SISE Practice Test 17 — 15 Questions

Question 1

A user reports that their BYOD device is not being recognized as 'Compliant' even though the MDM shows it is compliant. Which ISE component is responsible for retrieving this status?

Accepted Answer

The ISE MDM Server connector. The ISE MDM Server connector is the component that communicates directly with external MDM systems (such as Intune, AirWatch, or MobileIron) to retrieve device compliance status. It uses the MDM API to poll or receive push notifications about device posture, then feeds that data into ISE's authorization policies. Without this connector, ISE would have no way to know whether a BYOD device meets compliance requirements, even if the MDM itself reports it as compliant.

Answer

The ISE Policy Information Point (PIP)

Answer

The ISE Monitoring node

Answer

The ISE RADIUS service

Question 2

You need to ensure that the AnyConnect posture agent is updated automatically. Where is this configured?

Accepted Answer

Client Provisioning Policy. The Client Provisioning Policy in Cisco ISE determines which software (such as the AnyConnect posture agent) is provisioned to endpoints and how it is updated. To ensure the AnyConnect posture agent is updated automatically, you configure the Client Provisioning Policy to point to the latest AnyConnect package and enable automatic upgrades. This policy controls the provisioning and update behavior.

Answer

Posture Policy > Settings

Answer

Posture Requirements

Answer

Remediation Actions

Question 3

What is the effect of setting a Posture Requirement to 'Optional'?

Accepted Answer

The user can choose to bypass the check without being blocked. Setting a posture requirement to 'Optional' means the check is still evaluated and reported, but the user is not blocked if it fails — they can choose to continue without remediation. This is used for monitoring or gradual rollout rather than enforcement.

Answer

The agent only checks when requested by the user

Answer

The agent will not perform the check at all

Answer

The device is automatically granted access

Question 4

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

Accepted Answer

By creating a Network Device Group. Creating a Network Device Group (NDG) is the best way to group network devices by location so that authorization policies can differentiate them. NDGs can be hierarchical (e.g., Location#Branch) and are referenced directly in policy conditions, making location-based policy enforcement clean and scalable.

Answer

By using IP address ranges in the policy

Answer

By tagging them with SGTs

Answer

By using the Device Name in the condition

Question 5

A user is authenticating using EAP-TLS. Where is the certificate validation policy configured in ISE?

Accepted Answer

Allowed Protocols. In ISE, the certificate validation policy for EAP-TLS is configured under Allowed Protocols. This is where you enable EAP-TLS and configure whether to validate the client certificate against a specific CA, check certificate revocation, and set other TLS-specific options. The Allowed Protocols service is the central place for EAP method configuration.

Answer

Identity Source Sequence

Answer

Authorization Profile

Answer

Policy Set Condition

Question 6

You are implementing 'Device Administration' (TACACS+) and want to restrict an admin to 'show' commands only. How do you construct this policy?

Accepted Answer

Create a command set with 'show' and assign to an authorization policy rule. To restrict a TACACS+ admin to 'show' commands only, you create a Command Set that defines the permitted commands (e.g., 'show') and then assign that Command Set to an Authorization Policy rule that matches the admin's identity or group. The Command Set is the ISE object that specifies which commands are allowed or denied, and the Authorization Policy rule applies it to the session.

Answer

Use the 'Admin' group in the authentication policy

Answer

Create a shell profile with privilege level 1

Answer

Configure a dACL on the device

Question 7

Which TWO of the following represent ways to verify the posture status of an endpoint?

Accepted Answer

View the status in the AnyConnect agent UI. Option B is correct because the Cisco AnyConnect (Secure Client) agent UI displays the endpoint's posture status directly, showing whether the system has passed or failed the posture policy checks performed by the agent in conjunction with ISE. Option E is correct because ISE's Posture Assessment Report provides a centralized view of posture results, including compliance details for each endpoint that has undergone posture evaluation. Option A is incorrect because DHCP server logs only record IP address lease assignments and contain no posture or compliance information. Option C is incorrect because switch port configuration defines Layer 2 settings such as VLANs, trunking, and port security, not endpoint posture state. Option D is incorrect because an AAA traffic dump captures RADIUS authentication and authorization exchanges but does not present a usable posture status verification view.

Answer

Check the DHCP server logs

Answer

Review the switch port configuration

Answer

Analyze the AAA traffic dump

Question 8

You are troubleshooting a scenario where an admin cannot execute a specific command despite the Command Set having 'Permit' for that command. What is a common reason?

Accepted Answer

The command is blocked by the switch's local configuration. A common reason a permitted command still fails is that the switch's local configuration blocks it. For example, local command authorization, privilege-level restrictions, or AAA command authorization configured locally on the device can deny a command even when ISE's Command Set permits it. The device's local policy takes precedence or acts as an additional gate.

