Cisco 300-715 Practice Test 93
Question 920
A BYOD certificate is revoked but an ISE policy keeps accepting it because revocation status checks are disabled. The observed failure is: A lost device may continue authenticating with a valid-looking certificate if revocation is ignored. Which controlled recovery BEST restores the intended state?
- The supported recovery is to delete the guest portal theme to revoke a corporate BYOD certificate.
- The supported recovery is to revoke the appropriate credential and invalidate active access then test the denied device.
- The supported recovery is to assume a signed certificate is valid forever regardless of revocation.
- The supported recovery is to give the recovered phone's certificate to another employee to retain access.
Explanation
Correct Answer
B:A certificate can be revoked before expiry and must be evaluated by the intended access policy. Recheck certificate serial and issuer, CRL or OCSP status, My Devices block state, EAP failure and NAD session.
Incorrect Answers
A:Delete the guest portal theme to revoke a corporate BYOD certificate. This action does not repair the identified failure. A lost device may continue authenticating with a valid-looking certificate if revocation is ignored. Instead, revoke the appropriate credential and invalidate active access then test the denied device. For the specific situation, a BYOD certificate is revoked but an ISE policy keeps accepting it because revocation status checks are disabled.
C:Assume a signed certificate is valid forever regardless of revocation. This action does not repair the identified failure. A lost device may continue authenticating with a valid-looking certificate if revocation is ignored. Instead, revoke the appropriate credential and invalidate active access then test the denied device. For the specific situation, a BYOD certificate is revoked but an ISE policy keeps accepting it because revocation status checks are disabled.
D:Give the recovered phone's certificate to another employee to retain access. This action does not repair the identified failure. A lost device may continue authenticating with a valid-looking certificate if revocation is ignored. Instead, revoke the appropriate credential and invalidate active access then test the denied device. For the specific situation, a BYOD certificate is revoked but an ISE policy keeps accepting it because revocation status checks are disabled.
Question 921
An employee cannot see their registered tablet because it was associated with a different directory user. What is the BEST supported ISE implementation or corrective action?
- Grant every BYOD user global ISE administrator to edit one phone.
- Enable appropriate My Devices portal access and maintain accurate employee-to-endpoint ownership bindings.
- Assume an endpoint nickname is a verified ownership claim.
- Disable owner scope so every employee can modify all registered devices.
Explanation
Correct Answer
B:Verify the effect through my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
Incorrect Answers
A:This does not implement the required control for My Devices portal ownership and self-service. Incorrect ownership mapping can hide or expose device registrations to the wrong person.
C:Assume an endpoint nickname is a verified ownership claim. This alternative overlooks a required prerequisite or targets the wrong function. My Devices provides scoped self-service for employee-owned endpoints rather than full system management. The relevant evidence is my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
D:Incorrect ownership mapping can hide or expose device registrations to the wrong person. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
Question 922
An employee cannot see their registered tablet because it was associated with a different directory user. Which evidence BEST verifies the intended operational outcome?
- A device hostname alone without the policy result or authenticated source.
- A current login screenshot from a completely unrelated ISE deployment.
- A browser theme label without a current authorization trace.
- My Devices login, endpoint list, owner account, permitted actions and administrator audit.
Explanation
Correct Answer
D:These observations directly establish the result of My Devices portal ownership and self-service for the described endpoint or network device. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
Incorrect Answers
A:This observation cannot verify My Devices portal ownership and self-service. My Devices provides scoped self-service for employee-owned endpoints rather than full system management.
B:This observation cannot verify My Devices portal ownership and self-service. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
C:This observation cannot verify My Devices portal ownership and self-service. Check my Devices login, endpoint list, owner account, permitted actions and administrator audit.
Question 923
An employee cannot see their registered tablet because it was associated with a different directory user. Which technical principle BEST explains the required decision?
- A successful switch port link signal always proves the device identity and policy were verified.
- All Cisco ISE administration and policy personas perform exactly the same service.
- A policy display name alone is the complete source of enforcement state.
- My Devices provides scoped self-service for employee-owned endpoints rather than full system management.
