SISE Practice Test 21 — 15 Questions

Question 1

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

Accepted Answer

Authorization Profile. The VLAN ID is configured within the Authorization Profile, which is then selected as the result of an Authorization Policy rule.

Answer

Policy Set Condition

Answer

Identity Source Sequence

Answer

Authentication Policy

Question 2

You are troubleshooting a device that is stuck in the 'Unknown' profile state. You have confirmed that the DHCP probe is receiving packets. What is the next logical step to investigate the failure?

Accepted Answer

Check the attributes of the endpoint in Context Visibility.. Checking the endpoint's attributes in Context Visibility reveals exactly what the Profiler has learned. If the DHCP attributes are visible but the policy isn't matching, the policy logic is likely flawed.

Answer

Increase the SNMP polling interval.

Answer

Delete the endpoint from the database.

Answer

Restart the ISE node services.

Question 3

Which port does Cisco ISE use by default for TACACS+ communication with network devices?

Accepted Answer

TCP 49. TACACS+ utilizes TCP port 49 for communication.

Answer

TCP 8443

Answer

UDP 1812

Answer

UDP 1645

Question 4

What is the primary function of the TACACS+ 'Shared Secret' configured on both the Cisco ISE and the Network Access Device?

Accepted Answer

To authenticate the TACACS+ packet exchange. The shared secret is used to encrypt the TACACS+ packet body and authenticate the connection between the client and server.

Answer

To assign the device to a specific group

Answer

To encrypt the entire packet header

Answer

To enable SSL/TLS encryption for the session

Question 5

If a user is authenticated via TACACS+ but no authorization policy matches, what is the default behavior?

Accepted Answer

The user is rejected. The default ISE policy behavior for TACACS+ is to reject authorization if no rules match.

Answer

The user is granted read-only access

Answer

The user is prompted to re-authenticate

Answer

The user is granted full access

Question 6

How can you verify that ISE is receiving TACACS+ requests from a specific switch?

Accepted Answer

Check the TACACS Livelogs. Monitoring the TACACS Livelogs will show the live requests as they arrive at the ISE nodes.

Answer

View the Network Device list

Answer

Run a packet capture on the switch

Answer

Check the System Summary

Question 7

You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?

Accepted Answer

Deny 'show running-config' and permit all other commands. Command sets use regex or explicit matches. A specific match with 'permit' on other commands and 'deny' on 'show running-config' is the correct approach.

Answer

Deny 'show' and permit 'show running-config'

Answer

Permit 'show.*' and deny 'show running-config'

Answer

Set the command privilege level to 0

Question 8

An administrator notices that TACACS+ authentication is failing for devices. The logs show 'RADIUS request received'. What is the most likely cause?

Accepted Answer

The NAD is configured for RADIUS authentication instead of TACACS+.. The Network Access Device (NAD) is configured to send RADIUS requests to ISE instead of TACACS+, or the service type is incorrectly configured on the NAD side.

Answer

The TACACS+ service is disabled on the ISE Policy Service Node.

Answer

The ISE policy set is missing a TACACS+ rule.

Answer

The shared secret between ISE and the NAD is mismatched.

Question 9

Which THREE of the following items are considered 'results' in an ISE authorization policy? (Choose three)

Accepted Answer

Authorization Profile. Authorization policy results include command sets, shell profiles, and sometimes even dynamic access lists or VLAN assignments in RADIUS contexts.

Answer

Shared Secret

Answer

Network Device Group

Question 10

How does Cisco ISE handle requests that do not match any configured TACACS+ Authorization Policy?

Accepted Answer

It denies access. If no rule matches, ISE hits the default rule, which typically results in a 'Deny' access.

Answer

It defaults to local switch authentication

Answer

It prompts the user to select a profile

Answer

It permits access with default privileges

Question 11

Which THREE of the following are reasons why a TACACS+ authorization request might fail? (Choose three)

Accepted Answer

The requested command is not in the allowed list. Failures can be due to policy matching, command set configuration, or device-side restrictions.

Answer

The user password is incorrect

Answer

The ISE server is busy

Question 12

Which TWO of the following are common reasons for a Guest portal to display an 'Internal Server Error'?

Accepted Answer

The portal service on the PSN is unresponsive.. Internal Server Errors often relate to issues with the ISE node itself, such as database connectivity problems or the portal service being crashed/unresponsive.

Answer

The guest's device is blocked by a MAC filter.

Answer

The Guest user provided an invalid password.

Answer

The NAD is not configured for RADIUS.

Question 13

Which guest portal type should you select if you want to allow users to connect to the network without any authentication, simply by clicking an 'Accept' button?

Accepted Answer

Hotspot Portal. The Hotspot portal is specifically designed for 'click-through' access, commonly used in public Wi-Fi environments.

Answer

Sponsored Guest Portal

Answer

Guest Portal

Answer

Self-Registered Guest Portal

Question 14

In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?

Accepted Answer

To define attributes like account lifetime and access policies for guest accounts.. Guest types allow you to define common parameters like account duration, password requirements, and access permissions that can be applied to guest accounts.

Answer

To manage the list of sponsors.

Answer

To define the portal look and feel.

Answer

To configure the RADIUS server settings.

Question 15

You are troubleshooting a scenario where guest users are not being redirected when connecting to an open SSID. The WLC reports that the client is stuck in the 'Webauth' state but the portal never loads. Which component should you verify first?

Accepted Answer

Check if the client can resolve the ISE FQDN via DNS.. If the client is in the Webauth state on the WLC but the portal doesn't load, the issue is typically that the DNS resolution of the ISE FQDN is failing for the client or the WLC is not passing the redirect URL correctly.

Answer

Increase the idle timeout on the WLC's WLAN configuration.

Answer

Verify the WLC's 'Web Auth Redirect' configuration and ensure the 'Virtual Gateway' address is reachable.

Answer

Re-import the Guest Portal certificate on the WLC.