Which AAA authentication method should be selected?

A network administrator needs to implement a service that enables granular control of IOS
commands that can be executed. Which AAA authentication method should be selected?

A network administrator needs to implement a service that enables granular control of IOS
commands that can be executed. Which AAA authentication method should be selected?

A.
TACACS+

B.
RADIUS

C.
Windows Active Directory

D.
Generic LDAP



Leave a Reply 68

Your email address will not be published. Required fields are marked *


Ivo

Ivo

There seems to be no difference between 300-208v2 and this “new” version 3. It is still not valid for the exam. I wonder what the point of just changing the version number is?

papero23

papero23

No difference between 300-208v2 and 300-208v3.And both are out of date.

Pongo

Pongo

V2 / V3 it’s the same, why?

fadmour

fadmour

please update the questions also not only the version.
please anyone have passleader 194q share it.
or send it by email : [email protected]

Pongo

Pongo

Passleader 194q is’t not up-to-date too….

fadmour

fadmour

updated the last 12th January 2016
i though it’s valid !!!

pongo

pongo

No this is false , valid at 70 % no more

Pongo

Pongo

New questions :

– Commands IOS permit in Tacacas configuration ISE 2.0 Refer to the exhibit..
– ACL Redirect-CWA
– ACL redidirect Remédition
– What is l’URL of remediation
– nb bits SGT
– purge Radius if no stop session
– ISE 1.3 portal CA feature
– ISE 1.3 portal spnsor news feature
– In the tool Dump where is the field hostname in the board resume dump
– CAK MAC SECUR
-New simulation whith 4 questions Authent/Author/Posture
-….

Wil

Wil

could you tell us more details about the test?

Wil

Wil

the sims are same (MAB and ISE) ?

Venelopy

Venelopy

Took the exam at 16.02.2016 here are all question that I can remeber

1. How may bits there are in the SGT value field in TrustSEC Header?
A: 16bits
2. Refer to the exibit: Tacacs profile default access level 9 and maximum access 10
http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo_TACACS_for_IOS.pdf
3. Refer to the exibit: Tacacs commands set configuration
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200208-Configure-ISE-2-0-IOS-TACACS-Authentic.html
http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo_TACACS_for_IOS.pdf
4. BYOD with two SSIDs from the ISE GUI
A: ?
5. Which operating system has to have internet connection in order to download its supplicant.
A: Android has to access the Appstore in order to download the NSA
6. Refer to the exibit: EAP/PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate
A: The client has to either trust the rootCA that signed the ISE certificate or uncheck the “validate server certificate”

7. Which of the devices can accept environmental variables and use SGT tags for SGFW
A: Cisco ASA
8. redirect and dynamic asl configuration with different posture application server and ise server
A:
dynamic-ACL
permit dhcp
permit dns
permit access to ISE
permit access to Rem server
deny all
redirect-ACL
deny dhcp
deny dns
deny access to ISE
deny access to Rem server
permit all
9. What is the pushed url from the ISE to the switch?
A:https://atw-cp-ise02.ise.local:8443/guestportal/gateway?sessionId=0A742B860000004E1047F6F4&action=cpp – the cpp is the important part
10. What is CAK in MACSEC?
A: connectivity association key (CAK) – key that secures control plane traffic
secure association key (SAK) – randomly-generated key that secures data plane traffic
https://www.juniper.net/documentation/en_US/junos14.1/topics/concept/macsec.html
11. which operating system support nativly SPW?
A:iOS
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Design_Guide/BYOD_ISE.html
12. How is the default dynamic ACL configured in ISE
A:?
13. How to enable Tacacs on ISE?
Enable Device Admin services
http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200208-Configure-ISE-2-0-IOS-TACACS-Authentic.html#anc12
14. What are the 2 modes that 802.1x can set a port after violation?
A1: Shutdown—Errdisables the port; the default behavior on a port.
A2: Restrict—The port state is unaffected. However the platform is notified to restrict the traffic from offending MAC-address.
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/50sg/configuration/guide/Wrapper-46SG/dot1x.html#wp1376150
15. How many days after the guest account has experied the RADIUS server purges it?
A: 15days
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_guest_pol.html#pgfId-1595622
16. The Radius server purges sessions from active session after how many days?
A: should be 7 days
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_mnt.html

The MAB and ISE sumulations are the same

fadmour

fadmour

did you fail or pass ?
how many question from the dumps?

pongo

pongo

Hi,

My questions that I can remeber.

