SISE Practice Test 4 — 25 Questions

Question 1

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

Accepted Answer

File Remediation Action. A File Remediation action allows you to specify a URL or a path to a file that the client can download to remediate compliance.

Answer

Post-Posture Authorization Rule

Answer

Client Provisioning Policy

Answer

Posture Requirement

Question 2

When using AnyConnect as the posture agent, how can you prevent users from disabling the posture service?

Accepted Answer

By disabling the 'Allow Stop' option in the AnyConnect profile. The AnyConnect profile (xml) can be configured to hide the UI or prevent the service from being stopped by non-admin users.

Answer

By configuring a 'Mandatory' posture requirement

Answer

By setting the 'Posture Type' to 'System'

Answer

By enabling 'Auto-Restart' in the ISE global settings

Question 3

An administrator is troubleshooting a posture failure where the AnyConnect agent is installed but ISE reports the endpoint as 'Unknown'. Which configuration setting in the Posture Policy is most likely misconfigured?

Accepted Answer

The Posture Policy is not associated with the correct Authorization Profile used in the Authorization Policy.. If the agent is installed but shows 'Unknown', it usually indicates the agent is not successfully checking in or the Posture Policy is not correctly mapped to the authorization profile currently applied to the session.

Answer

The Compliance Module is not installed on the ISE server.

Answer

The Remediation Action is disabled.

Answer

The Posture Agent configuration is missing the server discovery URL.

Answer

The ISE server certificate is not trusted by the client.

Question 4

When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?

Accepted Answer

ISE Live Logs. The AnyConnect diagnostic logs, the ISE Posture reports, and the Live Logs are the primary sources of truth for investigating posture failures.

Answer

Cisco IOS syslog

Answer

AnyConnect VPN Gateway logs

Question 5

Which TWO of the following methods can be used to identify a device as 'BYOD' in ISE?

Accepted Answer

Bulk import of MAC addresses. Devices can be identified via manual registration by the user or through automated enrollment via the BYOD flow.

Answer

IP address range

Answer

SNMP community string

Answer

Switch port ID

Question 6

Which THREE of the following are potential reasons a device might be placed in a 'Quarantine' VLAN during the BYOD process?

Accepted Answer

Device failed MDM compliance check. A device might be quarantined if it fails compliance, is missing a required certificate, or has an outdated OS version detected by the MDM.

Answer

User forgot their Wi-Fi password

Answer

The device is too new

Question 7

Which THREE actions are required when configuring a BYOD flow that involves an external MDM integration?

Accepted Answer

Configure the MDM server details in Administration > Network Resources > MDM. Integrating MDM requires establishing the server connection, defining the authorization policy to check compliance, and ensuring the device is correctly registered in the ISE endpoint database.

Answer

Set the 'Native Supplicant' to disabled

Answer

Configure the WLC to act as an MDM proxy

Question 8

A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?

Accepted Answer

Authorization Profile. Authorization Profiles are used in ISE to return attributes like VLAN, dACLs, or SGTs to the network access device after successful authentication.

Answer

Authentication Policy

Answer

Policy Set

Answer

Authorization Policy

Question 9

A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?

Accepted Answer

Assign SGTs to the server subnet and the IT group, then apply an SGACL. Assigning an SGT to the server subnet and using an SGACL policy that allows only the IT SGT is the most scalable TrustSec approach.

Answer

Configure individual dACLs for every employee

Answer

Hardcode ACLs on every access switch

Answer

Use standard RADIUS VLAN steering

Question 10

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

Accepted Answer

The switch is missing the 'cts role-based enforcement' command. If the switch does not have 'cts role-based enforcement' enabled, it will not perform the actual filtering between SGTs.

Answer

The SGT is not in the ISE database

Answer

RADIUS shared secret is wrong

Answer

The user is in the wrong AD group

Question 11

You are implementing 'Device Administration' (TACACS+) and want to restrict an admin to 'show' commands only. How do you construct this policy?

