SISE Practice Test 12 — 15 Questions

Question 1

A security engineer is configuring Cisco ISE BYOD with a single SSID for both employee onboarding and corporate access. The engineer wants to ensure that devices without a valid certificate are redirected to the BYOD portal, while devices with a valid certificate are granted full access. The engineer has created a client provisioning policy that provisions the native supplicant with the corporate SSID and a certificate template. However, after provisioning, devices are still being redirected to the BYOD portal on subsequent connections. Which configuration change is required to allow onboarded devices to bypass the portal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the authorization policy to include a rule that matches devices presenting a valid certificate and assigns a permit access profile, placed above the redirection rule.. After a device is onboarded and presents a valid certificate, the authorization policy must have a rule that matches certificate authentication and grants full access. If the redirection rule is evaluated first or there is no certificate-based permit rule, the device will continue to be redirected. The correct fix is to add or reorder the authorization policy so that certificate-based access is granted before redirection.

Answer

Change the client provisioning policy to use a different supplicant profile that includes the certificate.

Answer

Add the certificate's issuer to the list of trusted CAs in the BYOD portal settings.

Answer

Enable the 'Allow employees to bypass BYOD portal' option in the BYOD settings.

Question 2

Which THREE of the following are valid types of Client Provisioning Resources?

Accepted Answer

AnyConnect Profile (XML). In Cisco ISE Client Provisioning, the valid Client Provisioning Resource types include the AnyConnect Profile (XML), which delivers an XML configuration profile that defines VPN, posture, and connection settings to the AnyConnect client, so option A is correct. The Compliance Module is also a valid resource type, as it supplies the posture assessment components (such as OPSWAT libraries) that the AnyConnect posture agent uses to evaluate endpoint compliance, making option C correct. The AnyConnect Core Package is likewise a valid Client Provisioning Resource, since it is the actual AnyConnect client installer package provisioned to endpoints, so option D is correct. Option B (Windows Update Agent) is not a Client Provisioning Resource type in ISE, and option E (Antivirus definition files) is not provisioned as a client provisioning resource either, as antivirus definitions are handled by the AV vendor rather than ISE client provisioning.

Answer

Windows Update Agent

Answer

Antivirus definition files

Question 3

What is the function of the 'PassiveID' feature in a distributed ISE deployment?

Accepted Answer

It provides user identity mapping without active probing. PassiveID in Cisco ISE is a service that listens to and analyzes existing network traffic (such as RADIUS accounting, DHCP, and SNMP) to build a user identity mapping without actively probing endpoints. It passively collects user and device information from sources like Active Directory logs, syslog, and NetFlow, associating IP addresses with usernames. This is especially useful for devices that cannot run an active supplicant or for guest/BYOD scenarios where active probing is not feasible. Thus, it provides identity mapping without generating additional network traffic or requiring active probes.

Answer

It enables redundant authentication

Answer

It replaces the need for PSNs

Answer

It caches RADIUS requests

Question 4

What is the benefit of using multiple TACACS+ Policy Sets?

Accepted Answer

To segment policies by device type or user group. Multiple TACACS+ Policy Sets allow you to segment policies by device type or user group, so different sets of rules can be applied to different network devices or administrative roles. This provides granular control over command authorization and accounting for diverse device populations.

Answer

To increase the speed of authentication

Answer

To reduce the need for shared secrets

Answer

To increase the number of users allowed

Question 5

What is the primary benefit of using native supplicant provisioning in ISE?

Accepted Answer

It leverages the built-in OS capabilities for connectivity. Native supplicant provisioning in Cisco ISE leverages the built-in 802.1X supplicant already present in the operating system (e.g., Windows Wired AutoConfig, macOS native supplicant) to establish network connectivity, rather than deploying a third-party supplicant like Cisco AnyConnect NAM. This reduces deployment complexity and cost while still enabling ISE to push configuration profiles and certificates to the endpoint.