I await your return

Thank

1- What is the right-redirect ACL?

Doc CISCO :
ip access-list extended redirect
deny udp any any eq domain
deny ip any host 192.168.131.1
permit tcp any any eq www
permit tcp any any eq 443

2- What is the « ACL-POSTURE-REDIRECT REMEDIATION » ?
ISE 10.1.1.1 SRV remed 10.2.2.2.

Doc CISCO :
ip access-list extended ACL-POSTURE-REDIRECT
deny udp any eq bootpc any eq bootps
deny udp any any eq domain
deny udp any host eq 8905
deny tcp any host eq 8905
deny tcp any host eq 8909
deny udp any host eq 8909
deny tcp any host eq 8443
deny ip any host
deny ip any host 192.230.240.8 (one of the ip of CLAMwin database virus Definitions)
permit ip any any

3- What is the URL remediation from CWA Authent(?) ?

• https:// ip:8443/guestportal/gateway?sessionId=SessionIdValue@action=cppcisco:cisco-av-pair=url-redirect (802.1x-authent/NAC Agent)

https://ip:8443/guestportal/gateway?sessionId=SessionIdValue@action=cwa cisco:cisco-av-pair=url-redirect (web-Authent/Web Agent)

https://ip:8443/guestportal/gateway?sessionId=SessionIdValue@action=mdm cisco:cisco-av-pair=url-redirect

4- Number of days before purge session radius with “start” but without “stop” de session ?
• Sessions without RADIUS activity are automatically purged from Active Session list every 5 days or if the endpoint is deleted from the system.

5- Default Radius logs ?
Default 90 days Radius data purge ??

6- IOS authorized commands with Tacacs on ISE 2.0?

Configuration ISE TACACAS :
Permit : ping .*
Deny show r.*
Permit s*h .*
Deny_always ping

What are possible commands?
• Show run
• Show clock
• Ping 10.1.1.1
• Sh interface ip …
• Conf terminal

7- what is the pre-requisites for activation TACACS ISE 2.0
• Have a licence “Management Device”
• Active the « service Device Admin »
• Configure « Indentity Store »
• Configure the switch NAD
• …

8- Nomber of bits field SGT ?
– 16

9- In which “Report Log” column is the value field “Host Name:” in the dialog box dump tool?
• ISE NODE <
• Server
• Endpoint

10- What is the default ACL applied by ISE?
• All TCP
• Management traffic
• only admin to ISE
• All IP <

11- The presence of any command line takes it to the conf of a switch if a DACL is not sent?

• aaa authorization network default group radius
• …

12- Command IOS for sent stat authentications to Radius ?
• aaa accounting resource start-stop group (à verifier)
• aaa authentication login default group

13- Command IOS RADIUS for ignore the AUP ?
?
14- Signification of CAK ?
http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/deploy_guide_c17-663760.html

15- What are the possibility from sponsor portal ISE 1.3 to the client?
• Monthly
• Delete
• Rename guest
• Daily
• Weekly
• Contractor (year).
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/sponsor_guide/b_spons_SponsorPortalUserGuide_13/b_spons_SponsorPortalUserGuide_13_chapter_00.html#concept_8EFC1F4B42CC47BFB5D7F072125CCD26

16- What are the possibility from CA portal ISE 1.3 ?
• Revoke <
• unrevoke
• import <
• Delete <
http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_01000.html#concept_8B6D9760C14344EC972B2DD81876328B

17- What are the situations of port 802.1x with « Security-Violation » ?
• Error disable
• traffic from that MAC address is dropped.

