SISE Practice Exam 3 — 20 Questions

Question 1

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

Accepted Answer

Initiate registration from the Primary PAN under Administration > System > Deployment. In Cisco ISE, the Primary PAN is the authoritative node that maintains the deployment database and controls node registration. To add a secondary node, you log into the Primary PAN, navigate to Administration > System > Deployment, and use the 'Register an ISE node' action to initiate the join. The secondary node must already be installed and reachable, but the registration workflow is always driven from the Primary PAN, not the joining node.

Answer

Configure the Secondary node as an standalone node and merge databases

Answer

Run the join command from the secondary node's CLI

Answer

Create a cluster via the ISE CLI setup wizard

Question 2

Which THREE factors influence the decision to use multiple PSNs in a deployment?

Accepted Answer

Geographical distribution. Option C (Geographical distribution) is correct because deploying multiple Policy Service Nodes (PSNs) across different sites lets each location authenticate its own users locally, avoiding WAN latency and link dependency for RADIUS traffic. Option D (Load balancing of RADIUS requests) is correct because multiple PSNs distribute the authentication, authorization, and accounting load, preventing any single PSN from becoming a bottleneck as endpoint counts grow. Option E (Redundancy for node failure) is correct because if one PSN becomes unavailable, NADs can fail over to another PSN, preserving network access during outages. Options A (Increased log storage capacity) and B (Centralized database backup) are not valid factors: logging and backup are handled by the Monitoring and Policy nodes (MnT/PAN), not by adding PSNs, so they do not drive the decision to deploy multiple PSNs.

Answer

Increased log storage capacity

Answer

Centralized database backup

Question 3

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

Accepted Answer

Authorization Policy Condition. In Cisco ISE, MAB (MAC Authentication Bypass) authorization decisions are made by the Authorization Policy, and the specific conditions that match attributes like MAC address, OUI, or endpoint identity group are configured as conditions within an Authorization Policy rule. To restrict access to specific MAC OUI addresses, you create a condition (e.g., using the 'MACAddress' or 'EndPointMacAddress' attribute with an OUI prefix match) inside the Authorization Policy rule, which then determines the resulting Authorization Profile.

Answer

Authentication Policy

Answer

Identity Source Sequence

Answer

Authorization Profile

Question 4

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

Accepted Answer

Shell Profile. In Cisco ISE TACACS+ device administration, the Shell Profile is the result object that defines the privilege level (e.g., Privilege Level 15) assigned to a user after successful authentication and authorization. It is referenced within an Authorization Policy rule and returned as an AV-pair (such as shell:priv-lvl=15) to the network device, which then enforces the user's CLI privilege.

Answer

Command Set

Answer

Authorization Profile

Answer

Device Administration Policy

Question 5

Which menu path in Cisco ISE is used to define a new Network Device Group?

Accepted Answer

Administration > Network Resources > Network Device Groups. The correct menu path to define a new Network Device Group in Cisco ISE is Administration > Network Resources > Network Device Groups. This is where you create and manage groups that can be used to logically group network devices for policy conditions and authorization rules.

Answer

Operations > TACACS Livelogs

Answer

Administration > Identity Management

Answer

Policy > Policy Elements > Results

Question 6

A security engineer is configuring a Cisco ISE guest portal for a conference. Attendees must be able to create their own accounts but must first receive a one-time code via SMS to validate their phone number. The SMS gateway has already been integrated with ISE. Which guest portal flow should the engineer select to meet this requirement?

Accepted Answer

Self-Registered Guest Flow with SMS validation. The Self-Registered Guest Flow enables guests to create their own accounts without sponsor intervention. Enabling SMS validation within that flow forces the guest to enter a one-time code sent to their mobile phone, confirming the number is valid. The other flows either skip identity validation entirely, require a sponsor, or serve a different purpose such as device onboarding.

