SISE Practice Exam 2 — 20 Questions

Question 1

What is the default persona of a newly installed Cisco ISE appliance before any configuration changes?

Accepted Answer

Standalone. A newly installed Cisco ISE appliance defaults to the Standalone persona, meaning it performs all roles (Policy Administration Node, Policy Service Node, and Monitoring Node) on a single node. This is the out-of-box state before any distributed deployment configuration is applied. Administrators must explicitly promote or register nodes to change personas.

Answer

PSN

Answer

Monitoring node

Answer

Primary PAN

Question 2

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

Accepted Answer

Patch Condition. A Patch Condition in ISE posture is specifically designed to check for the presence of a particular Windows patch by its KB number (or a range of KBs). It queries the endpoint's update history and compares it against the configured KB values, returning compliant or non-compliant. This is the only condition type that directly targets patch-level granularity.

Answer

Registry Condition

Answer

Application Condition

Answer

File Condition

Question 3

Which AnyConnect module is specifically required to perform posture assessment in ISE?

Accepted Answer

AnyConnect Compliance Module. The AnyConnect Compliance Module is the component that performs posture assessment on the endpoint. It collects information about the device's security state (e.g., antivirus, firewall, OS patches) and reports it to ISE for policy evaluation.

Answer

AnyConnect AMP Enabler

Answer

AnyConnect Web Security Module

Answer

AnyConnect VPN Module

Question 4

If you want to use a script remediation, where do you define the script content?

Accepted Answer

Directly in the 'Script Remediation' action in ISE. In Cisco ISE, when configuring a posture policy with a script remediation action, the script content is defined directly within the 'Script Remediation' action itself. This allows the administrator to embed the script that will be executed on the endpoint to remediate the non-compliance.

Answer

In the Client Provisioning Resource file

Answer

In the Posture Policy XML

Answer

On the endpoint in the AnyConnect directory

Question 5

A posture condition is defined to check for a registry key, but it always returns 'Non-Compliant'. You suspect the 'Expected Value' is wrong. Where can you see what the agent actually found on the endpoint?

Accepted Answer

Operations > Reports > Endpoints > Posture Assessment. The Operations > Reports > Endpoints > Posture Assessment report provides detailed information about posture assessments, including the actual values found on the endpoint for each condition. This allows you to compare the expected value with what the agent reported, helping to diagnose why a condition is returning Non-Compliant.

Answer

Context Visibility > Endpoints

Answer

Client Provisioning > Resources

Answer

Policy > Posture > Conditions

Question 6

When setting up a custom endpoint identity group for printers, what is the best practice for assigning devices to that group?

Accepted Answer

Use a Profiling Policy to automatically assign the device to the 'Printers' Identity Group.. The best practice for assigning devices to a custom endpoint identity group is to use a Profiling Policy. Profiling policies automatically classify endpoints based on collected attributes (e.g., DHCP, HTTP, SNMP) and assign them to the appropriate identity group. This ensures dynamic and scalable management, reducing manual effort and errors.

Answer

Manually add every printer MAC address to the group.

Answer

Import a CSV file periodically.

Answer

Use an Authorization Policy to bypass profiling.

Question 7

Which ISE menu path is used to create a new Authorization Profile?

Accepted Answer

Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. In Cisco ISE, Authorization Profiles define the actual permissions or attributes (e.g., VLAN, dACL, SGT) that are applied to a session after a successful authorization policy match. They are created and managed under Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. This is the only path among the options that leads to the Authorization Profiles configuration page.

Answer

Policy -> Policy Sets -> Add

Answer

Policy -> Policy Elements -> Conditions

Answer

Administration -> Identity Management -> Groups

Question 8

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

Accepted Answer

Called-Station-ID. Called-Station-ID is the RADIUS attribute that carries the identifier of the network access point (e.g., the SSID or the MAC address of the wireless controller/AP) that the guest is connecting to. In a guest flow, this attribute is used to determine the physical location of the request because it identifies the specific access device. Cisco ISE uses Called-Station-ID in authorization policies to apply location-based restrictions or to track where a guest session originates.

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 9

In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?

Accepted Answer

To define attributes like account lifetime and access policies for guest accounts.. Guest Types in ISE define the template for guest accounts, including account lifetime (duration), maximum simultaneous logins, and the access policies (authorization profiles) that apply to that type of guest. They allow administrators to create different classes of guests (e.g., short-term visitor vs. long-term contractor) with distinct attributes.

Answer

To manage the list of sponsors.

Answer

To define the portal look and feel.

Answer

To configure the RADIUS server settings.

Question 10

A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?

Accepted Answer

Adjust the Policy Set conditions. Policy Set conditions are the top-level matching criteria that determine which policy set a request is evaluated against. If guest traffic is landing in the wrong policy set, the fix is to adjust the conditions (e.g., SSID, NAS-IP-Address, device type, or RADIUS attributes) so the guest session matches the 'Guest' policy set. Reordering only changes evaluation order among policy sets that already match — it does not change which conditions cause a match.

Answer

Modify the guest portal settings

Answer

Change the authentication sequence

Answer

Reorder the policy sets

Question 11

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

Accepted Answer

The device remains Non-Compliant. If an endpoint is determined to be Non-Compliant and no remediation action is configured, the device remains Non-Compliant. The posture policy will not automatically remediate or grant full access; the status persists until remediation is applied or the policy changes. Thus, option D is correct.