18- No-Authorized with profil-TACACAS 5 to 9 configured on ISE 2.0 ?
• Show run
• Conf t
• Show interface
• Show ip route
• enable

19- What which allows to convey the SGT value in a network?
• ISE
• switch
• SGT Exchange Protocol
• …

20- Comment un BYOD peut mettre en œuvre un supplicant?
• From native supplicant
• on Cisco.com
• Direct from ISE…

21- What is the information from http PROBE ?
• User name
• http request
• ip-frame
• Mac user
• User-Agent Network Resources. 2. Click Create.
B. 1. Choose Network Resources > Network Devices and AAA Clients. 2. Click Create.
C. 1. Choose Network Resources > Network Devices and AAA Clients. 2. Click Manage.
D. 1. Choose Network Devices and AAA Clients > Network Resources. 2. Click Install.
Answer: B

26- What is the function of the SGACL policy matrix on a Cisco TrustSec domain with SGT Assignment?
A. It determines which access policy to apply to the endpoint.
B. It determines which switches are trusted within the TrustSec domain.
C. It determines the path the SGT of the packet takes when entering the Cisco TrustSec domain. D. It lists all servers that are permitted to participate in the TrustSec domain.
E. It lists all hosts that are permitted to participate in the TrustSec domain.
Answer: A

27- Simulations from DUMP : 171, 172, 173, 174 et 175

28- Le LAB n°170 du DUMP

29- Le LAB n°169 du DUMP

A new simulation with 4 questions to be answered debug by connecting to the ISE but without access to the tab “Operations” …
These 2 types of users “Sales” and “IT-Users” deployed from NAM.

The questions relate to authentication problems, authorization and Profiling.

pongo

pongo

Hello,

I’m ready to exchange with you and this test.
I try to push many questions here, but this has been blocked from the moderation discusion…I don’t know why…

fadmour

fadmour

please just make a question by post or send it by mail
mine is fadmour @yahoo.fr whithout space

hhj

hhj

hello pongo ,
I’ll be thankful if your post your questions to [email protected] , waiting for your reply .

vlad

vlad

Pongo hello!
please send your questions to osmius @ yandex.ru (whithout space)
Thanks a lot!

Deva

Deva

Hello Pongo, can you please share the recent exam 300-208 questions to below email : [email protected]

Venelopy

Venelopy

Fail 763/1000 846 needed, that is why it would be great if eveybody that has taken the exam shares what they rebebber

Not much are from this dump.

Venelopy

Venelopy

Hi Guys

I got additional information on two of the question above. I have no idea what are the answer for both of them. I searched a lot but I wasnt able to find anything relevant. It would be great if someone knows the answer or find any guide documents on the topics:

Please write me if you decide to look for the answer on the net and find it!
—————————————————————————————–
Q. How is the default dynamic ACL configured in ISE
Permit UDP
Permit All
Permit TCP
Permit only management
Q. After what time will ISE purge authentication session without receiving RADIUS Accounting Stop message.
1
5
10
15
————————————————————————————–

pongo

pongo

Q. How is the default dynamic ACL configured in ISE

All IP

Q. After what time will ISE purge authentication session without receiving RADIUS Accounting Stop message.

Sessions without RADIUS activity are automatically purged from Active Session list every 5 days or if the endpoint is deleted from the system.

zozo

zozo

!!!!!!!!!!!!Attention ExamCollection false advertising!!!!!

The dump 300-208 211q is a fake !! on Website there are 211 question but after buy and download there are only 174, it’s a old dump.

papero23

papero23

Hi Alan,
You have done a good job ! Everything is there ! Let us work a bit with courses, try these questions, go and pass the exam. Thanks Alan!

elton

elton

Hello,

i have scheduled this exam on Friday 20.05.2016 can anybody pass this exam on those days? im preparing with premium exam.

Thank you.

David

David

If you dont mind to share the updated 300-208 dump, I will have the test tomorrow!

thanks

danilo

danilo

Did you pass?

ciscogroupie

ciscogroupie

Nice work – will let you know if still valid soon!

mick

mick

Please, share your passed exame.
Thanks in advance for your cooperation.
bye.