Answer

It provides complete control over the device's file system

Answer

It encrypts the entire hard drive

Answer

It removes the need for RADIUS authentication

Question 6

A network administrator is adding a new Cisco IOS router to Cisco ISE for TACACS+ device administration. The administrator needs to ensure that ISE recognizes the router and accepts its TACACS+ requests. What must be configured in ISE for the router?

Accepted Answer

Add the router as a Network Device with its IP address and shared secret.. For Cisco ISE to accept TACACS+ requests from a router, the router must be defined as a Network Device in ISE. This configuration includes the device's IP address and a shared secret that matches the one on the router. Without this, ISE will not process the requests. Authorization policies and other settings are applied after the device is recognized.

Answer

Create an Authorization Policy that permits all commands.

Answer

Add the router to an Identity Group.

Answer

Configure a RADIUS server on the router pointing to ISE.

Question 7

Which THREE of the following are common reasons why an endpoint would be listed as 'Unknown' in Cisco ISE?

Accepted Answer

The endpoint has not generated enough traffic to trigger a probe.. Option C is correct because Cisco ISE profiling relies on collecting attributes from network traffic and other sources; if an endpoint has not generated enough traffic, insufficient attributes are gathered and the endpoint remains in the Unknown state. Option D is correct because profiling probes (such as SNMP, DHCP, RADIUS, NetFlow, and HTTP) must be enabled on the Policy Services Node (PSN); if the required probes are disabled, ISE cannot collect the endpoint attributes needed to identify it. Option E is correct because even when attributes are collected, ISE must match them against configured profiling policies; if no profiling policy matches the collected attributes, the endpoint is classified as Unknown. Option A is not necessarily correct because ISE can profile endpoints on non-Cisco switches using probes like DHCP, RADIUS, and NetFlow, so the switch vendor alone does not cause Unknown status. Option B is not necessarily correct because ISE can profile endpoints that do not use 802.1X through other probes such as DHCP, SNMP, and NetFlow, so lack of 802.1X alone does not make an endpoint Unknown.

Answer

The device is connected to a non-Cisco switch.

Answer

The endpoint is not using 802.1X.

Question 8

Which TWO of the following are valid ways to provide access to a guest user?

Accepted Answer

Bypassing login via a Hotspot portal.. Option A is correct because a Hotspot portal is a standard Cisco ISE guest-access method that lets visitors self-register or click through a web page and be granted network access without requiring pre-created credentials, effectively bypassing a traditional login. Option B is correct because the Guest Portal (Sponsored or Self-Registered guest flow) authenticates guest users with a username and password stored in the ISE internal guest identity store, which is the canonical way to provide credentialed guest access. Option C is not a valid guest-access method here because a VPN tunnel is a remote-access technology, not a guest onboarding/authentication mechanism in this context. Option D is not correct because assigning a static IP only provides addressing, not authentication or authorization for a guest. Option E is not correct because authenticating via the CLI on the NAD is an administrative/device-management action, not a supported way to grant a guest user network access.

Answer

Connecting via VPN tunnel only.

Answer

Using a static IP assigned by the administrator.

Answer

Authenticating via the CLI on the NAD.

Question 9

You are troubleshooting an issue where IP phones are not being profiled. The SNMP read community string on the switch does not match the one configured in ISE. What is the expected behavior?

Accepted Answer

The SNMP Query probe will fail to collect CDP/LLDP data from the switch.. The SNMP Query probe in ISE polls the switch via SNMP to retrieve CDP/LLDP neighbor data for profiling. If the SNMP read community string configured in ISE does not match the switch, the SNMP query fails and ISE cannot collect that CDP/LLDP data, so profiling is degraded or fails. This is the expected behavior described in option C.

Answer

The endpoint will be profiled based on the MAC OUI only.

Answer

The SNMP trap probe will still work.

Answer

ISE will automatically update the community string on the switch.

Question 10

You need to allow users to remediate a non-compliant status manually. Which feature allows them to 'retry' the posture check after they have fixed the issue?

