SISE Practice Test 20 — 15 Questions

Question 1

You have created a custom profiler condition that is not matching endpoints correctly. Where should you check the live authentication and profiling logs to verify if the attribute is being received by ISE?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Operations > RADIUS Livelogs. RADIUS Livelogs under Operations is the real-time troubleshooting view in ISE that shows authentication and authorization requests as they arrive, including the RADIUS attributes (Cisco AV pairs, Calling-Station-ID, etc.) that the NAD sends. When a custom profiler condition fails to match, you need to confirm whether the attribute the condition depends on is actually being received from the network device. RADIUS Livelogs displays the raw attribute payload of each Access-Request, so you can verify attribute presence, spelling, and value before blaming the profiling policy.

Answer

Administration > System > Logging

Answer

Policy > Profiling > Profiling Policies

Answer

Context Visibility > Endpoints

Question 2

A security team is deploying Cisco ISE BYOD for employee devices. They want to ensure that only devices that have completed the BYOD onboarding process and possess a valid certificate are allowed on the corporate SSID. Which ISE policy element should they configure to enforce this requirement?

Accepted Answer

An authorization policy that permits access only when the endpoint presents a valid certificate and is registered in the BYOD identity group.. Authorization policies in Cisco ISE determine the level of network access granted to an endpoint. To allow only devices that have completed BYOD onboarding and possess a valid certificate, the policy must evaluate certificate validity and BYOD registration status. This is the correct enforcement point, as client provisioning and posture serve different roles in the BYOD lifecycle.

Answer

A guest portal configuration that requires users to register their devices before accessing the network.

Answer

A client provisioning policy that matches the corporate SSID and requires certificate enrollment.

Answer

A posture policy that checks for the presence of the BYOD certificate on the endpoint.

Question 3

Which THREE features are configured at the node level in the ISE Administration console?

Accepted Answer

Logging categories. In the Cisco ISE Administration console, node-level configuration is scoped to a specific ISE node rather than the whole deployment. Logging categories (B) are configured per node under Administration > System > Logging > Logging Categories, allowing each node's logging levels and targets to be tuned independently. Profiling probes (D) are enabled and configured per node under Administration > System > Profiling Configuration, since probes such as SNMP, RADIUS, DHCP, and NetFlow run on individual PSNs. Network interface settings (E) are also node-specific, configured under Administration > System > Settings > Network Interfaces, because each node has its own NIC, IP address, and VLAN configuration. Global policy rules (A) and external ID store configuration (C) are deployment-wide settings managed at the system level, not per node, so they are not correct answers.

Answer

Global policy rules

Answer

External ID store configuration

Question 4

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

Accepted Answer

To gather compliance data without restricting network access. In Cisco ISE Posture policies, Monitor Mode is used to assess endpoint compliance without restricting network access. The endpoint is allowed on the network, but posture data is collected and logged. This allows administrators to see compliance status without impacting users, making option A correct.

Answer

To automatically remediate endpoints

Answer

To bypass the posture check entirely

Answer

To block all traffic until the agent is installed

Question 5

Where do you upload the AnyConnect posture agent packages to make them available for Client Provisioning?

Accepted Answer

Policy > Policy Elements > Results > Client Provisioning > Resources. AnyConnect posture agent packages are uploaded in ISE under Policy > Policy Elements > Results > Client Provisioning > Resources. This is where administrators add agent resources (such as AnyConnect .pkg or .msi files) and compliance modules, which are then referenced by Client Provisioning policies to be pushed to endpoints.

Answer

Operations > Troubleshoot > Client Provisioning

Answer

Policy > Posture > Policy

Answer

Administration > System > Settings > Posture

Question 6

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

Accepted Answer

Condition matching. In Cisco ISE, each Policy Set contains a set of conditions that are evaluated against incoming RADIUS request attributes (such as NAS-IP-Address, Calling-Station-ID, or Service-Type). The first Policy Set whose conditions match the request is selected for further processing. This condition-based matching allows granular control over which authentication and authorization policies apply to different users, devices, or locations.

Answer

Random selection

Answer

Alphabetical order

Answer

Authentication protocol

Question 7

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

Accepted Answer

Distributed Configuration Synchronization via HTTPS. In a distributed ISE deployment, the Primary PAN synchronizes configuration changes to all secondary nodes using a secure HTTPS-based mechanism called Distributed Configuration Synchronization. This ensures that all nodes have a consistent view of policies, identities, and other configuration data. The synchronization occurs automatically when changes are made on the Primary PAN, and it uses TLS to protect the data in transit.