Michael

Michael

hello everybody,
I need to schedule this exam before the end of this year 2016.
Is anyone that can pass me the topic question of 300-208 SISAL Cisco exam ?

my email is: [email protected]

Thanks in advance for your cooperation.

alex

alex

Hello guys.
I’m going to take 300-208 exam.
Can anybody share your questions?
My email is [email protected]
Thanks in advance

alex

Mike

Mike

Hi Alex,

Have you already taken the exam? Did you pass?

Abdel

Abdel

Hello,
I am planing to take 300-208 exam, has anyone took it recently?
Your answer is really appreciated.
Abdel

Mike

Mike

Update for anybody who schedules this exam.
I took the exam today but failed although referenced to Alan’s 232Q.
About 20 new questions.

Krishna

Krishna

I took this exam recently and failed. This dump is not valid anymore. Around 20 to 30 new questions and a new simulation as well. Be prepare and prepare very well before you write, oterwise just reschedule. The official Certification guide for SISAS is a shit and clearly that alone will not help the candidate to get the pass score. I think cisco needs to release a new book for SISAS with all topic covered and a sigle point of reference. Otherwise the quetions asked in these exams are really broad and tough. Good luck.

Giannis Papadopoulos

Giannis Papadopoulos

I took this exam 2 days ago and i failed with score 779.
Simulation & HOT Spots are valid but there are at least 20 new questions.
A lot of them focused in BYOD. I will try to remember some questions and post them here.

MeMe

MeMe

hello giannis,

any feedback on new questions ?

Thanks

MeMe

MeMe

hello Giannis
any feedback on the new Questions ?

thanks

Giannis Papadopoulos

Giannis Papadopoulos

Hi all,
Here are some Questions that i can recall:

1)What RADIUS attribute can be used to dynamically assign the Inactivity active timer for MAC users from the Cisco ISE?
A. idle-timeout attribute
B. session-timeout
C. radius-server
D. termination-action
Answer: ?

2)A malicious user gained network access by spoofing printer connections that were authorized using MAB on four different switch ports. What Cisco Catalyst switch security features will prevent further violations?[choose two]
A. ip device tracking
B. Private VLANs
C. Port Security
D. DHCP Snooping
E. Dynamic ARP inspection
F. 802.1AE MacSec
Answer: ?

3) Which tree statement about Windows Server Update Services remediation are true?
A. WSUS can install the latest service pack available
B. WSUS checks for automatic update configuration on the Windows Client
C. WSUS checks for client behavioral anomalies
D. WSUS remediates Windows client from a locally manage WSUS server
E. WSUS remediates Windows client from a Microsoft manage WSUS server
F. WSUS provides links to update AV/AS
Answer: ?

4) Which three EAP methods use tunnel to encapsulate EAP traffic? (Choose three).
A. EAP-MD5
B. EAP-FAST
C. EAP-TTLS
D. PEAP
E. EAP-TLS
Answer: B,D,E

5) A security engineer has configured separate Policy Service and Admin Node. What will occur when the Admin Node is offline?
A. AUP is shown at every login
B. Maximum Failed login in enforced
C. Change password becomes available
D. Device Registration is allowed
Answer: ?

6) What are the 3 portal provided by PSN? (Choose three).
A. Sponsor
B. admin
C. My devices
D. Monitoring
E. Guest
F. Troubleshooting
Answer: ?

Ijebu

Ijebu

What is the best exam to study within one week to study for recertification. please recommend the best practice test.

Big D

Big D

Guys I took the exam in October and again in Nov and failed both times. The Sims are the same but lots of new questions. Anybody have an update study guide that has passed the exam?

Terence Lee

Terence Lee

New 300-208 Exam Questions Have Been Updated Recently (4/Jan/2017):

NEW QUESTION 251
A security administrator wants to profile endpoints and gain visibility into attempted authentications. Which 802.1x mode allows these actions?

A. monitor mode
B. high-security mode
C. closed mode
D. low-impact mode

Answer: A

NEW QUESTION 252
Which three events immediately occur when a user clicks register on their device in a single- SSID BYOD onboarding registration process? (Choose three).

