What is the best Cisco CCNP Security 300-208 dumps exam? High quality Cisco CCNP Security 300-208 dumps exam practice questions and answers free download from lead4pass. The best useful Cisco CCNP Security 300-208 dumps pdf materials and vce youtube demo update free shared. “Implementing Cisco Secure Access Solutions” is the name of Cisco CCNP Security https://www.leads4pass.com/300-208.html exam dumps which covers all the knowledge points of the real Cisco CCNP Security. Latest Cisco CCNP Security 300-208 dumps pdf training resources and study guides free downlaod from lead4pass, pass Cisco 300-208 exam test easily at first try.
High quality Cisco 300-208 dumps pdf practice materials: https://drive.google.com/open?id=0B_7qiYkH83VRWWVtSWlTWENZMzA
High quality Cisco 300-209 dumps pdf practice materials: https://drive.google.com/open?id=0B_7qiYkH83VROWtCY2Nqc1Yta2c
Cisco CCNP Security 300-208 Dumps Exam Real Questions And Answers (1-30)
QUESTION 1
Which RADIUS attribute can be used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?
A. radius-server timeout
B. idle-timeout attribute
C. session-timeout attribute
D. termination-action attribute
Correct Answer: B
QUESTION 2
When you select Centralized Web Auth in the ISE Authorization Profile, which two components host the web authentication portal? (Choose two.)
A. ISE
B. the WLC
C. the access point
D. the switch
E. the endpoints
Correct Answer: BD
QUESTION 3
Which command defines administrator CLI access in ACS5.x?
A. Application reset-passwd acs username
B. username username password password role admin
C. username username password plain password role admin
D. password-policy
Correct Answer: C
QUESTION 4
What are two possible reasons why a scheduled nightly backup of ISE to a FTP repository would fail? (Choose two.)
A. ISE attempted to write the backup to an invalid path on the FTP server.
B. The ISE and FTP server clocks are out of sync.
C. The username and password for the FTP server are invalid.
D. The server key is invalid or misconfigured.
E. TCP port 69 is disabled on the FTP server.
Correct Answer: AC
QUESTION 5
Which model does Cisco support in a RADIUS change of authorization implementation?
A. push
B. pull
C. policy
D. security
Correct Answer: A
QUESTION 6
Which two conditions are valid when configuring ISE for posturing? 300-208 dumps (Choose two.)
A. Dictionary
B. member Of
C. Profile status
D. File
E. Service
Correct Answer: DE
QUESTION 7
In AAA, what function does authentication perform?
A. It identifies the actions that the user can perform on the device.
B. It identifies the user who is trying to access a device.
C. It identifies the actions that a user has previously taken.
D. It identifies what the user can access.
Correct Answer: B
QUESTION 8
A user is on a wired connection and the posture status is noncompliant. Which state will their EPS session be placed in?
A. disconnected
B. limited
C. no access
D. quarantined
Correct Answer: D
QUESTION 9
What are the initial steps must you perform to add the ISE to the WLC?
A. 1. With a Web browser, establish an HTTP connection to the WLC pod.
2. Navigate to Administration andgt; Authentication andgt; New.
3. Enter server values to begin the configuration.
B. 1. With a Web browser, establish an FTP connection to the WLC pod.
2. Navigate to Security andgt; Administration andgt; New.
3. Add additional security features for FTP authentication.
C. 1. With a Web browser, establish an HTTP connection to the WLC pod.
2. Navigate to Authentication andgt; New.
3. Enter ACLs and Authentication methods to begin the configuration.
D. 1. With a Web browser connect, establish an HTTPS connection to the WLC pod.
2. Navigate to Security andgt; Authentication andgt; New.
3. Enter server values to begin the configuration.
Correct Answer: D
QUESTION 10
Which remediation type ensures that Automatic Updates configuration is turned on Windows clients per security policy to remediate Windows clients for posture compliance?
A. AS Remediation
B. File Remediation
C. Launch Program Remediation
D. Windows Update Remediation
E. Windows Server Update Services Remediation
Correct Answer: D
QUESTION 11
You have configured a Cisco ISE 1.2 deployment for self-registration of guest users.
What two options can you select from to determine when the account duration timer begins? (Choose two.)
A. CreateTime
B. FirstLogin
C. BeginLogin
D. StartTime
Correct Answer: AB
QUESTION 12
Which type of access list is the most scalable that Cisco ISE can use to implement network authorization enforcement for a large number of users?
A. downloadable access lists
B. named access lists
C. VLAN access lists
D. MAC address access lists
Correct Answer: A
QUESTION 13
An organization has recently deployed ISE with Trustsec capable Cisco switches and would like to allow differentiated network access based on user groups. 300-208 dumps Which solution is most suitable for achieving these goals?
A. Cyber Threat Defense for user group control by leveraging Netflow exported from the Cisco switches and identity information from ISE
B. MACsec in Multiple-Host Mode in order to encrypt traffic at each hop of the network infrastructure
C. Identity-based ACLs preconfigured on the Cisco switches with user identities provided by ISE
D. Cisco Security Group Access Policies to control access based on SGTs assigned to different user groups
Correct Answer: D
QUESTION 14
Which two Cisco ISE administration options are available in the Default Posture Status setting? (Choose two.)
A. Unknown
B. Compliant
C. FailOpen
D. FailClose
E. Noncompliant
Correct Answer: BE
QUESTION 15
Which command would be used in order to maintain a single open connection between a network access device and a tacacs server?