Answer

Rsync over SSH

Answer

RADIUS Change of Authorization (CoA)

Answer

SNMPv3 Trap propagation

Question 8

A network engineer is deploying TACACS+ device administration with Cisco ISE for a large number of Cisco IOS routers. The engineer wants to centralize the authorization of commands so that users in different groups have different command privileges. The engineer has already configured authentication and authorization policy sets in ISE. Which additional configuration is required on the Cisco IOS routers to ensure that command authorization is enforced by ISE?

Accepted Answer

Configure 'aaa authorization commands 15 default group tacacs+ if-authenticated' on each router.. To enforce command authorization via TACACS+, the router must be configured with an AAA authorization method list for commands. The command 'aaa authorization commands 15 default group tacacs+ if-authenticated' sends authorization requests for privilege level 15 commands to ISE. The 'if-authenticated' fallback ensures that if the TACACS+ server is unreachable, commands are still allowed for authenticated users. Without this, command authorization is not performed, and users can execute any command permitted by their privilege level.

Answer

Configure 'aaa accounting commands 15 default start-stop group tacacs+' on each router.

Answer

Configure 'aaa authorization exec default group tacacs+ if-authenticated' on each router.

Answer

Configure 'tacacs-server directed-request' on each router.

Question 9

A network administrator is deploying a guest wireless network using Cisco ISE. They want guests to authenticate through a web portal, but they do not want guests to have to create their own accounts. Instead, they want employees to pre-create guest accounts and provide credentials to visitors. Which ISE feature should the administrator configure to enable this workflow?

Accepted Answer

Sponsor portal. The sponsor portal is specifically designed for sponsors to create and manage guest accounts. It enables employees to pre-create accounts and provide credentials to guests, which matches the requirement. Other portal types like self-registration or hotspot do not involve sponsors in account creation. Therefore, the sponsor portal is the correct configuration.

Answer

Hotspot portal

Answer

Device registration portal

Answer

Self-registration guest portal

Question 10

A network administrator has deployed Cisco ISE with AnyConnect posture. Windows endpoints must run Windows Defender and have real-time protection enabled to be considered compliant. The administrator configures a posture policy with a Windows Defender condition that checks the service status. However, endpoints where Defender is running but real-time protection is disabled are still reported as compliant. What is the most likely cause?

Accepted Answer

The posture condition only checks whether the Windows Defender service is running, not the real-time protection status.. The condition checks only the service status, not the real-time protection setting. To enforce real-time protection, the condition must evaluate the specific registry key or use a file condition that reflects that setting. The other options would cause different symptoms, such as Unknown status or complete posture failure, not a false Compliant result.

Answer

The AnyConnect posture module is not installed on the endpoints, so no posture data is collected.

Answer

The posture policy is set to audit mode, which allows non-compliant endpoints to appear compliant.

Answer

The Windows Defender firewall is blocking the posture communication between AnyConnect and ISE.

Question 11

A network engineer is configuring an authorization policy in Cisco ISE to enforce SGT-based segmentation on a Catalyst 9000 switch. The engineer wants to assign a static SGT to endpoints that authenticate via 802.1X and belong to a specific Active Directory group. The switch is already configured with 'cts manual' and 'propagate sgt' on the trunk. Which ISE configuration is required to assign the SGT to the endpoint?

Accepted Answer

Configure the SGT as a RADIUS attribute in the Authorization Profile's advanced attributes using cisco-av-pair with the value 'cts:security-group-tag=xxxx'.. To assign a static SGT to an endpoint during 802.1X authentication, the authorization policy must return the SGT value in a cisco-av-pair RADIUS attribute. The format 'cts:security-group-tag=xxxx' is recognized by Cisco switches to apply the SGT. Other methods like dACLs or CoA do not perform static SGT assignment. Therefore, configuring the cisco-av-pair in the Authorization Profile is the correct approach.

Answer

Enable 'SGT Enforcement' in the switch's global configuration and let ISE push the SGT via Change of Authorization (CoA).

Answer

Map the Active Directory group to an SGT in ISE's External Identity Sources configuration, and the SGT will be automatically applied.