Answer

The ISE Policy Set has 'Deny' as the default

Answer

The user is in the wrong AD group

Answer

The TACACS+ shared secret is incorrect

Question 9

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

Accepted Answer

It defines the privilege level for the session. The Shell Profile in TACACS+ defines the privilege level for the session. When a user authenticates via TACACS+, the Shell Profile is used to specify the privilege level (e.g., privilege 15) that the user will have on the device. This determines what commands the user can execute. The Shell Profile is part of the authorization process and is often configured on the TACACS+ server.

Answer

It stores the device credentials

Answer

It defines which users can access the device

Answer

It defines the list of allowed commands

Question 10

Which of the following is a requirement for a successful BYOD certificate provisioning flow?

Accepted Answer

The client must have the Root CA certificate installed in its trusted store. For BYOD certificate provisioning (e.g., via the native supplicant or Cisco Network Setup Assistant), the client must trust the ISE certificate chain, which requires the Root CA certificate to be installed in the client's trusted store. Without that trust anchor, the TLS handshake during enrollment fails and the certificate cannot be provisioned. This is a fundamental PKI requirement for any certificate-based onboarding flow.

Answer

The client must use a specific third-party supplicant

Answer

The client must be joined to the Active Directory domain

Answer

The device must be managed by the same MDM as the enterprise devices

Question 11

A network administrator needs to implement self-registered guest access where the guest must provide an email address for validation. Which feature in the Guest Portal settings allows for this?

Accepted Answer

Registration Form settings.. The Registration Form settings in the ISE Guest Portal configuration control the fields presented to self-registering guests, including the option to require an email address for validation. Enabling the email field with validation forces guests to enter a valid email before the account is created and credentials are delivered. This is the specific portal-level feature that governs what data guests must supply during self-registration.

Answer

Authentication Policy rules.

Answer

Guest Type settings.

Answer

Device Registration settings.

Answer

Sponsor Group settings.

Question 12

Which port does Cisco ISE use by default for TACACS+ communication with network devices?

Accepted Answer

TCP 49. TACACS+ uses TCP port 49 by default for all communication between the network access device and the AAA server such as Cisco ISE. This is a well-known, IANA-registered port specifically assigned to the TACACS+ protocol. ISE listens on TCP 49 for TACACS+ requests from NADs.

Answer

TCP 8443

Answer

UDP 1812

Answer

UDP 1645

Question 13

In the context of TACACS+, what is the purpose of the 'Network Device Group'?

Accepted Answer

To organize devices for policy assignment. In TACACS+, a Network Device Group (NDG) is used to logically group network devices (e.g., by location, type, or function) so that policies, command sets, and authorization rules can be applied to the group rather than individual devices. This simplifies management and enables scalable policy assignment.

Answer

To enable remote logging

Answer

To set the shared secret for all devices in the group

Answer

To update the device firmware

Question 14

Which TWO of the following are valid components of a TACACS+ Authorization Policy in Cisco ISE? (Choose two)

Accepted Answer

Shell Profile. In Cisco ISE, a TACACS+ Authorization Policy is built from authorization results that define what an authenticated user is permitted to do on a network device, and the two valid components here are the Shell Profile (C) and the Command Set (E). The Shell Profile (C) is correct because it defines the privilege level and shell attributes (such as default privilege, maximum privilege, and auto-command) that ISE returns in the TACACS+ authorization response to control the user's CLI session. The Command Set (E) is correct because it specifies the set of commands (permit/deny with optional arguments) that the user is authorized to execute, and it is referenced by the Shell Profile or applied directly in the authorization result. User Password (A) is not a TACACS+ authorization component; it is authentication data handled during the authentication phase. RADIUS attribute list (B) is incorrect because RADIUS attributes belong to RADIUS-based authorization, not TACACS+ authorization policy components. Device Shared Secret (D) is incorrect because it is a credential used to secure communication between the network device and ISE, not a component of the authorization policy itself.

Answer

User Password

Answer

RADIUS attribute list

Answer

Device Shared Secret

Question 15

What is the purpose of the 'Redirect ACL' on the network access device?

Accepted Answer

To permit access to the ISE portal while blocking all other traffic. The Redirect ACL on the NAD (switch/WLC) is a pre-auth ACL that permits only the traffic required to reach the ISE portal (DNS, DHCP, HTTP/HTTPS to ISE) and denies everything else, forcing the client into the guest/BYOD/posture flow. Once the client is authorized, ISE sends a CoA that replaces the redirect ACL with the appropriate authorization ACL (e.g., full access or limited access). This is the mechanism that makes centralized web authentication and BYOD onboarding work.

Answer

To encrypt the traffic between the client and the switch

Answer

To limit the bandwidth for BYOD users

Answer

To force the client to use a specific DNS server