[Latest Updates] Cisco CCNP Security 300-208 Exam Practice Questions and answers,300-208 dumps free

February 21, 2019 admin Cisco

Latest updates Cisco CCNP Security Implementing Cisco Secure Access Solutions (SISAS v1.0) 300-208 exam questions and Answers! Free sharing 300-208 pdf online download, online exam Practice test, easy to improve skills! Get the full 300-208 exam dumps: https://www.leads4pass.com/300-208.html (Total questions:401 Q&A). Year-round updates! guarantee the first attempt to pass the exam!

[PDF] Free Cisco 300-208 pdf dumps download from Google Drive: https://drive.google.com/open?id=10UI01zhp-OfXwCrRSDaZxZDhIUZqQqrg

[PDF] Free Full Cisco pdf dumps download from Google Drive: https://drive.google.com/open?id=1CMo2G21nPLf7ZmI-3_hBpr4GDKRQWrGx

300-208 SISAS – Cisco: https://www.cisco.com/c/en/us/training-events/training-certifications/exams/current-list/specialist-sisas.html

Latest effective Cisco 300-208 Exam Practice Tests

QUESTION 1
Which profiling capability allows you to gather and forward network packets to an analyzer?
A. collector
B. spanner
C. retriever
D. aggregator
Correct Answer: A

QUESTION 2
Which option is the code field of n EAP packet?
A. one byte and 1=request, 2=response 3=failure 4=success
B. two byte and 1=request, 2=response, 3=success, 4=failure
C. two byte and 1=request 2=response 3=failure 4=success
D. one byte and 1=request 2=response 3=success 4=failure
Correct Answer: D

QUESTION 3
In the command \\’aaa authentication default group tacacs local\\’, how is the word \\’default\\’ defined?
A. Command set
B. Group name
C. Method list
D. Login type
Correct Answer: C

QUESTION 4
When configuring the Auto Update feature for Cisco IOS IPS, what is a recommended best practice?
A. Synchronize the router\\’s clock to the PC before configuring Auto Update.
B. Clear the router\\’s flash of unused signature files.
C. Enable anonymous TFTP downloads from Cisco.com and specify the download frequency.
D. Create the appropriate directory on the router\\’s flash memory to store the downloaded signature files.
E. Download the realm-cisco.pub.key file and update the public key stored on the router.
Correct Answer: A

QUESTION 5
When you select Centralized Web Auth in the ISE Authorization Profile, which component hosts the web authentication
portal?
A. the endpoints
B. the WLC
C. the access point
D. the switch
E. ISE
Correct Answer: E

QUESTION 6
Which two statements about Cisco NAC Agents that are installed on clients that interact with the Cisco ISE profiler are
true? (Choose two.)
A. They send endpoint data to AAA servers.
B. They collect endpoint attributes.
C. They interact with the posture service to enforce endpoint security policies.
D. They block access from the network through noncompliant endpoints.
E. They store endpoints in the Cisco ISE with their profiles.
F. They evaluate clients against posture policies, to enforce requirements.
Correct Answer: CF

QUESTION 7
Which redirect-URL is pushed by Cisco ISE for posture redirect for corporate users?
A. https://ise1.cisco.com:8443/portal/gateway?sessionId=0A00023D0000003A239F78CCandpo
rtal=283258a0-e96e-11e4-a30a-005056bf01c9andaction=cppandtoken=a1a6ea71ea8f410c2637e11ba534379e
300-208 Practice Test | 300-208 Exam Questions | 300-208 Braindumps 3 / 16https://www.leads4pass.com/300-208.html
2019 Latest leads4pass 300-208 PDF and VCE dumps Download
B. https://ise1.cisco.com:8443/portal/gateway?sessionId=0A00023D0000003A239F78CCandpo
rtal=283258a0-e96e-11e4-a30a-005056bf01c9andaction=cwaandtoken=a1a6ea71ea8f410c2637e11ba534379e
C. https://ise1.cisco.com:8443/portal/gateway?sessionId=0A00023D0000003A239F78CCandpo
rtal=283258a0-e96e-11e4-a30a-005056bf01c9andaction=mdmandtoken=a1a6ea71ea8f410c2637e11ba534379e
D. https://ise1.cisco.com:8443/portal/gateway?sessionId=0A00023D0000003A239F78CCandpo
rtal=283258a0-e96e-11e4-a30a-005056bf01c9andaction=drwandtoken=a1a6ea71ea8f410c2637e11ba534379e
Correct Answer: A

