SISE Practice Test 2 — 25 Questions

Question 1

During the BYOD onboarding process, a user is successfully redirected to the portal, but the certificate installation fails because the client cannot trust the root CA. Which configuration is required to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Import the Root CA certificate into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled.. The Root CA certificate must be uploaded to the 'Trusted Certificates' store in ISE and marked as trusted for 'Client Authentication'.

Answer

Install the CA certificate on the local WLC controller under the WLAN configuration.

Answer

Add the Root CA to the 'System Certificates' store instead of 'Trusted Certificates'.

Answer

Enable 'Allow Weak Ciphers' in the global BYOD settings.

Question 2

You need to ensure that TACACS+ authentication requests for network devices are only accepted if the device IP matches a specific Network Device Group. Where do you configure the Device Type condition?

Accepted Answer

In the Policy Set condition using 'Device Type'. Policy sets allow for conditions based on Network Device Groups (NDG), which are mapped to devices.

Answer

In the Command Set definition

Answer

In the TACACS+ Profile settings

Answer

In the Global System Settings

Question 3

An administrator needs to ensure that only endpoints with a specific registry key present are allowed access. Where should this posture condition be defined in Cisco ISE?

Accepted Answer

Policy > Policy Elements > Conditions > Posture > Registry Condition. Registry checks are configured under Policy > Policy Elements > Conditions > Posture > Registry Condition.

Answer

Administration > System > Settings > Posture

Answer

Policy > Policy Elements > Conditions > Authorization > Compound Condition

Answer

Policy > Policy Elements > Results > Posture > Remediation Actions

Question 4

Which THREE of the following items are configured in an AnyConnect Posture Requirement?

Accepted Answer

Condition. Requirements include the condition, the operating system, and the remediation action.

Answer

Device ID

Answer

Authorization Rule

Question 5

Which dashboard widget provides a quick summary of BYOD activity in your network?

Accepted Answer

BYOD Registration Status. The BYOD/Registration dashboard widgets provide real-time visibility into the number of registered vs. pending devices.

Answer

System Resources

Answer

Active Directory Health

Answer

RADIUS Latency

Question 6

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

Accepted Answer

The user must manually 'Install' the configuration profile. iOS requires an Apple-signed profile, which ISE generates. The device must be able to reach the portal via HTTPS, and the profile must be trusted by the OS.

Answer

The device must be connected via VPN

Answer

The device must be jailbroken

Question 7

Which TWO of the following are valid device attributes that can be used to identify a device for BYOD onboarding?

Accepted Answer

Device-Type. Device type and operating system are fundamental attributes used in policy conditions to distinguish BYOD devices.

Answer

VLAN-ID

Answer

RADIUS-Session-ID

Answer

Port-Number

Question 8

When setting up TACACS+ for network administration, which THREE configurations must be present on the Cisco network device? (Choose three)

Accepted Answer

AAA authentication/authorization commands. The switch needs the TACACS+ server IP, the shared secret, and the AAA command authorization configured.

Answer

Local user database for all commands

Answer

RADIUS server configuration

Question 9

Which THREE of the following are valid types of Posture Conditions?

Accepted Answer

Service Condition. ISE supports multiple condition types including File, Registry, and Service checks.

Answer

User Identity Condition

Answer

Port Condition

Question 10

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

Accepted Answer

HTTPS. SCEP is for certificates, HTTPS is for the portal, and RADIUS is for network access control.

Answer

SMTP

Answer

FTP

Question 11

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

Accepted Answer

Reporting and analytics. MnT nodes are responsible for collecting logs from all nodes in the deployment and providing the analytics/reporting interface.

Answer

Policy distribution

Answer

RADIUS authentication

Answer

Endpoint profiling probe

Question 12

Which RADIUS attribute is commonly used to inform the Network Access Server (NAS) that a re-authentication is required after a successful BYOD provisioning?

Accepted Answer

Termination-Action: RADIUS-Request. The 'Cisco-AV-Pair' containing 'url-redirect' is used initially, but 'Termination-Action: RADIUS-Request' is often used to force a re-authentication after the BYOD process.

Answer

Class-Attribute: Re-Authenticate

Answer

Filter-Id: Refresh

Answer

Tunnel-Type: VLAN-Change

Question 13

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

Accepted Answer

Distributed Configuration Synchronization via HTTPS. The PAN uses a distributed configuration synchronization process via HTTPS/REST APIs to push configuration changes to all other nodes in the deployment.

Answer

Rsync over SSH

Answer

RADIUS Change of Authorization (CoA)

Answer

SNMPv3 Trap propagation

Question 14

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

Accepted Answer

The FQDN of the Load Balancer VIP. The AnyConnect profile should contain a list of PSNs or a load-balanced VIP to ensure redundancy.

Answer

The local gateway address

Answer

The IP address of the ISE Admin Node

Answer

A single static IP of the Primary PSN

Question 15

Which TWO of the following steps are required to deploy the AnyConnect posture agent?

Accepted Answer

Create a Client Provisioning policy. Deployment involves creating the Client Provisioning resource and then creating the policy to assign it to endpoints.

Answer

Set the NAS IP address

Answer

Enable RADIUS Accounting

Answer

Configure a TrustSec policy

Question 16

You are configuring a BYOD flow where users must register their devices via the self-service portal. Which ISE component is responsible for triggering the redirection to the BYOD portal after an initial MAC Authentication Bypass (MAB) success?

Accepted Answer

Authorization Profile with a redirect ACL and URL redirect. The Authorization Profile containing the 'Redirect' attribute is what forces the client to the portal.

Answer

Policy Set with a global redirect object

Answer

Authentication Policy with a portal trigger

Answer

RADIUS server-side redirect attribute

Question 17

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

Accepted Answer

It defines the privilege level for the session. The Shell Profile defines attributes like privilege level, auto-command, and custom attributes for CLI access.

Answer

It stores the device credentials

Answer

It defines which users can access the device

Answer

It defines the list of allowed commands

Question 18

Which TWO of the following are valid ways to assign a VLAN in an ISE Authorization Profile?

Accepted Answer

Using the VLAN common task. You can use the 'VLAN' common task or the 'Tunnel-Private-Group-ID' RADIUS attribute.

Answer

Using the Filter-Id attribute

Answer

Using the cisco-av-pair attribute

Answer

Using the Framed-IP-Address attribute

Question 19

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

Accepted Answer

In the Command Set Policy Element. TACACS+ command sets are defined under Policy Elements and then applied to the shell profile in the Device Administration policy.

Answer

In the Policy Set Authentication rule

Answer

In the Authorization Profile

Answer

In the User Identity Group

Question 20

Which component is responsible for triggering the posture assessment process when a user connects to the network?

Accepted Answer

Posture Policy. The posture requirement, when associated with a client provisioning policy, triggers the AnyConnect agent to begin assessment.

Answer

Network Access Device (NAD)

Answer

AnyConnect Compliance Module

Answer

RADIUS Server