SISE Practice Test 18 — 15 Questions

Question 1

When adding a secondary PAN, what is the consequence if the time synchronization (NTP) differs significantly between nodes?

Accepted Answer

The registration process will fail. When adding a secondary PAN to a Cisco ISE deployment, time synchronization is critical for certificate validation and secure communication. If NTP differs significantly between nodes, the secondary PAN will fail to register because the certificate exchange and authentication processes require synchronized clocks. This is a common requirement in distributed systems to prevent replay attacks and ensure log integrity.

Answer

The node will operate in read-only mode

Answer

The node will join but logs will be out of order

Answer

Only TACACS+ services will be impacted

Question 2

A network engineer is adding a Cisco Catalyst 9300 switch to Cisco ISE for TACACS+ device administration. The switch will use a shared secret of 'C1sco123'. The engineer wants to ensure that ISE can authenticate and authorize administrative sessions from this device. Where should the shared secret be configured in ISE?

Accepted Answer

In the Network Device definition under Administration > Network Resources > Network Devices.. The shared secret for TACACS+ is a device-specific credential configured in the Network Device object in ISE. It must match the key on the switch. Command Sets and TACACS+ Profiles define authorization results, not authentication credentials. External RADIUS Servers are for outbound proxying. Therefore, the Network Device definition is the correct place to configure the shared secret.

Answer

In the TACACS+ Profile under Work Centers > Device Administration > Policy Elements > TACACS Profiles.

Answer

In the TACACS+ Command Set under Work Centers > Device Administration > Policy Elements > Command Sets.

Answer

In the External RADIUS Server configuration under Administration > External RADIUS Servers.

Question 3

A user reports that a device was incorrectly identified as a 'Cisco IP Phone' when it is actually a 'Cisco Access Point'. Which troubleshooting step should you take first?

Accepted Answer

Check the endpoint attributes in Context Visibility to see why it matched that policy.. The first troubleshooting step is to check the endpoint's attributes in Context Visibility, which shows the collected profiling attributes, the matched profiling policies, and the confidence scores that led to the 'Cisco IP Phone' classification. This reveals whether the misclassification is due to incorrect attributes (e.g., a stale MAC OUI match) or an overly broad profiling policy, allowing targeted correction.

Answer

Re-register the device.

Answer

Delete all profiling policies.

Answer

Restart the ISE node.

Question 4

Where are the TACACS+ accounting logs stored and viewed in the ISE management console?

Accepted Answer

Operations > TACACS Livelogs. TACACS+ accounting logs in Cisco ISE are viewed under Operations > TACACS Livelogs. This live log view shows real-time TACACS+ authentication, authorization, and accounting events, including command execution details, the user, the device, and the result. It is the primary troubleshooting and auditing interface for TACACS+ activity in the ISE GUI.

Answer

Monitoring > Reports > TACACS

Answer

Administration > System > Logging

Answer

Policy > Policy Elements

Question 5

Which component in ISE defines the 'result' of an authorization rule?

Accepted Answer

Authorization Profile. In ISE, an Authorization Profile defines the actual result of an authorization rule, such as VLAN assignment, DACL, SGT, or reauthentication timers. The authorization policy contains rules that reference authorization profiles as the 'then' action. Therefore, the component that defines the 'result' is the Authorization Profile.

Answer

Policy Set

Answer

Identity Source

Answer

Authorization Policy

Question 6

A user is assigned a Command Set that permits all commands, but they are still receiving 'Access Denied' when running 'reload'. What is the most likely reason?

Accepted Answer

The user's privilege level on the device is insufficient. Even if a Command Set permits all commands, the user must have a sufficient privilege level on the device to execute privileged commands like 'reload'. If the Shell Profile assigns a low privilege level (for example, priv-lvl 1), the device will reject 'reload' with 'Access Denied' regardless of the Command Set.

Answer

The Command Set is not applied in the Policy Set

Answer

The device is not authorized for the command

Answer

The TACACS+ server is unreachable

Question 7

Which THREE of the following are valid actions an administrator can take in the Sponsor Portal?

Accepted Answer

Create a new guest account.. The Sponsor Portal in Cisco ISE is designed for sponsor users to manage guest accounts, so option B (Create a new guest account) is correct because sponsors can provision new guest users directly from the portal. Option D (Delete an existing guest account) is correct because sponsors are permitted to remove guest accounts they manage, revoking access. Option E (Extend the expiration time of a guest account) is correct because sponsors can modify guest account settings, including extending the account's validity period. Option A (Change the global ISE logging level) is not a Sponsor Portal function; logging levels are configured in the ISE GUI under Administration > System > Logging. Option C (Modify the existing portal theme) is also not a Sponsor Portal action; portal customization is performed by administrators in the ISE GUI under Guest Access > Portals & Components.

Answer

Change the global ISE logging level.

Answer

Modify the existing portal theme.

Question 8

What is the purpose of the 'Posture Discovery' phase?

Accepted Answer

To identify if posture is required for the session. Posture Discovery is the phase where ISE determines whether posture assessment is required for the session at all. It evaluates the authorization policy and posture policy to decide if the endpoint should be posture-checked, and if so, which posture policy applies. It does not itself verify compliance or remediate — it only decides whether posture is in scope.

