SISE Practice Test 5 — 10 Questions

Question 1

You are configuring a BYOD flow where users must register their devices via the self-service portal. Which ISE component is responsible for triggering the redirection to the BYOD portal after an initial MAC Authentication Bypass (MAB) success?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization Profile with a redirect ACL and URL redirect. The Authorization Profile containing the 'Redirect' attribute is what forces the client to the portal.

Answer

Policy Set with a global redirect object

Answer

Authentication Policy with a portal trigger

Answer

RADIUS server-side redirect attribute

Question 2

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

Accepted Answer

It defines the privilege level for the session. The Shell Profile defines attributes like privilege level, auto-command, and custom attributes for CLI access.

Answer

It stores the device credentials

Answer

It defines which users can access the device

Answer

It defines the list of allowed commands

Question 3

Which TWO of the following are valid ways to assign a VLAN in an ISE Authorization Profile?

Accepted Answer

Using the VLAN common task. You can use the 'VLAN' common task or the 'Tunnel-Private-Group-ID' RADIUS attribute.

Answer

Using the Filter-Id attribute

Answer

Using the cisco-av-pair attribute

Answer

Using the Framed-IP-Address attribute

Question 4

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

Accepted Answer

In the Command Set Policy Element. TACACS+ command sets are defined under Policy Elements and then applied to the shell profile in the Device Administration policy.

Answer

In the Policy Set Authentication rule

Answer

In the Authorization Profile

Answer

In the User Identity Group

Question 5

Which component is responsible for triggering the posture assessment process when a user connects to the network?

Accepted Answer

Posture Policy. The posture requirement, when associated with a client provisioning policy, triggers the AnyConnect agent to begin assessment.

Answer

Network Access Device (NAD)

Answer

AnyConnect Compliance Module

Answer

RADIUS Server

Question 6

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

Accepted Answer

Patch Condition. A 'Patch Condition' is used specifically to verify the presence of Windows updates/patches.

Answer

Registry Condition

Answer

Application Condition

Answer

File Condition

Question 7

Which probe is most effective for identifying the specific operating system and browser type of an endpoint connecting via a web portal?

Accepted Answer

HTTP probe. The HTTP probe inspects the User-Agent string in HTTP headers, which identifies the browser and OS.

Answer

DHCP probe

Answer

MAC OUI probe

Answer

DNS probe

Question 8

You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?

Accepted Answer

The necessary probes are not receiving enough attributes to match a policy.. If ISE has not received enough attributes to meet the threshold of a profiling policy, it remains 'Unknown'.

Answer

The device is using a static IP.

Answer

The endpoint is not authenticated.

Answer

The endpoint has a firewall enabled.

Question 9

You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?

Accepted Answer

To allow devices to request certificates from the CA via the ISE node. The SCEP proxy allows the endpoint to request a certificate from an internal CA through the ISE node, keeping the CA hidden from the internal network.

Answer

To sign certificates for the endpoints

Answer

To encrypt the SCEP traffic between ISE and the endpoint

Answer

To store the Private Keys of the issued certificates

Question 10

When configuring a RADIUS authorization policy for a dot1x deployment, which TWO attributes are commonly used to assign a dynamic VLAN?

Accepted Answer

Tunnel-Type equals VLAN. Tunnel-Type and Tunnel-Medium-Type are mandatory RADIUS attributes to signal to a switch that a VLAN assignment is intended.

Answer

Service-Type equals Framed

Answer

Framed-IP-Address

Answer

Cisco-AV-Pair