SISE Practice Test 24 — 15 Questions

Question 1

When configuring an AnyConnect Posture Policy, which option allows the administrator to force the agent to perform a scan regardless of the current posture status?

Accepted Answer

Agent Enforcement set to 'Mandatory'. The 'Mandatory' setting in the Posture Requirement forces the agent to report status and remediate if necessary, whereas 'Optional' allows the user to skip.

Answer

Posture Type set to 'Continuos'

Answer

Policy Status set to 'Production'

Question 2

In the ISE Policy Set, which component is used to define the user credentials' verification method?

Accepted Answer

Authentication Policy. The Authentication Policy defines the Identity Source Sequence, which dictates how ISE verifies credentials.

Answer

Policy Set Condition

Answer

Result Profile

Answer

Authorization Policy

Question 3

Which THREE of the following are valid Policy Set conditions?

Accepted Answer

NAS-Port-Type. Valid conditions include device location, user group, and NAS-Port-Type.

Answer

Switch Serial Number

Answer

RADIUS Secret

Question 4

A user is complaining that they are stuck in a posture remediation loop despite having the latest antivirus software installed. You verify that the AV check is correctly configured. What is the most likely cause for this behavior?

Accepted Answer

The AnyConnect Compliance Module is outdated on the endpoint.. If the AV software is installed but the posture agent does not recognize it, the version or the specific product identifier in the requirement might be slightly off, or the agent is not receiving the latest compliance library updates.

Answer

The ISE server is in maintenance mode.

Answer

The Posture Policy is disabled.

Answer

The Authorization policy uses the wrong group.

Answer

The Remediation action requires a reboot that hasn't occurred.

Question 5

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

Accepted Answer

Authorization Policy Condition. MAC OUI restrictions can be managed by creating an Endpoint Identity Group or a Policy Condition that checks the MAC address field.

Answer

Authentication Policy

Answer

Identity Source Sequence

Answer

Authorization Profile

Question 6

Which THREE of the following are necessary to configure CWA (Centralized Web Authentication)?

Accepted Answer

Authorization Policy rule that triggers the redirection profile. CWA requires the redirection profile, the authorization policy to trigger it, and the redirect ACL.

Answer

TACACS+ profile

Answer

SGT mapping

Question 7

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

Accepted Answer

Shell Profile. The Shell Profile in TACACS+ policies allows you to define the privilege level assigned to the user session.

Answer

Command Set

Answer

Authorization Profile

Answer

Device Administration Policy

Question 8

During a troubleshooting session, you notice that the AnyConnect agent is not receiving the posture policy. Which log file on the ISE Policy Service Node (PSN) should you examine?

Accepted Answer

ise-psc.log. The 'ise-psc.log' (Policy Service Component) is the primary log for posture policy evaluation and agent communication.

Answer

prrt-server.log

Answer

guest.log

Answer

admin.log

Question 9

A user is compliant, but ISE still classifies the device as 'Unknown'. What is the most likely cause?

Accepted Answer

The posture agent failed to connect to the PSN. If the device is 'Unknown', it means the posture agent has not successfully sent the report to the PSN or the PSN has not updated the session state.

Answer

The Client Provisioning policy is misconfigured

Answer

The remediation action is disabled

Answer

The authorization rule is incorrect

Question 10

Where do you upload the AnyConnect posture agent packages to make them available for Client Provisioning?

Accepted Answer

Policy > Policy Elements > Results > Client Provisioning > Resources. Client Provisioning resources are managed under Policy > Policy Elements > Results > Client Provisioning > Resources.

Answer

Operations > Troubleshoot > Client Provisioning

Answer

Policy > Posture > Policy

Answer

Administration > System > Settings > Posture

Question 11

You are configuring EAP-TLS for BYOD. What must be included in the 'Allowed Protocols' list in ISE?

Accepted Answer

EAP-TLS. EAP-TLS must be explicitly enabled in the 'Allowed Protocols' section of the Authentication Policy for the handshake to work.

Answer

LEAP

Answer

EAP-FAST

Answer

PEAP-MSCHAPv2

Question 12

During BYOD onboarding, the client is unable to download the Network Setup Assistant (NSA). You verify the portal settings and observe that the 'Client Provisioning' resource is correctly assigned to the policy. What is the most likely cause if the device fails to reach the download page?

Accepted Answer

The redirect ACL is blocking traffic to the ISE IP address on TCP port 8443. The redirect ACL must permit traffic to the Cisco ISE server on ports 8443 or 8905 to ensure the client can reach the provisioning services.

Answer

The user is not part of the Active Directory group assigned to the policy

Answer

The client does not have the native supplicant installed

Answer

The certificate on the ISE portal is expired

Question 13

An organization wants to implement EAP-TLS for BYOD. What is the correct sequence of the certificate lifecycle during the onboarding process?

Accepted Answer

Authentication > Certificate Signing Request > CA Signing > Installation. After the user authenticates, the client submits a CSR, ISE (via SCEP) signs it, and the certificate is pushed back to the client.

Answer

Certificate Request > Authentication > Signing > Installation

Answer

CA Signing > Authentication > Request > Installation

Answer

Installation > Signing > Authentication > Request

Question 14

What is the primary benefit of using native supplicant provisioning in ISE?

Accepted Answer

It leverages the built-in OS capabilities for connectivity. Native supplicant provisioning simplifies user experience by automatically configuring WiFi settings without requiring third-party software.

Answer

It provides complete control over the device's file system

Answer

It encrypts the entire hard drive

Answer

It removes the need for RADIUS authentication

Question 15

A user reports that their BYOD device is not being recognized as 'Compliant' even though the MDM shows it is compliant. Which ISE component is responsible for retrieving this status?

Accepted Answer

The ISE MDM Server connector. The ISE MDM Server connector periodically polls or receives webhooks from the MDM to update the endpoint status in the ISE database.

Answer

The ISE Policy Information Point (PIP)

Answer

The ISE Monitoring node

Answer

The ISE RADIUS service