SISE Practice Test 5 — 25 Questions

Question 1

Which of the following is a best practice when configuring TACACS+ for network administration?

Accepted Answer

Enable command authorization. Enabling command authorization is a best practice for TACACS+ because it allows the TACACS+ server to authorize each command a user attempts to execute, providing granular control over what administrators can do on network devices. This enforces the principle of least privilege and is a core strength of TACACS+ over RADIUS.

Answer

Use RADIUS for command authorization

Answer

Use a single shared secret for all devices

Answer

Disable accounting for performance

Question 2

Which THREE of the following are valid methods for collecting endpoint attributes for profiling in Cisco ISE?

Accepted Answer

HTTP User-Agent. HTTP User-Agent (C) is valid because ISE's HTTP profiling probe captures the User-Agent string from web requests to identify the endpoint's OS and browser. DHCP Snooping/Helper (D) is valid because ISE's DHCP probe collects attributes such as DHCP fingerprint, hostname, and vendor class from DHCP traffic relayed by the switch or helper address. SNMP Query (E) is valid because ISE can poll network devices via SNMP to retrieve endpoint attributes like MAC address, ARP tables, and CDP/LLDP neighbor data. FTP inspection (A) is not a supported ISE profiling probe, and SSH terminal login (B) is not a profiling collection method in ISE.

Answer

FTP inspection

Answer

SSH terminal login

Question 3

In the ISE Policy Set, which component is used to define the user credentials' verification method?

Accepted Answer

Authentication Policy. The Authentication Policy within an ISE Policy Set defines the method used to verify user credentials — for example, whether ISE uses an internal identity store, Active Directory, LDAP, or a certificate-based method. It answers the 'how are credentials validated' question, whereas the Authorization Policy answers 'what is the user allowed to do' after authentication succeeds.

Answer

Policy Set Condition

Answer

Result Profile

Answer

Authorization Policy

Question 4

Which THREE of the following are characteristics of the TACACS+ protocol? (Choose three)

Accepted Answer

Uses TCP port 49. Option A is correct because TACACS+ operates over TCP and uses well-known port 49 for its communications between the client (NAS) and the TACACS+ server. Option B is correct because TACACS+ encrypts the entire body of the packet, not just credentials, providing confidentiality for all payload data exchanged. Option E is correct because TACACS+ is designed to separate the AAA functions—authentication, authorization, and accounting—into distinct processes, allowing each to be handled independently. Option C is not correct because encrypting only the password field is characteristic of RADIUS, not TACACS+. Option D is not correct because UDP port 1812 is used by RADIUS authentication, whereas TACACS+ uses TCP port 49.

Answer

Only encrypts the password field

Answer

Uses UDP port 1812

Question 5

Which THREE of the following are steps required to configure Cisco ISE for TACACS+ command authorization?

Accepted Answer

Define a Shell Profile. Option A (Define a Shell Profile) is correct because the Shell Profile in Cisco ISE specifies the TACACS+ privilege level and the default command set (permit/deny) applied to the administrative session, which is required for command authorization to function. Option C (Create a Device Administration Policy) is correct because the Device Administration authorization policy set maps the matched identity/group conditions to the Shell Profile and Command Set, thereby enforcing TACACS+ command authorization on network devices. Option D (Define a Command Set) is correct because a Command Set is the reusable list of permitted or denied CLI commands (with optional arguments) that ISE references when evaluating each command sent by the device. Option B (Configure an SGT) is not required, as Security Group Tags are used for TrustSec segmentation, not TACACS+ command authorization. Option E (Enable MAB) is not required, since MAC Authentication Bypass is a network access authentication method for endpoints, not a step in configuring device administration command authorization.

