web analytics


100% Pass Lead2pass Practice Test Free Version


100% Free Download! 100% Pass Guaranteed!

Lead2pass updates Cisco 300-208 exam questions, adds some new changed questions from Cisco Official Exam Center. Want to know 2017 300-208 exam test points? Download the following free Lead2pass latest exam questions today!



A.    Choose an Active Directory user.
B.    Configure the management IP address.
C.    Configure replication.
D.    Choose an Active Directory group.

Answer: D


A.    RADIUS Change of Authorization
B.    device tracking
C.    DHCP snooping
D.    VLAN hopping

Answer: A


A.    single-host mode
B.    multidomain authentication host mode
C.    multiauthentication host mode
D.    multihost mode

Answer: A



A.    the VLAN ID
B.    the VRF ID
C.    the tunnel ID
D.    the group ID

Answer: A


A.    In the conditions of an authorization rule.
B.    In the attributes of an authorization rule.
C.    In the permissions of an authorization rule.
D.    In an authorization profile associated with an authorization rule.

Answer: D




Answer: A



Answer: A


A.    CreateTime
B.    FirstLogin
C.    BeginLogin
D.    StartTime

Answer: AB


B.    The redirect ACL is applied to an incorrect SVI.

Answer: A


A.    on the switch port
B.    on the router port
C.    on the supplicant
D.    on the controller

Answer: A

Which functionality does the Cisco ISE self-provisioning flow provide?

A.    It provides support for native supplicants, allowing users to connect devices directly to the network.
B.    It provides the My Devices portal, allowing users to add devices to the network.
C.    It provides support for users to install the Cisco NAC agent on enterprise devices.
D.    It provides self-registration functionality to allow guest users to access the network.

Answer: A

During client provisioning on a Mac OS X system, the client system fails to renew its IP address. Which change can you make to the agent profile to correct the problem?

A.    Enable the Agent IP Refresh feature.
B.    Enable the Enable VLAN Detect Without UI feature.
C.    Enable CRL checking.
D.    Edit the Discovery Host parameter to use an IP address instead of an FQDN.

Answer: A

Where is dynamic SGT classification configured?

A.    Cisco ISE
B.    NAD
C.    supplicant
D.    RADIUS proxy

Answer: A

What is the function of the SGACL policy matrix on a Cisco TrustSec domain with SGT Assignment?

A.    It determines which access policy to apply to the endpoint.
B.    It determines which switches are trusted within the TrustSec domain.
C.    It determines the path the SGT of the packet takes when entering the Cisco TrustSec domain.
D.    It lists all servers that are permitted to participate in the TrustSec domain.
E.    It lists all hosts that are permitted to participate in the TrustSec domain.

Answer: A

You are configuring SGA on a network device that is unable to perform SGT tagging. How can the device propagate SGT information?

A.    The device can use SXP to pass IP-address-to-SGT mappings to a TrustSec-capable hardware peer.
B.    The device can use SXP to pass MAC-address-to-STG mappings to a TrustSec-capable hardware peer.
C.    The device can use SXP to pass MAC-address-to-IP mappings to a TrustSec-capable hardware peer.
D.    The device can propagate SGT information in an encapsulated security payload.
E.    The device can use a GRE tunnel to pass the SGT information to a TrustSec-capable hardware peer.

Answer: A

Refer to the exhibit. The links outside the TrustSec area in the given SGA architecture are unprotected. On which two links does EAC take place? (Choose two.)


A.    between switch 2 and switch 3
B.    between switch 5 and host 2
C.    between host 1 and switch 1
D.    between the authentication server and switch 4
E.    between switch 1 and switch 2
F.    between switch 1 and switch 5

Answer: BD

Which three host modes support MACsec? (Choose three.)

A.    multidomain authentication host mode
B.    multihost mode
C.    multi-MAC host mode
D.    single-host mode
E.    dual-host mode
F.    multi-auth host mode

Answer: ABD

You are troubleshooting wired 802.1X authentications and see the following error: “Authentication failed: 22040 Wrong password or invalid shared secret.” What should you inspect to determine the problem?

A.    RADIUS shared secret
B.    Active Directory shared secret
C.    Identity source sequence
D.    TACACS+ shared secret
E.    Certificate authentication profile

Answer: A

Refer to the exhibit. You are troubleshooting RADIUS issues on the network and the debug radius command returns the given output. What is the most likely reason for the failure?


A.    An invalid username or password was entered.
B.    The RADIUS port is incorrect.
C.    The NAD is untrusted by the RADIUS server.
D.    The RADIUS server is unreachable.
E.    RADIUS shared secret does not match

Answer: A

Which devices support download of environmental data and IP from Cisco ISE to SGT bindings in their SGFW implementation?

A.    Cisco ASA devices
B.    Cisco ISR G2 and later devices with ZBFW
C.    Cisco ISR G3 devices with ZBFW
D.    Cisco ASR devices with ZBFW

Answer: A


A.    client provisioning policy
B.    client provisioning resources
C.    BYOD portal
D.    guest portal

Answer: D

Which description of the purpose of the Continue option in an authentication policy rule is true?

A.    It allows Cisco ISE to check the list of rules in an authentication policy until there is a match.
B.    It sends an authentication to the next subrule within the same authentication rule.
C.    It allows Cisco ISE to proceed to the authorization policy regardless of authentication pass/fail.
D.    It sends an authentication to the selected identity store.
E.    It causes Cisco ISE to ignore the NAD because NAD will treat the Cisco ISE server as dead.

Answer: C

How many days does Cisco ISE wait before it purges a session from the active session list if no RADIUS Accounting STOP message is received?

A.    1
B.    5
C.    10
D.    15

Answer: B

A user configured a Cisco Identity Service Engine and switch to work with downloadable access list for wired dot1x users, though it is failing to work. Which command must be added to address the issue?

A.    ip dhcp snooping
B.    ip device tracking
C.    dot1x pae authenticator
D.    aaa authentication dot1x default group radius

Answer: B

Which option is the correct format of username in MAB authentication?

A.    host/LSB67.cisco.com
B.    chris@cisco.com
C.    10:41:7F:46:9F:89
D.    CISCO\chris

Answer: C






August 2nd, 2017

Posted In: 300-208 Dumps, 300-208 Exam Questions, 300-208 New Questions, 300-208 PDF, 300-208 VCE, Cisco Exam

Tags: , , , , , , ,