SkillTestPro | CCNP Security 300-715 SISE Practice Test 4

CCNP Security 300-715 SISE Practice Test 4 (Hard) - Native Active Directory and LDAP Identity Store Integration

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco ISE identity store integration allows ISE to join a Windows domain directly and use Kerberos for authenticating users and machines against the domain?

Native Active Directory integration (joining ISE directly to the AD domain)

Native LDAP integration with no domain join capability

A TACACS+-only identity source with no AD relationship

A RADIUS token server used exclusively for one-time passwords

A local internal identity store with no external directory involvement

A guest-only identity store with no domain awareness

2 / 10

Which protocol-level difference distinguishes native Active Directory integration from generic LDAP integration in Cisco ISE?

Native AD integration uses Kerberos and other AD-specific protocols for domain join and authentication, while generic LDAP integration only queries the directory using the LDAP protocol without a true domain join

Generic LDAP integration provides machine authentication capability that native AD integration lacks entirely, under normal operating conditions, which is rarely the correct choice, in accordance with common design practices

Generic LDAP integration always requires Kerberos while native AD integration never does

Native AD integration cannot query group membership while generic LDAP can

Native AD integration is only usable for TACACS+ device administration and never for network access

Native AD integration and generic LDAP integration are functionally identical with no protocol differences

3 / 10

Which Cisco ISE configuration object is used to define connection details (such as domain name and join credentials) for integrating with Active Directory?

A sponsor group object

A guest portal customization object

A client provisioning resource object, in accordance with common design practices

A RADIUS network device object

An Active Directory identity source (join point)

A TACACS+ shared secret object

4 / 10

Which requirement must generally be met for Cisco ISE to successfully join an Active Directory domain as a native AD identity source?

ISE needs valid domain join credentials with sufficient privileges and network connectivity (including correct DNS resolution) to the domain controllers

ISE must disable all RADIUS services before it can join any domain

ISE must be physically located in the exact same server rack as a domain controller

ISE must have all TACACS+ device administration features disabled before joining a domain

ISE must be configured with an identical IP address to a domain controller

ISE must use only IPv6 addressing exclusively, with any IPv4 addressing being strictly incompatible with the join process, though this is not generally recommended

5 / 10

Which capability does native Active Directory integration provide that pure LDAP integration typically does not, related to authenticating domain-joined computers themselves?

The ability to authenticate guest users with no AD account at all

Machine authentication using the computer's AD machine account and Kerberos

The ability to bypass all authentication entirely for any domain-joined computer

The ability to authenticate TACACS+ device administrators exclusively

The ability to provision digital certificates directly through LDAP queries

Machine authentication is equally well supported by both integration types with no difference

6 / 10

Which Cisco ISE feature allows authentication and authorization policies to reference specific Active Directory security groups when making access decisions?

Authorization policies can never reference any AD attribute or group under any circumstance

Retrieving and referencing AD group membership as a condition in authorization policy rules

AD group membership can only be referenced after manually re-typing every group name into a flat text file

AD group references require disabling native AD integration entirely and relying only on LDAP

AD group membership can only be used in TACACS+ command authorization, never in network access policy

AD group membership is only usable within the guest portal customization settings

7 / 10

Which troubleshooting step would be most appropriate first when Cisco ISE reports that it cannot authenticate users against a newly joined Active Directory domain?

Change the ISE node's hostname repeatedly until authentication happens to start working

Disable all authorization policies as the first troubleshooting step

Verify DNS resolution, time synchronization, and connectivity between ISE and the domain controllers, and confirm the join operation actually completed successfully

Immediately delete the entire ISE deployment and reinstall from scratch with no further diagnosis, which is rarely the correct choice, which is rarely the correct choice

Immediately contact only the switch vendor's support line with no ISE-side investigation

Assume the issue is unrelated to AD and only investigate TACACS+ configuration instead

8 / 10

Which time-related requirement is important for successful Kerberos-based authentication between Cisco ISE and Active Directory domain controllers?

ISE must use a completely different, unrelated authentication protocol whenever any clock drift is detected

ISE's clock must be set exactly one year ahead of the domain controllers at all times

Kerberos authentication requires all clocks to be manually adjusted by hand before every single authentication attempt, which is rarely the correct choice

ISE's system clock must be reasonably synchronized (typically via NTP) with the domain controllers, since Kerberos is sensitive to clock skew

Domain controllers must be configured with no time source at all for Kerberos to function

Time synchronization is completely irrelevant to Kerberos authentication

9 / 10

Which scenario illustrates an appropriate use of combining native Active Directory integration with a separate LDAP identity source in the same Cisco ISE deployment?

Using native AD integration solely to change the ISE administrative GUI's color theme

Using native AD integration exclusively for guest portal branding with no relationship to user authentication, based on standard platform behavior, which is not the standard approach

Using LDAP exclusively to define RADIUS dictionaries with no directory query involved

Using native AD integration for the primary corporate domain while also querying a separate LDAP-based directory (such as a partner or legacy directory) for a distinct set of users

Using LDAP exclusively to configure TACACS+ shared secrets with no directory query involved

Using native AD integration solely to configure network device IP addresses

10 / 10

Which combination of practices would provide the most reliable native Active Directory integration for a Cisco ISE deployment supporting both user and machine authentication?

Disabling DNS resolution entirely to simplify the AD integration process

Using a join account with no privileges at all and hoping the join succeeds anyway

Avoiding any use of AD group membership in policy even when appropriate

Ensuring accurate DNS and NTP configuration, using an appropriately privileged join account, validating the join status regularly, and referencing AD groups in policy where appropriate

Never validating join status after the initial join operation, regardless of the platform version in use

Ignoring DNS and NTP configuration entirely since Kerberos does not depend on either, which is inconsistent with expected behavior, based on standard platform behavior, which does not align with best practices

Your score is

The average score is 0%