SISE Practice Test 4 — 10 Questions

Question 1

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

Accepted Answer

The user must manually 'Install' the configuration profile. iOS requires an Apple-signed profile, which ISE generates. The device must be able to reach the portal via HTTPS, and the profile must be trusted by the OS.

Answer

The device must be connected via VPN

Answer

The device must be jailbroken

Question 2

Which TWO of the following are valid device attributes that can be used to identify a device for BYOD onboarding?

Accepted Answer

Device-Type. Device type and operating system are fundamental attributes used in policy conditions to distinguish BYOD devices.

Answer

VLAN-ID

Answer

RADIUS-Session-ID

Answer

Port-Number

Question 3

When setting up TACACS+ for network administration, which THREE configurations must be present on the Cisco network device? (Choose three)

Accepted Answer

AAA authentication/authorization commands. The switch needs the TACACS+ server IP, the shared secret, and the AAA command authorization configured.

Answer

Local user database for all commands

Answer

RADIUS server configuration

Question 4

Which THREE of the following are valid types of Posture Conditions?

Accepted Answer

Service Condition. ISE supports multiple condition types including File, Registry, and Service checks.

Answer

User Identity Condition

Answer

Port Condition

Question 5

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

Accepted Answer

HTTPS. SCEP is for certificates, HTTPS is for the portal, and RADIUS is for network access control.

Answer

SMTP

Answer

FTP

Question 6

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

Accepted Answer

Reporting and analytics. MnT nodes are responsible for collecting logs from all nodes in the deployment and providing the analytics/reporting interface.

Answer

Policy distribution

Answer

RADIUS authentication

Answer

Endpoint profiling probe

Question 7

Which RADIUS attribute is commonly used to inform the Network Access Server (NAS) that a re-authentication is required after a successful BYOD provisioning?

Accepted Answer

Termination-Action: RADIUS-Request. The 'Cisco-AV-Pair' containing 'url-redirect' is used initially, but 'Termination-Action: RADIUS-Request' is often used to force a re-authentication after the BYOD process.

Answer

Class-Attribute: Re-Authenticate

Answer

Filter-Id: Refresh

Answer

Tunnel-Type: VLAN-Change

Question 8

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

Accepted Answer

Distributed Configuration Synchronization via HTTPS. The PAN uses a distributed configuration synchronization process via HTTPS/REST APIs to push configuration changes to all other nodes in the deployment.

Answer

Rsync over SSH

Answer

RADIUS Change of Authorization (CoA)

Answer

SNMPv3 Trap propagation

Question 9

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

Accepted Answer

The FQDN of the Load Balancer VIP. The AnyConnect profile should contain a list of PSNs or a load-balanced VIP to ensure redundancy.

Answer

The local gateway address

Answer

The IP address of the ISE Admin Node

Answer

A single static IP of the Primary PSN

Question 10

Which TWO of the following steps are required to deploy the AnyConnect posture agent?

Accepted Answer

Create a Client Provisioning policy. Deployment involves creating the Client Provisioning resource and then creating the policy to assign it to endpoints.

Answer

Set the NAS IP address

Answer

Enable RADIUS Accounting

Answer

Configure a TrustSec policy