SISE Practice Exam 3 — 20 Questions

Question 1

You are configuring a BYOD flow where users must register their devices via the self-service portal. Which ISE component is responsible for triggering the redirection to the BYOD portal after an initial MAC Authentication Bypass (MAB) success?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization Profile with a redirect ACL and URL redirect. The Authorization Profile containing the 'Redirect' attribute is what forces the client to the portal.

Answer

Policy Set with a global redirect object

Answer

Authentication Policy with a portal trigger

Answer

RADIUS server-side redirect attribute

Question 2

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

Accepted Answer

It defines the privilege level for the session. The Shell Profile defines attributes like privilege level, auto-command, and custom attributes for CLI access.

Answer

It stores the device credentials

Answer

It defines which users can access the device

Answer

It defines the list of allowed commands

Question 3

Which TWO of the following are valid ways to assign a VLAN in an ISE Authorization Profile?

Accepted Answer

Using the VLAN common task. You can use the 'VLAN' common task or the 'Tunnel-Private-Group-ID' RADIUS attribute.

Answer

Using the Filter-Id attribute

Answer

Using the cisco-av-pair attribute

Answer

Using the Framed-IP-Address attribute

Question 4

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

Accepted Answer

In the Command Set Policy Element. TACACS+ command sets are defined under Policy Elements and then applied to the shell profile in the Device Administration policy.

Answer

In the Policy Set Authentication rule

Answer

In the Authorization Profile

Answer

In the User Identity Group

Question 5

Which component is responsible for triggering the posture assessment process when a user connects to the network?

Accepted Answer

Posture Policy. The posture requirement, when associated with a client provisioning policy, triggers the AnyConnect agent to begin assessment.

Answer

Network Access Device (NAD)

Answer

AnyConnect Compliance Module

Answer

RADIUS Server

Question 6

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

Accepted Answer

Patch Condition. A 'Patch Condition' is used specifically to verify the presence of Windows updates/patches.

Answer

Registry Condition

Answer

Application Condition

Answer

File Condition

Question 7

Which probe is most effective for identifying the specific operating system and browser type of an endpoint connecting via a web portal?

Accepted Answer

HTTP probe. The HTTP probe inspects the User-Agent string in HTTP headers, which identifies the browser and OS.

Answer

DHCP probe

Answer

MAC OUI probe

Answer

DNS probe

Question 8

You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?

Accepted Answer

The necessary probes are not receiving enough attributes to match a policy.. If ISE has not received enough attributes to meet the threshold of a profiling policy, it remains 'Unknown'.

Answer

The device is using a static IP.

Answer

The endpoint is not authenticated.

Answer

The endpoint has a firewall enabled.

Question 9

You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?

Accepted Answer

To allow devices to request certificates from the CA via the ISE node. The SCEP proxy allows the endpoint to request a certificate from an internal CA through the ISE node, keeping the CA hidden from the internal network.

Answer

To sign certificates for the endpoints

Answer

To encrypt the SCEP traffic between ISE and the endpoint

Answer

To store the Private Keys of the issued certificates

Question 10

When configuring a RADIUS authorization policy for a dot1x deployment, which TWO attributes are commonly used to assign a dynamic VLAN?

Accepted Answer

Tunnel-Type equals VLAN. Tunnel-Type and Tunnel-Medium-Type are mandatory RADIUS attributes to signal to a switch that a VLAN assignment is intended.

Answer

Service-Type equals Framed

Answer

Framed-IP-Address

Answer

Cisco-AV-Pair

Question 11

Which AnyConnect module is specifically required to perform posture assessment in ISE?

Accepted Answer

AnyConnect Compliance Module. The 'AnyConnect Compliance Module' (formerly known as the posture module) is required.

Answer

AnyConnect AMP Enabler

Answer

AnyConnect Web Security Module

Answer

AnyConnect VPN Module

Question 12

Which THREE conditions are required for successful AnyConnect posture assessment in a wired network environment?

Accepted Answer

The endpoint must have the AnyConnect agent installed.. Posture requires a working authorization profile, a properly provisioned agent, and a clear communication path between the agent and the ISE Policy Services Node (PSN).

Answer

The switch must be configured for WebAuth.

Answer

The endpoint must be joined to an Active Directory domain.

Question 13

Which protocol is used by ISE to communicate with the MDM server for device status checks?

Accepted Answer

REST API. ISE uses REST APIs to communicate with most modern MDM solutions like AirWatch or Intune.

Answer

SNMP

Answer

RADIUS

Answer

LDAP

Question 14

A user is unable to pass posture assessment because the 'AnyConnect Compliance Module' is not detecting the antivirus software. Which log file on the endpoint should be reviewed to troubleshoot the compliance module's scanning logic?

Accepted Answer

AnyConnect Compliance Module log (ac_ise_posture.log). The ACLog.txt or the Compliance Module logs (typically found in %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture) contain details about scan results.

Answer

NAC Agent Log (nac_agent.log)

Answer

Windows Event Viewer - Application Log

Answer

ISE Posture Log (ise_posture.log)

Question 15

When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?

Accepted Answer

Greater Than or Equal. The 'Greater Than or Equal' operator is necessary to ensure the version meets or exceeds the security requirement.

Answer

Matches

Answer

Equals

Answer

Contains

Question 16

What is the effect of setting a Posture Requirement to 'Optional'?

Accepted Answer

The user can choose to bypass the check without being blocked. Optional means the agent will perform the check, but if the endpoint is non-compliant, the access is not restricted based on that specific requirement.

Answer

The agent only checks when requested by the user

Answer

The agent will not perform the check at all

Answer

The device is automatically granted access

Question 17

You are configuring a 'Registry' check as part of a posture requirement. The goal is to ensure a specific registry key exists to prove a corporate application is configured correctly. What is the correct way to specify the path if the key is located in HKEY_LOCAL_MACHINE?

Accepted Answer

Use 'HKLM' as the root of the path.. In Cisco ISE posture requirement configurations, you must use the 'HKLM' abbreviation for the HKEY_LOCAL_MACHINE root key when defining the path.

Answer

Use 'ROOT:HKLM'.

Answer

The path must be relative to the user profile, so HKLM is invalid.

Answer

Use a backslash prefix like '\HKLM'.

Answer

Use the full string 'HKEY_LOCAL_MACHINE' at the start of the path.

Question 18

Which THREE of the following are valid remediation actions?

Accepted Answer

Service Remediation. File, Registry, and Service remediation are standard in Cisco ISE.

Answer

VLAN Remediation

Answer

ACL Remediation

Question 19

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

Accepted Answer

Device Profiling. ISE uses 'Device Profiling' (via DHCP fingerprinting, HTTP User-Agent, etc.) to identify the device and trigger the correct provisioning flow.

Answer

RADIUS Accounting

Answer

Active Directory Identity Store

Answer

Policy Sets

Question 20

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

Accepted Answer

By creating a Network Device Group. Network Device Groups (NDGs) allow you to logically group devices and use them in policy conditions.

Answer

By using IP address ranges in the policy

Answer

By tagging them with SGTs

Answer

By using the Device Name in the condition