SISE Practice Test 2 — 25 Questions

Question 1

When setting up a custom endpoint identity group for printers, what is the best practice for assigning devices to that group?

Accepted Answer

Use a Profiling Policy to automatically assign the device to the 'Printers' Identity Group.. The best practice for assigning devices to a custom endpoint identity group is to use a Profiling Policy. Profiling policies automatically classify endpoints based on collected attributes (e.g., DHCP, HTTP, SNMP) and assign them to the appropriate identity group. This ensures dynamic and scalable management, reducing manual effort and errors.

Answer

Manually add every printer MAC address to the group.

Answer

Import a CSV file periodically.

Answer

Use an Authorization Policy to bypass profiling.

Question 2

Which ISE menu path is used to create a new Authorization Profile?

Accepted Answer

Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. In Cisco ISE, Authorization Profiles define the actual permissions or attributes (e.g., VLAN, dACL, SGT) that are applied to a session after a successful authorization policy match. They are created and managed under Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. This is the only path among the options that leads to the Authorization Profiles configuration page.

Answer

Policy -> Policy Sets -> Add

Answer

Policy -> Policy Elements -> Conditions

Answer

Administration -> Identity Management -> Groups

Question 3

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

Accepted Answer

Called-Station-ID. Called-Station-ID is the RADIUS attribute that carries the identifier of the network access point (e.g., the SSID or the MAC address of the wireless controller/AP) that the guest is connecting to. In a guest flow, this attribute is used to determine the physical location of the request because it identifies the specific access device. Cisco ISE uses Called-Station-ID in authorization policies to apply location-based restrictions or to track where a guest session originates.

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 4

In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?

Accepted Answer

To define attributes like account lifetime and access policies for guest accounts.. Guest Types in ISE define the template for guest accounts, including account lifetime (duration), maximum simultaneous logins, and the access policies (authorization profiles) that apply to that type of guest. They allow administrators to create different classes of guests (e.g., short-term visitor vs. long-term contractor) with distinct attributes.

Answer

To manage the list of sponsors.

Answer

To define the portal look and feel.

Answer

To configure the RADIUS server settings.

Question 5

A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?

Accepted Answer

Adjust the Policy Set conditions. Policy Set conditions are the top-level matching criteria that determine which policy set a request is evaluated against. If guest traffic is landing in the wrong policy set, the fix is to adjust the conditions (e.g., SSID, NAS-IP-Address, device type, or RADIUS attributes) so the guest session matches the 'Guest' policy set. Reordering only changes evaluation order among policy sets that already match — it does not change which conditions cause a match.

Answer

Modify the guest portal settings

Answer

Change the authentication sequence

Answer

Reorder the policy sets

Question 6

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

Accepted Answer

The device remains Non-Compliant. If an endpoint is determined to be Non-Compliant and no remediation action is configured, the device remains Non-Compliant. The posture policy will not automatically remediate or grant full access; the status persists until remediation is applied or the policy changes. Thus, option D is correct.

Answer

The agent automatically remediates the issue

Answer

The device is granted full access

Answer

The posture agent crashes

Question 7

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

Accepted Answer

Authorization Profile. The Authorization Profile in Cisco ISE is where you set attributes like VLAN assignment, dACL, SGT, and reauthentication timers that are returned to the NAD after successful authorization. For wireless clients, the VLAN is typically delivered via RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) configured in the Authorization Profile.

Answer

Policy Set Condition

Answer

Identity Source Sequence

Answer

Authentication Policy

Question 8

Which TWO methods can be used to verify that a TACACS+ request from a network device is reaching the Cisco ISE PSN?