QUESTION 8
Which two answers are potential results of an attacker that is performing a DHCP server spoofing attack? (Choose two.)
A. ability to selectively change DHCP options fields of the current DHCP server, such as the giaddr field.
B. DoS
C. excessive number of DHCP discovery requests
D. ARP cache poisoning on the router
E. client unable to access network resources
Correct Answer: BE

QUESTION 9
Which two Cisco Catalyst switch interface commands allow only a single voice device and a single data device to be
connected to the IEEE 802.1X-enabled interface? (Choose two.)
A. authentication host-mode single-host
B. authentication host-mode multi-domain
C. authentication host-mode multi-host
D. authentication host-mode multi-auth
Correct Answer: AB

QUESTION 10
Which 802.1x command is needed for ACL to be applied on a switch port?
A. dot1x system-auth-control
B. dot1x pae authenticator
C. authentication port-control auto
D. radius-server vsa send authentication
E. aaa authorization network default group radius
Correct Answer: D

QUESTION 11
Which feature must you configure on a switch to allow it to redirect wired endpoints to Cisco ISE?
A. the http secure-server command
B. RADIUS Attribute 29
C. the RADIUS VSA for accounting
D. the RADIUS VSA for URL-REDIRECT
Correct Answer: A

QUESTION 12
Changes were made to the ISE server while troubleshooting, and now all wireless certificate authentications are failing.
Logs indicate an EAP failure. What are the two possible causes of the problem? (Choose two.)
A. EAP-TLS is not checked in the Allowed Protocols list
B. Client certificate is not included in the Trusted Certificate Store
C. MS-CHAPv2-is not checked in the Allowed Protocols list
D. Default rule denies all traffic
E. Certificate authentication profile is not configured in the Identity Store
Correct Answer: AE

QUESTION 13
A network administrator is seeing a posture status “unknown\\’ for a single corporate mac address but unknown
machines are reported as `complaint\\’. Which option is the reason for machine being reported `unknown\\’.
A. Posture service disabled on cisco ISE
B. Posture policy does not support the OS
C. Posture agent not installed on the machine
D. Posture compliance condition is missing on the machine
Correct Answer: C

QUESTION 14
Which type of SGT classification method is required when authentication is unavailable?
A. Bypass
B. Dynamic
C. Static
D. Inline
Correct Answer: C

QUESTION 15
When enabling the Cisco IOS IPS feature, which step should you perform to prevent rogue signature updates from
being installed on the router?
A. configure authentication and authorization for maintaining signature updates
B. install a known RSA public key that correlates to a private key used by Cisco
C. manually import signature updates from Cisco to a secure server, and then transfer files from the secure server to the
router
D. use the SDEE protocol for all signature updates from a known secure management station
Correct Answer: B

QUESTION 16
Which statement best describes inside policy based NAT?
A. Policy NAT rules are those that determine which addresses need to be translated per the enterprise security policy
B. Policy NAT consists of policy rules based on outside sources attempting to communicate with inside endpoints.
C. These rules use source addresses as the decision for translation policies.
D. These rules are sensitive to all communicating endpoints.
Correct Answer: A

QUESTION 17
What is the function of the SGACL policy matrix on a Cisco TrustSec domain with SGT Assignment?
A. It determines which access policy to apply to the endpoint.
B. It determines which switches are trusted within the TrustSec domain.
C. It determines the path the SGT of the packet takes when entering the Cisco TrustSec domain.
D. It lists all servers that are permitted to participate in the TrustSec domain.
E. It lists all hosts that are permitted to participate in the TrustSec domain.
Correct Answer: A

QUESTION 18
Which two authentication stores are supported to design a wireless network using PEAP EAP-MSCHAPv2 as the
authentication method? (Choose two.)
A. Microsoft Active Directory
B. ACS
C. LDAP
D. RSA Secure-ID
E. Certificate Server
Correct Answer: AB

QUESTION 19
Which three statement about Windows Server Update Services remediation are true?
A. WSUS can install the latest service pack available
B. WSUS checks for automatic update configuration on Windows
C. WSUS checks for client behavior anomalies
D. WSUS remediates Windows client from a locally manage WSUS server
E. WSUS remediates Windows client from a Microsoft manage WSUS server
F. WSUS provides links to update AV/AS
Correct Answer: ADE

