SISE Practice Test 10 — 10 Questions

Question 1

An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?

Accepted Answer

Authorization Profile. The Authorization Profile is the ISE object that contains the dACL name (and other authorization attributes like VLAN, SGT, or URL redirect) returned to the NAD in the RADIUS Access-Accept. The authorization rule references the Authorization Profile, and ISE pushes the dACL to the switch as part of the authorization result. Without configuring the dACL in an Authorization Profile, ISE has no mechanism to deliver it.

Answer

Network Device Group

Answer

Policy Set Authentication Sequence

Answer

Device Administration Policy Set

Question 2

Which of the following is required for AnyConnect to perform posture assessment on a Mac endpoint?

Accepted Answer

The 'AnyConnect Compliance Module' must be installed. The AnyConnect Compliance Module is required on a Mac endpoint to perform posture assessment. It provides the posture agents that check endpoint compliance with policies such as antivirus, firewall, and OS version.

Answer

The Mac must be domain joined

Answer

A separate 'Posture Proxy' must be configured

Answer

The user must have root access

Question 3

Which attribute is used by the MAC OUI probe to determine the device manufacturer?

Accepted Answer

MAC Address prefix (first 3 bytes). The MAC OUI (Organizationally Unique Identifier) probe inspects the first 3 bytes (24 bits) of a device's MAC address, which is the OUI assigned by the IEEE to a specific manufacturer. ISE maintains an internal OUI-to-vendor mapping database, so when an endpoint's MAC address is seen, the probe matches the prefix to identify the manufacturer (e.g., Apple, Samsung, Cisco). This is why the first 3 bytes are the correct answer.

Answer

User-Agent string

Answer

IP Address

Answer

DHCP Client ID

Question 4

A guest user reports they receive a certificate warning when redirected to the ISE Guest portal. What is the most common cause of this issue?

Accepted Answer

The ISE server certificate is self-signed or not trusted by the client device.. The most common cause of certificate warnings on the ISE Guest portal is that the ISE server is using a self-signed certificate or a certificate not trusted by the client's browser trust store. Browsers will display a warning when the certificate chain cannot be validated against a trusted CA. Replacing the default self-signed certificate with a CA-signed certificate whose SAN matches the portal FQDN resolves the warning.

Answer

The ISE portal is configured for HTTP instead of HTTPS.

Answer

The DNS server is not resolving the ISE FQDN.

Answer

The switch is not configured for SSL interception.

Question 5

An administrator needs to ensure that only endpoints with a specific registry key present are allowed access. Where should this posture condition be defined in Cisco ISE?

Accepted Answer

Policy > Policy Elements > Conditions > Posture > Registry Condition. Posture conditions, such as checking for a specific registry key, are defined under Policy > Policy Elements > Conditions > Posture > Registry Condition. This allows you to create a condition that evaluates the presence of a registry key on the endpoint, which can then be used in posture policies.

Answer

Administration > System > Settings > Posture

Answer

Policy > Policy Elements > Conditions > Authorization > Compound Condition

Answer

Policy > Policy Elements > Results > Posture > Remediation Actions

Question 6

You need to create a posture condition to verify that the 'Cisco AnyConnect' service is running. Which condition type should you select?

Accepted Answer

Service Condition. In Cisco ISE posture conditions, a Service Condition is used to check whether a specific service (such as the Cisco AnyConnect service) is running on the endpoint. This condition type queries the endpoint's service status via the posture agent and returns a compliant or non-compliant result based on whether the service is active. It is the correct choice for verifying that a named service is running.

Answer

Registry Condition

Answer

Process Condition

Answer

Application Condition

Question 7

During the BYOD onboarding process, a user is successfully redirected to the portal, but the certificate installation fails because the client cannot trust the root CA. Which configuration is required to resolve this?

Accepted Answer

Import the Root CA certificate into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled.. The certificate installation fails because the client does not trust the root CA. To resolve this, the root CA certificate must be imported into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled. This ensures that the client trusts the CA that issued the certificate, allowing successful installation.

Answer

Install the CA certificate on the local WLC controller under the WLAN configuration.

Answer

Add the Root CA to the 'System Certificates' store instead of 'Trusted Certificates'.

Answer

Enable 'Allow Weak Ciphers' in the global BYOD settings.

Question 8

A TACACS+ command authorization policy is failing to restrict specific configuration changes on a Cisco IOS device. Which field in the TACACS+ Profile must be correctly configured to ensure the command list is evaluated?

Accepted Answer

Command Sets. In a TACACS+ Profile in Cisco ISE, the Command Sets field is where you define the list of commands (permit/deny) that will be evaluated for command authorization. If the command list is not correctly configured in the Command Sets, the device will not receive the proper authorization response, and the policy will fail to restrict commands. Therefore, Command Sets is the field that must be correctly configured.

Answer

Device Administration Policy

Answer

Policy Set Condition

Answer

Shell Profile

Question 9

Which THREE of the following are valid components of a RADIUS-based Authorization Policy rule in Cisco ISE?

Accepted Answer

Rule Name. In Cisco ISE, an Authorization Policy rule is built from three mandatory elements: a Rule Name (A), which uniquely identifies the rule within the policy set; a Condition (B), which defines the matching criteria such as AD group membership, device type, or posture status that must evaluate to true; and an Authorization Profile (E), which specifies the actual permissions or attributes (for example, VLAN, dACL, SGT, or downloadable ACL) returned in the RADIUS Access-Accept. The Identity Source Sequence (C) is not part of an authorization rule — it is referenced in the Authentication Policy to determine where user credentials are verified. The Command Set (D) is not an authorization rule component either; it is a TACACS+ construct used in Device Administration authorization to define permitted CLI commands, not a RADIUS authorization element.

Answer

Identity Source Sequence

Answer

Command Set

Question 10

What is the primary function of the 'Client Provisioning' policy in the context of BYOD?

Accepted Answer

To determine which provisioning resources are delivered to the device based on its attributes.. The Client Provisioning policy in Cisco ISE determines which provisioning resources — such as supplicants, native supplicants, profiles, and agent installers — are delivered to an endpoint based on its attributes (OS, posture, device type). It is the policy layer that matches endpoint conditions to the correct provisioning portal and resource package. It does not govern device registration limits, user authorization, or MDM server settings.

Answer

To restrict the number of devices a user can register.

Answer

To define which users are authorized to access the network.

Answer

To configure the MDM server connection settings.