Answer

Configure an SGT

Answer

Enable MAB

Question 6

Which TWO of the following are benefits of using Network Device Groups (NDG)? (Choose two)

Accepted Answer

Simplifies policy management by grouping devices. Option C is correct because Network Device Groups (NDGs) in Cisco ISE let you organize network access devices into logical collections so that authorization policies and policy sets can be applied to the group as a whole rather than to each device individually, greatly simplifying policy management. Option D is correct because NDGs can be defined by attributes such as location, device type, or role, allowing authorization rules and policy conditions to target specific groups of devices with granular precision. Options A, B, and E are incorrect: NDGs do not eliminate shared secrets (RADIUS/TACACS+ shared secrets are still configured per device), they do not automatically push or update device configurations (that is the role of configuration management tools, not NDGs), and they do not replace TACACS+ command sets, which are still required to control the specific commands an administrator may execute on a device.

Answer

Eliminates the need for shared secrets

Answer

Automatically updates the device config

Answer

Replaces the need for TACACS+ command sets

Question 7

Which THREE of the following items are required for the EAP-TLS authentication process to succeed?

Accepted Answer

Client certificate installed on the device. EAP-TLS is a mutual certificate-based authentication method, so the client must present its own identity certificate: option B (client certificate installed on the device) is required for the supplicant to authenticate to the network. The authentication server must also prove its identity, so option C (ISE server certificate installed on the PSN) is required for the Policy Service Node to present a valid server certificate during the TLS handshake. Both sides must validate the other's certificate chain, so option D (trust anchor/Root CA installed on both client and server) is required to build and verify the certificate path. Option A is incorrect because EAP-TLS does not use a user password in the registry; authentication is based on certificates, not stored credentials. Option E is incorrect because an Active Directory GPO forcing login is not a prerequisite for the EAP-TLS handshake itself, even if AD may be used for authorization or identity mapping.

Answer

User password stored in the endpoint registry

Answer

Active Directory GPO to force login

Question 8

When designing an ISE deployment across WAN links, what is the primary recommendation regarding MnT nodes?

Accepted Answer

Keep the MnT node in the same high-speed network as the PAN. Cisco recommends keeping the MnT (Monitoring and Troubleshooting) node in the same high-speed network as the PAN (Policy Administration Node) because MnT stores and processes large volumes of logging and session data, and it frequently communicates with the PAN for policy and configuration synchronization. Placing MnT across a WAN link introduces latency and potential replication issues.

Answer

Distributed MnTs across all WAN sites

Answer

Always place MnT in the cloud

Answer

Disable logging for remote sites

Question 9

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

Accepted Answer

HTTPS. HTTPS (B) is critical because BYOD enrollment, policy delivery, and MDM/UEM management traffic must be encrypted and authenticated over TLS, typically on TCP 443, protecting device and user data in transit. RADIUS (D) is essential for authenticating BYOD devices and users to the network, commonly via 802.1X/EAP, enabling access control and dynamic VLAN or role assignment. SCEP (E) is the Simple Certificate Enrollment Protocol used to automate certificate issuance to BYOD devices, which underpins identity, Wi-Fi/EAP-TLS authentication, and VPN trust in the lifecycle. SMTP (A) is only for sending email and FTP (C) is a legacy cleartext file-transfer protocol; neither provides the authentication, encryption, or certificate provisioning functions required for BYOD onboarding and management.

Answer

SMTP

Answer

FTP

Question 10

Which license type is required to enable advanced profiling and posture services on Cisco ISE?

Accepted Answer

ISE Advantage. Cisco ISE Advantage is the highest-tier license and is required for advanced profiling and posture services. Profiling collects endpoint attributes to classify devices, while posture assesses endpoint compliance (e.g., antivirus, OS patches) before granting access. These features are exclusive to the Advantage license; lower tiers like Essentials or Premier do not include them. The Device Admin license is for TACACS+ device administration, not for profiling or posture.

Answer

ISE Premier

Answer

Device Admin License

Answer

ISE Essentials

Question 11

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

Accepted Answer

NAS-Port-Type. The NAS-Port-Type RADIUS attribute (attribute 61) identifies the physical port type used by the network access server (NAS) to authenticate the user. Common values include Ethernet (15) for wired and Wireless-IEEE-802.11 (19) for wireless. ISE policy sets commonly use this attribute to differentiate between wired and wireless requests because it is sent by the NAD in the Access-Request and reliably indicates the access medium.