Answer

BYOD Onboarding Flow

Answer

Hotspot Guest Flow

Answer

Sponsored Guest Flow

Question 7

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

Accepted Answer

To test the policy before enforcing access control. Monitoring Mode in Cisco ISE is a deployment phase where the switch port is configured to authenticate and authorize endpoints but does not enforce the result. The purpose is to test policies and gather data without impacting network access, allowing administrators to validate configurations before moving to enforcement. Thus, the correct answer is to test the policy before enforcing access control.

Answer

To force the port to shutdown

Answer

To provide internet access to guests

Answer

To perform vulnerability scanning

Question 8

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

Accepted Answer

Enable BYOD settings in the device portal configuration. Option B is correct because enabling BYOD settings in the device portal configuration is a mandatory step: the Cisco ISE device portal (the client provisioning and BYOD portal) must have BYOD functionality turned on so that endpoints can be onboarded, registered, and have supplicant/certificate provisioning performed. Option D is correct because a mandatory part of BYOD is an authorization policy that matches non-compliant or unregistered BYOD endpoints and redirects them to the BYOD/guest portal for onboarding, typically using a redirect URL (e.g., the client provisioning portal) before granting full network access. Option A is incorrect because BYOD onboarding does not require installing a dedicated agent on every switch; Cisco ISE uses RADIUS, web portals, and supplicant provisioning instead. Option C is incorrect because BYOD does not require creating a local user account for every device; identity is handled through ISE's identity stores, certificates, and endpoint registration. Option E is incorrect because disabling RADIUS authentication would break the 802.1X/MAC authentication and authorization that ISE relies on for BYOD, so it is the opposite of a required step.

Answer

Install a dedicated agent on every switch

Answer

Create a local user account for every device

Answer

Disable RADIUS authentication

Question 9

If a PSN loses connectivity to the PAN, what happens to existing user sessions?

Accepted Answer

Sessions remain active and the PSN continues to authenticate. When a PSN loses connectivity to the PAN, existing user sessions remain active and the PSN continues to authenticate new sessions using its last known policy configuration. This is by design to maintain network access during PAN outages.

Answer

All sessions are terminated

Answer

The PSN enters emergency mode

Answer

The PSN reboots

Question 10

When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?

Accepted Answer

It enables TACACS+ services for this device. When adding a network device in ISE, checking the 'TACACS+ Authentication Settings' checkbox enables TACACS+ services for that device, allowing ISE to process TACACS+ authentication, authorization, and accounting requests from it. This is separate from RADIUS configuration, which is controlled by the RADIUS settings on the same device entry. Enabling TACACS+ is a prerequisite for using ISE for device administration (AAA) on that network device.

Answer

It enables RADIUS for this device

Answer

It forces the switch to use SNMP

Answer

It automatically configures the switch via CLI

Question 11

You are using the Feed Service to update your profiling policies. How can you ensure that custom profiling policies you have created are not overwritten during the update?

Accepted Answer

Custom policies are not affected by Feed Service updates.. Cisco ISE's Feed Service updates only the system-provided profiling policies that ship with ISE; custom profiling policies created by administrators are stored separately and are not overwritten or removed during a feed update. This design lets organizations receive updated fingerprints for new device types without losing their own customizations.

Answer

Place custom policies in the system policy folder.

Answer

Export custom policies before every update.

Answer

Disable automatic updates.

Question 12

You are configuring a policy to block access for non-compliant devices. Where do you configure the posture status as a policy condition?

Accepted Answer

Authorization Policy. Posture status (e.g., Compliant, Non-Compliant, Unknown) is evaluated as a condition within the Authorization Policy, where ISE checks the posture result and applies the appropriate authorization profile — such as a quarantine VLAN or restricted dACL for non-compliant devices. The Authorization Policy is the correct location because posture is an authorization-time attribute, not an authentication-time one.

Answer

Authentication Policy

Answer

Endpoint Group

Answer

Identity Source

Question 13

You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?

Accepted Answer

The necessary probes are not receiving enough attributes to match a policy.. Profiling in ISE relies on collecting attributes from various probes (DHCP, HTTP, RADIUS, SNMP, etc.) and matching them against profiling policies. If the endpoint shows as 'Unknown', the most likely cause is that the probes are not receiving enough attributes — or the attributes received do not match any existing policy condition. Without sufficient attribute data, ISE cannot classify the device even if it is obviously a Windows workstation to a human.

