A. 1
• B. 10
• C. 15
• D. 20

Answer: C

NEW QUESTION 10
You are troubleshooting wired 802.1X authentications and see the following error: "Authentication failed: 22040 Wrong password or invalid shared secret." What should you inspect to determine the problem?

• A. RADIUS shared secret
• B. Active Directory shared secret
• C. Identity source sequence
• D. TACACS+ shared secret
• E. Certificate authentication profile

Answer: A

NEW QUESTION 11
Refer to the exhibit.

The links outside the TrustSec area in the given SGA architecture are unprotected. On which two links does EAC take place? (Choose two.)

• A. between switch 2 and switch 3
• B. between switch 5 and host 2
• C. between host 1 and switch 1
• D. between the authentication server and switch 4
• E. between switch 1 and switch 2
• F. between switch 1 and switch 5

Answer: AB

NEW QUESTION 12
Where would a Cisco ISE administrator define a named ACL to use in an authorization policy?

• A. In the conditions of an authorization rule.
• B. In the attributes of an authorization rule.
• C. In the permissions of an authorization rule.
• D. In an authorization profile associated with an authorization rule.

Answer: D

NEW QUESTION 13
If an endpoint is marked noncompliant during that download, a CoA is sent and the device is forced to reauthenticate, providing a different result (such as quarantine).

• A. quarantine
• B. exit
• C. default
• D. end

Answer: A

NEW QUESTION 14
Which three components comprise the Cisco ISE profiler? (Choose three.)

• A. the sensor, which contains one or more probes
• B. the probe manager
• C. a monitoring tool that connects to the Cisco ISE
• D. the trigger, which activates ACLs
• E. an analyzer, which uses configured policies to evaluate endpoints
• F. a remitter tool, which fails over to redundant profilers

Answer: ABE

NEW QUESTION 15
Which two are best practices to implement profiling services in a distributed environment? (Choose two)

• A. use of device sensor feature
• B. configuration to send syslogs to the appropriate profiler node
• C. netflow probes enabled on central nodes
• D. node-specific probe configuration
• E. global enablement of the profiler service

Answer: BD

Explanation: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_prof_pol.html#wp1340515
You can deploy the Cisco ISE profiler service either in a standalone environment (on a single node), or in a distributed environment (on multiple nodes).
Depending on the type of your deployment and the license you have installed, the profiler service of Cisco ISE can run on a single node or on multiple nodes.
You need to install either the base license to take advantage of the basic services or the advanced license to take advantage of all the services of Cisco ISE.
The ISE distributed deployment includes support for the following:
• The Deployment Nodes page supports the infrastructure for the distributed nodes in the distributed deployment.
• A node specific configuration of probes—The Probe Config page allows you to configure the probe per node.
• Global Implementation of the profiler Change of Authorization (CoA).
• Configuration to allow syslogs to be sent to the appropriate profiler node.

NEW QUESTION 16
Which statement about IOS accounting is true?

• A. A named list of AAA methods must be defined.
• B. A named list of accounting methods must be defined.
• C. Authorization must be configured before accounting.
• D. A named list of tracking methods must be defined.

Answer: C

NEW QUESTION 17
Which 2 options are functional components of the posture service?

• A. Quarantined policy
• B. Posture policy
• C. Client provisioning
• D. Network provisioning

Answer: BC

NEW QUESTION 18
Which two options are EAP methods supported by Cisco ISE? (Choose two.)

• A. EAP-FAST
• B. EAP-TLS
• C. EAP-MS-CHAPv2
• D. EAP-GTC

Answer: AB

NEW QUESTION 19
A security engineer has configured a switch port in x closed mode. Which protocol is allowed to pass?

• A. HTTP
• B. EAPOL
• C. Bootps
• D. ARP
• E. PXE

Answer: B