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

Device-Name

Question 12

Which TWO of the following are common troubleshooting steps for a failed BYOD portal redirection?

Accepted Answer

Check the Authorization Policy for the correct URL-Redirect attribute. Option B is correct because in Cisco ISE BYOD flows the Authorization Policy must return the correct URL-Redirect attribute (e.g., the Cisco AV pair url-redirect pointing to the guest/BYOD portal) so the endpoint is redirected to the portal instead of being denied or passed through. Option C is correct because the redirect ACL applied to the authorization result must permit the client's traffic to reach ISE (TCP 8443 for the portal, and DNS resolution), otherwise the HTTP redirect cannot complete and the portal never loads. Restarting the Active Directory domain controller (A) is unrelated to portal redirection and would not fix a redirect attribute or ACL problem. Re-configuring the DHCP server (D) is unnecessary unless IP addressing is broken, which is not the described symptom. Changing the switch model (E) is irrelevant since redirection depends on policy and ACL configuration, not hardware model.

Answer

Restart the Active Directory domain controller

Answer

Re-configure the DHCP server

Answer

Change the switch model

Question 13

A user is authenticating via the Sponsored Guest portal. After the sponsor approves the guest, the user still cannot access the network. What is the most common reason for this if the RADIUS flow is correct?

Accepted Answer

The NAD is not processing the CoA request sent by ISE.. After a sponsor approves a guest, ISE must push a Change of Authorization (CoA) to the NAD to move the session from the restricted guest VLAN/ACL to the authorized state. If the NAD does not support, is not configured for, or rejects the CoA (RFC 5176), the guest remains in the limited-access state even though ISE shows the account as approved. This is the most common cause when the RADIUS authentication flow itself is working correctly.

Answer

The guest password has expired.

Answer

The guest account is not in the correct group.

Answer

The browser cache is preventing the redirect.

Question 14

Which THREE items are configurable within a TACACS+ Shell Profile in Cisco ISE?

Accepted Answer

Idle Timeout. In Cisco ISE, a TACACS+ Shell Profile defines the authorization attributes returned to a network device for a shell session, and it includes the Idle Timeout (C), which sets the inactivity period in minutes before the session is terminated, the Default Privilege Level (D), which assigns the initial privilege level (0-15) for the user's EXEC session, and the Auto-command (E), which specifies a command to run automatically upon login. These three attributes are all configurable fields within the Shell Profile's authorization settings. The Shared Secret (A) is not part of a Shell Profile; it is configured on the TACACS+ device/network access device definition to secure communication between ISE and the NAD. The RADIUS Service Type (B) is a RADIUS authorization attribute and is not applicable to TACACS+ shell profiles, which use TACACS+ AV pairs instead.

Answer

Shared Secret

Answer

RADIUS Service Type

Question 15

Which TWO of the following are types of Identity Sources in ISE?

Accepted Answer

Internal Users. In Cisco ISE, an Identity Source is a repository that ISE queries to authenticate and retrieve attributes about a user or endpoint, and both Internal Users (C) and Active Directory (E) are valid Identity Source types. Internal Users (C) is correct because ISE's built-in internal user database can serve as an identity store for local authentication, including users, passwords, and identity group assignments. Active Directory (E) is correct because ISE can join an AD domain and use it as an external identity source via the ISE AD connector for authentication and group/attribute retrieval. The other options are not identity sources: Policy Set (A) is a container that binds conditions to authentication/authorization policies, Authorization Profile (B) is a set of attributes (such as VLAN, dACL, or SGT) applied in an authorization rule result, and Command Set (D) is a TACACS+ construct that defines which CLI commands a user is permitted to run.

