An ISE administrator must change the inactivity timer for MAB endpoints to terminate the authentication session whenever a switch port that is connected to an IP phone does not detect packets from the device for 30 minutes. Which action must be taken to accomplish this task?

1. A. Add the authentication timer reauthenticate server command to the switchport.
2. B. Add the authentication timer inactivity 3600 command to the switchport.
3. C. Change the idle-timeout on the Radius server to 3600 seconds for IP Phone endpoints.
4. D. Configure the session-timeout to be 3600 seconds on Cisco ISE.

Correct Answer: B

A user changes the status of a device to stolen in the My Devices Portal of Cisco ISE. The device was originally onboarded in the BYOD wireless Portal without a certificate. The device is found later, but the user cannot re-onboard the device because Cisco ISE assigned the device to the Blocklist endpoint identity group. What must the user do in the My Devices Portal to resolve this issue?

1. A. Manually remove the device from the Blocklist endpoint identity group.
2. B. Change the device state from Stolen to Not Registered.
3. C. Change the BYOD registration attribute of the device to None.
4. D. Delete the device, and then re-add the device.

Correct Answer: B

An administrator is configuring TACACS+ on a Cisco switch but cannot authenticate users with Cisco ISE. The configuration contains the correct key of Cisc039712287. but the switch is not receiving a response from the Cisco ISE instance What must be done to validate the AAA configuration and identify the problem with the TACACS+ servers?

1. A. Check for server reachability using the test aaa group tacacs+ admin <key> legacy command.
2. B. Test the user account on the server using the test aaa group radius server CUCS user admin pass <key> legacy command.
3. C. Validate that the key value is correct using the test aaa authentication admin <key> legacy command.
4. D. Conrm the authorization policies are correct using the test aaa authorization admin drop legacy command.

Correct Answer: A
https://medium.com/training-course-ccna-security-210-260/ccna-security-part-3-implementing-aaa-in-cisco-ios

Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?

1. A. DHCP server
2. B. static IP tunneling
3. C. override Interface ACL
4. D. AAA override

Correct Answer: D

When creating a policy within Cisco ISE for network access control, the administrator wants to allow different access restrictions based upon the wireless SSID to which the device is connecting. Which policy condition must be used in order to accomplish this?

1. A. Network Access NetworkDeviceName CONTAINS <SSID Name>
2. B. DEVICE Device Type CONTAINS <SSID Name>
3. C. Radius Called-Station-ID CONTAINS <SSID Name>
4. D. Airespace Airespace-Wlan-ld CONTAINS <SSID Name>

Correct Answer: C
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115734-ise-policies-ssid-00.h