A. CA certificate is sent to the device from Cisco ISE
B. An endpoint is added to a Registered Devices identity group
C. RADIUS access request is sent to Cisco ISE
D. The profile service is sent to the device from Cisco ISE
E. DACL is sent to the device from Cisco ISE
F. BYOD registration flag is set by Cisco ISE

Answer: ABF

NEW QUESTION 253
A company wants to allow employees to register and manage their own devices that do not support NSP. Which portals enable this?

A. MDM portals
B. Client provisioning portals
C. My devices portals
D. BYOD Portals

Answer: C

NEW QUESTION 254
Which three options can be pushed from Cisco ISE server as part of a successful 802.1x authentication. (Choose three)

A. authentication order
B. posture status
C. authentication priority
D. vlan
E. DACL
F. reauthentication timer

Answer: DEF

NEW QUESTION 255
With which two appliance-based products can Cisco Prime infrastructure integrate to perform centralized management?

A. Cisco content security appliance
B. Cisco email security appliance
C. Cisco wireless location appliance
D. Cisco Mobility Services Engine
E. Cisco ISE

Answer: DE

NEW QUESTION 256
A malicious user gained network access by spoofing printer connections that were authorized using MAB on four different switch ports at the same time. What two catalyst switch security features will prevent further violations? (Choose two)

A. DHCP Snooping
B. 802.1AE MacSec
C. Port security
D. IP Device tracking
E. Dynamic ARP inspection
F. Private VLANs

Answer: AE

NEW QUESTION 257
Refer to exhibit, which statement about the authentication protocol used in the configuration is true?
aaa new model
tacacs-server host 1.1.1.1 single connection
tacas-server key cisco123

A. Authentication request contains username, encrypted password, NAS IP address, and port.
B. Authentication and authorization requests are sent in a single open connection between the network device and the TACACS+ server.
C. Authentication request contains username, password, NAS IP address and port.
D. Authentication and authorization request packets are grouped together in a single packet.

Answer: B

NEW QUESTION 258
Which option is the code field of n EAP packet?

A. one byte and 1=request, 2=response 3=failure 4=success
B. two byte and 1=request, 2=response, 3=success, 4=failure
C. two byte and 1=request 2=response 3=failure 4=success
D. one byte and 1=request 2=response 3=success 4=failure

Answer: D

NEW QUESTION 259
……

These New 300-208 Exam Questions Were Just Updated From The Actual 300-208 Exam, You Can Get The Newest 300-208 Dumps In PDF And VCE From — http://www.passleader.com/300-208.html (275q VCE and PDF)

Good Luck!

Mx12

Mx12

I scored above 950.

The exam is truly difficult.

Some of the questions have been changed a little, so other responses are valid, not the one published in dumps.

The exam focuses on asking you the new, added questions, about 50% of them were the new one, only about 50% the old from previous dumps.

Not all questions are in the latest dump, I had about 10 new ones.

Examples, differences:

– accounting is not working, what could be the reason: single choice, ans.: misconfigured authorization (I beleive 😉 )

– q275 from PL which two components are required for creating native supplicant profile – choose two – ans.: Operating System, Connection type – wired/wireless

– q143 from PL – which component hosts the CWA portal – single choice – ans.: the ISE

– shown radius configuration, what is true about it – single choice – ans.: the authentication and authorization send in one packet

– Cisco Any Connect must be installed, what OSes are supported – choose two from: Windows, Android, two Linux distributions, Apple iOS, I think Windows, Apple iOS

– a few others – just stay calm and analyze, eliminate, choose and go on

– one or two questions where I didn’t understand what the author had in mind, so I chose intuitively

!ALL! the questions where you have to analyze ISE configuration and answer which statement is true are modified in such way, that different answers are valid, not the one marked in dumps. So dont learn these ones by heart, you have to analyze thoroughly and choose different answers, ex: q208 from PL – not AD, but in my case AC

!ALL! the questions where you have to analyze detail of live log have the same valid answers as in dumps

Good luck!

oka

oka

do u have last dump , i Failed today

Chris

Chris

834/846 Failed, OMG…
Please can anybody share latest dump?

[email protected]

Thanks a lot!

