SISE Practice Test 2 — 30 Questions

Question 1

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

Accepted Answer

The device remains Non-Compliant. If an endpoint is determined to be Non-Compliant and no remediation action is configured, the device remains Non-Compliant. The posture policy will not automatically remediate or grant full access; the status persists until remediation is applied or the policy changes. Thus, option D is correct.

Answer

The agent automatically remediates the issue

Answer

The device is granted full access

Answer

The posture agent crashes

Question 2

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

Accepted Answer

Authorization Profile. The Authorization Profile in Cisco ISE is where you set attributes like VLAN assignment, dACL, SGT, and reauthentication timers that are returned to the NAD after successful authorization. For wireless clients, the VLAN is typically delivered via RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) configured in the Authorization Profile.

Answer

Policy Set Condition

Answer

Identity Source Sequence

Answer

Authentication Policy

Question 3

Which TWO methods can be used to verify that a TACACS+ request from a network device is reaching the Cisco ISE PSN?

Accepted Answer

Reviewing the Operations > TACACS Livelogs in the ISE GUI.. Option B is correct because the Operations > TACACS Livelogs page in the ISE GUI shows TACACS+ authentication and authorization requests as they arrive at the PSN, confirming the request reached ISE. Option D is correct because running a packet capture (tcpdump) on the PSN interface lets you see the inbound TCP port 49 traffic from the network device, directly proving the TACACS+ request arrived. Option A is wrong because Network Device Group membership only defines device classification, not whether a request reached the PSN. Option C is wrong because Policy Set order of precedence controls rule evaluation, not request arrival. Option E is wrong because switch console AAA server status shows local client-side state, not whether the request reached the ISE PSN.

Answer

Checking the Network Device Group membership list.

Answer

Viewing the Policy Set order of precedence.

Answer

Checking the switch console logs for AAA server status.

Question 4

Which service is required to be enabled on a PSN to allow it to receive RADIUS requests from network access devices?

Accepted Answer

Policy Service. The Policy Service is the Cisco ISE service that must be enabled on a Policy Services Node (PSN) to allow it to receive RADIUS requests from network access devices (NADs). The Policy Service handles authentication, authorization, and accounting (AAA) decisions for RADIUS traffic. Without it, the PSN cannot process RADIUS requests.

Answer

Registration Service

Answer

Administration Service

Answer

Monitoring Service

Question 5

Which guest portal type should you select if you want to allow users to connect to the network without any authentication, simply by clicking an 'Accept' button?

Accepted Answer

Hotspot Portal. The Hotspot Portal is specifically designed for unauthenticated guest access where users simply click an 'Accept' button (or similar) to acknowledge the acceptable use policy and gain network access. It requires no credentials, sponsorship, or self-registration, making it the correct choice for click-through access.

Answer

Sponsored Guest Portal

Answer

Guest Portal

Answer

Self-Registered Guest Portal

Question 6

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Accepted Answer

The Network Access Device (NAD). The Network Access Device (NAD) is responsible for redirecting the guest user's browser in a Central Web Authentication (CWA) flow. When the endpoint connects, the NAD (e.g., a wireless controller or switch) intercepts the HTTP traffic and redirects the user to the ISE guest portal for authentication.

Answer

The Cisco ISE Policy Service Node (PSN)

Answer

The endpoint's default browser

Answer

The Guest Portal application

Question 7

How can you verify that ISE is receiving TACACS+ requests from a specific switch?

Accepted Answer

Check the TACACS Livelogs. Cisco ISE provides TACACS+ Livelogs under Operations > TACACS > Live Logs, which show real-time TACACS+ authentication and authorization requests received from network devices. This is the direct way to verify that ISE is receiving TACACS+ requests from a specific switch, including the device name, user, and result.

Answer

View the Network Device list

Answer

Run a packet capture on the switch

Answer

Check the System Summary

Question 8

You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?

Accepted Answer

Deny 'show running-config' and permit all other commands. To block a specific command like 'show running-config' while allowing other 'show' commands, the command set must explicitly deny 'show running-config' and then permit all other commands. TACACS+ command sets are evaluated top-down, so the deny rule for the specific command must come before a permit-all rule. This ensures only that command is blocked.