Accepted Answer

Create a command set with 'show' and assign to an authorization policy rule. Create a Command Set containing 'show .*' (regex) and assign it to an Authorization Policy rule for that user.

Answer

Use the 'Admin' group in the authentication policy

Answer

Create a shell profile with privilege level 1

Answer

Configure a dACL on the device

Question 12

Which THREE of the following are valid components of a RADIUS-based Authorization Policy rule in Cisco ISE?

Accepted Answer

Rule Name. Authorization rules consist of a name, a set of conditions, and an assigned authorization profile result.

Answer

Identity Source Sequence

Answer

Command Set

Question 13

Which attribute is used by the MAC OUI probe to determine the device manufacturer?

Accepted Answer

MAC Address prefix (first 3 bytes). The MAC OUI probe parses the first 3 bytes of the MAC address to identify the vendor.

Answer

User-Agent string

Answer

IP Address

Answer

DHCP Client ID

Question 14

You are configuring a BYOD flow for iOS devices and notice that the native supplicant provisioning process is failing during the installation of the mobile configuration profile. Where should you check the logs in ISE to determine if the issue is related to the SCEP proxy communication?

Accepted Answer

Operations > Troubleshoot > Debug Wizard > scep. The SCEP proxy logs are specifically located under the 'SCEP' category within the Operations > Troubleshooting > Debug Wizard or by monitoring the 'scep.log' file.

Answer

Policy > Policy Elements > Results > Certificate Profiles

Answer

Administration > System > Licensing

Answer

Operations > RADIUS Livelog

Question 15

Which menu path allows you to view the posture compliance status of all endpoints?

Accepted Answer

Context Visibility > Endpoints. Operations > Reports > Endpoints and Users > Posture Assessment is the standard path to view posture-specific reports.

Answer

Administration > Identity Management

Answer

Policy > Posture > Reports

Question 16

You are troubleshooting a scenario where an Android device is unable to complete the BYOD onboarding flow. You suspect the issue is with the supplicant provisioning wizard. Which tool should you use to verify if the provisioning payload was actually generated?

Accepted Answer

Work Centers > BYOD > Client Provisioning. The 'Provisioning' resources tab in the ISE portal configuration lists the resources generated for different operating systems.

Answer

Administration > System > Settings > Proxy

Answer

Operations > Troubleshoot > TCP Dump

Answer

Policy > Policy Elements > Conditions > Other > BYOD

Question 17

Which component in ISE defines the 'result' of an authorization rule?

Accepted Answer

Authorization Profile. The Authorization Profile is the outcome object that is returned to the NAD to dictate session parameters.

Answer

Policy Set

Answer

Identity Source

Answer

Authorization Policy

Question 18

What does the 'Fallthrough' option in an ISE Policy Set rule do?

Accepted Answer

It allows the request to continue to the next rule. Fallthrough allows the request to continue being evaluated against subsequent rules in the policy set if the current rule matches.

Answer

It drops the connection

Answer

It skips the current rule and goes to the next

Answer

It forces the request to the Default rule

Question 19

You need to create a posture condition to verify that the 'Cisco AnyConnect' service is running. Which condition type should you select?

Accepted Answer

Service Condition. Service conditions are used to verify that specific Windows services or macOS processes are active.

Answer

Registry Condition

Answer

Process Condition

Answer

Application Condition

Question 20

You are configuring a Posture policy in Cisco ISE and need to ensure that endpoints running an outdated version of Windows are directed to a specific remediation portal. Which component must you configure to define the conditions that trigger this remediation?

Accepted Answer

Posture Requirements. Posture requirements are the components that define the specific checks (e.g., OS version, registry keys) that must be met to reach a compliant state; if not met, the remediation action is triggered.

Answer

Client Provisioning Policies

Answer

Remediation Actions

Answer

Posture Policies