Explanation
Correct Answer
D:The supported implementation is to enable appropriate My Devices portal access and maintain accurate employee-to-endpoint ownership bindings. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
Incorrect Answers
A:A successful switch port link signal always proves the device identity and policy were verified. This generalization is not valid for My Devices portal ownership and self-service. Instead my Devices provides scoped self-service for employee-owned endpoints rather than full system management. Verify the actual state using my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
B:All Cisco ISE administration and policy personas perform exactly the same service. This generalization is not valid for My Devices portal ownership and self-service. Instead my Devices provides scoped self-service for employee-owned endpoints rather than full system management. Verify the actual state using my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
C:A policy display name alone is the complete source of enforcement state. This generalization is not valid for My Devices portal ownership and self-service. Instead my Devices provides scoped self-service for employee-owned endpoints rather than full system management. Verify the actual state using my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
Question 924
An employee cannot see their registered tablet because it was associated with a different directory user. An operator proposes the following incorrect shortcut: Grant every BYOD user global ISE administrator to edit one phone. What material risk or failure follows from that shortcut?
- A justified least-privilege ACL caused every unrelated network authentication fault.
- A correctly recorded TACACS command audit caused the preceding security violation.
- Reading the authentication event report caused the original network access outage.
- Incorrect ownership mapping can hide or expose device registrations to the wrong person.
Explanation
Correct Answer
D:The shortcut is unsuitable because my Devices provides scoped self-service for employee-owned endpoints rather than full system management. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
Incorrect Answers
A:This unrelated assertion does not explain the My Devices portal ownership and self-service problem. The relevant risk is that incorrect ownership mapping can hide or expose device registrations to the wrong person.
B:This unrelated assertion does not explain the My Devices portal ownership and self-service problem. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
C:This unrelated assertion does not explain the My Devices portal ownership and self-service problem. Check my Devices login, endpoint list, owner account, permitted actions and administrator audit.
Question 925
An employee cannot see their registered tablet because it was associated with a different directory user. The observed failure is: Incorrect ownership mapping can hide or expose device registrations to the wrong person. Which controlled recovery BEST restores the intended state?
- Assume an endpoint nickname is a verified ownership claim.
- Disable owner scope so every employee can modify all registered devices.
- Correct ownership and portal authorization then test intended and forbidden device visibility.
- Grant every BYOD user global ISE administrator to edit one phone.
Explanation
Correct Answer
C:My Devices provides scoped self-service for employee-owned endpoints rather than full system management. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
Incorrect Answers
A:Assume an endpoint nickname is a verified ownership claim. This action does not repair the identified failure. Incorrect ownership mapping can hide or expose device registrations to the wrong person. Instead, correct ownership and portal authorization then test intended and forbidden device visibility. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
B:Disable owner scope so every employee can modify all registered devices. This action does not repair the identified failure. Incorrect ownership mapping can hide or expose device registrations to the wrong person. Instead, correct ownership and portal authorization then test intended and forbidden device visibility. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
D:Grant every BYOD user global ISE administrator to edit one phone. This action does not repair the identified failure. Incorrect ownership mapping can hide or expose device registrations to the wrong person. Instead, correct ownership and portal authorization then test intended and forbidden device visibility. For the specific situation, an employee cannot see their registered tablet because it was associated with a different directory user.
Question 926
A personal device owner needs to change a device's description without gaining global ISE administrator privileges. Which configuration decision most directly satisfies the requirement?
- In this case, assume an endpoint nickname is a verified ownership claim.
- In this case, disable owner scope so every employee can modify all registered devices.
- In this case, grant every BYOD user global ISE administrator to edit one phone.
- In this case, enable appropriate My Devices portal access and maintain accurate employee-to-endpoint ownership bindings.
Explanation
Correct Answer
D:Verify the effect through my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
Incorrect Answers
A:Assume an endpoint nickname is a verified ownership claim. This alternative overlooks a required prerequisite or targets the wrong function. My Devices provides scoped self-service for employee-owned endpoints rather than full system management. The relevant evidence is my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
B:Incorrect ownership mapping can hide or expose device registrations to the wrong person. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
C:This does not implement the required control for My Devices portal ownership and self-service. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
Question 927
A personal device owner needs to change a device's description without gaining global ISE administrator privileges. What observations most directly test this network-access condition?
- The supporting evidence is a switch interface description without any live AAA request or response.
- The supporting evidence is a device hostname alone without the policy result or authenticated source.
- The supporting evidence is a current login screenshot from a completely unrelated ISE deployment.
- The supporting evidence is my Devices login, endpoint list, owner account, permitted actions and administrator audit.
