Policy Enforcement

Which THREE components are required to successfully deploy a Scalable Group Access (SGA) policy for SGT enforcement?

When configuring a RADIUS authorization policy for a dot1x deployment, which TWO attributes are commonly used to assign a dynamic VLAN?

When configuring dACLs for enforcement on Cisco IOS switches, which TWO of the following are true regarding the behavior of the dACL downloaded from Cisco ISE?

You are implementing Cisco TrustSec and need to restrict traffic between two different SGTs on a Cisco Catalyst switch. Which policy component enforces this communication restriction?

An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?

You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?

Which component in ISE defines the 'result' of an authorization rule?

Which attribute is used to enforce dACLs on a Cisco Catalyst switch from ISE?

When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

A user is authenticating using EAP-TLS. Where is the certificate validation policy configured in ISE?

A TACACS+ command authorization policy is failing to restrict specific configuration changes on a Cisco IOS device. Which field in the TACACS+ Profile must be correctly configured to ensure the command list is evaluated?

A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?

When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?

What is the function of the 'Default' policy set in ISE?

Which of the following is a valid condition for an ISE Authorization Policy?

In an ISE Authorization Policy, what happens if no rules match a request?

You want to implement a 'Change of Authorization' (CoA) after a user changes their location. How is the CoA triggered by ISE?

Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

You are configuring a policy to block access for non-compliant devices. Where do you configure the posture status as a policy condition?

Which of the following is NOT a standard RADIUS attribute type used in ISE?

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

During an 802.1X process, the NAD sends an Access-Request with a specific Calling-Station-ID. If ISE does not find this in its Endpoint DB, what is the default behavior for the 'Unknown' status?

A user is authenticated, but their authorization profile returns the wrong VLAN. Which troubleshooting tool in ISE is best suited to verify the attributes sent to the NAD?

What is the primary benefit of using a Policy Set compared to the legacy 'Rule-Based' approach in ISE?

You are implementing 'Device Administration' (TACACS+) and want to restrict an admin to 'show' commands only. How do you construct this policy?

In the ISE Policy Set, which component is used to define the user credentials' verification method?

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

Which of the following is a key requirement for dACL enforcement on a Cisco switch?

Which ISE menu path is used to create a new Authorization Profile?

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

Which of the following is an example of an 'Exception' policy in ISE?

What does the 'Fallthrough' option in an ISE Policy Set rule do?

You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?

Which TWO of the following are valid components of an ISE Authorization Policy rule?

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

What is the purpose of an Authorization Profile's 'Common Tasks'?

You have a Cisco switch that supports both RADIUS and TACACS+. When using ISE for device administration, which protocol is mandatory for command-level authorization?

Which TWO of the following are valid ways to assign a VLAN in an ISE Authorization Profile?

Which THREE of the following items can be included in an ISE 'Common Task' for authorization?

Which TWO of the following are benefits of using the Cisco TrustSec architecture?

Which TWO of the following are valid locations to check for policy match results in ISE?

Which THREE of the following are required to successfully implement SXP (SGT Exchange Protocol)?

Which TWO of the following authentication protocols are supported by ISE for 802.1X?

Which THREE of the following are valid Policy Set conditions?

Which THREE of the following are steps required to configure Cisco ISE for TACACS+ command authorization?

Which THREE of the following are necessary to configure CWA (Centralized Web Authentication)?

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

Which TWO of the following are valid ways to restrict access based on posture status in ISE?

Which TWO of the following are types of Identity Sources in ISE?

Which THREE of the following are found in an Authorization Profile's 'Advanced Attributes'?

Which TWO of the following are steps to handle a user authentication failure in ISE?

An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?

You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?

Which Cisco ISE construct is used to combine authentication and authorization policies into a single logical container?

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

A user is failing to receive the expected dACL. The ISE logs show the correct authorization rule was matched, but the dACL is not applied. What is the most likely cause?

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

You are troubleshooting a scenario where an SGT is not being assigned to a session. You notice the Authorization Profile is correctly configured. What must be configured on the Network Access Device (NAD) to allow the SGT to be learned from the RADIUS Access-Accept?

When creating a Policy Condition in Cisco ISE, which attribute is most commonly used to identify a user's location?

A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?

You have a policy set where authentication succeeds, but the user is hitting the 'Default' authorization rule instead of the expected rule. What should you check first?

Which THREE of the following are valid components of a RADIUS-based Authorization Policy rule in Cisco ISE?

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

Which TWO of the following steps are required to implement SGT-based enforcement using an SXP connection?

Which THREE attributes can be used within a Cisco ISE Authorization Policy condition?

Which TWO settings in an Authorization Profile are commonly used to restrict a client's network access?

Which THREE items are required when configuring a new Policy Set in Cisco ISE?

Which TWO of the following are true regarding the order of operations in Cisco ISE policy evaluation?