SISE Practice Exam 4 — 20 Questions

Question 1

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

Accepted Answer

The FQDN of the Load Balancer VIP. The posture agent should point to the FQDN of the Load Balancer VIP to ensure it always reaches a PSN for assessment. In a high-availability environment, using a load balancer VIP provides a single, resilient endpoint that distributes requests across multiple PSNs. This avoids single points of failure and ensures that if one PSN goes down, the agent can still reach another PSN via the VIP.

Answer

The local gateway address

Answer

The IP address of the ISE Admin Node

Answer

A single static IP of the Primary PSN

Question 2

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

Accepted Answer

The switch is missing the 'cts role-based enforcement' command. For SGACL enforcement to occur on a switch, the switch must have the 'cts role-based enforcement' command enabled globally (and often on the interface). Without this command, the switch may receive the SGT via RADIUS but will not enforce any SGACL filtering, resulting in the described failure. This is the most likely reason when the SGT is assigned but filtering does not happen.

Answer

The SGT is not in the ISE database

Answer

RADIUS shared secret is wrong

Answer

The user is in the wrong AD group

Question 3

When configuring an SNMP Query probe, why is it recommended to use SNMPv3 instead of SNMPv1/v2c?

Accepted Answer

SNMPv3 provides authentication and encryption for the query.. SNMPv3 is recommended over SNMPv1/v2c for SNMP Query probes because it provides authentication and encryption, ensuring that the queries and responses are secure. SNMPv1/v2c use plaintext community strings, which are vulnerable to eavesdropping and unauthorized access. SNMPv3 also supports stronger security models like USM (User-based Security Model).

Answer

SNMPv3 is the only version supported by ISE.

Answer

SNMPv3 is faster.

Answer

SNMPv3 eliminates the need for a community string.

Question 4

You need to ensure that only specific ISE nodes perform the NMAP scan probe. Where is this configured?

Accepted Answer

Administration > System > Deployment > [Node Name] > Profiling Configuration. NMAP scan probe enablement is configured per-PSN under Administration > System > Deployment > [Node Name] > Profiling Configuration. This is where you enable or disable individual probes (NMAP, DHCP, RADIUS, SNMP, NetFlow, etc.) on a specific ISE node, allowing you to restrict scanning to dedicated PSNs rather than every node in the deployment.

Answer

Administration > System > Settings > Profiling Feed

Answer

Policy > Profiling > Profiling Policies

Answer

Policy > Policy Elements > Results

Question 5

Which of the following is NOT a valid probe type in Cisco ISE?

Accepted Answer

ICMP. Cisco ISE supports several active probe types for endpoint profiling: DHCP, RADIUS, SNMP Query, SNMP Trap, NetFlow, DNS, HTTP, and NMAP, among others. ICMP is not one of the configurable probe types in ISE's profiling configuration — while ISE may send pings internally for reachability, ICMP is not exposed as a profiling probe. Therefore ICMP is the option that is NOT a valid probe type.

Answer

SNMP Query

Answer

DHCP

Answer

RADIUS

Question 6

What is the primary benefit of using a Policy Set compared to the legacy 'Rule-Based' approach in ISE?

Accepted Answer

Improved logical organization and modularity. The primary benefit of a Policy Set over the legacy rule-based approach is improved logical organization and modularity. Policy Sets let you group authentication and authorization rules by use case (e.g., wired 802.1X, wireless guest, VPN) with their own conditions, making large deployments easier to manage and troubleshoot.

Answer

Requires fewer licenses

Answer

Eliminates the need for external identity sources

Answer

Faster performance

Question 7

Which TWO of the following are valid locations to check for policy match results in ISE?

Accepted Answer

Live Logs. Option B (Live Logs) is correct because ISE's Live Logs (Operations > Live Logs / RADIUS Live Logs) display real-time authentication and authorization results, including which policy set, authentication rule, and authorization rule matched for each session. Option D (Policy Simulation tool) is correct because the Policy Simulation tool lets you run a simulated authentication/authorization request and shows the exact policy match results, including the matched policy set and rules, without affecting live traffic. Option A (Device Administration console) is incorrect because it is a TACACS+ management area for device administration, not a location for viewing policy match results. Option C (Identity Group properties) is incorrect because identity groups only define group membership and attributes, not policy evaluation results. Option E (RADIUS Secret settings) is incorrect because it only configures the shared secret used between the NAD and ISE, not policy match outcomes.

