SISE Practice Test 5 — 10 Questions

Question 1

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

Accepted Answer

Initiate registration from the Primary PAN under Administration > System > Deployment. In Cisco ISE, the Primary PAN is the authoritative node that maintains the deployment database and controls node registration. To add a secondary node, you log into the Primary PAN, navigate to Administration > System > Deployment, and use the 'Register an ISE node' action to initiate the join. The secondary node must already be installed and reachable, but the registration workflow is always driven from the Primary PAN, not the joining node.

Answer

Configure the Secondary node as an standalone node and merge databases

Answer

Run the join command from the secondary node's CLI

Answer

Create a cluster via the ISE CLI setup wizard

Question 2

Which THREE factors influence the decision to use multiple PSNs in a deployment?

Accepted Answer

Geographical distribution. Option C (Geographical distribution) is correct because deploying multiple Policy Service Nodes (PSNs) across different sites lets each location authenticate its own users locally, avoiding WAN latency and link dependency for RADIUS traffic. Option D (Load balancing of RADIUS requests) is correct because multiple PSNs distribute the authentication, authorization, and accounting load, preventing any single PSN from becoming a bottleneck as endpoint counts grow. Option E (Redundancy for node failure) is correct because if one PSN becomes unavailable, NADs can fail over to another PSN, preserving network access during outages. Options A (Increased log storage capacity) and B (Centralized database backup) are not valid factors: logging and backup are handled by the Monitoring and Policy nodes (MnT/PAN), not by adding PSNs, so they do not drive the decision to deploy multiple PSNs.

Answer

Increased log storage capacity

Answer

Centralized database backup

Question 3

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

Accepted Answer

Authorization Policy Condition. In Cisco ISE, MAB (MAC Authentication Bypass) authorization decisions are made by the Authorization Policy, and the specific conditions that match attributes like MAC address, OUI, or endpoint identity group are configured as conditions within an Authorization Policy rule. To restrict access to specific MAC OUI addresses, you create a condition (e.g., using the 'MACAddress' or 'EndPointMacAddress' attribute with an OUI prefix match) inside the Authorization Policy rule, which then determines the resulting Authorization Profile.

Answer

Authentication Policy

Answer

Identity Source Sequence

Answer

Authorization Profile

Question 4

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

Accepted Answer

Shell Profile. In Cisco ISE TACACS+ device administration, the Shell Profile is the result object that defines the privilege level (e.g., Privilege Level 15) assigned to a user after successful authentication and authorization. It is referenced within an Authorization Policy rule and returned as an AV-pair (such as shell:priv-lvl=15) to the network device, which then enforces the user's CLI privilege.

Answer

Command Set

Answer

Authorization Profile

Answer

Device Administration Policy

Question 5

Which menu path in Cisco ISE is used to define a new Network Device Group?

Accepted Answer

Administration > Network Resources > Network Device Groups. The correct menu path to define a new Network Device Group in Cisco ISE is Administration > Network Resources > Network Device Groups. This is where you create and manage groups that can be used to logically group network devices for policy conditions and authorization rules.

Answer

Operations > TACACS Livelogs

Answer

Administration > Identity Management

Answer

Policy > Policy Elements > Results

Question 6

A security engineer is configuring a Cisco ISE guest portal for a conference. Attendees must be able to create their own accounts but must first receive a one-time code via SMS to validate their phone number. The SMS gateway has already been integrated with ISE. Which guest portal flow should the engineer select to meet this requirement?

Accepted Answer

Self-Registered Guest Flow with SMS validation. The Self-Registered Guest Flow enables guests to create their own accounts without sponsor intervention. Enabling SMS validation within that flow forces the guest to enter a one-time code sent to their mobile phone, confirming the number is valid. The other flows either skip identity validation entirely, require a sponsor, or serve a different purpose such as device onboarding.

Answer

BYOD Onboarding Flow

Answer

Hotspot Guest Flow

Answer

Sponsored Guest Flow

Question 7

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

Accepted Answer

To test the policy before enforcing access control. Monitoring Mode in Cisco ISE is a deployment phase where the switch port is configured to authenticate and authorize endpoints but does not enforce the result. The purpose is to test policies and gather data without impacting network access, allowing administrators to validate configurations before moving to enforcement. Thus, the correct answer is to test the policy before enforcing access control.

Answer

To force the port to shutdown

Answer

To provide internet access to guests

Answer

To perform vulnerability scanning

Question 8

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

Accepted Answer

Enable BYOD settings in the device portal configuration. Option B is correct because enabling BYOD settings in the device portal configuration is a mandatory step: the Cisco ISE device portal (the client provisioning and BYOD portal) must have BYOD functionality turned on so that endpoints can be onboarded, registered, and have supplicant/certificate provisioning performed. Option D is correct because a mandatory part of BYOD is an authorization policy that matches non-compliant or unregistered BYOD endpoints and redirects them to the BYOD/guest portal for onboarding, typically using a redirect URL (e.g., the client provisioning portal) before granting full network access. Option A is incorrect because BYOD onboarding does not require installing a dedicated agent on every switch; Cisco ISE uses RADIUS, web portals, and supplicant provisioning instead. Option C is incorrect because BYOD does not require creating a local user account for every device; identity is handled through ISE's identity stores, certificates, and endpoint registration. Option E is incorrect because disabling RADIUS authentication would break the 802.1X/MAC authentication and authorization that ISE relies on for BYOD, so it is the opposite of a required step.

Answer

Install a dedicated agent on every switch

Answer

Create a local user account for every device

Answer

Disable RADIUS authentication

Question 9

If a PSN loses connectivity to the PAN, what happens to existing user sessions?

Accepted Answer

Sessions remain active and the PSN continues to authenticate. When a PSN loses connectivity to the PAN, existing user sessions remain active and the PSN continues to authenticate new sessions using its last known policy configuration. This is by design to maintain network access during PAN outages.

Answer

All sessions are terminated

Answer

The PSN enters emergency mode

Answer

The PSN reboots

Question 10

When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?

Accepted Answer

It enables TACACS+ services for this device. When adding a network device in ISE, checking the 'TACACS+ Authentication Settings' checkbox enables TACACS+ services for that device, allowing ISE to process TACACS+ authentication, authorization, and accounting requests from it. This is separate from RADIUS configuration, which is controlled by the RADIUS settings on the same device entry. Enabling TACACS+ is a prerequisite for using ISE for device administration (AAA) on that network device.

Answer

It enables RADIUS for this device

Answer

It forces the switch to use SNMP

Answer

It automatically configures the switch via CLI