SISE Practice Test 15 — 15 Questions

Question 1

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

Accepted Answer

NAS-Port-Type. The 'NAS-Port-Type' attribute is standard for identifying the access medium (e.g., Wireless-802.11 vs. Ethernet).

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

Device-Name

Question 2

You need to allow guest users to access specific internal resources (like a printer) while they are connected to the Guest network. How do you configure this in ISE?

Accepted Answer

Assign a downloadable ACL (dACL) in the Authorization Profile.. Authorization Profiles define the permissions for the user. By assigning a specific dACL that permits access to the printer, you allow that traffic.

Answer

Enable Guest VLAN assignment.

Answer

Modify the Redirect ACL on the switch.

Answer

Configure a port-based ACL on the switch interface.

Question 3

Which attribute is used to enforce dACLs on a Cisco Catalyst switch from ISE?

Accepted Answer

cisco-av-pair. The 'cisco-av-pair' attribute with the 'ip:inacl#x=...' format is the standard way to push dACLs.

Answer

Filter-Id

Answer

Class attribute

Answer

Tunnel-Private-Group-ID

Question 4

Which of the following is a valid condition for an ISE Authorization Policy?

Accepted Answer

Device-Type EQUALS Switch. ISE conditions can be based on device type, user group, location, or protocol.

Answer

SGT EQUALS 5

Answer

VLAN EQUALS 10

Answer

Username EQUALS 'Admin'

Question 5

Which ISE menu path is used to create a new Authorization Profile?

Accepted Answer

Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles.

Answer

Policy -> Policy Sets -> Add

Answer

Policy -> Policy Elements -> Conditions

Answer

Administration -> Identity Management -> Groups

Question 6

Which TWO of the following are valid locations to check for policy match results in ISE?

Accepted Answer

Live Logs. You can verify matches in the Live Logs and the Policy Simulation tool.

Answer

Device Administration console

Answer

Identity Group properties

Answer

RADIUS Secret settings

Question 7

You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?

Accepted Answer

In the Authorization Policy rule conditions. The authorization policy within a policy set is where you define the conditions and the corresponding permissions based on attributes like the Internal Endpoint Group.

Answer

In the Results section of the Authentication Policy

Answer

In the RADIUS dictionary under Policy Elements

Answer

In the Policy Set general authentication settings

Question 8

Which TWO settings in an Authorization Profile are commonly used to restrict a client's network access?

Accepted Answer

dACL name. Authorization Profiles can restrict access by applying a dACL or by assigning a specific VLAN (or both).

Answer

SGT propagation

Answer

Authentication protocol

Answer

Identity Source

Question 9

Which TWO of the following are necessary to correctly configure a custom profiling condition based on DHCP attributes?

Accepted Answer

Define a matching operator (e.g., equals, contains).. A custom condition requires selecting the specific DHCP attribute (e.g., Option 60) and defining the value to match.

Answer

Enable HTTP profiling.

Answer

Configure a static IP on the endpoint.

Answer

Clear the MAC address table on the switch.

Question 10

You need to ensure that only specific ISE nodes perform the NMAP scan probe. Where is this configured?

Accepted Answer

Administration > System > Deployment > [Node Name] > Profiling Configuration. Probe configuration, including which node collects which data, is handled in the Profiling Configuration tab for each PSN.

Answer

Administration > System > Settings > Profiling Feed

Answer

Policy > Profiling > Profiling Policies

Answer

Policy > Policy Elements > Results

Question 11

Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?

Accepted Answer

Common Tasks -> Web Redirection. The 'Web Redirection' checkbox under the Authorization Profile allows configuring the Centralized Web Authentication (CWA) URL.

Answer

RADIUS Attributes -> Tunnel-Private-Group-ID

Answer

Advanced Attributes -> ACL

Answer

VLAN/dACL Filters

Question 12

What is the primary benefit of using a Policy Set compared to the legacy 'Rule-Based' approach in ISE?

Accepted Answer

Improved logical organization and modularity. Policy Sets provide a hierarchical and modular structure, allowing for easier management of different authentication/authorization policies.

Answer

Requires fewer licenses

Answer

Eliminates the need for external identity sources

Answer

Faster performance

Question 13

Which TWO of the following authentication protocols are supported by ISE for 802.1X?

Accepted Answer

EAP-TLS. PEAP and EAP-TLS are the most common protocols used with ISE.

Answer

SNMPv2

Answer

ICMP

Answer

FTP

Question 14

You have a policy set where authentication succeeds, but the user is hitting the 'Default' authorization rule instead of the expected rule. What should you check first?

Accepted Answer

The Authorization rule order. The order of rules in the Authorization Policy is critical; if a rule appears below a more general rule that also matches, the more general one wins.

Answer

The RADIUS dictionary version

Answer

The Identity Store order

Answer

The Policy Set name

Question 15

Which of the following is NOT a valid probe type in Cisco ISE?

Accepted Answer

ICMP. 'ICMP' is not a dedicated probe type for profiling in the Cisco ISE interface; it is used for connectivity testing.

Answer

SNMP Query

Answer

DHCP

Answer

RADIUS