Question 1

An administrator must block access to BYOD endpoints that were onboarded without a certificate and have been reported as stolen in the Cisco ISE My Devices Portal. Which condition must be used when configuring an authorization policy that sets DenyAccess permission?

Options :

A : Endpoint Identity Group is Blocklist, and the BYOD state is Registered.

B : Endpoint Identify Group is Blocklist, and the BYOD state is Pending.

C : Endpoint Identity Group is Blocklist, and the BYOD state is Lost.

D : Endpoint Identity Group is Blocklist, and the BYOD state is Reinstate.

Answer: A

Question 2

When planning for the deployment of Cisco ISE, an organization's security policy dictates that they must use network access authentication via RADIUS. It also states that the deployment provide an adequate amount of security and visibility for the hosts on the network. Why should the engineer configure MAB in this situation?

Options :

A : The Cisco switches only support MAB.

B : MAB provides the strongest form of authentication available.

C : The devices in the network do not have a supplicant.

D : MAB provides user authentication.

Answer: C

Question 3

An engineer is configuring 802.1X and is testing out their policy sets. After authentication, some endpoints are given an access-reject message but are still allowed onto the network. What is causing this issue to occur?

Options :

A : The switch port is configured with authentication event server dead action authorize vlan.

B : The authorization results for the endpoints include a dACL allowing access.

C : The authorization results for the endpoints include the Trusted security group tag.

D : The switch port is configured with authentication open.

Answer: D

Question 4

Which command displays all 802 1X/MAB sessions that are active on the switch ports of a Cisco Catalyst switch?

Options :

A : show authentication sessions output

B : Show authentication sessions

C : show authentication sessions interface Gi 1/0/x

D : show authentication sessions interface Gi1/0/x output

Answer: B

Question 5

Which Cisco ISE service allows an engineer to check the compliance of endpoints before connecting to the network?

Options :

A : personas

B : qualys

C : nexpose

D : posture

Answer: D