SISE Practice Test 12 — 15 Questions

Question 1

You are deploying a Posture agent using the Web Agent. Which mechanism does the Web Agent use to perform compliance checks on a Windows machine?

Accepted Answer

It uses a temporary ActiveX or Java component to scan the system.. The AnyConnect Web Agent (now referred to as the posture agent in browser-less scenarios or via the portal) uses a small temporary utility to gather information, but it is limited in scope compared to the persistent AnyConnect agent.

Answer

It performs deep packet inspection to determine compliance.

Answer

It requires the full AnyConnect VPN client to be pre-installed.

Answer

It communicates directly with the Microsoft Update server.

Answer

It relies on WMI calls initiated by the ISE server.

Question 2

Which of the following is an example of an 'Exception' policy in ISE?

Accepted Answer

A rule placed at the top of the Authorization Policy. Exception rules are used to handle specific, high-priority cases before the main policy rules are evaluated.

Answer

A Policy Set condition

Answer

An Identity Source Sequence

Answer

The Default policy set

Question 3

Which THREE of the following items can be included in an ISE 'Common Task' for authorization?

Accepted Answer

dACL assignment. Common Tasks include VLAN, Voice Domain, and dACL/SGACL assignment.

Answer

Password complexity policy

Answer

RADIUS session timeout

Question 4

You are troubleshooting an issue where IP phones are not being profiled. The SNMP read community string on the switch does not match the one configured in ISE. What is the expected behavior?

Accepted Answer

The SNMP Query probe will fail to collect CDP/LLDP data from the switch.. If the SNMP community string is incorrect, ISE cannot query the switch, and the SNMP Query probe will fail to gather data.

Answer

The endpoint will be profiled based on the MAC OUI only.

Answer

The SNMP trap probe will still work.

Answer

ISE will automatically update the community string on the switch.

Question 5

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

Accepted Answer

Verify SXP connection status and configuration on both peers. SXP (SGT Exchange Protocol) requires the SXP connection to be enabled and the SGTs to be properly mapped on the speaker/listener devices.

Answer

Verify the dACL configuration

Answer

Verify the RADIUS shared secret

Answer

Verify the EAP protocol version

Question 6

Which THREE of the following are steps required to configure Cisco ISE for TACACS+ command authorization?

Accepted Answer

Define a Shell Profile. You must create the Command Sets, define the Shell Profiles, and create the Device Administration Policy.

Answer

Configure an SGT

Answer

Enable MAB

Question 7

You are configuring a custom profiling policy and notice that the 'Certainty Factor' is too low for the device to be assigned to the correct group. What is the purpose of the Certainty Factor in ISE?

Accepted Answer

To indicate the confidence level that the device is correctly profiled.. The Certainty Factor is a numerical value that increases as more matching conditions are met, ensuring a higher confidence in the device identity.

Answer

To determine the priority of the profiling policy.

Answer

To force the device to re-authenticate.

Answer

To limit the number of devices in an endpoint group.

Question 8

Which component of the Cisco ISE Profiling architecture is responsible for comparing collected attributes against defined profiling policies?

Accepted Answer

Policy Service Node (PSN) Profiler Service. The Profiler service on the PSN acts as the policy engine that matches attributes to policies.

Answer

Monitoring Node (MnT)

Answer

Feed Service

Answer

Administration Node (PAN)

Question 9

Which THREE of the following are true regarding the Cisco ISE Profiler Feed Service?

Accepted Answer

It can be configured to update automatically on a schedule.. The Feed Service provides updates, allows for manual/automatic updates, and ensures the list of profile policies is current.

Answer

It automatically assigns devices to groups.

Answer

It is mandatory for all deployments.

Question 10

What is the function of the 'Default' policy set in ISE?

Accepted Answer

It is a catch-all for traffic that does not match other Policy Sets. The Default policy set acts as a catch-all if no other policy set conditions are matched.

Answer

It is the only policy set allowed to process MAB requests

Answer

It is used to manage ISE internal traffic only

Answer

It cannot be modified

Question 11

When configuring an SNMP Query probe, why is it recommended to use SNMPv3 instead of SNMPv1/v2c?

Accepted Answer

SNMPv3 provides authentication and encryption for the query.. SNMPv3 provides authentication and encryption, which are essential for security in enterprise networks.

Answer

SNMPv3 is the only version supported by ISE.

Answer

SNMPv3 is faster.

Answer

SNMPv3 eliminates the need for a community string.

Question 12

Which TWO of the following are necessary to successfully profile devices using the SNMP Query probe?

Accepted Answer

Read access to the MIBs on the target device.. SNMP requires read-only access to the device and the correct community string or credentials configured on the ISE PSN.

Answer

SNMP Write community string configured on the device.

Answer

LLDP-MED enabled on the endpoint.

Answer

A static IP address on the target device.

Question 13

When configuring dACLs for enforcement on Cisco IOS switches, which TWO of the following are true regarding the behavior of the dACL downloaded from Cisco ISE?

Accepted Answer

The dACL is pushed to the switch using RADIUS VSA 11.. dACLs are applied per-session and represent a list of ACEs pushed via RADIUS VSA 11.

Answer

The dACL replaces existing static ACLs on the interface.

Answer

The dACL is downloaded to the switch NVRAM.

Answer

The dACL is applied globally to the switch interface.

Question 14

When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?

Accepted Answer

Cisco IOS-style extended access-list format. dACLs on ISE must be defined using standard IOS-style access-list syntax, and they are pushed to the NAD during the authorization phase.

Answer

SGACL tag format

Answer

JSON format

Answer

XML format

Question 15

During an 802.1X process, the NAD sends an Access-Request with a specific Calling-Station-ID. If ISE does not find this in its Endpoint DB, what is the default behavior for the 'Unknown' status?

Accepted Answer

Process based on Authorization Policy match. If the endpoint is not found, the default authorization policy will typically match a 'default' rule that denies access or places the device in a guest flow.

Answer

Always deny

Answer

Always permit

Answer

Automatically add to database