Student

Student

AnyConnect actually is supported on Linux, Windows and Android….

oka

oka

Failed , is so Difficult so many new question

oka

oka

An engineer wants do allow dynamic vlan assignment from ISE. What must be configured on the switch?

WHAT THE ANSWER

AAA authentication
OR
AAA authorization

Chris

Chris

AAA authozrization, because authorization resend such things like gives results ACL, VLAN, and so on…

Barak VE

Barak VE

[Update]

New 300-208 Exam Questions Updated Recently (1/Mar/2017):

NEW QUESTION 288
An engineer must ensure that all client operating systems have the AnyConnect Agent for an upcoming posture implementation. Which two versions of OS does the AnyConnect posture agent support? (Choose two.)

A. Google Android
B. Ubuntu
C. Apple Mac OS X
D. Microsoft Windows
E. Red Hat Enterprise Linux

Answer: C

NEW QUESTION 289
Which command would be used in order to maintain a single open connection between a network access device and a tacacs server?

A. tacacs-server host timeout
B. tacacs-server host single-connection
C. tacacs-server host
D. tacacs-server host single-connection

Answer: D

NEW QUESTION 290
Refer to the exhibit. Which authentication method is being used?
Evaluating Identity Policy
15006 Matched Default Rule
15013 Selected Identity Store C LDAP_TESTE
22043 Current Identity Store does not support the authentication method; Skipping it

A. PEAP-MSCHAP
B. EAP-GTC
C. EAP-TLS
D. PEAP-TLS

Answer: C

NEW QUESTION 291
A security engineer has a new TrustSec project and must create a few static security group tag classifications as a proof of concept. Which two classifications can the tags be mapped to? (Choose two.)

A. VLAN
B. user ID
C. interface
D. switch ID
E. MAC address

Answer: AC

NEW QUESTION 292

NEW QUESTION 293
Which CoA type does a Cisco ISE PSN send to a network access device when a NAG agent reports the OS patch status of a noncompliant endpoint?

A. CoA-Terminate
B. CoA-PortBounce
C. CoA-Reauth
D. CoA-Remediate

Answer: B

NEW QUESTION 294

P.S. You Can Get The Newest 300-208 Dumps In PDF And VCE From — http://www.passleader.com/300-208.html (300q VCE and PDF)

Good Luck!

Jack

Jack

NEW QUESTION 288
An engineer must ensure that all client operating systems have the AnyConnect Agent for an upcoming posture implementation. Which two versions of OS does the AnyConnect posture agent support? (Choose two.)

A. Google Android
B. Ubuntu
C. Apple Mac OS X
D. Microsoft Windows
E. Red Hat Enterprise Linux

Answer: C D

Cisco AnyConnect Secure Mobility Client supports the following operating systems for its contained modules:
Supported Operating Systems VPN Client Network Access Manager Cloud Web Security VPN Posture (HostScan) ISE Posture DART Customer Experience Feedback

Windows 7, 8, 8.1, & 10

x86(32-bit) and x64(64-bit)
Yes Yes Yes Yes Yes Yes

Mac OS X 10.8, 10.9, 10.10, 10.11
Yes No Yes Yes Yes Yes

Linux Red Hat 6, 7 & Ubuntu 12.04 (LTS), and 14.04 (LTS) (64-bit only)
Yes No No Yes No Yes Yes

Jack

Jack

QUESTION 289
Which command would be used in order to maintain a single open connection between a network
access device and a tacacs server?
A.tacacs-server host timeout
B.tacacs-server host single-connection
C.tacacs-server host
C.tacacs-server host single-connection
Answer:
D

Jack

Jack

must be

QUESTION 289
Which command would be used in order to maintain a single open connection between a network
access device and a tacacs server?
A.tacacs-server host timeout
B.tacacs-server host single-connection
C.tacacs-server host
C.tacacs-server host single-connection
Answer:
D

Jack

Jack

QUESTION 289
Which command would be used in order to maintain a single open connection between a network
access device and a tacacs server?
A.tacacs-server host timeout
B.tacacs-server host single-connection
C.tacacs-server host
D.tacacs-server host “” single-connection
Answer:
D