Accepted Answer

Reviewing the Operations > TACACS Livelogs in the ISE GUI.. Option B is correct because the Operations > TACACS Livelogs page in the ISE GUI shows TACACS+ authentication and authorization requests as they arrive at the PSN, confirming the request reached ISE. Option D is correct because running a packet capture (tcpdump) on the PSN interface lets you see the inbound TCP port 49 traffic from the network device, directly proving the TACACS+ request arrived. Option A is wrong because Network Device Group membership only defines device classification, not whether a request reached the PSN. Option C is wrong because Policy Set order of precedence controls rule evaluation, not request arrival. Option E is wrong because switch console AAA server status shows local client-side state, not whether the request reached the ISE PSN.

Answer

Checking the Network Device Group membership list.

Answer

Viewing the Policy Set order of precedence.

Answer

Checking the switch console logs for AAA server status.

Question 9

Which service is required to be enabled on a PSN to allow it to receive RADIUS requests from network access devices?

Accepted Answer

Policy Service. The Policy Service is the Cisco ISE service that must be enabled on a Policy Services Node (PSN) to allow it to receive RADIUS requests from network access devices (NADs). The Policy Service handles authentication, authorization, and accounting (AAA) decisions for RADIUS traffic. Without it, the PSN cannot process RADIUS requests.

Answer

Registration Service

Answer

Administration Service

Answer

Monitoring Service

Question 10

Which guest portal type should you select if you want to allow users to connect to the network without any authentication, simply by clicking an 'Accept' button?

Accepted Answer

Hotspot Portal. The Hotspot Portal is specifically designed for unauthenticated guest access where users simply click an 'Accept' button (or similar) to acknowledge the acceptable use policy and gain network access. It requires no credentials, sponsorship, or self-registration, making it the correct choice for click-through access.

Answer

Sponsored Guest Portal

Answer

Guest Portal

Answer

Self-Registered Guest Portal

Question 11

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Accepted Answer

The Network Access Device (NAD). The Network Access Device (NAD) is responsible for redirecting the guest user's browser in a Central Web Authentication (CWA) flow. When the endpoint connects, the NAD (e.g., a wireless controller or switch) intercepts the HTTP traffic and redirects the user to the ISE guest portal for authentication.

Answer

The Cisco ISE Policy Service Node (PSN)

Answer

The endpoint's default browser

Answer

The Guest Portal application

Question 12

How can you verify that ISE is receiving TACACS+ requests from a specific switch?

Accepted Answer

Check the TACACS Livelogs. Cisco ISE provides TACACS+ Livelogs under Operations > TACACS > Live Logs, which show real-time TACACS+ authentication and authorization requests received from network devices. This is the direct way to verify that ISE is receiving TACACS+ requests from a specific switch, including the device name, user, and result.

Answer

View the Network Device list

Answer

Run a packet capture on the switch

Answer

Check the System Summary

Question 13

You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?

Accepted Answer

Deny 'show running-config' and permit all other commands. To block a specific command like 'show running-config' while allowing other 'show' commands, the command set must explicitly deny 'show running-config' and then permit all other commands. TACACS+ command sets are evaluated top-down, so the deny rule for the specific command must come before a permit-all rule. This ensures only that command is blocked.

Answer

Deny 'show' and permit 'show running-config'

Answer

Permit 'show.*' and deny 'show running-config'

Answer

Set the command privilege level to 0

Question 14

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

Accepted Answer

Reporting and analytics. The Monitoring and Troubleshooting (MnT) persona in Cisco ISE is responsible for collecting and storing operational data, so option B (Reporting and analytics) is correct because MnT nodes host the reporting and analytics services that let administrators run operational reports, live logs, and dashboards on authentication, authorization, and accounting events. Option D (Log aggregation from all nodes) is also correct because all Policy Services Nodes (PSNs) and other ISE nodes forward their syslog and session data to the MnT node, which aggregates and stores it in the MnT database for troubleshooting and audit purposes. Option A (Policy distribution) is not an MnT function; policy configuration and distribution are handled by the Policy Administration Node (PAN), which pushes policies to PSNs. Option C (RADIUS authentication) is performed by Policy Services Nodes, which handle RADIUS and TACACS+ authentication, authorization, and accounting, not the MnT persona. Option E (Endpoint profiling probe) is a function of the PSN, where profiling probes (e.g., RADIUS, SNMP, DHCP, NetFlow) collect endpoint attributes, not the MnT node.

