Policy Enforcement

Which THREE components are required to successfully deploy a Scalable Group Access (SGA) policy for SGT enforcement?

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

Which component in ISE defines the 'result' of an authorization rule?

When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

A user is authenticating using EAP-TLS. Where is the certificate validation policy configured in ISE?

A TACACS+ command authorization policy is failing to restrict specific configuration changes on a Cisco IOS device. Which field in the TACACS+ Profile must be correctly configured to ensure the command list is evaluated?

A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?

When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?

What is the function of the 'Default' policy set in ISE?

In an ISE Authorization Policy, what happens if no rules match a request?

You want to implement a 'Change of Authorization' (CoA) after a user changes their location. How is the CoA triggered by ISE?

Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

You are configuring a policy to block access for non-compliant devices. Where do you configure the posture status as a policy condition?

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

During an 802.1X process, the NAD sends an Access-Request with a specific Calling-Station-ID. If ISE does not find this in its Endpoint DB, what is the default behavior for the 'Unknown' status?

A user is authenticated, but their authorization profile returns the wrong VLAN. Which troubleshooting tool in ISE is best suited to verify the attributes sent to the NAD?

What is the primary benefit of using a Policy Set compared to the legacy 'Rule-Based' approach in ISE?

You are implementing 'Device Administration' (TACACS+) and want to restrict an admin to 'show' commands only. How do you construct this policy?

In the ISE Policy Set, which component is used to define the user credentials' verification method?

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

Which ISE menu path is used to create a new Authorization Profile?

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

Which of the following is an example of an 'Exception' policy in ISE?

You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?

Which TWO of the following are valid components of an ISE Authorization Policy rule?

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

What is the purpose of an Authorization Profile's 'Common Tasks'?

You have a Cisco switch that supports both RADIUS and TACACS+. When using ISE for device administration, which protocol is mandatory for command-level authorization?

Which THREE of the following items can be included in an ISE 'Common Task' for authorization?

Which TWO of the following are benefits of using the Cisco TrustSec architecture?

Which TWO of the following are valid locations to check for policy match results in ISE?

Which TWO of the following authentication protocols are supported by ISE for 802.1X?

Which THREE of the following are steps required to configure Cisco ISE for TACACS+ command authorization?

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

Which TWO of the following are valid ways to restrict access based on posture status in ISE?

Which TWO of the following are types of Identity Sources in ISE?

Which THREE of the following are found in an Authorization Profile's 'Advanced Attributes'?

An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?

You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?

Which Cisco ISE construct is used to combine authentication and authorization policies into a single logical container?

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

A user is failing to receive the expected dACL. The ISE logs show the correct authorization rule was matched, but the dACL is not applied. What is the most likely cause?

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?

You have a policy set where authentication succeeds, but the user is hitting the 'Default' authorization rule instead of the expected rule. What should you check first?

Which THREE of the following are valid components of a RADIUS-based Authorization Policy rule in Cisco ISE?

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

Which TWO of the following steps are required to implement SGT-based enforcement using an SXP connection?

Which TWO of the following are true regarding the order of operations in Cisco ISE policy evaluation?

A network engineer is configuring an authorization policy in Cisco ISE to enforce SGT-based segmentation on a Catalyst 9000 switch. The engineer wants to assign a static SGT to endpoints that authenticate via 802.1X and belong to a specific Active Directory group. The switch is already configured with 'cts manual' and 'propagate sgt' on the trunk. Which ISE configuration is required to assign the SGT to the endpoint?

A network administrator is implementing a TACACS+ command authorization policy on Cisco ISE for a group of network devices. The administrator wants to allow users in the 'NetOps' group to execute only 'show' commands and deny all other commands. The policy set for TACACS+ device administration is already configured with the correct conditions. Where in ISE should the administrator define the permitted commands and associate them with the 'NetOps' group?

A security administrator is configuring a policy set in Cisco ISE to enforce different authorization policies based on the endpoint's posture status. The administrator wants to ensure that non-compliant endpoints are placed in a remediation VLAN. Which condition should be used in the authorization policy to match endpoints that have failed posture assessment?

A network engineer is deploying Cisco ISE to enforce Security Group Tags (SGTs) in a wired environment. The engineer wants to ensure that the SGT is assigned to the endpoint during authorization and that the switch enforces the SGT-based policy. Which two actions are required to enable SGT enforcement on the switch? (Choose two.)