SISE Practice Test 3 — 10 Questions

Question 1

What is the default persona of a newly installed Cisco ISE appliance before any configuration changes?

Accepted Answer

Standalone. A newly installed Cisco ISE appliance defaults to the Standalone persona, meaning it performs all roles (Policy Administration Node, Policy Service Node, and Monitoring Node) on a single node. This is the out-of-box state before any distributed deployment configuration is applied. Administrators must explicitly promote or register nodes to change personas.

Answer

PSN

Answer

Monitoring node

Answer

Primary PAN

Question 2

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

Accepted Answer

Patch Condition. A Patch Condition in ISE posture is specifically designed to check for the presence of a particular Windows patch by its KB number (or a range of KBs). It queries the endpoint's update history and compares it against the configured KB values, returning compliant or non-compliant. This is the only condition type that directly targets patch-level granularity.

Answer

Registry Condition

Answer

Application Condition

Answer

File Condition

Question 3

Which AnyConnect module is specifically required to perform posture assessment in ISE?

Accepted Answer

AnyConnect Compliance Module. The AnyConnect Compliance Module is the component that performs posture assessment on the endpoint. It collects information about the device's security state (e.g., antivirus, firewall, OS patches) and reports it to ISE for policy evaluation.

Answer

AnyConnect AMP Enabler

Answer

AnyConnect Web Security Module

Answer

AnyConnect VPN Module

Question 4

If you want to use a script remediation, where do you define the script content?

Accepted Answer

Directly in the 'Script Remediation' action in ISE. In Cisco ISE, when configuring a posture policy with a script remediation action, the script content is defined directly within the 'Script Remediation' action itself. This allows the administrator to embed the script that will be executed on the endpoint to remediate the non-compliance.

Answer

In the Client Provisioning Resource file

Answer

In the Posture Policy XML

Answer

On the endpoint in the AnyConnect directory

Question 5

A posture condition is defined to check for a registry key, but it always returns 'Non-Compliant'. You suspect the 'Expected Value' is wrong. Where can you see what the agent actually found on the endpoint?

Accepted Answer

Operations > Reports > Endpoints > Posture Assessment. The Operations > Reports > Endpoints > Posture Assessment report provides detailed information about posture assessments, including the actual values found on the endpoint for each condition. This allows you to compare the expected value with what the agent reported, helping to diagnose why a condition is returning Non-Compliant.

Answer

Context Visibility > Endpoints

Answer

Client Provisioning > Resources

Answer

Policy > Posture > Conditions

Question 6

When setting up a custom endpoint identity group for printers, what is the best practice for assigning devices to that group?

Accepted Answer

Use a Profiling Policy to automatically assign the device to the 'Printers' Identity Group.. The best practice for assigning devices to a custom endpoint identity group is to use a Profiling Policy. Profiling policies automatically classify endpoints based on collected attributes (e.g., DHCP, HTTP, SNMP) and assign them to the appropriate identity group. This ensures dynamic and scalable management, reducing manual effort and errors.

Answer

Manually add every printer MAC address to the group.

Answer

Import a CSV file periodically.

Answer

Use an Authorization Policy to bypass profiling.

Question 7

Which ISE menu path is used to create a new Authorization Profile?

Accepted Answer

Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. In Cisco ISE, Authorization Profiles define the actual permissions or attributes (e.g., VLAN, dACL, SGT) that are applied to a session after a successful authorization policy match. They are created and managed under Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. This is the only path among the options that leads to the Authorization Profiles configuration page.

Answer

Policy -> Policy Sets -> Add

Answer

Policy -> Policy Elements -> Conditions

Answer

Administration -> Identity Management -> Groups

Question 8

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

Accepted Answer

Called-Station-ID. Called-Station-ID is the RADIUS attribute that carries the identifier of the network access point (e.g., the SSID or the MAC address of the wireless controller/AP) that the guest is connecting to. In a guest flow, this attribute is used to determine the physical location of the request because it identifies the specific access device. Cisco ISE uses Called-Station-ID in authorization policies to apply location-based restrictions or to track where a guest session originates.

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 9

In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?

Accepted Answer

To define attributes like account lifetime and access policies for guest accounts.. Guest Types in ISE define the template for guest accounts, including account lifetime (duration), maximum simultaneous logins, and the access policies (authorization profiles) that apply to that type of guest. They allow administrators to create different classes of guests (e.g., short-term visitor vs. long-term contractor) with distinct attributes.

Answer

To manage the list of sponsors.

Answer

To define the portal look and feel.

Answer

To configure the RADIUS server settings.

Question 10

A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?

Accepted Answer

Adjust the Policy Set conditions. Policy Set conditions are the top-level matching criteria that determine which policy set a request is evaluated against. If guest traffic is landing in the wrong policy set, the fix is to adjust the conditions (e.g., SSID, NAS-IP-Address, device type, or RADIUS attributes) so the guest session matches the 'Guest' policy set. Reordering only changes evaluation order among policy sets that already match — it does not change which conditions cause a match.

Answer

Modify the guest portal settings

Answer

Change the authentication sequence

Answer

Reorder the policy sets