Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles? (Choose two.)

1. A. Firepower
2. B. WLC
3. C. IOS
4. D. ASA
5. E. Shell

Correct Answer: BE
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide TACACS+ Profile
TACACS+ profiles control the initial login session of the device administrator. A session refers to each individual authentication, authorization, or accounting request. A session authorization request to a network device elicits an ISE response. The response includes a token that is interpreted by the network device, which limits the commands that may be executed for the duration of a session. The authorization policy for a device administration access service can contain a single shell profile and multiple command sets. The TACACS+ profile definitions are split into two components:
Common tasks
Custom attributes
There are two views in the TACACS+ Profiles page (Work Centers > Device Administration > Policy Elements > Results > TACACS Profiles)—Task Attribute View and Raw View. Common tasks can be entered using the Task Attribute View and custom attributes can be created in the Task Attribute View as well as the Raw View.
The Common Tasks section allows you to select and configure the frequently used attributes for a profile. The attributes that are included here are those defined by the TACACS+ protocol draft specifications. However,
the values can be used in the authorization of requests from other services. In the Task Attribute View, the ISE administrator can set the privileges that will be assigned to the device administrator. The common task types are:
Shell
WLC
Nexus
Generic
The Custom Attributes section allows you to configure additional attributes. It provides a list of attributes that are not recognized by the Common Tasks section. Each definition consists of the attribute name, an indication of whether the attribute is mandatory or optional, and the value for the attribute. In the Raw View, you can enter the mandatory attributes using a equal to (=) sign between the attribute name and its value and optional attributes are entered using an asterisk (*) between the attribute name and its value. The attributes entered in the Raw View are reflected in the Custom Attributes section in the Task Attribute View and vice versa. The Raw View is also used to copy paste the attribute list (for example, another product's attribute list) from the clipboard onto ISE. Custom attributes can be defined for nonshell services.

What is an advantage of using EAP-TLS over EAP-MS-CHAPv2 for client authentication?

1. A. EAP-TLS uses a username and password for authentication to enhance security, while EAP-MS-CHAPv2 does not.
2. B. EAP-TLS secures the exchange of credentials, while EAP-MS-CHAPv2 does not.
3. C. EAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not.
4. D. EAP-TLS uses multiple forms of authentication, while EAP-MS-CHAPv2 only uses one.

Correct Answer: C

An administrator must block access to BYOD endpoints that were onboarded without a certificate and have been reported as stolen in the Cisco ISE My Devices Portal. Which condition must be used when configuring an authorization policy that sets DenyAccess permission?

1. A. Endpoint Identity Group is Blocklist, and the BYOD state is Registered.
2. B. Endpoint Identify Group is Blocklist, and the BYOD state is Pending.
3. C. Endpoint Identity Group is Blocklist, and the BYOD state is Lost.
4. D. Endpoint Identity Group is Blocklist, and the BYOD state is Reinstate.

Correct Answer: A
https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_

If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?

1. A. Client Provisioning
2. B. Guest
3. C. BYOD
4. D. Blacklist

Correct Answer: D
https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Desi The Blacklist identity group is system generated and maintained by ISE to prevent access to lost or stolen devices. In this design guide, two authorization profiles are used to enforce the permissions for wireless and wired devices within the Blacklist:
Blackhole WiFi Access
Blackhole Wired Access

Select and Place

Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A