Answer

Device Administration console

Answer

Identity Group properties

Answer

RADIUS Secret settings

Question 8

You want to improve profiling accuracy for endpoints that do not send DHCP options. You decide to use SNMP Trap profiling. What is a critical prerequisite for this to function?

Accepted Answer

The network device must be configured to send SNMP traps to the ISE PSN IP address.. SNMP Trap profiling requires the network device (switch, WLC, router) to be configured to send SNMP traps to the ISE PSN's IP address, because ISE relies on receiving those traps to extract endpoint attributes like MAC addresses, link up/down events, and CDP/LLDP neighbor data. Without the device actively sending traps to ISE, the SNMP Trap probe receives no data and profiling cannot occur.

Answer

The endpoint must support SNMP agents.

Answer

The ISE node must have the SNMP Query probe enabled.

Answer

RADIUS Accounting must be disabled.

Question 9

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

Accepted Answer

The user must manually 'Install' the configuration profile. Option A is correct because Native Supplicant Provisioning (NSP) on iOS requires the user to manually tap 'Install' to accept and install the generated .mobileconfig profile — iOS does not allow silent installation of Wi-Fi/802.1X profiles pushed by ISE. Option C is correct because the iOS device must reach the ISE Guest/Sponsor/ BYOD portal over HTTPS (TCP 443) to authenticate, download the provisioning profile, and complete the onboarding flow. Option D is correct because the configuration profile delivered during NSP must be signed by a certificate that the iOS device trusts (e.g., a publicly trusted CA or an internal CA whose root is already installed), otherwise iOS rejects the profile as unsigned/untrusted. Option B is not required — NSP operates over the existing Wi-Fi/HTTPS path to the ISE portal, not a VPN tunnel. Option E is not required — NSP is a supported, Apple-sanctioned workflow on non-jailbroken iOS devices.

Answer

The device must be connected via VPN

Answer

The device must be jailbroken

Question 10

You are troubleshooting a Guest flow where the client hits the portal but cannot authenticate. You notice the MAC address is not being cached properly. Which setting in the Guest Portal configuration is responsible for enabling MAC caching?

Accepted Answer

Enable MAC Caching. MAC caching in the ISE Guest Portal configuration allows the client's MAC address to be remembered after successful authentication, so subsequent connections bypass the portal and are authenticated automatically. If MAC caching is not enabled, the MAC address is not cached, and the client is forced to re-authenticate through the portal each time, which matches the reported symptom. Enabling MAC Caching in the Guest Portal settings resolves this.

Answer

Enable Auto-Login

Answer

Enable Guest Flow Bypass

Answer

Enable Device Registration

Question 11

If a user's certificate expires, how can the user renew it using the ISE BYOD flow?

Accepted Answer

Reconnect to the SSID and follow the re-enrollment prompt in the portal. When a user's certificate expires in an ISE BYOD flow, the user can renew it by reconnecting to the SSID and following the re-enrollment prompt in the portal. This triggers the BYOD onboarding process again, allowing the user to obtain a new certificate. The certificate does not renew automatically, nor does it require manual administrator intervention or re-installing the Network Setup Assistant.

Answer

The certificate renews automatically in the background

Answer

Re-install the Network Setup Assistant manually

Answer

Contact the administrator to manually push a new certificate

Question 12

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

Accepted Answer

Device Profiling. Device Profiling is the ISE component that identifies the device type (e.g., iPhone vs. Windows) by collecting attributes via probes such as DHCP, RADIUS, SNMP, and NMAP, then matching them against profiling policies. This identification drives the appropriate BYOD configuration and authorization.

Answer

RADIUS Accounting

Answer

Active Directory Identity Store

Answer

Policy Sets

Question 13

When deploying the AnyConnect Posture agent, which specific file must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment?

Accepted Answer

AnyConnect Compliance Module. The AnyConnect Compliance Module is the specific file that must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment. It contains the posture policies and checks that the AnyConnect ISE Posture Agent uses to evaluate endpoint compliance. Without this module, the agent cannot perform posture checks, so it is essential for posture assessment.

