SISE Practice Test 14 — 15 Questions

Question 1

Which portal is intended for guest users to manage their own registered devices, such as adding or removing their personal laptops?

Accepted Answer

My Devices Portal. The My Devices Portal is specifically designed for end users (including guests) to self-register, add, and remove their personal devices, such as laptops and smartphones, without sponsor intervention. It provides a self-service interface for device management tied to the user's account.

Answer

Hotspot Portal

Answer

Sponsor Portal

Answer

Guest Portal

Question 2

You are configuring a DHCP probe on a Cisco ISE node to identify endpoints. Which specific configuration step is required to ensure the ISE node receives DHCP traffic when the client and server are on a different subnet?

Accepted Answer

Configure an IP helper-address on the Layer 3 device for the client VLAN pointing to the ISE node.. To ensure the ISE node receives DHCP traffic when the client and DHCP server are on different subnets, you must configure an IP helper-address on the Layer 3 device (e.g., router or switch) for the client VLAN, pointing to the ISE node. This relays DHCP packets to ISE, allowing the DHCP probe to collect profiling data. Thus, option C is correct.

Answer

Configure a DHCP relay agent on the ISE node itself.

Answer

Enable DHCP Server mode on the Cisco ISE Profiling service.

Answer

Enable DHCP Snooping on the ISE node interface.

Question 3

Which probe is most effective for identifying the specific operating system and browser type of an endpoint connecting via a web portal?

Accepted Answer

HTTP probe. The HTTP probe is the most effective for identifying OS and browser type because it collects User-Agent strings and other HTTP headers sent by the endpoint's browser during web portal authentication. These headers contain detailed information about the operating system, browser name, and version, which ISE uses to match profiling policies. No other probe provides this level of browser-specific detail.

Answer

DHCP probe

Answer

MAC OUI probe

Answer

DNS probe

Question 4

Which Cisco ISE construct is used to combine authentication and authorization policies into a single logical container?

Accepted Answer

Policy Set. A Policy Set in Cisco ISE is the top-level container that binds together authentication and authorization policies for a specific set of conditions (e.g., matching a device type, protocol, or network device). It allows you to define a single logical unit where the authentication policy (who can authenticate) and authorization policy (what they are allowed to do) are evaluated in sequence. This structure simplifies management by grouping related rules, and ISE evaluates policy sets in a top-down order based on their rank. The correct answer is Policy Set because it is explicitly designed to combine these two policy types into one container.

Answer

Identity Source Sequence

Answer

Policy Elements

Answer

Authorization Profile

Question 5

In the BYOD flow, what occurs immediately after the user provides credentials in the portal?

Accepted Answer

The device is provisioned with a certificate. In the BYOD flow, after the user authenticates to the device registration portal, ISE provisions the device with a certificate (typically an X.509 client certificate from the internal CA) so the device can be trusted for future 802.1X/EAP-TLS authentications. This certificate-based trust is the core of the BYOD onboarding process.

Answer

The device is automatically moved to the production VLAN

Answer

The user is disconnected from the network

Answer

The device is registered in the Active Directory

Question 6

Which component in Cisco ISE defines the TACACS+ privilege levels and attributes sent to the network device?

Accepted Answer

Shell Profile. The Shell Profile in Cisco ISE is the authorization component that defines the TACACS+ privilege level (e.g., Privilege 15) and shell attributes such as idle timeout and session timeout that are returned to the network device in the TACACS+ authorization response. It is referenced from the Authorization Policy result and determines the user's shell-level access on the device.

Answer

Command Set

Answer

Network Device Group

Answer

Authorization Policy

Question 7

A company uses Cisco ISE BYOD with certificate-based authentication. Employees report that their devices successfully onboard and receive a certificate, but after a few days, they are unable to connect to the corporate SSID. The administrator checks ISE and finds that the devices are failing authentication with the error 'Certificate revoked'. The administrator verifies that the certificates are still valid and not expired. Which ISE feature should the administrator check to resolve this issue?

Accepted Answer

Certificate Revocation List (CRL) distribution point and ISE's revocation check settings. The 'Certificate revoked' error means ISE's revocation check is determining the certificate is revoked. This typically occurs when the CRL distribution point is unreachable, the CRL is stale, or the certificate is incorrectly listed as revoked. The administrator should verify the CRL distribution point in the certificate and ISE's revocation settings. Ensuring ISE can retrieve a current CRL and that the certificate is not actually revoked will resolve the authentication failures.

Answer

Certificate Revocation List (CRL) settings in the certificate template

Answer

Certificate template's validity period and renewal settings

Answer

Online Certificate Status Protocol (OCSP) configuration in ISE

Question 8

Which TWO of the following are true regarding the order of operations in Cisco ISE policy evaluation?

