SISE Practice Exam 2 — 20 Questions

Question 1

If a PSN loses connectivity to the PAN, what happens to existing user sessions?

Accepted Answer

Sessions remain active and the PSN continues to authenticate. The PSN will continue to handle existing sessions and new authentications using the cached policy, but configuration changes cannot be pushed.

Answer

All sessions are terminated

Answer

The PSN enters emergency mode

Answer

The PSN reboots

Question 2

Which of the following is required for AnyConnect to perform posture assessment on a Mac endpoint?

Accepted Answer

The 'AnyConnect Compliance Module' must be installed. The 'AnyConnect Compliance Module' must be deployed and configured to support macOS.

Answer

The Mac must be domain joined

Answer

A separate 'Posture Proxy' must be configured

Answer

The user must have root access

Question 3

Which THREE features are configured at the node level in the ISE Administration console?

Accepted Answer

Logging categories. Logging categories, physical interface settings, and service-specific parameters (like profiling probes) are configured per-node.

Answer

Global policy rules

Answer

External ID store configuration

Question 4

Which TWO of the following are valid components of an ISE Posture Policy?

Accepted Answer

Posture Requirement. Posture policies are composed of Requirements and Remediation Actions.

Answer

Identity Group

Answer

Authorization Policy Rule

Answer

Certificate Profile

Question 5

Which TWO of the following are benefits of integrating MDM with Cisco ISE for BYOD?

Accepted Answer

Ability to trigger remote wipe or lock commands. MDM integration enables automated compliance checks and the ability to wipe or lock devices if they are lost.

Answer

Faster SSID connection speed

Answer

Automatic creation of Active Directory accounts

Answer

Increased bandwidth for BYOD users

Question 6

During the BYOD onboarding process, a user is successfully redirected to the portal, but the certificate installation fails because the client cannot trust the root CA. Which configuration is required to resolve this?

Accepted Answer

Import the Root CA certificate into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled.. The Root CA certificate must be uploaded to the 'Trusted Certificates' store in ISE and marked as trusted for 'Client Authentication'.

Answer

Install the CA certificate on the local WLC controller under the WLAN configuration.

Answer

Add the Root CA to the 'System Certificates' store instead of 'Trusted Certificates'.

Answer

Enable 'Allow Weak Ciphers' in the global BYOD settings.

Question 7

You need to ensure that TACACS+ authentication requests for network devices are only accepted if the device IP matches a specific Network Device Group. Where do you configure the Device Type condition?

Accepted Answer

In the Policy Set condition using 'Device Type'. Policy sets allow for conditions based on Network Device Groups (NDG), which are mapped to devices.

Answer

In the Command Set definition

Answer

In the TACACS+ Profile settings

Answer

In the Global System Settings

Question 8

An administrator needs to ensure that only endpoints with a specific registry key present are allowed access. Where should this posture condition be defined in Cisco ISE?

Accepted Answer

Policy > Policy Elements > Conditions > Posture > Registry Condition. Registry checks are configured under Policy > Policy Elements > Conditions > Posture > Registry Condition.

Answer

Administration > System > Settings > Posture

Answer

Policy > Policy Elements > Conditions > Authorization > Compound Condition

Answer

Policy > Policy Elements > Results > Posture > Remediation Actions

Question 9

Which THREE of the following items are configured in an AnyConnect Posture Requirement?

Accepted Answer

Condition. Requirements include the condition, the operating system, and the remediation action.

Answer

Device ID

Answer

Authorization Rule

Question 10

Which dashboard widget provides a quick summary of BYOD activity in your network?

Accepted Answer

BYOD Registration Status. The BYOD/Registration dashboard widgets provide real-time visibility into the number of registered vs. pending devices.

Answer

System Resources

Answer

Active Directory Health

Answer

RADIUS Latency

Question 11

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

Accepted Answer

The user must manually 'Install' the configuration profile. iOS requires an Apple-signed profile, which ISE generates. The device must be able to reach the portal via HTTPS, and the profile must be trusted by the OS.

Answer

The device must be connected via VPN

Answer

The device must be jailbroken

Question 12

Which TWO of the following are valid device attributes that can be used to identify a device for BYOD onboarding?

Accepted Answer

Device-Type. Device type and operating system are fundamental attributes used in policy conditions to distinguish BYOD devices.

Answer

VLAN-ID

Answer

RADIUS-Session-ID

Answer

Port-Number

Question 13

When setting up TACACS+ for network administration, which THREE configurations must be present on the Cisco network device? (Choose three)

Accepted Answer

AAA authentication/authorization commands. The switch needs the TACACS+ server IP, the shared secret, and the AAA command authorization configured.

Answer

Local user database for all commands

Answer

RADIUS server configuration

Question 14

Which THREE of the following are valid types of Posture Conditions?

Accepted Answer

Service Condition. ISE supports multiple condition types including File, Registry, and Service checks.

Answer

User Identity Condition

Answer

Port Condition

Question 15

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

Accepted Answer

HTTPS. SCEP is for certificates, HTTPS is for the portal, and RADIUS is for network access control.

Answer

SMTP

Answer

FTP

Question 16

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

Accepted Answer

Reporting and analytics. MnT nodes are responsible for collecting logs from all nodes in the deployment and providing the analytics/reporting interface.

Answer

Policy distribution

Answer

RADIUS authentication

Answer

Endpoint profiling probe

Question 17

Which RADIUS attribute is commonly used to inform the Network Access Server (NAS) that a re-authentication is required after a successful BYOD provisioning?

Accepted Answer

Termination-Action: RADIUS-Request. The 'Cisco-AV-Pair' containing 'url-redirect' is used initially, but 'Termination-Action: RADIUS-Request' is often used to force a re-authentication after the BYOD process.

Answer

Class-Attribute: Re-Authenticate

Answer

Filter-Id: Refresh

Answer

Tunnel-Type: VLAN-Change

Question 18

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

Accepted Answer

Distributed Configuration Synchronization via HTTPS. The PAN uses a distributed configuration synchronization process via HTTPS/REST APIs to push configuration changes to all other nodes in the deployment.

Answer

Rsync over SSH

Answer

RADIUS Change of Authorization (CoA)

Answer

SNMPv3 Trap propagation

Question 19

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

Accepted Answer

The FQDN of the Load Balancer VIP. The AnyConnect profile should contain a list of PSNs or a load-balanced VIP to ensure redundancy.

Answer

The local gateway address

Answer

The IP address of the ISE Admin Node

Answer

A single static IP of the Primary PSN

Question 20

Which TWO of the following steps are required to deploy the AnyConnect posture agent?

Accepted Answer

Create a Client Provisioning policy. Deployment involves creating the Client Provisioning resource and then creating the policy to assign it to endpoints.

Answer

Set the NAS IP address

Answer

Enable RADIUS Accounting

Answer

Configure a TrustSec policy