SISE Practice Exam 1 — 20 Questions

Question 1

What is the function of the 'PassiveID' feature in a distributed ISE deployment?

Accepted Answer

It provides user identity mapping without active probing. PassiveID allows ISE to collect user-to-IP mapping information from external sources without active polling, which is critical for identity-based access control.

Answer

It enables redundant authentication

Answer

It replaces the need for PSNs

Answer

It caches RADIUS requests

Question 2

What is the purpose of the 'PAN' role in a deployment?

Accepted Answer

Centralized policy management. The Policy Administration Node (PAN) provides the centralized management interface for all policy definitions and deployment configuration.

Answer

Log aggregation and reports

Answer

Authentication of endpoints

Answer

Database backups

Question 3

Which service is required to be enabled on a PSN to allow it to receive RADIUS requests from network access devices?

Accepted Answer

Policy Service. The 'Policy Service' node must have the RADIUS/TACACS+ service enabled in its configuration.

Answer

Registration Service

Answer

Administration Service

Answer

Monitoring Service

Question 4

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

Accepted Answer

To configure the native supplicant settings for secure network access. The NSA is a small utility downloaded by the endpoint to configure the supplicant for secure wireless network access.

Answer

To provide a VPN tunnel to the internal network

Answer

To manage the user's Active Directory account

Answer

To scan the device for malware before allowing network access

Question 5

If a user's certificate expires, how can the user renew it using the ISE BYOD flow?

Accepted Answer

Reconnect to the SSID and follow the re-enrollment prompt in the portal. The user can reconnect to the network, trigger the MAB/Redirect process, and the portal will provide an option to re-enroll or renew the certificate.

Answer

The certificate renews automatically in the background

Answer

Re-install the Network Setup Assistant manually

Answer

Contact the administrator to manually push a new certificate

Question 6

When utilizing pxGrid in a distributed deployment, which node should be configured as the pxGrid controller?

Accepted Answer

Any PSN with the service enabled. pxGrid services can be enabled on any PSN, but it is typically recommended to pin them to specific nodes to ensure consistent connectivity for subscribers.

Answer

Dedicated pxGrid node only

Answer

Monitoring node only

Answer

Primary PAN only

Question 7

Which TWO of the following are valid ISE deployment personas?

Accepted Answer

Policy Administration Node. The three standard ISE personas are Policy Administration Node (PAN), Monitoring and Troubleshooting Node (MnT), and Policy Service Node (PSN).

Answer

Authentication Proxy Node

Answer

Database Node

Answer

Reporting Node

Question 8

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

Accepted Answer

Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. The BYOD setting is enabled within the Portal Settings page of a specific Guest or My Devices portal.

Answer

Policy > Policy Sets > [Set Name] > Authorization Policy

Answer

Operations > Troubleshoot > BYOD Settings

Answer

Administration > Device Portal Management

Question 9

A customer is planning a large campus deployment with 50,000 concurrent endpoints. Which persona should be dedicated to handle the authentication load to ensure high performance?

Accepted Answer

Policy Service Node (PSN). Policy Service Nodes (PSNs) are the dedicated persona for handling RADIUS and TACACS+ authentication/authorization requests.

Answer

Policy Administration Node (PAN)

Answer

Standalone Node

Answer

Monitoring and Troubleshooting Node (MnT)

Question 10

When configuring a secondary MnT node, what is the 'Primary' versus 'Secondary' relationship regarding log collection?

Accepted Answer

The Primary collects, Secondary is standby. The Primary MnT is the active log aggregator, and the Secondary MnT acts as a standby, taking over only if the Primary fails.

Answer

The Secondary collects from specific PSNs only

Answer

Both nodes log simultaneously

Answer

Nodes load balance the logs

Question 11

When decommissioning an ISE node, what is the correct order of steps?

Accepted Answer

Remove from deployment, then shut down. You must first remove the node from the deployment list in the Primary PAN, then you can safely wipe/decommission the physical/virtual appliance.

Answer

Change node to standalone, then remove

Answer

Shut down the node, then remove from deployment

Answer

Re-image the node, then remove from deployment

Question 12

Which THREE of the following are valid types of Client Provisioning Resources?

Accepted Answer

AnyConnect Profile (XML). Valid resources include AnyConnect packages, compliance modules, and profiles.

Answer

Windows Update Agent

Answer

Antivirus definition files

Question 13

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

Accepted Answer

Operations > Reports > Endpoints and Users > Certificate Provisioning. The 'Certificate Provisioning' logs are located under Operations > Reports > Endpoints and Users > Certificate Provisioning.

Answer

Policy > Policy Elements > Results > Certificate Templates

Answer

Operations > RADIUS Livelog

Answer

Administration > System > Certificates > Certificate Signing Requests

Question 14

What is the default persona of a newly installed Cisco ISE appliance before any configuration changes?

Accepted Answer

Standalone. A fresh ISE installation defaults to a standalone node, which includes all personas enabled.

Answer

PSN

Answer

Monitoring node

Answer

Primary PAN

Question 15

You are troubleshooting a PSN that is not receiving configuration updates. Which log file on the PSN would provide the most insight into the configuration sync process?

Accepted Answer

config-dist.log. The 'config-dist.log' file specifically tracks the configuration distribution and synchronization events between the PAN and PSN.

Answer

catalina.out

Answer

radius.log

Answer

prrt-server.log

Question 16

You are integrating an MDM server with ISE for BYOD. The requirement is that ISE must check the compliance status of the device before granting full network access. Which feature must be enabled in the MDM configuration within ISE?

Accepted Answer

Enable 'Device Compliance' in the MDM server configuration object. The 'Device Compliance' checkbox must be enabled in the MDM server configuration to trigger the API calls for status checks.

Answer

Configure a 'Compliance' RADIUS attribute

Answer

Enable 'Allow full access' in the Authorization Policy

Answer

Enable 'MDM Enrollment' in the Policy Set

Question 17

Which of the following is a requirement for a successful BYOD certificate provisioning flow?

Accepted Answer

The client must have the Root CA certificate installed in its trusted store. The client must trust the Root CA that signed the ISE portal/certificate to ensure the enrollment process is secure.

Answer

The client must use a specific third-party supplicant

Answer

The client must be joined to the Active Directory domain

Answer

The device must be managed by the same MDM as the enterprise devices

Question 18

How do you verify the current licensing status and consumption on your ISE deployment?

Accepted Answer

Administration > System > Licensing. You navigate to Administration > System > Licensing to view the consumption and validity of your licenses.

Answer

Dashboard > Licensing

Answer

Policy > Licensing

Answer

Operations > Licensing

Question 19

Which TWO are common causes for a node to fail to join a deployment?

Accepted Answer

Blocked network ports. The most common causes are certificate validation errors and network connectivity issues (e.g., blocked ports).

Answer

Insufficient memory on the node

Answer

License mismatch between nodes

Answer

Incorrect browser version

Question 20

Which specific ISE process is responsible for managing the communication between the PAN and PSNs?

Accepted Answer

ISE Messaging Service. The 'ISE Messaging Service' (based on RabbitMQ) is the backbone for communication and state synchronization between nodes.

Answer

Application Server

Answer

Radius Core

Answer

Monitoring Service