QUESTION 20
Which statement about IOS accounting is true?
A. A named list of AAA methods must be defined.
B. A named list of accounting methods must be defined.
C. Authorization must be configured before accounting.
D. A named list of tracking methods must be defined.
Correct Answer: C

QUESTION 21
Which of these is a configurable Cisco IOS feature that triggers notifications if an attack attempts to exhaust critical
router resources and if preventative controls have been bypassed or are not working correctly?
A. Control Plane Protection
B. Management Plane Protection
C. CPU and memory thresholding
D. SNMPv3
Correct Answer: C

QUESTION 22
Which two simple posture conditions are valid?
A. Service
B. Antispyware
C. Firewall
D. File
E. Antivirus
Correct Answer: AD

QUESTION 23
Which feature must you configure on a switch to allow it to redirect wired endpoints to Cisco ISE?
A. the http secure-server command
B. RADIUS Attribute 29
C. the RADIUS VSA for accounting
D. the RADIUS VSA for URL-REDIRECT
Correct Answer: A

QUESTION 24
Security Group Access requires which three syslog messages to be sent to Cisco ISE? (Choose three.)
A. IOS-7-PROXY_DROP
B. AP-1-AUTH_PROXY_DOS_ATTACK
C. MKA-2-MACDROP
D. AUTHMGR-5-MACMOVE
E. ASA-6-CONNECT_BUILT
F. AP-1-AUTH_PROXY_FALLBACK_REQ
Correct Answer: BDF

QUESTION 25
Which three host modes support MACsec? (Choose three.)
A. multidomain authentication host mode
B. multihost mode
C. multi-MAC host mode
D. single-host mode
E. dual-host mode
F. multi-auth host mode
Correct Answer: ABD

QUESTION 26
When Cisco IOS IPS signatures are being tuned, how is the Target Value Rating assigned?
A. It is calculated from the Event Risk Rating.
B. It is calculated from a combination of the Attack Severity Rating and Signature Fidelity Rating
C. It is manually set by the administrator.
D. It is set based upon SEAP functions.
Correct Answer: C

QUESTION 27
Which two are best practices to implement profiling services in a distributed environment? (Choose two)
A. use of device sensor feature
B. configuration to send syslogs to the appropriate profiler node
C. netflow probes enabled on central nodes
D. node-specific probe configuration
E. global enablement of the profiler service
Correct Answer: BD

QUESTION 28
When RADIUS NAC and AAA Override are enabled for WLC on a Cisco ISE, which two statements about RADIUS NAC
are true? (Choose two.)
A. It will return an access-accept and send the redirection URL for all users.
B. It establishes secure connectivity between the RADIUS server and the ISE.
C. It allows the ISE to send a CoA request that indicates when the user is authenticated.
D. It is used for posture assessment, so the ISE changes the user profile based on posture result.
E. It allows multiple users to authenticate at the same time.
Correct Answer: CD

QUESTION 29
Cisco 802.1X phasing enables flexible deployments through the use of open, low-impact, and closed modes. What is a
unique characteristic of the most secure mode?
A. Granular ACLs applied prior to authentication
B. Per user dACLs applied after successful authentication
C. Only EAPoL traffic allowed prior to authentication
D. Adjustable 802.1X timers to enable successful authentication
Correct Answer: C

QUESTION 30
Which command can check a AAA server authentication for server group Group1, user cisco, and password cisco555
on a Cisco ASA device?
A. ASA# test aaa-server authentication Group1 username cisco password cisco555
B. ASA# test aaa-server authentication group Group1 username cisco password cisco555
C. ASA# aaa-server authorization Group1 username cisco password cisco555
D. ASA# aaa-server authentication Group1 roger cisco555
Correct Answer: A

QUESTION 31
A network security engineer is considering configuring 802.1x for security. He wants to use single host for data and
single host for voice. Which port authentication method he use?
A. Single host
B. Multi host
C. Multi auth
D. Multi-domain
Correct Answer: D

QUESTION 32
Which configuration is required in the Cisco ISE Authentication policy to allow Central Web Authentication?
A. Dot1x and if authentication failed continue
B. MAB and if user not found continue
C. MAB and if authentication failed continue D. Dot1x and if user not found continue
Correct Answer: B

