Ace Cisco 300-715 Certification with Actual Questions Feb 22, 2026 Updated [Q93-Q112]

NEW QUESTION 93
Refer to the exhibit:

Which command is typed within the CU of a switch to view the troubleshooting output?

show authentication sessions mac 000e.84af.59af details

show authentication registrations

show authentication interface gigabitethemet2/0/36

show authentication sessions method

NEW QUESTION 94
A network engineer must configure a centralized Cisco ISE solution for wireless guest access with users in different time zones. The guest account activation time must be independent of the user time zone, and the guest account must be enabled automatically when the user self- registers on the guest portal. Which option in the time profile settings must be selected to meet the requirement?

Select FromFirstLogin from the Account Type dropdown.

Select FromCreation from the Account Type dropdown.

Set the Maximum Account Duration to 1 Day.

Set the Duration field to 24:00:00.

NEW QUESTION 95
A Cisco device has a port configured in multi-authentication mode and is accepting connections only from hosts assigned the SGT of SGT_0422048549. The VLAN trunk link supports a maximum of 8 VLANS. What is the reason for these restrictions?

The device is performing inline tagging without acting as a SXP speaker

The device is performing mime tagging while acting as a SXP speaker

The IP subnet addresses are dynamically mapped to an SGT.

The IP subnet addresses are statically mapped to an SGT

NEW QUESTION 96
An organization has a fully distributed Cisco ISE deployment. When implementing probes, an administrator must scan for unknown endpoints to learn the IP-to-MAC address bindings. The scan is complete on one FPSN, but the information is not available on the others.
What must be done to make the information available?

Scanning must be initiated from the PSN that last authenticated the endpoint

Cisco ISE must learn the IP-MAC binding of unknown endpoints via DHCP profiling, not via scanning

Scanning must be initiated from the MnT node to centrally gather the information

Cisco ISE must be configured to learn the IP-MAC binding of unknown endpoints via RADIUS authentication, not via scanning

NEW QUESTION 97
An administrator is attempting to replace the built-in self-signed certificates on a Cisco ISE appliance. The CA is requesting some information about the appliance in order to sign the new certificate. What must be done in order to provide the CA this information?

Install the Root CA and intermediate CA.

Generate the CSR.

Download the intermediate server certificate.

Download the CA server certificate.

NEW QUESTION 98
An engineer is configuring Cisco ISE and needs to dynamically identify the network endpoints and ensure that endpoint access is protected. Which service should be used to accomplish this task?

Profiling

Guest access

Client provisioning

Posture

NEW QUESTION 99
An ISE administrator must change the inactivity timer for MAB endpoints to terminate the authentication session whenever a switch port that is connected to an IP phone does not detect packets from the device for 30 minutes. Which action must be taken to accomplish this task?

Add the authentication timer reauthenticate server command to the switchport.

Add the authentication timer inactivity 3600 command to the switchport.

Change the idle-timeout on the Radius server to 3600 seconds for IP Phone endpoints.

Configure the session-timeout to be 3600 seconds on Cisco ISE.

NEW QUESTION 100
Which Cisco ISE deployment model provides redundancy by having every node in the deployment configured with the Administration. Policy Service, and Monitoring personas to protect from a complete node failure?

distributed

dispersed

two-node

hybrid

NEW QUESTION 101
An engineer is adding a new network device to be used with 802.1X authentication. After configuring the device, the engineer notices that no endpoints that connect to the switch are able to authenticate. What is the problem?

The command dot1x system-auth-control is not configured on the switch.

The switch’s supplicant is unable to establish a connection to Cisco ISE.

The command dot1x critical vlan 40 is not configured on the switch ports.

The endpoint firewalls are blocking the EAPoL traffic.

NEW QUESTION 102
An administrator is configuring an AD domain to be used with authentication for endpoints and users within Cisco ISE. Which two steps are required to configure this to be used as an external identity store? (Choose two.)

Add an Authentication Joint Point.

Configure Authentication Domains.

Configure Active Directory Schema.

Configure Active Directory Domains.

Add an Active Directory Join Point.

NEW QUESTION 103
An organization wants to implement 802.1X and is debating whether to use PEAP-MSCHAPv2 or PEAP-EAP-TLS for authentication. Drag the characteristics on the left to the corresponding protocol on the right.

NEW QUESTION 104
What must be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

pass

reject

drop

continue

NEW QUESTION 105
An engineer must use certificate authentication for endpoints that connect to a wired network with a Cisco ISE deployment. The engineer must define the certificate field used as the principal username. What is needed to complete the configuration?

authorization profile

authentication policy

authorization rule

authentication profile

NEW QUESTION 106
A policy is being created in order to provide device administration access to the switches on a network. There is a requirement to ensure that if the session is not actively being used, after 10 minutes, it will be disconnected. Which task must be configured in order to meet this requirement?

session timeout

idle time

monitor

set attribute as

NEW QUESTION 107
An engineer is implementing Cisco ISE and needs to configure 802.1X. The port settings are configured for port-based authentication. Which command should be used to complete this configuration?

dot1x pae authenticator

dot1x system-auth-control

authentication port-control auto

aaa authentication dot1x default group radius

NEW QUESTION 108
An administrator made changes in Cisco ISE and needs to apply new permissions for endpoints that have already been authenticated by sending a CoA packet to the network devices. Which IOS command must be configured on the devices to accomplish this goal?

aaa server radius dynamic-author

authentication command bounce-port

authentication command disable-port

aaa nas port extended

NEW QUESTION 109
Which command displays all 802 1X/MAB sessions that are active on the switch ports of a Cisco Catalyst switch?

show authentication sessions output

Show authentication sessions

show authentication sessions interface Gi 1/0/x

show authentication sessions interface Gi1/0/x output

NEW QUESTION 110
An administrator must configure Cisco ISE to send CoA requests to a Cisco switch using SNMP.
These configurations were performed:
– enabled SNMP on the switch
– added the switch to Cisco ISE
– configured a network device profile
– configured the NAD port detection method
– configured the operation to be performed on the switch port
– configured an authorization profile
Which two configurations must be performed to send the CoA requests? (Choose two.)

Configure a network device group

Configure the SNMP server in Cisco ISE.

Configure the switch SNMP settings of the NAD

Configure SNMP authentication in Cisco ISE

Select the CoA type as SNMP in the network device profile.

NEW QUESTION 111
Refer to the exhibit:

Refer to the exhibit Which component must be configured to apply the SGACL?

egress router

host

secure server

ingress router

NEW QUESTION 112
An engineer is assigned to enhance security across the campus network. The task is to enable MAB across all access switches in the network. Which command must be entered on the switch to enable MAB?

Switch(config)# authentication port-control auto

Switch(config)# mab

Switch# authentication port-control auto

Switch(config-if)# mab