SISE Practice Test 17 — 15 Questions

Question 1

Which THREE of the following are common reasons why an endpoint would be listed as 'Unknown' in Cisco ISE?

Accepted Answer

The endpoint has not generated enough traffic to trigger a probe.. 'Unknown' means the device hasn't been classified; this happens if no policies match, if probes are disabled, or if insufficient attributes are collected.

Answer

The device is connected to a non-Cisco switch.

Answer

The endpoint is not using 802.1X.

Question 2

Which protocol does the Cisco ISE use to inform the NAD that a guest user's session state has changed (e.g., from 'redirect' to 'authenticated')?

Accepted Answer

RADIUS CoA. Change of Authorization (CoA) is the mechanism used by RADIUS to update an active session.

Answer

HTTP

Answer

SNMP

Answer

TACACS+

Question 3

Which TWO of the following are true regarding the order of operations in Cisco ISE policy evaluation?

Accepted Answer

Policy sets are evaluated from top to bottom based on the list order. ISE evaluates policy sets first, then moves to the selected policy set to evaluate individual rules. Within a set, authentication rules are checked before authorization rules.

Answer

All policy sets are evaluated simultaneously

Answer

Authorization policies are evaluated before authentication policies

Answer

The default policy set can be deleted

Question 4

Which THREE of the following are valid methods for collecting endpoint attributes for profiling in Cisco ISE?

Accepted Answer

HTTP User-Agent. The probes that gather data include DHCP, SNMP, and HTTP.

Answer

FTP inspection

Answer

SSH terminal login

Question 5

When setting up a custom endpoint identity group for printers, what is the best practice for assigning devices to that group?

Accepted Answer

Use a Profiling Policy to automatically assign the device to the 'Printers' Identity Group.. Using a profiling policy to automatically assign endpoints to a group based on matching conditions is the most scalable approach.

Answer

Manually add every printer MAC address to the group.

Answer

Import a CSV file periodically.

Answer

Use an Authorization Policy to bypass profiling.

Question 6

What is the purpose of the 'Endpoint Identity Group' in the context of profiling?

Accepted Answer

To classify devices for use in authorization policy rules.. Endpoint Identity Groups are used to organize devices into logical categories, which are then used in Authorization Policies.

Answer

To manage authentication credentials.

Answer

To store device hardware serial numbers.

Answer

To define which PSN handles the device.

Question 7

Which THREE of the following are valid ways to trigger a profiling scan or update for an endpoint in Cisco ISE?

Accepted Answer

Manually trigger 'Re-profile' in Context Visibility.. Endpoints can be re-profiled via manual refresh, CoA events, or changes in probe data.

Answer

Change the device's IP address.

Answer

Modify the endpoint's MAC address.

Question 8

What is the impact of changing the 'Minimum Certainty Factor' in a Profiling Policy?

Accepted Answer

It requires more attributes to match before the policy is triggered.. A higher threshold requires more matching attributes, making the profiling more restrictive and potentially less likely to match.

Answer

It triggers an automatic purge of endpoint cache.

Answer

It disables the probe for that policy.

Answer

It changes the priority of the policy.

Question 9

You need to create a custom profiling condition to identify printers based on their MAC OUI. Which menu path should you use to define this condition?

Accepted Answer

Policy > Profiling > Profiling Conditions. Custom conditions are managed within the Policy > Profiling > Profiling Conditions section.

Answer

Administration > System > Profiling

Answer

Policy > Policy Elements > Conditions

Answer

Context Visibility > Endpoints

Question 10

Which THREE of the following items are verified by ISE when a guest attempts to authenticate?

Accepted Answer

Account expiration date.. ISE checks the validity of the account (status), whether the account has expired, and if the specific credentials provided match the stored record.

Answer

The physical location of the NAD.

Answer

The user's browser version.

Question 11

When a new device connects, you notice it stays in the 'Unknown' profile state. You have confirmed the probes are active. What is the most likely step to fix this?

Accepted Answer

Create or update a Profiling Policy to match the collected attributes.. If the device is unknown, it likely does not match any existing policy rules; creating a new or adjusting an existing policy is the standard fix.

Answer

Increase the SNMP timeout.

Answer

Disable and re-enable the PSN service.

Answer

Delete the endpoint from the database.

Question 12

Which TWO of the following are required to successfully profile a device using SNMP Query?

Accepted Answer

The device must have the SNMP Query probe enabled.. SNMP query requires the network device to be added to ISE and the correct community string to be configured.

Answer

The device must support DHCP Option 150.

Answer

The device must have a static IP address.

Answer

The device must be running an SNMP Agent.

Question 13

A network administrator needs to implement self-registered guest access where the guest must provide an email address for validation. Which feature in the Guest Portal settings allows for this?

Accepted Answer

Registration Form settings.. The 'Self-Registration' page settings in the Guest Portal configuration allow enabling fields such as 'Email Address' and configuring the 'Email Validation' mechanism.

Answer

Authentication Policy rules.

Answer

Guest Type settings.

Answer

Device Registration settings.

Answer

Sponsor Group settings.

Question 14

Which TWO of the following are true regarding the 'Certainty Factor' in a Profiling Policy?

Accepted Answer

It allows ISE to weigh the importance of different attribute matches.. The Certainty Factor is a weight applied to attributes to determine the confidence of a profile match, and it is configured within the profiling policy.

Answer

It is a global setting for the entire ISE deployment.

Answer

It is updated automatically by the Feed Service.

Answer

It can only be used with SNMP probes.

Question 15

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

Accepted Answer

The NAD is missing the 'aaa server radius dynamic-author' configuration.. After successful portal authentication, ISE sends a RADIUS CoA to the NAD. If the NAD is not configured to accept CoA, the session remains in the initial state.

Answer

The Guest user group is missing from the Policy Set.

Answer

The Redirect ACL is applied to the wrong interface.

Answer

The portal URL is incorrect.