We provide real cisco 300 208 exam questions and answers braindumps in two formats. Download PDF & Practice Tests. Pass Cisco 300 208 dumps Exam quickly & easily. The 300 208 dumps PDF type is available for reading and printing. You can print more and practice many times. With the help of our Cisco ccnp security sisas 300 208 official cert guide pdf dumps pdf and vce product and material, you can easily pass the 300 208 sisas exam.
Q41. Refer to the exhibit.
You are configuring permissions for a new Cisco ISE standard authorization profile. If you configure the Tunnel-Private-Group-ID attribute as shown, what does the value 123 represent?
A. the VLAN ID
B. the VRF ID
C. the tunnel ID
D. the group ID
Q42. Which command in the My Devices Portal can restore a previously lost device to the network?
Q43. Which five portals are provided by PSN? (Choose five.)
C. my devices
E. client provisioning
G. monitoring and troubleshooting
Q44. During client provisioning on a Mac OS X system, the client system fails to renew its IP address. Which change can you make to the agent profile to correct the problem?
A. Enable the Agent IP Refresh feature.
B. Enable the Enable VLAN Detect Without UI feature.
C. Enable CRL checking.
D. Edit the Discovery Host parameter to use an IP address instead of an FQDN.
Q45. Which two components are required to connect to a WLAN network that is secured by EAP-TLS authentication? (Choose two.)
A. Kerberos authentication server
B. AAA/RADIUS server
D. CA server
Q46. ORRECT TEXT
The Secure-X company has started to tested the 802.1X authentication deployment using the Cisco Catalyst 3560-X layer 3 switch and the Cisco ISEvl2 appliance. Each employee desktop will be connected to the 802.1X enabled switch port and will use the Cisco AnyConnect NAM 802.1X supplicant to log in and connect to the network.
Your particular tasks in this simulation are to create a new identity source sequence named AD_internal which will first use the Microsoft Active Directory (AD1) then use the ISE Internal User database. Once the new identity source sequence has been configured, edit the existing DotlX authentication policy to use the new AD_internal identity source sequence.
The Microsoft Active Directory (AD1) identity store has already been successfully configured, you just need to reference it in your configuration.
In addition to the above, you are also tasked to edit the IT users authorization policy so IT users who successfully authenticated will get the permission of the existing IT_Corp authorization profile.
Perform this simulation by accessing the ISE GUI to perform the following tasks:
. Create a new identity source sequence named AD_internal to first use the Microsoft Active Directory (AD1) then use the ISE Internal User database
. Edit the existing Dot1X authentication policy to use the new AD_internal identity source sequence:
. If authentication failed-reject the access request
. If user is not found in AD-Drop the request without sending a response
. If process failed-Drop the request without sending a response
. Edit the IT users authorization policy so IT users who successfully authenticated will get the permission of the existing IT_Corp authorization profile.
To access the ISE GUI, click the ISE icon in the topology diagram. To verify your configurations, from the ISE GUI, you should also see the Authentication Succeeded event for the it1 user after you have successfully defined the DotlX authentication policy to use the Microsoft Active Directory first then use the ISE Internal User Database to authenticate the user. And in the Authentication Succeeded event, you should see the IT_Corp authorization profile being applied to the it1 user. If your configuration is not correct and ISE can't authenticate the user against the Microsoft Active Directory, you should see the Authentication Failed event instead for the it1 user.
Note: If you make a mistake in the Identity Source Sequence configuration, please delete the Identity Source Sequence then re-add a new one. The edit Identity Source Sequence function is not implemented in this simulation.
Answer: Review the explanation for full configuration and solution.
Q47. Which statement about Cisco Management Frame Protection is true?
A. It enables stations to remain in power-save mode, except at specified intervals to receive data from the access point.
B. It detects spoofed MAC addresses.
C. It identifies potential RF jamming attacks.
D. It protects against frame and device spoofing.
Q48. An administrator can leverage which attribute to assign privileges based on Microsoft Active Directory user groups?
A. member of
Q49. Which statement about IOS accounting is true?
A. A named list of AAA methods must be defined.
B. A named list of accounting methods must be defined.
C. Authorization must be configured before accounting.
D. A named list of tracking methods must be defined.
Q50. You configured wired 802.1X with EAP-TLS on Windows machines. The ISE authentication detail report shows "EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain." What is the most likely cause of this error?
A. The ISE certificate store is missing a CA certificate.
B. The Wireless LAN Controller is missing a CA certificate.
C. The switch is missing a CA certificate.
D. The Windows Active Directory server is missing a CA certificate.