Answer

Deny 'show' and permit 'show running-config'

Answer

Permit 'show.*' and deny 'show running-config'

Answer

Set the command privilege level to 0

Question 9

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

Accepted Answer

Reporting and analytics. The Monitoring and Troubleshooting (MnT) persona in Cisco ISE is responsible for collecting and storing operational data, so option B (Reporting and analytics) is correct because MnT nodes host the reporting and analytics services that let administrators run operational reports, live logs, and dashboards on authentication, authorization, and accounting events. Option D (Log aggregation from all nodes) is also correct because all Policy Services Nodes (PSNs) and other ISE nodes forward their syslog and session data to the MnT node, which aggregates and stores it in the MnT database for troubleshooting and audit purposes. Option A (Policy distribution) is not an MnT function; policy configuration and distribution are handled by the Policy Administration Node (PAN), which pushes policies to PSNs. Option C (RADIUS authentication) is performed by Policy Services Nodes, which handle RADIUS and TACACS+ authentication, authorization, and accounting, not the MnT persona. Option E (Endpoint profiling probe) is a function of the PSN, where profiling probes (e.g., RADIUS, SNMP, DHCP, NetFlow) collect endpoint attributes, not the MnT node.

Answer

Policy distribution

Answer

RADIUS authentication

Answer

Endpoint profiling probe

Question 10

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

Accepted Answer

TACACS+ Livelogs. TACACS+ Livelogs in Cisco ISE is the dedicated real-time log view that shows TACACS+ authentication and authorization request details, including the policy set and rule that matched. When troubleshooting TACACS+ authentication issues, this is the correct log to monitor because it captures the full request/response exchange and the policy evaluation result. RADIUS Livelogs, by contrast, only show RADIUS traffic and would not display TACACS+ request details.

Answer

System Summary Dashboard

Answer

Endpoint Context Visibility

Answer

RADIUS Livelogs

Question 11

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

Accepted Answer

Initiate registration from the Primary PAN under Administration > System > Deployment. In Cisco ISE, the Primary PAN is the authoritative node that maintains the deployment database and controls node registration. To add a secondary node, you log into the Primary PAN, navigate to Administration > System > Deployment, and use the 'Register an ISE node' action to initiate the join. The secondary node must already be installed and reachable, but the registration workflow is always driven from the Primary PAN, not the joining node.

Answer

Configure the Secondary node as an standalone node and merge databases

Answer

Run the join command from the secondary node's CLI

Answer

Create a cluster via the ISE CLI setup wizard

Question 12

Which THREE factors influence the decision to use multiple PSNs in a deployment?

Accepted Answer

Geographical distribution. Option C (Geographical distribution) is correct because deploying multiple Policy Service Nodes (PSNs) across different sites lets each location authenticate its own users locally, avoiding WAN latency and link dependency for RADIUS traffic. Option D (Load balancing of RADIUS requests) is correct because multiple PSNs distribute the authentication, authorization, and accounting load, preventing any single PSN from becoming a bottleneck as endpoint counts grow. Option E (Redundancy for node failure) is correct because if one PSN becomes unavailable, NADs can fail over to another PSN, preserving network access during outages. Options A (Increased log storage capacity) and B (Centralized database backup) are not valid factors: logging and backup are handled by the Monitoring and Policy nodes (MnT/PAN), not by adding PSNs, so they do not drive the decision to deploy multiple PSNs.

Answer

Increased log storage capacity

Answer

Centralized database backup

Question 13

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

Accepted Answer

Authorization Policy Condition. In Cisco ISE, MAB (MAC Authentication Bypass) authorization decisions are made by the Authorization Policy, and the specific conditions that match attributes like MAC address, OUI, or endpoint identity group are configured as conditions within an Authorization Policy rule. To restrict access to specific MAC OUI addresses, you create a condition (e.g., using the 'MACAddress' or 'EndPointMacAddress' attribute with an OUI prefix match) inside the Authorization Policy rule, which then determines the resulting Authorization Profile.

Answer

Authentication Policy

Answer

Identity Source Sequence

Answer

Authorization Profile

Question 14

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

Accepted Answer

Shell Profile. In Cisco ISE TACACS+ device administration, the Shell Profile is the result object that defines the privilege level (e.g., Privilege Level 15) assigned to a user after successful authentication and authorization. It is referenced within an Authorization Policy rule and returned as an AV-pair (such as shell:priv-lvl=15) to the network device, which then enforces the user's CLI privilege.