Explanation
Correct Answer
D:These observations directly establish the result of My Devices portal ownership and self-service for the described endpoint or network device. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
Incorrect Answers
A:This observation cannot verify My Devices portal ownership and self-service. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
B:This observation cannot verify My Devices portal ownership and self-service. A device hostname alone without the policy result or authenticated source.
C:This observation cannot verify My Devices portal ownership and self-service. A current login screenshot from a completely unrelated ISE deployment.
Question 928
A personal device owner needs to change a device's description without gaining global ISE administrator privileges. What principle of ISE authentication and authorization explains this case?
- The governing principle is that a policy display name alone is the complete source of enforcement state.
- The governing principle is that a successful switch port link signal always proves the device identity and policy were verified.
- The governing principle is that my Devices provides scoped self-service for employee-owned endpoints rather than full system management.
- The governing principle is that every RADIUS Access-Accept grants unrestricted access to all applications.
Explanation
Correct Answer
C:The supported implementation is to enable appropriate My Devices portal access and maintain accurate employee-to-endpoint ownership bindings. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
Incorrect Answers
A:A policy display name alone is the complete source of enforcement state. This generalization is not valid for My Devices portal ownership and self-service. Instead my Devices provides scoped self-service for employee-owned endpoints rather than full system management. Verify the actual state using my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
B:A successful switch port link signal always proves the device identity and policy were verified. This generalization is not valid for My Devices portal ownership and self-service. Instead my Devices provides scoped self-service for employee-owned endpoints rather than full system management. Verify the actual state using my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
D:Every RADIUS Access-Accept grants unrestricted access to all applications. This generalization is not valid for My Devices portal ownership and self-service. Instead my Devices provides scoped self-service for employee-owned endpoints rather than full system management. Verify the actual state using my Devices login, endpoint list, owner account, permitted actions and administrator audit. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
Question 929
A personal device owner needs to change a device's description without gaining global ISE administrator privileges. An operator proposes the following incorrect shortcut: Grant every BYOD user global ISE administrator to edit one phone. Which negative consequence BEST explains the shortcut’s flaw?
- The material consequence is that reading the authentication event report caused the original network access outage.
- The material consequence is that the only result is an unrelated portal background color change.
- The material consequence is that incorrect ownership mapping can hide or expose device registrations to the wrong person.
- The material consequence is that a correctly recorded TACACS command audit caused the preceding security violation.
Explanation
Correct Answer
C:The shortcut is unsuitable because my Devices provides scoped self-service for employee-owned endpoints rather than full system management. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
Incorrect Answers
A:This unrelated assertion does not explain the My Devices portal ownership and self-service problem. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
B:This unrelated assertion does not explain the My Devices portal ownership and self-service problem. The only result is an unrelated portal background color change.
D:This unrelated assertion does not explain the My Devices portal ownership and self-service problem. A correctly recorded TACACS command audit caused the preceding security violation.
Question 930
A personal device owner needs to change a device's description without gaining global ISE administrator privileges. The observed failure is: Incorrect ownership mapping can hide or expose device registrations to the wrong person. How should the administrator correct and verify this failure?
- The supported recovery is to disable owner scope so every employee can modify all registered devices.
- The supported recovery is to grant every BYOD user global ISE administrator to edit one phone.
- The supported recovery is to assume an endpoint nickname is a verified ownership claim.
- The supported recovery is to correct ownership and portal authorization then test intended and forbidden device visibility.
Explanation
Correct Answer
D:My Devices provides scoped self-service for employee-owned endpoints rather than full system management. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
Incorrect Answers
A:Disable owner scope so every employee can modify all registered devices. This action does not repair the identified failure. Incorrect ownership mapping can hide or expose device registrations to the wrong person. Instead, correct ownership and portal authorization then test intended and forbidden device visibility. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
B:Grant every BYOD user global ISE administrator to edit one phone. This action does not repair the identified failure. Incorrect ownership mapping can hide or expose device registrations to the wrong person. Instead, correct ownership and portal authorization then test intended and forbidden device visibility. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.
C:Assume an endpoint nickname is a verified ownership claim. This action does not repair the identified failure. Incorrect ownership mapping can hide or expose device registrations to the wrong person. Instead, correct ownership and portal authorization then test intended and forbidden device visibility. For the specific situation, a personal device owner needs to change a device's description without gaining global ISE administrator privileges.