SISE Practice Test 20 — 15 Questions

Question 1

When configuring an LWA portal, you notice that the HTTP traffic is not being redirected. What is a primary requirement for LWA that differs from CWA?

Accepted Answer

The NAD must have the 'ip http server' enabled.. LWA requires the NAD to act as the web server for the captive portal, meaning the switch handles the HTTP request interception directly, unlike CWA where the endpoint is redirected to ISE.

Answer

The endpoint must be statically assigned an IP.

Answer

A redirect ACL must be applied to the ISE interface.

Answer

The ISE node must be the default gateway.

Question 2

Which TWO of the following are valid ways to provide access to a guest user?

Accepted Answer

Bypassing login via a Hotspot portal.. Guests can be authenticated via their own credentials (Guest Portal) or by simply accepting terms (Hotspot Portal).

Answer

Connecting via VPN tunnel only.

Answer

Using a static IP assigned by the administrator.

Answer

Authenticating via the CLI on the NAD.

Question 3

Which TWO of the following are mandatory components for a CWA deployment?

Accepted Answer

A redirect ACL configured on the NAD.. CWA requires a properly configured redirect ACL on the NAD and a corresponding authorization profile in ISE that points the client to the portal.

Answer

A WLC with WPA3-Enterprise.

Answer

A local user database on the switch.

Answer

A static IP address for all guest clients.

Question 4

What is the maximum number of TACACS+ servers you can configure on a Cisco device for redundancy?

Accepted Answer

Multiple. Cisco devices typically support defining multiple TACACS+ server statements in the configuration for failover.

Answer

Only one

Answer

None, TACACS+ doesn't support redundancy

Answer

Exactly two

Question 5

Which TWO of the following are benefits of using Network Device Groups (NDG)? (Choose two)

Accepted Answer

Simplifies policy management by grouping devices. NDGs simplify policy management and allow for device-specific policy targeting.

Answer

Eliminates the need for shared secrets

Answer

Automatically updates the device config

Answer

Replaces the need for TACACS+ command sets

Question 6

An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?

Accepted Answer

Enable SGT propagation on the policy set. Before SGTs can be used, the TrustSec matrix must be defined and the ISE must be configured to send SGT information in RADIUS Access-Accept messages.

Answer

Manually map IP to SGT on all switches

Answer

Configure the SGACL on the client

Answer

Create a dACL with SGT 10

Question 7

Where do you view the 'Context Visibility' of endpoints in Cisco ISE?

Accepted Answer

Context Visibility > Endpoints. The Context Visibility dashboard is located under the 'Context Visibility' menu in the ISE GUI.

Answer

Administration > Network Resources

Answer

Policy > Endpoints

Answer

Operations > Context Visibility

Question 8

A network engineer reports that they can log into a switch via TACACS+, but cannot run any commands. What is the most likely cause?

Accepted Answer

The Command Set is missing or not assigned in the Authorization Policy. If authorization is enabled but no command set is assigned, ISE returns a 'deny' for all commands by default.

Answer

The switch is not configured for 'aaa authorization commands'

Answer

The shell profile lacks privilege level configuration

Answer

The user is not in the correct Identity Store

Question 9

When defining a Shell Profile for a TACACS+ administrator, which setting ensures the user is placed into privilege level 15 immediately upon login?

Accepted Answer

Configure the 'Privilege Level' field to 15. The Default Privilege setting in the Shell Profile controls the initial privilege level upon successful authentication.

Answer

Set 'Attribute' to 'priv-lvl=15' in custom attributes

Answer

Set the 'Auto-Command' to 'enable 15'

Answer

Enable 'Maximum Privilege' in the command set

Question 10

You are implementing TACACS+ device administration for a group of routers. You need to assign specific privilege levels to different users. Where in the ISE policy set is this privilege assignment configured?

Accepted Answer

In the Shell Profile assigned to the Authorization Policy.. Privilege levels are defined within the Shell Profile, which is then mapped to an authorization policy.

Answer

In the Network Device Group settings.

Answer

In the Command Set configuration.

Answer

In the Network Device definition.

Question 11

Which TWO of the following are valid components of a TACACS+ Authorization Policy in Cisco ISE? (Choose two)

Accepted Answer

Shell Profile. Authorization policies link identities to command sets and shell profiles.

Answer

User Password

Answer

RADIUS attribute list

Answer

Device Shared Secret

Question 12

Which THREE of the following are characteristics of the TACACS+ protocol? (Choose three)

Accepted Answer

Uses TCP port 49. TACACS+ is TCP-based, encrypts the body, and supports separate A-A-A.

Answer

Only encrypts the password field

Answer

Uses UDP port 1812

Question 13

You want to use TACACS+ for administrative access. Which protocol feature distinguishes TACACS+ from RADIUS for device administration?

Accepted Answer

TACACS+ encrypts the entire packet body. TACACS+ separates authentication, authorization, and accounting, allowing for command-level authorization.

Answer

RADIUS allows command-level authorization

Answer

TACACS+ is an open standard protocol

Answer

TACACS+ uses UDP port 49

Question 14

Which TWO of the following are true regarding the configuration of Command Sets in Cisco ISE?

Accepted Answer

Command Sets can be used to deny specific commands while permitting everything else.. Command Sets allow specific commands to be permitted or denied, and you can use regular expressions to match command arguments.

Answer

Command Sets are applied at the Authentication Policy level.

Answer

Command Sets are mandatory for all RADIUS authentication sessions.

Answer

Command Sets automatically include all 'show' commands by default.

Question 15

Which TWO of the following steps are required to implement SGT-based enforcement using an SXP connection?

Accepted Answer

Define the SGT mapping in the ISE TrustSec configuration. SXP is used to propagate SGTs to devices that are not SGT-capable natively. This involves configuring the connection and ensuring the mapping is present.

Answer

Apply a dACL to every port

Answer

Enable TACACS+ on the NAD

Answer

Enable 802.1X on all switch ports