SISE Practice Exam 4 — 20 Questions

Question 1

Which THREE attributes can be used within a Cisco ISE Authorization Policy condition?

Accepted Answer

Device Type. ISE allows matching based on a wide range of attributes from dictionaries including Network Device, Endpoint, and Session attributes.

Answer

TACACS+ Command

Answer

SGT Value

Question 2

Which of the following is a valid remediation action type in Cisco ISE?

Accepted Answer

File Remediation. File, Registry, and Service remediation are standard options.

Answer

Process Kill Remediation

Answer

Network Remediation

Answer

User Prompt Remediation

Question 3

What is the purpose of the 'Posture Discovery' phase?

Accepted Answer

To identify if posture is required for the session. Discovery is the initial communication where the agent identifies the ISE PSN and checks if a posture policy exists.

Answer

To verify the user credentials

Answer

To remediate non-compliant endpoints

Answer

To determine if the endpoint is compliant

Question 4

In the BYOD flow, what occurs immediately after the user provides credentials in the portal?

Accepted Answer

The device is provisioned with a certificate. After credentials are verified, the ISE portal triggers the download of the Network Setup Assistant or the SCEP enrollment process.

Answer

The device is automatically moved to the production VLAN

Answer

The user is disconnected from the network

Answer

The device is registered in the Active Directory

Question 5

Which THREE of the following are valid operators for a Registry Condition?

Accepted Answer

Equals. Standard operators include Equals, Contains, and Starts With.

Answer

Includes All

Answer

Exists Only

Question 6

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

Accepted Answer

Enable BYOD settings in the device portal configuration. The two core requirements are enabling the BYOD portal and configuring the authorization policy to handle the registration flow.

Answer

Install a dedicated agent on every switch

Answer

Create a local user account for every device

Answer

Disable RADIUS authentication

Question 7

What is the benefit of using multiple TACACS+ Policy Sets?

Accepted Answer

To segment policies by device type or user group. Policy Sets allow for granular control and different rules for different types of devices or users.

Answer

To increase the speed of authentication

Answer

To reduce the need for shared secrets

Answer

To increase the number of users allowed

Question 8

Which of the following is NOT a standard RADIUS attribute type used in ISE?

Accepted Answer

Protocol Header. Standard RADIUS attributes follow specific RFC formats; custom vendor-specific attributes (VSAs) are used for Cisco proprietary functions.

Answer

System Defined

Answer

IETF

Answer

Vendor Specific

Question 9

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

Accepted Answer

To test the policy before enforcing access control. Monitoring mode allows the admin to see if 802.1X/MAB would pass or fail without actually blocking traffic.

Answer

To force the port to shutdown

Answer

To provide internet access to guests

Answer

To perform vulnerability scanning

Question 10

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

Accepted Answer

To gather compliance data without restricting network access. Monitor Mode allows administrators to log posture results without denying access, facilitating testing before enforcement.

Answer

To automatically remediate endpoints

Answer

To bypass the posture check entirely

Answer

To block all traffic until the agent is installed

Question 11

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

Accepted Answer

The device remains Non-Compliant. If no remediation is defined, the device simply remains in a non-compliant state, and the authorization policy usually denies access or places it in a restricted VLAN.

Answer

The agent automatically remediates the issue

Answer

The device is granted full access

Answer

The posture agent crashes

Question 12

Which TWO of the following are prerequisites for the AnyConnect posture agent to function?

Accepted Answer

Connectivity to the ISE PSN. The agent needs to reach the PSN and be supported by the endpoint OS.

Answer

Administrative rights on the server

Answer

A pre-installed VPN tunnel

Answer

A static IP address on the endpoint

Question 13

You are configuring a DHCP probe on a Cisco ISE node to identify endpoints. Which specific configuration step is required to ensure the ISE node receives DHCP traffic when the client and server are on a different subnet?

Accepted Answer

Configure an IP helper-address on the Layer 3 device for the client VLAN pointing to the ISE node.. IP Helper-address must be configured on the default gateway to forward DHCP broadcasts to the ISE node acting as a probe.

Answer

Configure a DHCP relay agent on the ISE node itself.

Answer

Enable DHCP Server mode on the Cisco ISE Profiling service.

Answer

Enable DHCP Snooping on the ISE node interface.

Question 14

Which TWO of the following are potential sources of information for the DHCP probe?

Accepted Answer

DHCP Option 60 (Vendor Class Identifier). DHCP packets contain useful information in the Option fields, specifically the Vendor Class Identifier and the Parameter Request List.

Answer

Layer 2 source MAC address.

Answer

IP Header Source Address.

Answer

DHCP Option 12 (Host Name)

Question 15

Which of the following is a common reason for a 'Certificate Mismatch' error during EAP-TLS?

Accepted Answer

The client does not trust the Root CA that signed the server certificate. This occurs when the Root CA certificate on the client does not match the CA that signed the certificate provided by the ISE server.

Answer

The ISE node time is out of sync

Answer

The device is not in the correct VLAN

Answer

The SSID is not configured for EAP-TLS

Question 16

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

Accepted Answer

File Remediation Action. A File Remediation action allows you to specify a URL or a path to a file that the client can download to remediate compliance.

Answer

Post-Posture Authorization Rule

Answer

Client Provisioning Policy

Answer

Posture Requirement

Question 17

When using AnyConnect as the posture agent, how can you prevent users from disabling the posture service?

Accepted Answer

By disabling the 'Allow Stop' option in the AnyConnect profile. The AnyConnect profile (xml) can be configured to hide the UI or prevent the service from being stopped by non-admin users.

Answer

By configuring a 'Mandatory' posture requirement

Answer

By setting the 'Posture Type' to 'System'

Answer

By enabling 'Auto-Restart' in the ISE global settings

Question 18

An administrator is troubleshooting a posture failure where the AnyConnect agent is installed but ISE reports the endpoint as 'Unknown'. Which configuration setting in the Posture Policy is most likely misconfigured?

Accepted Answer

The Posture Policy is not associated with the correct Authorization Profile used in the Authorization Policy.. If the agent is installed but shows 'Unknown', it usually indicates the agent is not successfully checking in or the Posture Policy is not correctly mapped to the authorization profile currently applied to the session.

Answer

The Compliance Module is not installed on the ISE server.

Answer

The Remediation Action is disabled.

Answer

The Posture Agent configuration is missing the server discovery URL.

Answer

The ISE server certificate is not trusted by the client.

Question 19

When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?

Accepted Answer

ISE Live Logs. The AnyConnect diagnostic logs, the ISE Posture reports, and the Live Logs are the primary sources of truth for investigating posture failures.

Answer

Cisco IOS syslog

Answer

AnyConnect VPN Gateway logs

Question 20

Which TWO of the following methods can be used to identify a device as 'BYOD' in ISE?

Accepted Answer

Bulk import of MAC addresses. Devices can be identified via manual registration by the user or through automated enrollment via the BYOD flow.

Answer

IP address range

Answer

SNMP community string

Answer

Switch port ID