SISE Practice Test 18 — 15 Questions

Question 1

When setting up a self-registration portal, you want to require that the guest's email address is validated before granting access. Which feature should you enable?

Accepted Answer

Self-Registration Account Activation. Email verification requires the user to click a link sent to their email to activate the account. This is configured in the self-registration portal settings.

Answer

Enable Guest MAC Caching

Answer

Enable Captcha

Answer

Require Sponsor Approval

Question 2

You are reviewing the ISE logs and see that the Guest Portal authentication is failing. Where should you look to find the exact reason for the failure?

Accepted Answer

Operations > RADIUS Livelogs. The 'Live Logs' in ISE provide real-time visibility into authentication attempts, including the specific failure reason (e.g., 'invalid credentials', 'user account expired').

Answer

Monitoring > Reports > Guest

Answer

Policy > Policy Sets

Answer

Administration > System > Logging

Question 3

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

Accepted Answer

Called-Station-ID. The 'Called-Station-ID' attribute, which typically contains the SSID or the Switch Port ID, allows ISE to identify where the connection attempt originated.

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 4

You want to customize the guest portal so that it displays the company logo and specific terms of use. Where is this configuration performed within the Cisco ISE GUI?

Accepted Answer

Work Centers > Guest Access > Portals & Components. Portal customization is managed under the Guest Access menu, specifically within the Portal Builder of the selected portal type.

Answer

Administration > System > Settings > Portal Configuration

Answer

Policy > Policy Elements > Results > Authorization > Authorization Profiles

Answer

Operations > Troubleshoot > Diagnostic Tools

Question 5

You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?

Accepted Answer

Set the Access Type to Permit Access and enable URL Redirect with the portal ID.. For CWA, the authorization profile must include a dACL or a filter-ID, and the Web Redirection component must be enabled with the specific Client Provisioning or Guest portal selected as the target.

Answer

Enable 'Authentication Bypass' in the authorization profile to allow the traffic to hit the redirect rule.

Answer

Configure the profile as a standard permit access profile with a dynamic VLAN assignment.

Answer

Set the Access Type to Web Auth and manually input the redirect IP address in the Custom Attributes field.

Question 6

When using Local Web Authentication (LWA) on a WLC, which entity performs the actual credentials check against Cisco ISE?

Accepted Answer

The Wireless LAN Controller (WLC).. In LWA, the WLC acts as the RADIUS client that sends the user-provided credentials to Cisco ISE for authentication.

Answer

The Access Point (AP) in FlexConnect mode.

Answer

The Cisco ISE node directly.

Answer

The client browser via HTTPS POST.

Question 7

Which THREE components are part of the 'Guest Access' workflow in Cisco ISE?

Accepted Answer

ISE Policy Sets.. The guest workflow typically involves the guest user, a sponsor who validates the access, and the ISE engine that enforces the policy.

Answer

Device Sensor Service.

Answer

Active Directory Join.

Question 8

Which license type is required to enable advanced profiling and posture services on Cisco ISE?

Accepted Answer

ISE Advantage. ISE licenses are tiered, and 'ISE Advantage' is typically required for advanced context-aware features like profiling and posture.

Answer

ISE Premier

Answer

Device Admin License

Answer

ISE Essentials

Question 9

Which THREE resources are monitored via the ISE dashboard to ensure deployment health?

Accepted Answer

CPU utilization. The dashboard provides visibility into CPU usage, memory utilization, and disk I/O, which are critical for PSN performance.

Answer

Bandwidth per user

Answer

Temperature of the appliance

Question 10

When designing an ISE deployment across WAN links, what is the primary recommendation regarding MnT nodes?

Accepted Answer

Keep the MnT node in the same high-speed network as the PAN. MnT nodes are bandwidth-heavy due to log aggregation; placing them across high-latency, low-bandwidth WAN links can cause replication delays and data loss.

Answer

Distributed MnTs across all WAN sites

Answer

Always place MnT in the cloud

Answer

Disable logging for remote sites

Question 11

When adding a secondary PAN, what is the consequence if the time synchronization (NTP) differs significantly between nodes?

Accepted Answer

The registration process will fail. ISE requires tight time synchronization between all nodes in the deployment for certificate validation and log timestamps; large drifts cause replication failure.

Answer

The node will operate in read-only mode

Answer

The node will join but logs will be out of order

Answer

Only TACACS+ services will be impacted

Question 12

Which of the following describes the 'Standalone' deployment model?

Accepted Answer

All personas on a single node. A standalone model means all personas (PAN, MnT, PSN) are hosted on a single physical or virtual appliance.

Answer

PAN and PSN on separate nodes

Answer

Only PSN role is active

Answer

Multiple nodes in a cluster

Question 13

When configuring a load balancer for a group of PSNs, what is the best practice for handling RADIUS traffic?

Accepted Answer

Source-IP affinity (persistence). For RADIUS, the load balancer should use source-IP persistence (sticky sessions) to ensure that the Access-Request and subsequent Access-Challenge/Response messages hit the same PSN.

Answer

SSL-offloading

Answer

Active-passive failover only

Answer

Round-robin without persistence

Question 14

Which THREE conditions must be met for a successful ISE node upgrade?

Accepted Answer

All nodes in the deployment are in a 'Connected' state. Upgrades require a healthy cluster state, enough disk space for the upgrade bundle, and verified database consistency.

Answer

A factory reset is performed

Answer

The node is in 'Standalone' mode

Question 15

Which TWO items are required to register a secondary node to the Primary PAN?

Accepted Answer

Administrative credentials for the secondary node. The registration requires the secondary node's hostname/IP and administrative credentials to authenticate the handshake process.

Answer

A list of all other nodes in the cluster

Answer

A shared secret for RADIUS

Answer

A valid license file for the secondary node