Answer

To verify the user credentials

Answer

To remediate non-compliant endpoints

Answer

To determine if the endpoint is compliant

Question 9

Which component in ISE is responsible for mapping an authenticated user to a specific set of permissions and command restrictions in a TACACS+ environment?

Accepted Answer

TACACS+ Authorization Policy. In ISE TACACS+, the Authorization Policy is the component that evaluates the authenticated identity and device attributes and returns the authorization result, including the shell profile and command set that define permissions and command restrictions. Authentication only verifies identity; authorization is what maps the user to a specific permission set.

Answer

TACACS+ Authentication Policy

Answer

Policy Set

Answer

Network Device Group

Question 10

Which THREE of the following items are considered 'results' in an ISE authorization policy? (Choose three)

Accepted Answer

Authorization Profile. In an ISE authorization policy, the results are the enforcement artifacts that ISE returns to the network access device (NAD) once a matching authorization rule is hit. Option A (Authorization Profile) is correct because it is the primary result object, bundling attributes such as VLAN, dACL, SGT, and reauthentication timers that are pushed to the NAD via RADIUS. Option C (Command Set) is correct because it is a result that defines the set of TACACS+ commands (permit/deny) an authenticated administrator is allowed to run on a device. Option D (Shell Profile) is correct because it is a TACACS+ result that specifies the privilege level and shell attributes (e.g., default privilege, auto-command) assigned to an admin session. Option B (Shared Secret) is not a result; it is a credential used to secure RADIUS/TACACS+ communication between ISE and the NAD, configured under Network Devices. Option E (Network Device Group) is not a result; it is a condition/attribute used to classify and match NADs within policy rules, not an enforcement outcome.

Answer

Shared Secret

Answer

Network Device Group

Question 11

If a user is redirected to the Guest portal but receives a '404 Page Not Found' error, what is the most likely configuration issue?

Accepted Answer

The redirect URL is pointing to a non-existent portal path or the PSN is not reachable.. A '404 Page Not Found' on the guest portal almost always means the redirect URL the NAD was given points to a path that does not exist on the PSN, or the PSN hosting the portal is unreachable from the client. ISE constructs the redirect URL from the portal configuration and the PSN's hostname/FQDN, so a mismatch in the portal name, a stale DNS entry, or an unreachable PSN produces a 404 rather than a login page.

Answer

The NAD is blocking the traffic.

Answer

The Guest Portal is not enabled on the PSN.

Answer

The user's account is expired.

Question 12

When a user's device is stolen, which action should be taken in the 'My Devices' portal?

Accepted Answer

Deregister or Blacklist the device. In the 'My Devices' portal, the appropriate action when a device is stolen is to deregister or blacklist the device. Deregistration removes the device from the user's profile, while blacklisting prevents it from reconnecting to the network. This mitigates risk by ensuring the stolen device cannot access corporate resources.

Answer

Perform a factory reset on the device remotely

Answer

Delete the user's account

Answer

Change the user's AD password

Question 13

You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?

Accepted Answer

To allow devices to request certificates from the CA via the ISE node. The SCEP proxy in ISE acts as an intermediary between the endpoint and the Certificate Authority (CA). Instead of the endpoint contacting the CA directly, it sends its SCEP request to ISE, which forwards it to the CA, obtains the certificate, and returns it to the endpoint. This allows ISE to enforce BYOD policies, apply authorization, and avoid exposing the CA directly to endpoints.

Answer

To sign certificates for the endpoints

Answer

To encrypt the SCEP traffic between ISE and the endpoint

Answer

To store the Private Keys of the issued certificates

Question 14

Which of the following is an example of an 'Exception' policy in ISE?

Accepted Answer

A rule placed at the top of the Authorization Policy. In Cisco ISE, an 'Exception' policy is an authorization rule placed at the top of the Authorization Policy set that matches specific conditions and applies a result before the normal rule flow. It is used to override standard authorization for special cases (e.g., a specific user, endpoint, or device) without disturbing the main policy logic. Placing it at the top ensures it is evaluated first.

Answer

A Policy Set condition

Answer

An Identity Source Sequence

Answer

The Default policy set

Question 15

You are configuring a BYOD flow for iOS devices and notice that the native supplicant provisioning process is failing during the installation of the mobile configuration profile. Where should you check the logs in ISE to determine if the issue is related to the SCEP proxy communication?

Accepted Answer

Operations > Troubleshoot > Debug Wizard > scep. The Debug Wizard under Operations > Troubleshoot allows you to enable targeted debug logging for specific ISE services, including the SCEP proxy (scep). When native supplicant provisioning fails during mobile configuration profile installation, the SCEP proxy is responsible for forwarding certificate requests to the CA; enabling the scep debug lets you see the actual SCEP enrollment exchange and pinpoint failures. This is the correct place to check SCEP proxy communication logs.

Answer

Policy > Policy Elements > Results > Certificate Profiles

Answer

Administration > System > Licensing

Answer

Operations > RADIUS Livelog