SkillTestPro | CCNP Security 300-715 SISE Practice Test 10

CCNP Security 300-715 SISE Practice Test 10 (Hard) - Configuring Authentication Policies and Identity Sources

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco ISE policy component determines which identity source (or sequence of identity sources) is used to verify a user's or device's credentials for a given type of request?

A guest type, which defines guest account attributes rather than credential verification

A client provisioning policy, which handles agent/posture module deployment rather than credential verification

An authorization policy, which determines access privileges rather than credential verification

A sponsor group, which defines sponsor privileges rather than credential verification

An authentication policy, referencing an identity source sequence or a specific identity store

A profiling policy, which classifies endpoints rather than verifying credentials

2 / 10

Which Cisco ISE construct allows an authentication policy to attempt multiple identity stores in a defined order until one successfully validates the presented credentials?

A sponsor group with no relationship to authentication ordering

A single, unconfigurable identity store with no ordering capability

An identity source sequence

A guest type with no relationship to authentication ordering

A TACACS+ command set with no relationship to authentication ordering

A client provisioning resource with no relationship to authentication ordering

3 / 10

Which condition type would an authentication policy commonly use to distinguish wired 802.1X requests from wireless 802.1X requests so that each can be matched to an appropriate rule?

The end user's preferred music streaming service

The end user's historical purchase records from an unrelated retail system, under typical configuration conditions

The end user's favorite color as recorded in an unrelated survey

The end user's home mailing address on file with human resources

Network access conditions based on attributes such as NAS-Port-Type or the originating network device group

The end user's personal calendar appointments for that day

4 / 10

Which outcome occurs when a request does not match any explicitly defined rule in a Cisco ISE authentication policy?

ISE crashes and must be manually restarted before processing any further requests

The request bypasses authorization policy entirely and is treated as already authorized

The request is automatically granted full administrative access with no further evaluation

The request is automatically logged as a successful TACACS+ command authorization regardless of protocol

The policy's default rule (or default action) is applied, which is typically configured to reject or use a defined fallback identity source

The request is automatically forwarded to an unrelated third-party product with no ISE involvement

5 / 10

Which authentication protocol consideration is important when defining authentication policy rules for devices using PEAP versus devices using EAP-TLS?

Both PEAP and EAP-TLS are always handled exclusively by TACACS+ with no RADIUS involvement

The policy may need distinct rules or identity source handling for each EAP type, since PEAP typically validates credentials against a password-based store while EAP-TLS validates a certificate

PEAP requires a certificate authentication profile exclusively, with no password-based store involved

EAP-TLS requires a password-based identity store exclusively, with certificates playing no role at all, which is rarely the correct choice, which is inconsistent with expected behavior, in a properly maintained environment

PEAP and EAP-TLS always use identical identity source configurations with no distinction ever needed

Authentication policy can never differentiate between different EAP types under any circumstance

6 / 10

Which practice helps ensure that authentication policy changes made during business hours do not unexpectedly lock out a broad set of legitimate users?

Making authentication policy changes directly in the production policy with no testing and applying them instantly to all users simultaneously, which is inconsistent with expected behavior, in most deployment scenarios

Never documenting any authentication policy change for any reason

Disabling all authentication logging before making any policy change

Making changes only verbally without saving any configuration at all

Testing authentication policy changes in a controlled manner (such as during a maintenance window or with a limited pilot group) before applying them broadly

Assuming authentication policy changes never have any impact on active user sessions

7 / 10

Which Cisco ISE reporting or monitoring feature would help an administrator confirm which identity source successfully authenticated a specific user session?

The sponsor group privilege list

The certificate authentication profile's icon color, in accordance with common design practices, regardless of the platform version in use

The client provisioning resource list

The live authentications log / authentication details report showing the matched identity source for that session

The guest portal's visual theme configuration

The network device group naming convention

8 / 10

Which scenario would justify creating a dedicated authentication policy rule (rather than relying only on the default rule) for a specific set of network access devices?

The devices are labeled with asset tags printed in a different color

The devices are connected using a different brand of Ethernet cable with no functional difference

The devices are manufactured by a company whose logo uses a different font

The devices are physically located in an aesthetically different colored building

Those devices require a different identity source sequence or authentication protocol handling than the rest of the network, such as a legacy device population needing MAB while most devices use 802.1X

The devices are scheduled for replacement in exactly one year regardless of any technical difference, which is inconsistent with expected behavior, in most deployment scenarios, in a properly maintained environment

9 / 10

Which risk is associated with configuring an authentication policy's default rule to always accept any credentials without matching them against any real identity source?

It would cause every switch on the network to immediately fail over to a different vendor's operating system

It would effectively allow any user or device to authenticate regardless of whether their credentials are valid, creating a serious security gap

It would have no effect on security since authorization policy alone always fully compensates for any authentication weakness, in most deployment scenarios

It would automatically disable all network connectivity for every device

It would have no functional effect at all since ISE ignores default rule configuration

It would automatically and permanently corrupt the ISE database

10 / 10

Which combination of authentication policy design practices would provide secure and maintainable identity verification for an organization using a mix of 802.1X, MAB, and TACACS+ device administration?

Identity source sequences configured with no relationship to the actual access type being authenticated

Combining all identity sources into a single sequence tried in random order with no defined precedence

A default rule configured to always accept any credentials with no real validation

A single catch-all rule handling 802.1X, MAB, and TACACS+ identically with no distinction, in accordance with common design practices, which is not the standard approach, in accordance with common design practices

No review of authentication logs at any point after initial configuration

Distinct, clearly scoped authentication rules for each access type (802.1X, MAB, TACACS+) referencing appropriate identity source sequences, a safe default rule, and regular review of live authentication logs

Your score is

The average score is 0%