Answer

AnyConnect Diagnostic and Reporting Tool

Answer

AnyConnect ISE Posture Agent profile

Answer

AnyConnect VPN package

Question 14

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

Accepted Answer

Verify SXP connection status and configuration on both peers. SXP (SGT Exchange Protocol) propagates SGTs between devices that cannot natively carry them (e.g., non-Cisco or older switches). If an SGT is not being embedded in SXP, the first thing to verify is the SXP connection status and configuration on both peers — the connection must be established and the correct SGTs permitted. This is the direct troubleshooting step for SXP propagation failures.

Answer

Verify the dACL configuration

Answer

Verify the RADIUS shared secret

Answer

Verify the EAP protocol version

Question 15

You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?

Accepted Answer

It sets the guest account status to 'Pending' until approved.. The 'Sponsor Approval' setting in a Guest Portal configuration sets the guest account status to 'Pending' until a sponsor approves the request. This means the guest cannot access the network until the sponsor explicitly grants approval, typically via the Sponsor Portal. The setting enforces a workflow where guest access is gated by sponsor action.

Answer

It automatically emails the sponsor.

Answer

It sends a RADIUS request to the sponsor's device.

Answer

It allows the guest to bypass the login screen.

Question 16

In an ISE Authorization Policy, what happens if no rules match a request?

Accepted Answer

The request hits the Default rule in the Policy Set. If no rules match a request in an ISE Authorization Policy, the request hits the Default rule in the Policy Set. The Default rule is a catch-all that typically has a result of 'DenyAccess' unless explicitly configured otherwise. This ensures that unmatched requests are handled consistently, often denying access by default.

Answer

The request is sent to the primary PAN

Answer

The request is automatically permitted

Answer

The NAD closes the port

Question 17

Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?

Accepted Answer

Common Tasks -> Web Redirection. The Web Redirection option is located under Common Tasks in an Authorization Profile, where you select the redirect type (Centralized Web Auth, Hotspot, Client Provisioning, MDM, etc.) and specify the ACL and redirect URL. This is the standard mechanism for sending endpoints to a WebAuth portal for guest or BYOD flows.

Answer

RADIUS Attributes -> Tunnel-Private-Group-ID

Answer

Advanced Attributes -> ACL

Answer

VLAN/dACL Filters

Question 18

You are implementing TACACS+ device administration for a group of routers. You need to assign specific privilege levels to different users. Where in the ISE policy set is this privilege assignment configured?

Accepted Answer

In the Shell Profile assigned to the Authorization Policy.. Privilege level assignment in ISE TACACS+ is configured in the Shell Profile, which is then referenced by the Authorization Policy. The shell profile contains the Privilege Level field (and other AV pairs) that ISE returns to the network device to set the user's EXEC privilege after authentication.

Answer

In the Network Device Group settings.

Answer

In the Command Set configuration.

Answer

In the Network Device definition.

Question 19

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

Accepted Answer

The NAD is missing the 'aaa server radius dynamic-author' configuration.. In a CWA (Central Web Authentication) flow, after the user authenticates on the portal, ISE must send a Change of Authorization (CoA) to the NAD to move the session from redirected to authenticated. This requires the NAD to be configured with the 'aaa server radius dynamic-author' command so it can accept CoA requests from ISE. Without it, the NAD ignores the CoA and the session remains in the redirected state.

Answer

The Guest user group is missing from the Policy Set.

Answer

The Redirect ACL is applied to the wrong interface.

Answer

The portal URL is incorrect.

Question 20

You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?

Accepted Answer

Set the Access Type to Permit Access and enable URL Redirect with the portal ID.. Central Web Authentication requires the authorization profile to permit access and simultaneously return a URL redirect AV pair pointing to the ISE guest/central portal. In ISE, the authorization profile's 'Access Type = ACCESS_ACCEPT' plus the 'Web Redirection (CWA)' setting with the correct portal ID is what tells the WLC/switch to redirect the client's HTTP traffic to the ISE portal. Without the URL redirect attribute, the client is simply permitted and never sees the portal.

Answer

Enable 'Authentication Bypass' in the authorization profile to allow the traffic to hit the redirect rule.

Answer

Configure the profile as a standard permit access profile with a dynamic VLAN assignment.

Answer

Set the Access Type to Web Auth and manually input the redirect IP address in the Custom Attributes field.