Answer

The device is using a static IP.

Answer

The endpoint is not authenticated.

Answer

The endpoint has a firewall enabled.

Question 14

What is the purpose of the 'Guest Flow' setting in the Authorization Profile?

Accepted Answer

It tells the ISE to trigger the Guest Portal.. The 'Guest Flow' setting in an ISE Authorization Profile tells ISE to redirect the endpoint to the Guest Portal for registration or sponsorship, rather than granting normal network access. It is the mechanism that triggers the guest onboarding workflow when a user or device is not yet known to ISE. This is distinct from session timeout, MAC caching, or group definition, which are separate authorization attributes.

Answer

It defines the session timeout.

Answer

It enables MAC caching.

Answer

It defines the Guest Group.

Question 15

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

Accepted Answer

Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. The BYOD checkbox for a specific device registration portal is enabled under Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. This is where the portal configuration includes the option to enable BYOD device registration. The path is specific to the Guest Access work center in ISE.

Answer

Policy > Policy Sets > [Set Name] > Authorization Policy

Answer

Operations > Troubleshoot > BYOD Settings

Answer

Administration > Device Portal Management

Question 16

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

Accepted Answer

To configure the native supplicant settings for secure network access. The Network Setup Assistant (NSA) is a client-side provisioning component in Cisco ISE BYOD flows that walks the end user through configuring the native supplicant (Windows WLAN AutoConfig, macOS, iOS, Android, etc.) with the correct SSID, EAP method (PEAP/EAP-TLS), and certificate settings so the device can authenticate via 802.1X. It is downloaded from the ISE Guest/BYOD portal and runs locally on the endpoint to install the required profile. This enables secure EAP-based network access without manual supplicant configuration by the user.

Answer

To provide a VPN tunnel to the internal network

Answer

To manage the user's Active Directory account

Answer

To scan the device for malware before allowing network access

Question 17

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

Accepted Answer

Operations > Reports > Endpoints and Users > Certificate Provisioning. The Certificate Provisioning report under Operations > Reports > Endpoints and Users is the dedicated location where ISE logs the outcome of CA interactions during BYOD onboarding, including certificate enrollment requests, successes, and failures. When devices register successfully but certificate issuance fails, this report captures the SCEP/PKCS or EST exchange between ISE and the CA, showing error codes returned by the CA.

Answer

Policy > Policy Elements > Results > Certificate Templates

Answer

Operations > RADIUS Livelog

Answer

Administration > System > Certificates > Certificate Signing Requests

Question 18

Which specific ISE process is responsible for managing the communication between the PAN and PSNs?

Accepted Answer

ISE Messaging Service. The ISE Messaging Service is the internal process that handles communication between the Policy Administration Node (PAN) and the Policy Service Nodes (PSNs). It uses a messaging bus to propagate policy configuration, session data, and administrative changes across the deployment.

Answer

Application Server

Answer

Radius Core

Answer

Monitoring Service

Question 19

How do you verify the current licensing status and consumption on your ISE deployment?

Accepted Answer

Administration > System > Licensing. In Cisco ISE, licensing status and consumption are viewed under Administration > System > Licensing. This page shows the license type (Base, Plus, Apex), the number of concurrent sessions consumed, and the evaluation period remaining. It is the authoritative location for verifying license compliance and usage.

Answer

Dashboard > Licensing

Answer

Policy > Licensing

Answer

Operations > Licensing

Question 20

You are troubleshooting a PSN that is not receiving configuration updates. Which log file on the PSN would provide the most insight into the configuration sync process?

Accepted Answer

config-dist.log. The config-dist.log file on a PSN records the configuration distribution process, including synchronization attempts, successes, and failures with the Primary PAN. When a PSN is not receiving configuration updates, this log provides the most direct insight into why the sync is failing (e.g., connectivity, certificate, or replication issues). It is the go-to log for troubleshooting configuration replication.

Answer

catalina.out

Answer

radius.log

Answer

prrt-server.log