SISE Practice Test 5 — 25 Questions

Question 1

A posture condition is defined to check for a registry key, but it always returns 'Non-Compliant'. You suspect the 'Expected Value' is wrong. Where can you see what the agent actually found on the endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Operations > Reports > Endpoints > Posture Assessment. The 'Posture Assessment' report under Operations provides the 'Result' details, including what the agent detected versus the expected value.

Answer

Context Visibility > Endpoints

Answer

Client Provisioning > Resources

Answer

Policy > Posture > Conditions

Question 2

Which TWO of the following are valid remediation actions available in Cisco ISE for posture compliance?

Accepted Answer

Link Remediation. Cisco ISE supports various remediation actions including link-based (for web portals) and file-based actions to help users become compliant.

Answer

MAC Authentication Bypass

Answer

VLAN Change

Answer

Downloadable ACL

Question 3

Which TWO of the following are true about Shell Profiles? (Choose two)

Accepted Answer

They can include custom attributes for specific vendors. Shell profiles define session attributes and initial privilege levels.

Answer

They replace the need for accounting

Answer

They define the command set to be used

Answer

They are used for RADIUS authentication only

Question 4

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Accepted Answer

The Network Access Device (NAD). The switch (NAD) performs the redirection based on the 'url-redirect' attribute provided by ISE in the RADIUS access-accept.

Answer

The Cisco ISE Policy Service Node (PSN)

Answer

The endpoint's default browser

Answer

The Guest Portal application

Question 5

Which THREE of the following are required to successfully implement SXP (SGT Exchange Protocol)?

Accepted Answer

Configure an SGT-to-IP mapping. SXP requires the connection between the speaker/listener, the CTS feature enabled, and SGT-to-IP mapping.

Answer

Enable 802.1X on all ports

Answer

Enable DHCP snooping

Question 6

Which TWO of the following are valid ways to restrict access based on posture status in ISE?

Accepted Answer

Create an Authorization Policy rule using Posture status. Posture status is used in authorization conditions to return different profiles (e.g., restricted access for non-compliant).

Answer

Change the Identity Source Sequence

Answer

Use a Shell Profile

Answer

Create an Authentication Policy rule using Posture status

Question 7

When creating a Policy Condition in Cisco ISE, which attribute is most commonly used to identify a user's location?

Accepted Answer

Network Device Location. The 'Location' attribute within the Network Device dictionary is frequently used for location-based policy enforcement.

Answer

User-Name

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 8

Which of the following is a posture requirement setting that defines how often the agent performs a re-scan?

Accepted Answer

Periodic Scanning Interval. The 'Periodic Scanning' setting in the posture policy defines the interval for re-scanning.

Answer

Re-assessment Frequency

Answer

Scan Timeout

Answer

Policy Update Interval

Question 9

What is the function of the 'RADIUS Accounting' probe in the profiling process?

Accepted Answer

To collect device attributes contained in RADIUS accounting packets.. It collects session information from the RADIUS traffic, providing start/stop and attribute data useful for device identification.

Answer

To encrypt the session.

Answer

To act as a RADIUS server.

Answer

To authenticate the device.

Question 10

Which THREE of the following are considered 'probes' in the Cisco ISE Profiling architecture?

Accepted Answer

DHCP. DHCP, SNMP, and HTTP are standard probes; RADIUS is also a probe type.

Answer

ICMP Echo

Answer

ARP Inspection

Question 11

Which TWO of the following are true about Monitor Mode?

Accepted Answer

It logs posture results for analysis. Monitor mode allows visibility without blocking access.

Answer

It requires user intervention

Answer

It blocks traffic for non-compliant devices

Answer

It automatically fixes compliance issues

Question 12

When deploying the AnyConnect Posture agent, which specific file must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment?

Accepted Answer

AnyConnect Compliance Module. To enable posture assessment, you must upload the AnyConnect Compliance Module, which contains the logic for checking OS and application compliance.

Answer

AnyConnect Diagnostic and Reporting Tool

Answer

AnyConnect ISE Posture Agent profile

Answer

AnyConnect VPN package

Question 13

You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?

Accepted Answer

Session:AuthenticationStatus equals Guest. The 'Guest Type' or 'Guest Flow' attributes are specific to the Guest portal authentication process, ensuring the policy only applies after successful portal interaction.

Answer

Radius:Service-Type equals Framed

Answer

Device:DeviceType equals Wireless

Answer

Radius:Called-Station-ID

Question 14

When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?

Accepted Answer

Authorization Policy. The 'Authorization Policy' column in the Live Logs displays the name of the rule that was triggered for a specific session.

Answer

Authentication Policy

Answer

Policy Set

Answer

Result

Question 15

Which TWO of the following represent ways to verify the posture status of an endpoint?

Accepted Answer

View the status in the AnyConnect agent UI. You can check the ISE reports or the endpoint's AnyConnect UI.

Answer

Check the DHCP server logs

Answer

Review the switch port configuration

Answer

Analyze the AAA traffic dump

Question 16

You are deploying a Posture agent using the Web Agent. Which mechanism does the Web Agent use to perform compliance checks on a Windows machine?

Accepted Answer

It uses a temporary ActiveX or Java component to scan the system.. The AnyConnect Web Agent (now referred to as the posture agent in browser-less scenarios or via the portal) uses a small temporary utility to gather information, but it is limited in scope compared to the persistent AnyConnect agent.

Answer

It performs deep packet inspection to determine compliance.

Answer

It requires the full AnyConnect VPN client to be pre-installed.

Answer

It communicates directly with the Microsoft Update server.

Answer

It relies on WMI calls initiated by the ISE server.

Question 17

Which of the following is an example of an 'Exception' policy in ISE?

Accepted Answer

A rule placed at the top of the Authorization Policy. Exception rules are used to handle specific, high-priority cases before the main policy rules are evaluated.

Answer

A Policy Set condition

Answer

An Identity Source Sequence

Answer

The Default policy set

Question 18

Which THREE of the following items can be included in an ISE 'Common Task' for authorization?

Accepted Answer

dACL assignment. Common Tasks include VLAN, Voice Domain, and dACL/SGACL assignment.

Answer

Password complexity policy

Answer

RADIUS session timeout

Question 19

You are troubleshooting an issue where IP phones are not being profiled. The SNMP read community string on the switch does not match the one configured in ISE. What is the expected behavior?

Accepted Answer

The SNMP Query probe will fail to collect CDP/LLDP data from the switch.. If the SNMP community string is incorrect, ISE cannot query the switch, and the SNMP Query probe will fail to gather data.

Answer

The endpoint will be profiled based on the MAC OUI only.

Answer

The SNMP trap probe will still work.

Answer

ISE will automatically update the community string on the switch.

Question 20

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

Accepted Answer

Verify SXP connection status and configuration on both peers. SXP (SGT Exchange Protocol) requires the SXP connection to be enabled and the SGTs to be properly mapped on the speaker/listener devices.

Answer

Verify the dACL configuration

Answer

Verify the RADIUS shared secret

Answer

Verify the EAP protocol version