SISE Practice Test 13 — 15 Questions

Question 1

You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?

Accepted Answer

permit ip any any. After explicitly denying the specific subnet, you must permit the rest of the traffic with 'permit ip any any'.

Answer

deny ip any 10.1.1.0 0.0.0.255

Answer

permit tcp any any

Answer

deny ip any any

Question 2

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

Accepted Answer

SGT (Security Group Tag). Enforcement requires the SGT, the SGACL, and the enforcement device.

Answer

TACACS+ command set

Answer

RADIUS shared secret

Question 3

An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?

Accepted Answer

Authorization Profile. The dACL must be defined in the Policy Elements section and then referenced within an Authorization Profile, which is then assigned to the Authorization Policy.

Answer

Network Device Group

Answer

Policy Set Authentication Sequence

Answer

Device Administration Policy Set

Question 4

You are using the Feed Service to update your profiling policies. How can you ensure that custom profiling policies you have created are not overwritten during the update?

Accepted Answer

Custom policies are not affected by Feed Service updates.. Cisco ISE Feed Service updates do not overwrite custom policies; they only add or update predefined policies in the 'Cisco' folder.

Answer

Place custom policies in the system policy folder.

Answer

Export custom policies before every update.

Answer

Disable automatic updates.

Question 5

Which probe is required to collect the 'User-Agent' string from a web browser to assist in profiling a device as a workstation?

Accepted Answer

HTTP. The HTTP probe is specifically designed to extract information from HTTP/HTTPS traffic, including the User-Agent string.

Answer

RADIUS

Answer

DHCP

Answer

DNS

Question 6

You are implementing Cisco TrustSec and need to restrict traffic between two different SGTs on a Cisco Catalyst switch. Which policy component enforces this communication restriction?

Accepted Answer

SGACL. SGACLs are applied between source and destination SGTs on the enforcement device to control traffic based on group tags.

Answer

CTS Role-Based Policy

Answer

SGT Mapping

Answer

dACL

Question 7

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

Accepted Answer

Condition matching. Policy Sets are evaluated from top to bottom based on their defined conditions. The first matching condition wins.

Answer

Random selection

Answer

Alphabetical order

Answer

Authentication protocol

Question 8

You want to implement a 'Change of Authorization' (CoA) after a user changes their location. How is the CoA triggered by ISE?

Accepted Answer

ISE sends a RADIUS CoA message to the NAD. CoA is triggered by an event such as a change in authorization profile or an external API call, sending a message to the NAD.

Answer

The NAD sends a re-authentication request

Answer

It requires a manual port bounce

Answer

The user must log out and back in

Question 9

What is the purpose of an Authorization Profile's 'Common Tasks'?

Accepted Answer

To configure standard RADIUS attributes easily. Common Tasks provides an easy GUI interface to configure standard RADIUS attributes like VLAN, Voice Domain, and dACL without manual attribute entry.

Answer

To group devices together

Answer

To define user permissions for ISE UI

Answer

To store identity sources

Question 10

Which Cisco ISE construct is used to combine authentication and authorization policies into a single logical container?

Accepted Answer

Policy Set. Policy Sets in Cisco ISE aggregate authentication and authorization policies for specific traffic types (e.g., Wireless, Wired).

Answer

Identity Source Sequence

Answer

Policy Elements

Answer

Authorization Profile

Question 11

You are troubleshooting a scenario where an SGT is not being assigned to a session. You notice the Authorization Profile is correctly configured. What must be configured on the Network Access Device (NAD) to allow the SGT to be learned from the RADIUS Access-Accept?

Accepted Answer

Configure the CTS environment to support SGTs. The switch must be configured for Cisco TrustSec (CTS) and be capable of processing the SGT attribute sent in the RADIUS response.

Answer

Set the switch port to trunk mode

Answer

Enable Device Tracking

Answer

Enable 802.1X globally

Question 12

You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?

Accepted Answer

It sets the guest account status to 'Pending' until approved.. It forces the guest account status to be 'pending' until a sponsor manually updates it to 'approved', preventing network access until that happens.

Answer

It automatically emails the sponsor.

Answer

It sends a RADIUS request to the sponsor's device.

Answer

It allows the guest to bypass the login screen.

Question 13

A guest user successfully authenticates at the sponsor portal but cannot access the internet. You notice the session remains in the 'Pending' state. What is the most likely cause?

Accepted Answer

The sponsor has not approved the guest account request.. The 'Pending' state indicates that the sponsor or an administrator has not yet approved the account creation request, which is a common security feature in guest access flows.

Answer

The ISE node is not reachable via the DNS server specified in the guest VLAN.

Answer

The authorization policy is missing a 'permit access' rule for the guest account.

Answer

The guest password policy is incorrectly configured in the Guest Portal settings.

Question 14

Which TWO of the following tasks are performed within the Sponsor Portal?

Accepted Answer

Creating new guest accounts.. The sponsor portal is used by internal users to manage the lifecycle of guest accounts, such as creating, approving, or extending them.

Answer

Mapping VLANs to specific guest SSIDs.

Answer

Configuring global portal branding.

Answer

Defining RADIUS shared secrets.

Question 15

In an ISE Authorization Policy, what happens if no rules match a request?

Accepted Answer

The request hits the Default rule in the Policy Set. If no rules are matched, ISE falls through to the 'Default' rule within the policy set, which usually results in a 'Deny Access' action.

Answer

The request is sent to the primary PAN

Answer

The request is automatically permitted

Answer

The NAD closes the port