A. tacacs-server host timeout
B. tacacs-server host single-connection
C. tacacs-server host andlt;ip addressandgt;
D. tacacs-server host andlt;ip addressandgt; single-connection
Correct Answer: D
QUESTION 16
Which statement about system time and NTP server configuration with Cisco ISE is true?
A. The system time and NTP server settings can be configured centrally on the Cisco ISE.
B. The system time can be configured centrally on the Cisco ISE, but NTP server settings must be configured individually on each ISE node.
C. NTP server settings can be configured centrally on the Cisco ISE, but the system time must be configured individually on each ISE node.
D. The system time and NTP server settings must be configured individually on each ISE node.
Correct Answer: D
QUESTION 17
Which valid external identity source can be used with Cisco ISE?
A. IPsec vpn authentication
B. smart card
C. local user name and password
D. TACACS+ token
Correct Answer: B
QUESTION 18
Changes were made to the ISE server while troubleshooting, and now all wireless certificate authentications are failing.
Logs indicate an EAP failure. What is the most likely cause of the problem?
A. EAP-TLS is not checked in the Allowed Protocols list
B. Certificate authentication profile is not configured in the Identity Store
C. MS-CHAPv2-is not checked in the Allowed Protocols list
D. Default rule denies all traffic
E. Client root certificate is not included in the Certificate Store
Correct Answer: A
QUESTION 19
Which functionality does the Cisco ISE self-provisioning flow provide?
A. It provides support for native supplicants, allowing users to connect devices directly to the network.
B. It provides the My Devices portal, allowing users to add devices to the network.
C. It provides support for users to install the Cisco NAC agent on enterprise devices.
D. It provides self-registration functionality to allow guest users to access the network.
Correct Answer: A
QUESTION 20
Which option is the code field of n EAP packet?
A. one byte and 1=request, 2=response 3=failure 4=success
B. two byte and 1=request, 2=response, 3=success, 4=failure
C. two byte and 1=request 2=response 3=failure 4=success
D. one byte and 1=request 2=response 3=success 4=failure
Correct Answer: D
QUESTION 21
In a basic ACS deployment consisting of two servers, for which three tasks is the primary server responsible? 300-208 dumps (Choose three.)
A. configuration
B. authentication
C. sensing
D. policy requirements
E. monitoring
F. repudiation
Correct Answer: ABD
QUESTION 22
During client provisioning on a Mac OS X system, the client system fails to renew its IP address. Which change can you make to the agent profile to correct the problem?
A. Enable the Agent IP Refresh feature.
B. Enable the Enable VLAN Detect Without UI feature.
C. Enable CRL checking.
D. Edit the Discovery Host parameter to use an IP address instead of an FQDN.
Correct Answer: A
QUESTION 23
A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group.
Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?
A. Authenticate guest users to Cisco ISE.
B. Keep track of guest user activities.
C. Create and manage guest user accounts.
D. Configure authorization setting for guest users.
Correct Answer: C
QUESTION 24
Which two profile attributes can be collected by a Cisco Wireless LAN Controller that supports Device Sensor? (Choose two.)
A. LLDP agent information
B. user agent
C. DHCP options
D. open ports
E. CDP agent information
F. FQDN
Correct Answer: BC
QUESTION 25
A security administrator wants to profile endpoints and gain visibility into attempted authentications. Which 802.1x mode allows these actions?
A. monitor mode
B. high-security mode
C. closed mode
D. low-impact mode
Correct Answer: A
QUESTION 26
Where is dynamic SGT classification configured?
A. Cisco ISE
B. NAD
C. supplicant
D. RADIUS proxy
Correct Answer: A
QUESTION 27
By default, how many days does Cisco ISE wait before it purges the expired guest accounts?
A. 1
B. 10
C. 15
D. 20
Correct Answer: C
QUESTION 28
Which command on the switch ensures that the Service-Type attribute is sent with all RADIUS authentication request?
A. radius-server attribute 8 include-in-access-req
B. radius-server attribute 25 access-request include
C. radius-server attribute 6 on-for-login-auth
D. radius-server attribute 31 send nas-port-detail
Correct Answer: C
QUESTION 29
A network administrator is seeing a posture status andquot;unknownandquot; for a single corporate machine on the Cisco ISE authentication report, whereas the other machines are reported as andquot;compliantandquot;. Which option is the reason for machine being reported as andquot;unknownandquot;?
A. Posture agent is not installed on the machine.
B. Posture policy does not support the OS.
C. Posfure compliance condition is missing on the machine.
D. Posture service is disabled on Cisco ISE.
Correct Answer: A
QUESTION 30
Cisco 802.1X phasing enables flexible deployments through the use of open, low-impact, and closed modes. 300-208 dumps What is a unique characteristic of the most secure mode?
A. Granular ACLs applied prior to authentication
B. Per user dACLs applied after successful authentication
C. Only EAPoL traffic allowed prior to authentication
D. Adjustable 802.1X timers to enable successful authentication
Correct Answer: C
What Our Customers Are Saying:
The best and most updated latest Cisco CCNP Security 300-208 dumps exam practice files in PDF format free download from lead4pass. Newest helpful Cisco CCNP Security https://www.leads4pass.com/300-208.html dumps pdf training resources which are the best for clearing 300-208 exam test, and to get certified by Cisco CCNP Security, free download with high pass rate.
Latest Cisco CCNP Security 300-208 dumps vce youtube: https://youtu.be/vUWwU0Ocw6s
Why Choose Lead4pass?
Lead4pass is the best provider of IT learning materials and the right choice for you to pass the exam. Other brands started earlier, but the questions are not the newest the price is relatively expensive. Lead4pass provide the latest real and cheapest questions and answers, help you pass the exam easily at first try.
