Be able to configure web auth and guest services in ISE: set up portals, sponsor accounts, and authorization policies. The most important thing is knowing that RADIUS CoA informs the NAD of session state changes after web authentication.
Start practicing
Web Auth And Guest Services — choose a session length
Free · No account required
Domain overview
This domain covers Cisco ISE web authentication and guest services, including centralized web auth, sponsor and guest portals, and guest lifecycle management. You must configure redirects, customize portals, and control access for guest endpoints. Questions test protocol knowledge, portal task delegation, and authorization policy for guest traffic.
Exam objectives
RADIUS Change of Authorization (CoA) to update NAD session state after web auth
Sponsor Portal tasks: creating guest accounts and managing guest access
Configuring authorization policies for guest access to internal resources like printers
Customizing guest portal login page settings, including logos and acceptable use policy
Confusing RADIUS CoA with SNMP or syslog for session state changes; ISE uses CoA to inform the NAD.
Assuming sponsors can configure global portal settings; sponsors only manage guest accounts and access.
Forgetting that guest access to internal resources requires specific authorization policy rules, not just portal settings.
Click any question to see the full explanation and answer options, or start a focused practice session above.
Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?
2A guest user reports they receive a certificate warning when redirected to the ISE Guest portal. What is the most common cause of this issue?
3In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?
4You are troubleshooting a Guest flow where the client hits the portal but cannot authenticate. You notice the MAC address is not being cached properly. Which setting in the Guest Portal configuration is responsible for enabling MAC caching?
5You need to allow guest users to access specific internal resources (like a printer) while they are connected to the Guest network. How do you configure this in ISE?
6Which guest portal type should you select if you want to allow users to connect to the network without any authentication, simply by clicking an 'Accept' button?
7In a CWA flow, what is the significance of the 'cisco-av-pair = url-redirect-acl' attribute?
8Where do you customize the visual look and feel of the guest portal, such as logos and background colors?
9A user is authenticating via the Sponsored Guest portal. After the sponsor approves the guest, the user still cannot access the network. What is the most common reason for this if the RADIUS flow is correct?
10When setting up a self-registration portal, you want to require that the guest's email address is validated before granting access. Which feature should you enable?
11You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?
12Which protocol does the Cisco ISE use to inform the NAD that a guest user's session state has changed (e.g., from 'redirect' to 'authenticated')?
13You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?
14In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?
15If a user is redirected to the Guest portal but receives a '404 Page Not Found' error, what is the most likely configuration issue?
16Which portal is intended for guest users to manage their own registered devices, such as adding or removing their personal laptops?
17You are reviewing the ISE logs and see that the Guest Portal authentication is failing. Where should you look to find the exact reason for the failure?
18What is the purpose of the 'Guest Flow' setting in the Authorization Profile?
19If you want a guest user to be automatically redirected to a specific webpage (e.g., company news) after a successful login, where is this configured?
20Which THREE of the following are steps involved in the guest portal sponsor approval process?
21Which THREE of the following items are verified by ISE when a guest attempts to authenticate?
22Which TWO of the following settings are available for customizing the guest portal login page?
23Which THREE of the following are valid actions an administrator can take in the Sponsor Portal?
24Which TWO of the following are valid ways to provide access to a guest user?
25You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?
26You want to customize the guest portal so that it displays the company logo and specific terms of use. Where is this configuration performed within the Cisco ISE GUI?
27What is the purpose of the 'Guest Type' configuration in Cisco ISE?
28A network administrator needs to implement self-registered guest access where the guest must provide an email address for validation. Which feature in the Guest Portal settings allows for this?
29Which THREE of the following are required components to successfully implement Central Web Authentication (CWA) with a Cisco WLC?
30Which TWO of the following tasks are performed within the Sponsor Portal?
31A security engineer is configuring a Cisco ISE guest portal for a conference. Attendees must be able to create their own accounts but must first receive a one-time code via SMS to validate their phone number. The SMS gateway has already been integrated with ISE. Which guest portal flow should the engineer select to meet this requirement?
32A network administrator is deploying a guest wireless network using Cisco ISE. They want guests to authenticate through a web portal, but they do not want guests to have to create their own accounts. Instead, they want employees to pre-create guest accounts and provide credentials to visitors. Which ISE feature should the administrator configure to enable this workflow?
33A guest user connects to the network and is redirected to the ISE Guest Portal. After entering valid credentials, the user is authenticated, but the browser remains on the 'Redirecting' page and never reaches the intended URL. The NAD logs show repeated MAC authentication bypass (MAB) attempts with the guest endpoint's MAC address, and the authorization result is 'Redirect'. What is the most likely cause of this issue?
34A network engineer is setting up a guest portal that allows guests to self-register. The company requires that guests provide a valid email address to receive their account credentials. Which portal configuration setting must be enabled to enforce this requirement?
Be able to configure web auth and guest services in ISE: set up portals, sponsor accounts, and authorization policies. The most important thing is knowing that RADIUS CoA informs the NAD of session state changes after web authentication.
The Courseiva SISE question bank contains 34 questions in the Web Auth And Guest Services domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Web Auth And Guest Services domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included