Cisco 300-715 - Implementing and Configuring Cisco Identity Services Engine (SISE) v1.1 (300-715 SISE)

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sg/configuration/guide/conf/dot1x.html#wp1133395

In the context of a wired 802.1X deployment with Cisco ISE, the requirement is to log failed authentications while minimizing user impact. Let ' s analyze each option:

A. authentication open - This command configures the port to allow network access regardless of the authentication state. It ' s useful in situations where specific devices can ' t perform 802.1X authentication but should still be allowed network access. However, it doesn ' t specifically address the logging of failed authentications.

B. pae dot1x enabled - PAE (Port Access Entity) refers to the entity on a network device that enforces access control. This command enables 802.1X on the port, which is a prerequisite for implementing 802.1X, but doesn ' t directly relate to logging failed authentication attempts.

C. authentication host-mode multi-auth - This command configures the port to allow multiple authenticated sessions. This mode is used when multiple devices are connected to the same port (like in a conference room). While it ' s relevant for 802.1X environments, it doesn ' t specifically cater to logging failed authentications or minimizing user impact.

D. monitor-mode enabled - This command is used in the context of 802.1X to enable Monitor Mode on a port. Monitor Mode allows a port to grant limited network access to endpoints without 802.1X capabilities. It ' s often used to ease the deployment of 802.1X by monitoring the authentication status without fully enforcing access control, thereby minimizing user impact. It also helps in logging authentication attempts, including failures.

Given these options, the most appropriate command for logging failed authentications while having minimal impact on users would be D. monitor-mode enabled. This command ensures that authentication attempts are monitored and logged, including failures, without fully restricting access, thus minimizing the impact on users who might face issues with the authentication process.

https://ciscocustomer.lookbookhq.com/iseguidedjourney/ISE-profiling-design

Question no : 139

An administrator is configuring cisco ISE lo authenticate users logging into network devices using TACACS+ The administrator is not seeing any oí the authentication in the TACACS+ live logs. Which action ensures the users are able to log into the network devices?

A. Enable the device administration service in the Administration persona

B. Enable the session services in the administration persona

C. Enable the service sessions in the PSN persona.

D. Enable the device administration service in the PSN persona.

Answer: D

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_ise_tacacs_device_admin.html

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-8-0E/15-24E/configuration/guide/xe-380-configuration/dot1x.html

https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html

The persona or personas of a node determine the services provided by a node. An ISE node can assume any or all of the following personas: Administration, Policy Service, and Monitoring. The menu options that are available through the administrative user interface are dependent on the role and personas that an ISE node assumes. See Cisco ISE Nodes and Available Menu Options for more information.