SISE Practice Test 2 — 10 Questions

Question 1

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

Accepted Answer

File Remediation Action. A File Remediation Action in Cisco ISE is specifically designed to provide users with a downloadable link or instructions to obtain the required compliance software when a posture check fails. It is the remediation component that bridges the gap between a failed posture condition and the user's ability to fix it.

Answer

Post-Posture Authorization Rule

Answer

Client Provisioning Policy

Answer

Posture Requirement

Question 2

Which of the following describes the 'Standalone' deployment model?

Accepted Answer

All personas on a single node. The 'Standalone' deployment model in Cisco ISE refers to a configuration where all personas (Policy Administration Node, Policy Service Node, Monitoring and Troubleshooting Node) are installed on a single node. This is typical for small deployments or lab environments where high availability and scalability are not required. It simplifies management but lacks redundancy.

Answer

PAN and PSN on separate nodes

Answer

Only PSN role is active

Answer

Multiple nodes in a cluster

Question 3

When a new device connects, you notice it stays in the 'Unknown' profile state. You have confirmed the probes are active. What is the most likely step to fix this?

Accepted Answer

Create or update a Profiling Policy to match the collected attributes.. If a device remains in the 'Unknown' profile state despite active probes, it means ISE is collecting attributes but no profiling policy matches those attributes to assign a known profile. Creating or updating a profiling policy to match the collected attributes will allow ISE to classify the device correctly. The other options do not address the root cause: SNMP timeout, PSN service restart, or deleting the endpoint are not relevant to policy matching.

Answer

Increase the SNMP timeout.

Answer

Disable and re-enable the PSN service.

Answer

Delete the endpoint from the database.

Question 4

Which statement best describes the role of the TACACS+ 'Accounting' feature?

Accepted Answer

It records command execution details. TACACS+ separates AAA functions into distinct roles: Authentication verifies identity, Authorization determines what a user may do, and Accounting logs what the user actually did. The Accounting feature specifically records command execution details such as the command entered, the user, timestamp, and result, sending them to the TACACS+ server for auditing. This makes it the mechanism for tracking administrative activity on network devices.

Answer

It validates user credentials

Answer

It limits the commands a user can run

Answer

It encrypts the communication channel

Question 5

Which TWO of the following are true about Shell Profiles? (Choose two)

Accepted Answer

They can include custom attributes for specific vendors. Shell Profiles in Cisco ISE (TACACS+) are policy elements that define the authorization attributes returned to a network device after successful authentication. Option B is correct because Shell Profiles can include custom attributes (such as Cisco AV pairs) tailored to specific vendors, allowing device-specific authorization behavior. Option D is correct because Shell Profiles define the initial privilege level (for example, privilege level 15) assigned to the user's session upon login. Option A is incorrect because accounting is a separate TACACS+ function that logs user activity and is not replaced by Shell Profiles. Option C is incorrect because the command set is defined by Command Sets, not Shell Profiles, although both are authorization policy elements. Option E is incorrect because Shell Profiles are used with TACACS+ authorization, not exclusively with RADIUS authentication.

Answer

They replace the need for accounting

Answer

They define the command set to be used

Answer

They are used for RADIUS authentication only

Question 6

When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?

Accepted Answer

ISE Live Logs. ISE Live Logs (A) are the primary real-time troubleshooting tool because they show the posture policy evaluation, the exact posture condition that failed, and the authorization result for the session as it happens. ISE Posture Reports (B) aggregate posture compliance data and show which posture policies and conditions are failing across endpoints, which helps confirm the specific compliance check that caused the failure. The AnyConnect DART bundle (E) collects the client-side posture logs, including the Posture Agent (cscan/ISEPosture) and compliance module logs, which reveal why the endpoint's posture assessment failed on the client. Cisco IOS syslog (C) only records router/switch events and does not contain posture policy evaluation details, and AnyConnect VPN Gateway logs (D) cover tunnel establishment and connection events rather than the posture compliance decision made by ISE.

Answer

Cisco IOS syslog

Answer

AnyConnect VPN Gateway logs

Question 7

You are configuring a device sensor on a Cisco switch to help with ISE profiling. What is the primary benefit of using Device Sensor?

Accepted Answer

It enables the switch to send collected device attributes to ISE via RADIUS accounting.. The primary benefit of Device Sensor on a Cisco switch is that it collects device attributes (e.g., CDP, LLDP, DHCP, HTTP) and sends them to Cisco ISE via RADIUS accounting packets. This enriches ISE's profiling database, allowing ISE to more accurately identify and classify endpoints. Device Sensor offloads the collection from ISE to the switch, improving scalability and reducing network traffic.

Answer

It replaces the need for DHCP snooping.

Answer

It allows the switch to act as a RADIUS server.

Answer

It increases the throughput of the switch.

Question 8

How does Cisco ISE handle requests that do not match any configured TACACS+ Authorization Policy?

Accepted Answer

It denies access. Cisco ISE uses a default-deny model for TACACS+ authorization: if an authorization request does not match any configured policy rule, ISE returns a deny, and the device will not grant the requested command or privilege. This mirrors the implicit deny at the end of an ACL and ensures no unauthorized access is granted by omission.

Answer

It defaults to local switch authentication

Answer

It prompts the user to select a profile

Answer

It permits access with default privileges

Question 9

Which TWO of the following settings are available for customizing the guest portal login page?

Accepted Answer

Inclusion of a mandatory AUP checkbox.. Option B is correct because guest portal configurations in ClearPass (and similar NAC solutions) allow administrators to enable a mandatory Acceptable Use Policy checkbox that users must acknowledge before authenticating, which is a standard customization on the login page. Option E is correct because the login form's header and footer text are editable fields within the guest portal customization settings, letting administrators add branding, instructions, or legal notices. Option A is not a guest portal login page setting; switch interface selection relates to network infrastructure configuration, not portal appearance. Option C is incorrect because direct editing of Apache server config files is not a supported or exposed customization method in the portal UI and would be an unsupported modification. Option D is incorrect because the RADIUS shared secret is an authentication service configuration parameter, not a login page customization option.

Answer

Selection of the switch interface.

Answer

Direct editing of the Apache server config files.

Answer

Configuration of the RADIUS shared secret.

Question 10

You are reviewing the ISE logs and see that the Guest Portal authentication is failing. Where should you look to find the exact reason for the failure?

Accepted Answer

Operations > RADIUS Livelogs. Operations > RADIUS Livelogs provides real-time, detailed RADIUS authentication and authorization logs, including the exact failure reason for guest portal authentication attempts. It shows the full RADIUS request/response exchange, the policy set matched, and any error codes. This is the primary place to diagnose why a guest authentication is failing.

Answer

Monitoring > Reports > Guest

Answer

Policy > Policy Sets

Answer

Administration > System > Logging