Answer

Create a downloadable ACL (dACL) that includes the SGT value, and reference it in the Authorization Profile.

Question 12

A network administrator is implementing a TACACS+ command authorization policy on Cisco ISE for a group of network devices. The administrator wants to allow users in the 'NetOps' group to execute only 'show' commands and deny all other commands. The policy set for TACACS+ device administration is already configured with the correct conditions. Where in ISE should the administrator define the permitted commands and associate them with the 'NetOps' group?

Accepted Answer

In the Authorization Policy, create a rule that references a Command Set containing the permitted 'show' commands, and set the condition to match the 'NetOps' group.. For TACACS+ command authorization in Cisco ISE, you define a Command Set that lists the allowed commands, and then reference that Command Set in an Authorization Policy rule. The rule's condition matches the user's group, such as 'NetOps'. This approach ensures that only the commands in the Command Set are permitted, and any command not explicitly allowed is denied. The other options describe incorrect locations or methods for defining command permissions.

Answer

In the External Identity Source configuration for the 'NetOps' group, add the permitted commands as attributes.

Answer

In the TACACS+ Command Authorization settings under Device Administration, create a command set and assign it directly to the user's group.

Answer

In the Policy Set's Allowed Protocols section, enable TACACS+ and specify the allowed command list.

Question 13

A network engineer configures a Cisco ISE deployment with profiler probes enabled on the Policy Service nodes. After deploying a new Cisco Catalyst 9300 switch, the engineer notices that endpoints connected to that switch are not appearing in the Endpoints list, even though they are passing 802.1X authentication. The engineer verifies that the switch is sending RADIUS accounting packets to ISE. Which probe should the engineer verify is enabled to collect endpoint attributes from the switch itself?

Accepted Answer

RADIUS probe. The RADIUS probe is responsible for extracting endpoint attributes from RADIUS authentication and accounting packets. When endpoints authenticate via 802.1X, the switch sends RADIUS messages to ISE, and the RADIUS probe uses those to create or update endpoint profiles. If this probe is disabled, endpoints may authenticate successfully but remain unprofiled, which matches the described symptom.

Answer

SNMP probe

Answer

HTTP probe

Answer

DHCP probe

Question 14

An administrator configures a posture policy that checks for a specific Windows registry key with an expected value of '1'. After deployment, endpoints that have the key correctly set to '1' are still reported as Non-Compliant. The AnyConnect Posture module is installed and the agent is communicating with ISE. Which action should the administrator take first to resolve this issue?

Accepted Answer

Verify that the registry condition is using the correct operator, such as 'Exists' or 'Equals', and that the expected value matches the data type.. The endpoints are communicating and the registry key is present, so the failure likely stems from a misconfigured condition. Registry conditions require an operator that matches the check (e.g., 'Exists', 'Equals') and an expected value that matches the registry data type (e.g., DWORD, String). Verifying these settings is the most direct troubleshooting step before considering more invasive actions.

Answer

Change the posture policy to use a file condition instead of a registry condition, as file checks are more reliable.

Answer

Reinstall the AnyConnect Posture module on the affected endpoints to ensure the latest version is used.

Answer

Restart the Cisco ISE Policy Service Node to clear any cached posture results that might be stale.

Question 15

A security administrator is troubleshooting why a particular endpoint is being profiled as a generic 'Windows Workstation' instead of the more specific 'Windows 10 Enterprise' policy. The administrator checks the Profiling Policies and sees that the 'Windows 10 Enterprise' policy has a minimum certainty factor of 20, while the endpoint's current certainty factor is 18. The administrator also notices that the endpoint has matching attributes for both policies. What is the most likely reason the endpoint is not matching the more specific policy?

Accepted Answer

The minimum certainty factor for the 'Windows 10 Enterprise' policy is higher than the endpoint's current certainty factor.. Profiling policies use a minimum certainty factor to determine whether an endpoint qualifies for that policy. When multiple policies match, the one with the highest certainty factor that meets its minimum threshold is selected. Here, the endpoint's certainty factor of 18 is below the required 20 for the Windows 10 Enterprise policy, so ISE falls back to a less specific policy with a lower threshold.

Answer

The endpoint's MAC address is not in the OUI database.

Answer

The endpoint has not been assigned to the correct Endpoint Identity Group.

Answer

The 'Windows 10 Enterprise' policy is disabled.