Accepted Answer

Re-scan button in the AnyConnect agent UI. The Re-scan button in the AnyConnect agent UI allows users to manually trigger a posture re-assessment after they have remediated the issue. This button is available in the AnyConnect posture module interface, enabling users to retry the posture check without waiting for a periodic scan or re-authenticating. It is the feature designed for manual remediation retry.

Answer

A remediation link that triggers a command

Answer

A periodic re-scan timer in the posture policy

Answer

Re-authentication via the 802.1X supplicant

Question 11

If a user is assigned a Shell Profile with a specific 'Auto-Command' configured, what happens when they log into the network device?

Accepted Answer

The command is executed on the device upon login. When a user is assigned a Shell Profile with an 'Auto-Command' configured in Cisco ISE, that command is automatically executed on the network device immediately after the user successfully logs in via TACACS+. This is often used to restrict users to a specific menu or command, enhancing security and simplifying access.

Answer

The user is immediately disconnected

Answer

The user is prompted to run the command manually

Answer

The shell profile is ignored

Question 12

You are deploying a Posture agent using the Web Agent. Which mechanism does the Web Agent use to perform compliance checks on a Windows machine?

Accepted Answer

It uses a temporary ActiveX or Java component to scan the system.. The Cisco ISE Web Agent is a clientless posture solution that uses a temporary ActiveX control (for Internet Explorer) or Java applet (for other browsers) to perform posture checks on Windows machines. This component is downloaded and executed within the browser session to gather endpoint information such as antivirus status, OS patches, and registry settings. Once the compliance assessment is complete, the temporary component is removed, leaving no persistent software on the endpoint.

Answer

It performs deep packet inspection to determine compliance.

Answer

It requires the full AnyConnect VPN client to be pre-installed.

Answer

It communicates directly with the Microsoft Update server.

Answer

It relies on WMI calls initiated by the ISE server.

Question 13

Which THREE resources are monitored via the ISE dashboard to ensure deployment health?

Accepted Answer

CPU utilization. The Cisco ISE dashboard's System Health/Deployment Health monitoring reports the appliance's core system resources, and CPU utilization (A) is one of them because sustained high CPU on a PSN or PAN degrades authentication and policy-processing throughput. Memory usage (B) is also monitored, since ISE services such as the profiler, session directory, and M&T database can exhaust RAM and cause service failures if not tracked. Disk space usage (E) is the third monitored resource, as ISE depends on local disk for logging, the M&T data store, and backups, and low disk space triggers alarms and can halt logging or database operations. Bandwidth per user (C) is not a node-level health resource tracked by the ISE dashboard; it is a network-traffic metric, not an ISE appliance resource. Temperature of the appliance (D) is not reported by the ISE dashboard either; hardware thermal status is handled by the underlying platform/CIMC or hypervisor, not by ISE's deployment-health monitoring.

Answer

Bandwidth per user

Answer

Temperature of the appliance

Question 14

In a distributed environment, if the Primary PAN goes offline, what happens to the Secondary PAN?

Accepted Answer

It remains in Secondary mode until manually promoted. In a Cisco ISE distributed deployment, the Secondary PAN does not automatically take over the Primary role. The Secondary PAN remains in a standby state and must be manually promoted via the ISE CLI (application configure ise) or GUI before it can serve as the active Primary PAN. This design prevents split-brain scenarios where two nodes simultaneously believe they are Primary.

Answer

It disconnects from the PSNs

Answer

It stops accepting configuration changes

Answer

It automatically assumes the Primary role

Question 15

Which probe is required to collect the 'User-Agent' string from a web browser to assist in profiling a device as a workstation?

Accepted Answer

HTTP. The HTTP probe in ISE collects attributes from HTTP traffic, including the User-Agent string sent by web browsers. This string (e.g., 'Mozilla/5.0 ... Windows NT 10.0 ...') is a key fingerprint used to profile a device as a workstation. Without the HTTP probe, ISE would not see the User-Agent and would have to rely on other probes like DHCP or RADIUS, which do not carry that information.

Answer

RADIUS

Answer

DHCP

Answer

DNS