Answer

The agent automatically remediates the issue

Answer

The device is granted full access

Answer

The posture agent crashes

Question 12

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

Accepted Answer

Authorization Profile. The Authorization Profile in Cisco ISE is where you set attributes like VLAN assignment, dACL, SGT, and reauthentication timers that are returned to the NAD after successful authorization. For wireless clients, the VLAN is typically delivered via RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) configured in the Authorization Profile.

Answer

Policy Set Condition

Answer

Identity Source Sequence

Answer

Authentication Policy

Question 13

Which TWO methods can be used to verify that a TACACS+ request from a network device is reaching the Cisco ISE PSN?

Accepted Answer

Reviewing the Operations > TACACS Livelogs in the ISE GUI.. Option B is correct because the Operations > TACACS Livelogs page in the ISE GUI shows TACACS+ authentication and authorization requests as they arrive at the PSN, confirming the request reached ISE. Option D is correct because running a packet capture (tcpdump) on the PSN interface lets you see the inbound TCP port 49 traffic from the network device, directly proving the TACACS+ request arrived. Option A is wrong because Network Device Group membership only defines device classification, not whether a request reached the PSN. Option C is wrong because Policy Set order of precedence controls rule evaluation, not request arrival. Option E is wrong because switch console AAA server status shows local client-side state, not whether the request reached the ISE PSN.

Answer

Checking the Network Device Group membership list.

Answer

Viewing the Policy Set order of precedence.

Answer

Checking the switch console logs for AAA server status.

Question 14

Which service is required to be enabled on a PSN to allow it to receive RADIUS requests from network access devices?

Accepted Answer

Policy Service. The Policy Service is the Cisco ISE service that must be enabled on a Policy Services Node (PSN) to allow it to receive RADIUS requests from network access devices (NADs). The Policy Service handles authentication, authorization, and accounting (AAA) decisions for RADIUS traffic. Without it, the PSN cannot process RADIUS requests.

Answer

Registration Service

Answer

Administration Service

Answer

Monitoring Service

Question 15

Which guest portal type should you select if you want to allow users to connect to the network without any authentication, simply by clicking an 'Accept' button?

Accepted Answer

Hotspot Portal. The Hotspot Portal is specifically designed for unauthenticated guest access where users simply click an 'Accept' button (or similar) to acknowledge the acceptable use policy and gain network access. It requires no credentials, sponsorship, or self-registration, making it the correct choice for click-through access.

Answer

Sponsored Guest Portal

Answer

Guest Portal

Answer

Self-Registered Guest Portal

Question 16

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Accepted Answer

The Network Access Device (NAD). The Network Access Device (NAD) is responsible for redirecting the guest user's browser in a Central Web Authentication (CWA) flow. When the endpoint connects, the NAD (e.g., a wireless controller or switch) intercepts the HTTP traffic and redirects the user to the ISE guest portal for authentication.

Answer

The Cisco ISE Policy Service Node (PSN)

Answer

The endpoint's default browser

Answer

The Guest Portal application

Question 17

How can you verify that ISE is receiving TACACS+ requests from a specific switch?

Accepted Answer

Check the TACACS Livelogs. Cisco ISE provides TACACS+ Livelogs under Operations > TACACS > Live Logs, which show real-time TACACS+ authentication and authorization requests received from network devices. This is the direct way to verify that ISE is receiving TACACS+ requests from a specific switch, including the device name, user, and result.

Answer

View the Network Device list

Answer

Run a packet capture on the switch

Answer

Check the System Summary

Question 18

You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?

Accepted Answer

Deny 'show running-config' and permit all other commands. To block a specific command like 'show running-config' while allowing other 'show' commands, the command set must explicitly deny 'show running-config' and then permit all other commands. TACACS+ command sets are evaluated top-down, so the deny rule for the specific command must come before a permit-all rule. This ensures only that command is blocked.

Answer

Deny 'show' and permit 'show running-config'

Answer

Permit 'show.*' and deny 'show running-config'

Answer

Set the command privilege level to 0

Question 19

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

Accepted Answer

Reporting and analytics. The Monitoring and Troubleshooting (MnT) persona in Cisco ISE is responsible for collecting and storing operational data, so option B (Reporting and analytics) is correct because MnT nodes host the reporting and analytics services that let administrators run operational reports, live logs, and dashboards on authentication, authorization, and accounting events. Option D (Log aggregation from all nodes) is also correct because all Policy Services Nodes (PSNs) and other ISE nodes forward their syslog and session data to the MnT node, which aggregates and stores it in the MnT database for troubleshooting and audit purposes. Option A (Policy distribution) is not an MnT function; policy configuration and distribution are handled by the Policy Administration Node (PAN), which pushes policies to PSNs. Option C (RADIUS authentication) is performed by Policy Services Nodes, which handle RADIUS and TACACS+ authentication, authorization, and accounting, not the MnT persona. Option E (Endpoint profiling probe) is a function of the PSN, where profiling probes (e.g., RADIUS, SNMP, DHCP, NetFlow) collect endpoint attributes, not the MnT node.

Answer

Policy distribution

Answer

RADIUS authentication

Answer

Endpoint profiling probe

Question 20

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

Accepted Answer

TACACS+ Livelogs. TACACS+ Livelogs in Cisco ISE is the dedicated real-time log view that shows TACACS+ authentication and authorization request details, including the policy set and rule that matched. When troubleshooting TACACS+ authentication issues, this is the correct log to monitor because it captures the full request/response exchange and the policy evaluation result. RADIUS Livelogs, by contrast, only show RADIUS traffic and would not display TACACS+ request details.

Answer

System Summary Dashboard

Answer

Endpoint Context Visibility

Answer

RADIUS Livelogs