SISE Practice Test 19 — 15 Questions

Question 1

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

Accepted Answer

TACACS+ Livelogs. The TACACS+ Livelogs provide the most granular view of the request, policy matching, and the selected results.

Answer

System Summary Dashboard

Answer

Endpoint Context Visibility

Answer

RADIUS Livelogs

Question 2

In a distributed environment, if the Primary PAN goes offline, what happens to the Secondary PAN?

Accepted Answer

It remains in Secondary mode until manually promoted. The Secondary PAN does not automatically promote itself to Primary. An administrator must manually promote it.

Answer

It disconnects from the PSNs

Answer

It stops accepting configuration changes

Answer

It automatically assumes the Primary role

Question 3

Which menu path is used to view the status of all nodes in an ISE deployment?

Accepted Answer

Administration > System > Deployment. Administration > System > Deployment provides the status dashboard for all nodes in the cluster.

Answer

Operations > Reports

Answer

Administration > Maintenance

Answer

Policy > Policy Elements

Question 4

What is the purpose of the 'Guest Flow' setting in the Authorization Profile?

Accepted Answer

It tells the ISE to trigger the Guest Portal.. The Guest Flow setting determines how the guest session is handled by the ISE, specifically linking the authorization profile to the appropriate portal type.

Answer

It defines the session timeout.

Answer

It enables MAC caching.

Answer

It defines the Guest Group.

Question 5

Which THREE components are required to successfully deploy a Scalable Group Access (SGA) policy for SGT enforcement?

Accepted Answer

SGACL definition. SGA requires SGT definition, a policy matrix in the Cisco TrustSec configuration, and the enforcement device's capability to apply the SGACL.

Answer

TACACS+ Command Authorization

Answer

DHCP Snooping

Question 6

In a high-availability deployment, you have a Primary PAN/MnT and a Secondary PAN/MnT. If the Primary PAN fails, what is the impact on the Monitoring (MnT) services?

Accepted Answer

Monitoring data remains logged to the Secondary MnT node. MnT services are independent of the PAN role; if the Primary MnT fails, the Secondary MnT assumes the role, but PAN failure does not automatically crash MnT unless they share the same physical node.

Answer

The Secondary PAN must be manually promoted to Primary to restore MnT functionality

Answer

ISE enters a read-only state for all PSNs

Answer

MnT services immediately stop on all nodes

Question 7

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

Accepted Answer

Initiate registration from the Primary PAN under Administration > System > Deployment. You must register the secondary node from the Primary PAN GUI, providing the secondary node's credentials and IP.

Answer

Configure the Secondary node as an standalone node and merge databases

Answer

Run the join command from the secondary node's CLI

Answer

Create a cluster via the ISE CLI setup wizard

Question 8

When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?

Accepted Answer

It enables TACACS+ services for this device. Checking this box enables the device to participate in TACACS+ authentication and authorization flows managed by ISE.

Answer

It enables RADIUS for this device

Answer

It forces the switch to use SNMP

Answer

It automatically configures the switch via CLI

Question 9

Which TWO of the following are valid ways to define conditions in a TACACS+ Policy Set? (Choose two)

Accepted Answer

Network Device Group. Policy sets can be based on various attributes including device groups and user groups.

Answer

Shell Profile Name

Answer

Command Set Name

Answer

Device Firmware Version

Question 10

Which TWO methods can be used to verify that a TACACS+ request from a network device is reaching the Cisco ISE PSN?

Accepted Answer

Reviewing the Operations > TACACS Livelogs in the ISE GUI.. You can verify traffic using the Live Logs in the Operations menu or by performing a TCP dump on the PSN.

Answer

Checking the Network Device Group membership list.

Answer

Viewing the Policy Set order of precedence.

Answer

Checking the switch console logs for AAA server status.

Question 11

Which THREE factors influence the decision to use multiple PSNs in a deployment?

Accepted Answer

Geographical distribution. Multiple PSNs are used for geographical redundancy, load balancing of authentication requests, and high availability in case of node failure.

Answer

Increased log storage capacity

Answer

Centralized database backup

Question 12

Which THREE of the following are valid actions when configuring a Command Set for a user? (Choose three)

Accepted Answer

Permit commands using regular expressions. Command sets allow permit/deny, arguments, and regex matching.

Answer

Set the timeout for the command

Answer

Define the default privilege level

Question 13

In the context of TACACS+, what is the purpose of the 'Network Device Group'?

Accepted Answer

To organize devices for policy assignment. Network Device Groups (NDGs) allow for the logical organization of network devices, enabling policy application based on device type or location.

Answer

To enable remote logging

Answer

To set the shared secret for all devices in the group

Answer

To update the device firmware

Question 14

If a user is assigned a Shell Profile with a specific 'Auto-Command' configured, what happens when they log into the network device?

Accepted Answer

The command is executed on the device upon login. The auto-command is automatically executed by the network device upon successful authentication and authorization.

Answer

The user is immediately disconnected

Answer

The user is prompted to run the command manually

Answer

The shell profile is ignored

Question 15

Which TWO of the following are true regarding TACACS+ command sets? (Choose two)

Accepted Answer

They support explicit 'permit' and 'deny' rules. Command sets support both permit/deny and regex matching.

Answer

They only support exact command matching

Answer

They are used to define the privilege level of the session

Answer

They are defined in the Identity store