QUESTION 33
Where would a Cisco ISE administrator define a named ACL to use in an authorization policy?
A. In the conditions of an authorization rule.
B. In the attributes of an authorization rule.
C. In the permissions of an authorization rule.
D. In an authorization profile associated with an authorization rule.
300-208 Practice Test | 300-208 Exam Questions | 300-208 Braindumps 11 / 16https://www.leads4pass.com/300-208.html
2019 Latest leads4pass 300-208 PDF and VCE dumps Download
Correct Answer: D

QUESTION 34
Which effect does the ip http secure-server command have on a Cisco ISE?
A. It enables the HTTP server for users to connect on the command line.
B. It enables the HTTP server for users to connect by using web-based authentication.
C. It enables the HTTPS server for users to connect by using web-based authentication.
D. It enables the HTTPS server for users to connect on the command line.
Correct Answer: C

QUESTION 35
What steps must you perform to deploy a CA-signed identify certificate on an ISE device?
A. 1. Download the CA server certificate.
2.
Generate a signing request and save it as a file.
3.
Access the CA server and submit the ISE request.
4.
Install the issued certificate on the ISE.
B. 1. Download the CA server certificate.
2.
Generate a signing request and save it as a file.
3.
Access the CA server and submit the ISE request.
4.
Install the issued certificate on the CA server.
C. 1. Generate a signing request and save it as a file.
2.
Download the CA server certificate.
3.
Access the ISE server and submit the CA request.
4.
Install the issued certificate on the CA server.
D. 1. Generate a signing request and save it as a file.
2.
Download the CA server certificate.
3.
Access the CA server and submit the ISE request.
4.
Install the issued certificate on the ISE.
Correct Answer: A

QUESTION 36
Which two are technologies that secure the control plane of the Cisco router? (Choose two.)
A. Cisco IOS Flexible Packet Matching
B. uRPF
C. routing protocol authentication
D. CPPr
E. BPDU protection
F. role-based access control
Correct Answer: CD

QUESTION 37
What is a required step when you deploy dynamic VLAN and ACL assignments?
A. Configure the VLAN assignment.
B. Configure the ACL assignment.
C. Configure Cisco IOS Software 802.1X authenticator authorization.
D. Configure the Cisco IOS Software switch for ACL assignment.
Correct Answer: C

QUESTION 38
A network administrator wants to use dynamic VLAN assignment from Cisco ISE. Which option must be configured on
the switch to support this?
A. AAA authentication
B. VTP
C. DTP
D. AAA authorization
Correct Answer: D

QUESTION 39
Which three features should be enabled as best practices for MAB? (Choose three.)
A. MD5
B. IP source guard
C. DHCP snooping
D. storm control
E. DAI
F. URPF
Correct Answer: BCE

QUESTION 40
What are two actions that can occur when an 802.1X-enabled port enters violation mode? (Choose two.)
A. The port is error disabled.
B. The port drops packets from any new device that sends traffic to the port.
C. The port generates a port resistance error.
D. The port attempts to repair the violation.
E. The port is placed in quarantine state.
F. The port is prevented from authenticating indefinitely.

We offer more ways to make it easier for everyone to learn, and YouTube is the best tool in the video.
Follow channels: https://www.youtube.com/channel/UCXg-xz6fddo6wo1Or9eHdIQ/videos get more useful exam content.

Latest Cisco 300-208 YouTube videos:

This is the latest update released by the Cisco CCNP Security Implementing Cisco Secure Access Solutions (SISAS v1.0) 300-208 exam questions and answers, and we share 40 exam questions and answers for free to help you improve your skills! You can download 300-208 pdf or watch the 300-208 YouTube video tutorial online! Get the full 300-208 exam dumps: https://www.leads4pass.com/300-208.html (Total questions:401 Q&A). Help you pass the exam quickly!

[PDF] Free Cisco 300-208 pdf dumps download from Google Drive: https://drive.google.com/open?id=10UI01zhp-OfXwCrRSDaZxZDhIUZqQqrg

[PDF] Free Full Cisco pdf dumps download from Google Drive: https://drive.google.com/open?id=1CMo2G21nPLf7ZmI-3_hBpr4GDKRQWrGx

leads4pass Promo Code 12% Off

We share more practical and effective exam dumps
(Cisco,Microsoft,Oracle,Citrix,Comptia…) The latest citrix 1y0-351 exam dumps help you improve your skills

300-208 dumps, 300-208 sisas, 300-208 sisas dumps, 300-208 sisas pdf