Accepted Answer

Policy sets are evaluated from top to bottom based on the list order. Option B is correct because Cisco ISE evaluates policy sets sequentially in the order they appear in the Policy Sets list, from top to bottom, and stops at the first policy set whose conditions match the request. Option D is correct because within a matched policy set, authorization rules are also evaluated top to bottom, and the first rule whose conditions match is applied (unless the rule is configured to continue). Option A is wrong because policy sets are not evaluated simultaneously; ISE processes them in a defined sequential order. Option C is wrong because authentication policies are always evaluated before authorization policies within a policy set—a user must be authenticated before authorization rules can be applied. Option E is wrong because the default policy set in Cisco ISE cannot be deleted, ensuring there is always a fallback for unmatched requests.

Answer

All policy sets are evaluated simultaneously

Answer

Authorization policies are evaluated before authentication policies

Answer

The default policy set can be deleted

Question 9

Which THREE of the following items must be configured to ensure a successful SNMP Trap profiling implementation?

Accepted Answer

Add the network switch to the ISE Network Devices list.. Option A is correct because the switch sending SNMP traps must exist as a Network Device in ISE, which provides the shared secret and device definition ISE uses to authenticate and process incoming SNMP traffic from that switch. Option B is correct because the SNMP Trap probe must be enabled on the ISE PSN that will receive the traps; without this probe running, ISE will not listen for or process SNMP trap notifications. Option D is correct because the switch itself must be configured with the ISE PSN as a trap destination (snmp-server host <PSN-IP> ...), otherwise no traps are ever sent to ISE and profiling data is never collected. Option C is not required because the HTTP probe is used for HTTP-based profiling (User-Agent, URL data) and is unrelated to receiving SNMP traps. Option E is not required because DHCP Snooping is a Layer 2 switch security feature for DHCP traffic, not a prerequisite for SNMP Trap profiling.

Answer

Enable HTTP probe.

Answer

Configure DHCP Snooping.

Question 10

When setting up TACACS+ for network administration, which THREE configurations must be present on the Cisco network device? (Choose three)

Accepted Answer

AAA authentication/authorization commands. Option A is correct because the device must be configured with AAA commands such as 'aaa new-model' and 'aaa authentication login' / 'aaa authorization exec' to actually invoke TACACS+ for administrative access. Option D is correct because the TACACS+ shared secret (key) configured on the Cisco device must exactly match the key configured on the ISE/TACACS+ server, otherwise authentication packets are rejected. Option E is correct because you must define a TACACS+ server group (e.g., 'aaa group server tacacs+') and add the TACACS+ server host(s) to it so the AAA method lists can reference that group. Option B is not required because a local user database is only a fallback for when the TACACS+ server is unreachable, not a mandatory part of TACACS+ administration. Option C is not required because RADIUS is a separate AAA protocol and is not needed when implementing TACACS+.

Answer

Local user database for all commands

Answer

RADIUS server configuration

Question 11

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

Accepted Answer

NetworkDevice:Name. The NetworkDevice:Name condition in Cisco ISE allows you to match requests based on the name of the network device (WLC) as defined in ISE's network device repository. This is the correct condition to ensure a policy set only applies to requests originating from a specific WLC, because the WLC is a network device and its name is a unique identifier in ISE.

Answer

Radius:NAS-IP-Address

Answer

Radius:Called-Station-ID

Answer

Device:Model

Question 12

Which menu path is used to view the status of all nodes in an ISE deployment?

Accepted Answer

Administration > System > Deployment. In Cisco ISE, the status of all nodes in a deployment is viewed under Administration > System > Deployment. This page lists every node, its persona (PAN, PSN, MnT), role (Primary/Secondary), and operational status, allowing administrators to monitor node health and synchronization.

Answer

Operations > Reports

Answer

Administration > Maintenance

Answer

Policy > Policy Elements

Question 13

What is the purpose of the 'Endpoint Identity Group' in the context of profiling?

Accepted Answer

To classify devices for use in authorization policy rules.. The Endpoint Identity Group in Cisco ISE is used to classify devices based on their profiling attributes. These groups are then referenced in authorization policy rules to apply appropriate access controls. For example, a group 'Printers' can be used in an authorization rule to grant printers access to specific network resources. Thus, its primary purpose is to classify devices for use in authorization policy rules.

Answer

To manage authentication credentials.

Answer

To store device hardware serial numbers.

Answer

To define which PSN handles the device.

Question 14

When decommissioning an ISE node, what is the correct order of steps?

Accepted Answer

Remove from deployment, then shut down. The correct decommissioning sequence is to first remove the node from the ISE deployment via the PAN (Deregister), then shut it down. Removing the node from the deployment first ensures the PAN stops replicating configuration to it and other nodes stop forwarding logs or authentication requests to it, preventing orphaned references and replication errors.

Answer

Change node to standalone, then remove

Answer

Shut down the node, then remove from deployment

Answer

Re-image the node, then remove from deployment

Question 15

When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?

Accepted Answer

Authorization Policy. The Authorization Policy column in the ISE live logs shows the exact authorization rule that was evaluated and matched for a given session. When a user or endpoint attempts access, ISE processes the request through the authentication policy, then the authorization policy, and the live log records which specific rule within the authorization policy was hit. This allows administrators to quickly identify which condition (e.g., AD group, posture status, device type) triggered the result, such as PermitAccess or DenyAccess.

Answer

Authentication Policy

Answer

Policy Set

Answer

Result