Answer

Policy distribution

Answer

RADIUS authentication

Answer

Endpoint profiling probe

Question 15

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

Accepted Answer

TACACS+ Livelogs. TACACS+ Livelogs in Cisco ISE is the dedicated real-time log view that shows TACACS+ authentication and authorization request details, including the policy set and rule that matched. When troubleshooting TACACS+ authentication issues, this is the correct log to monitor because it captures the full request/response exchange and the policy evaluation result. RADIUS Livelogs, by contrast, only show RADIUS traffic and would not display TACACS+ request details.

Answer

System Summary Dashboard

Answer

Endpoint Context Visibility

Answer

RADIUS Livelogs

Question 16

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

Accepted Answer

Initiate registration from the Primary PAN under Administration > System > Deployment. In Cisco ISE, the Primary PAN is the authoritative node that maintains the deployment database and controls node registration. To add a secondary node, you log into the Primary PAN, navigate to Administration > System > Deployment, and use the 'Register an ISE node' action to initiate the join. The secondary node must already be installed and reachable, but the registration workflow is always driven from the Primary PAN, not the joining node.

Answer

Configure the Secondary node as an standalone node and merge databases

Answer

Run the join command from the secondary node's CLI

Answer

Create a cluster via the ISE CLI setup wizard

Question 17

Which THREE factors influence the decision to use multiple PSNs in a deployment?

Accepted Answer

Geographical distribution. Option C (Geographical distribution) is correct because deploying multiple Policy Service Nodes (PSNs) across different sites lets each location authenticate its own users locally, avoiding WAN latency and link dependency for RADIUS traffic. Option D (Load balancing of RADIUS requests) is correct because multiple PSNs distribute the authentication, authorization, and accounting load, preventing any single PSN from becoming a bottleneck as endpoint counts grow. Option E (Redundancy for node failure) is correct because if one PSN becomes unavailable, NADs can fail over to another PSN, preserving network access during outages. Options A (Increased log storage capacity) and B (Centralized database backup) are not valid factors: logging and backup are handled by the Monitoring and Policy nodes (MnT/PAN), not by adding PSNs, so they do not drive the decision to deploy multiple PSNs.

Answer

Increased log storage capacity

Answer

Centralized database backup

Question 18

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

Accepted Answer

Authorization Policy Condition. In Cisco ISE, MAB (MAC Authentication Bypass) authorization decisions are made by the Authorization Policy, and the specific conditions that match attributes like MAC address, OUI, or endpoint identity group are configured as conditions within an Authorization Policy rule. To restrict access to specific MAC OUI addresses, you create a condition (e.g., using the 'MACAddress' or 'EndPointMacAddress' attribute with an OUI prefix match) inside the Authorization Policy rule, which then determines the resulting Authorization Profile.

Answer

Authentication Policy

Answer

Identity Source Sequence

Answer

Authorization Profile

Question 19

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

Accepted Answer

Shell Profile. In Cisco ISE TACACS+ device administration, the Shell Profile is the result object that defines the privilege level (e.g., Privilege Level 15) assigned to a user after successful authentication and authorization. It is referenced within an Authorization Policy rule and returned as an AV-pair (such as shell:priv-lvl=15) to the network device, which then enforces the user's CLI privilege.

Answer

Command Set

Answer

Authorization Profile

Answer

Device Administration Policy

Question 20

Which menu path in Cisco ISE is used to define a new Network Device Group?

Accepted Answer

Administration > Network Resources > Network Device Groups. The correct menu path to define a new Network Device Group in Cisco ISE is Administration > Network Resources > Network Device Groups. This is where you create and manage groups that can be used to logically group network devices for policy conditions and authorization rules.

Answer

Operations > TACACS Livelogs

Answer

Administration > Identity Management

Answer

Policy > Policy Elements > Results