Answer

Command Set

Answer

Authorization Profile

Answer

Device Administration Policy

Question 15

Which menu path in Cisco ISE is used to define a new Network Device Group?

Accepted Answer

Administration > Network Resources > Network Device Groups. The correct menu path to define a new Network Device Group in Cisco ISE is Administration > Network Resources > Network Device Groups. This is where you create and manage groups that can be used to logically group network devices for policy conditions and authorization rules.

Answer

Operations > TACACS Livelogs

Answer

Administration > Identity Management

Answer

Policy > Policy Elements > Results

Question 16

A security engineer is configuring a Cisco ISE guest portal for a conference. Attendees must be able to create their own accounts but must first receive a one-time code via SMS to validate their phone number. The SMS gateway has already been integrated with ISE. Which guest portal flow should the engineer select to meet this requirement?

Accepted Answer

Self-Registered Guest Flow with SMS validation. The Self-Registered Guest Flow enables guests to create their own accounts without sponsor intervention. Enabling SMS validation within that flow forces the guest to enter a one-time code sent to their mobile phone, confirming the number is valid. The other flows either skip identity validation entirely, require a sponsor, or serve a different purpose such as device onboarding.

Answer

BYOD Onboarding Flow

Answer

Hotspot Guest Flow

Answer

Sponsored Guest Flow

Question 17

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

Accepted Answer

To test the policy before enforcing access control. Monitoring Mode in Cisco ISE is a deployment phase where the switch port is configured to authenticate and authorize endpoints but does not enforce the result. The purpose is to test policies and gather data without impacting network access, allowing administrators to validate configurations before moving to enforcement. Thus, the correct answer is to test the policy before enforcing access control.

Answer

To force the port to shutdown

Answer

To provide internet access to guests

Answer

To perform vulnerability scanning

Question 18

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

Accepted Answer

Enable BYOD settings in the device portal configuration. Option B is correct because enabling BYOD settings in the device portal configuration is a mandatory step: the Cisco ISE device portal (the client provisioning and BYOD portal) must have BYOD functionality turned on so that endpoints can be onboarded, registered, and have supplicant/certificate provisioning performed. Option D is correct because a mandatory part of BYOD is an authorization policy that matches non-compliant or unregistered BYOD endpoints and redirects them to the BYOD/guest portal for onboarding, typically using a redirect URL (e.g., the client provisioning portal) before granting full network access. Option A is incorrect because BYOD onboarding does not require installing a dedicated agent on every switch; Cisco ISE uses RADIUS, web portals, and supplicant provisioning instead. Option C is incorrect because BYOD does not require creating a local user account for every device; identity is handled through ISE's identity stores, certificates, and endpoint registration. Option E is incorrect because disabling RADIUS authentication would break the 802.1X/MAC authentication and authorization that ISE relies on for BYOD, so it is the opposite of a required step.

Answer

Install a dedicated agent on every switch

Answer

Create a local user account for every device

Answer

Disable RADIUS authentication

Question 19

If a PSN loses connectivity to the PAN, what happens to existing user sessions?

Accepted Answer

Sessions remain active and the PSN continues to authenticate. When a PSN loses connectivity to the PAN, existing user sessions remain active and the PSN continues to authenticate new sessions using its last known policy configuration. This is by design to maintain network access during PAN outages.

Answer

All sessions are terminated

Answer

The PSN enters emergency mode

Answer

The PSN reboots

Question 20

When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?

Accepted Answer

It enables TACACS+ services for this device. When adding a network device in ISE, checking the 'TACACS+ Authentication Settings' checkbox enables TACACS+ services for that device, allowing ISE to process TACACS+ authentication, authorization, and accounting requests from it. This is separate from RADIUS configuration, which is controlled by the RADIUS settings on the same device entry. Enabling TACACS+ is a prerequisite for using ISE for device administration (AAA) on that network device.

Answer

It enables RADIUS for this device

Answer

It forces the switch to use SNMP

Answer

It automatically configures the switch via CLI