Answer

Policy Set

Answer

Authorization Profile

Answer

Command Set

Question 16

A security engineer is configuring Cisco ISE BYOD with a single SSID for both employee onboarding and corporate access. The engineer wants to ensure that devices without a valid certificate are redirected to the BYOD portal, while devices with a valid certificate are granted full access. The engineer has created a client provisioning policy that provisions the native supplicant with the corporate SSID and a certificate template. However, after provisioning, devices are still being redirected to the BYOD portal on subsequent connections. Which configuration change is required to allow onboarded devices to bypass the portal?

Accepted Answer

Modify the authorization policy to include a rule that matches devices presenting a valid certificate and assigns a permit access profile, placed above the redirection rule.. After a device is onboarded and presents a valid certificate, the authorization policy must have a rule that matches certificate authentication and grants full access. If the redirection rule is evaluated first or there is no certificate-based permit rule, the device will continue to be redirected. The correct fix is to add or reorder the authorization policy so that certificate-based access is granted before redirection.

Answer

Change the client provisioning policy to use a different supplicant profile that includes the certificate.

Answer

Add the certificate's issuer to the list of trusted CAs in the BYOD portal settings.

Answer

Enable the 'Allow employees to bypass BYOD portal' option in the BYOD settings.

Question 17

Which THREE of the following are valid types of Client Provisioning Resources?

Accepted Answer

AnyConnect Profile (XML). In Cisco ISE Client Provisioning, the valid Client Provisioning Resource types include the AnyConnect Profile (XML), which delivers an XML configuration profile that defines VPN, posture, and connection settings to the AnyConnect client, so option A is correct. The Compliance Module is also a valid resource type, as it supplies the posture assessment components (such as OPSWAT libraries) that the AnyConnect posture agent uses to evaluate endpoint compliance, making option C correct. The AnyConnect Core Package is likewise a valid Client Provisioning Resource, since it is the actual AnyConnect client installer package provisioned to endpoints, so option D is correct. Option B (Windows Update Agent) is not a Client Provisioning Resource type in ISE, and option E (Antivirus definition files) is not provisioned as a client provisioning resource either, as antivirus definitions are handled by the AV vendor rather than ISE client provisioning.

Answer

Windows Update Agent

Answer

Antivirus definition files

Question 18

What is the function of the 'PassiveID' feature in a distributed ISE deployment?

Accepted Answer

It provides user identity mapping without active probing. PassiveID in Cisco ISE is a service that listens to and analyzes existing network traffic (such as RADIUS accounting, DHCP, and SNMP) to build a user identity mapping without actively probing endpoints. It passively collects user and device information from sources like Active Directory logs, syslog, and NetFlow, associating IP addresses with usernames. This is especially useful for devices that cannot run an active supplicant or for guest/BYOD scenarios where active probing is not feasible. Thus, it provides identity mapping without generating additional network traffic or requiring active probes.

Answer

It enables redundant authentication

Answer

It replaces the need for PSNs

Answer

It caches RADIUS requests

Question 19

What is the benefit of using multiple TACACS+ Policy Sets?

Accepted Answer

To segment policies by device type or user group. Multiple TACACS+ Policy Sets allow you to segment policies by device type or user group, so different sets of rules can be applied to different network devices or administrative roles. This provides granular control over command authorization and accounting for diverse device populations.

Answer

To increase the speed of authentication

Answer

To reduce the need for shared secrets

Answer

To increase the number of users allowed

Question 20

What is the primary benefit of using native supplicant provisioning in ISE?

Accepted Answer

It leverages the built-in OS capabilities for connectivity. Native supplicant provisioning in Cisco ISE leverages the built-in 802.1X supplicant already present in the operating system (e.g., Windows Wired AutoConfig, macOS native supplicant) to establish network connectivity, rather than deploying a third-party supplicant like Cisco AnyConnect NAM. This reduces deployment complexity and cost while still enabling ISE to push configuration profiles and certificates to the endpoint.

Answer

It provides complete control over the device's file system

Answer

It encrypts the entire hard drive

Answer

It removes the need for RADIUS authentication