SISE Practice Questions 1 — 50 Questions

Question 1

What is the function of the 'Default' policy set in ISE?

Accepted Answer

It is a catch-all for traffic that does not match other Policy Sets. The 'Default' policy set in ISE is a catch-all that processes any authentication or authorization request that does not match any other policy set. It is the last policy set evaluated and ensures that no traffic is left unprocessed. It can be modified, but it cannot be deleted.

Answer

It is the only policy set allowed to process MAB requests

Answer

It is used to manage ISE internal traffic only

Answer

It cannot be modified

Question 2

Which protocol does the Cisco ISE use to inform the NAD that a guest user's session state has changed (e.g., from 'redirect' to 'authenticated')?

Accepted Answer

RADIUS CoA. Cisco ISE uses RADIUS Change of Authorization (CoA) to dynamically change the authorization state of an active session on a Network Access Device (NAD). When a guest user's session state changes (e.g., from redirect to authenticated), ISE sends a RADIUS CoA request (Disconnect or CoA-Request) to the NAD, which then reauthenticates or changes the session's authorization. This is the standard mechanism for dynamic session control.

Answer

HTTP

Answer

SNMP

Answer

TACACS+

Question 3

When configuring a load balancer for a group of PSNs, what is the best practice for handling RADIUS traffic?

Accepted Answer

Source-IP affinity (persistence). RADIUS is a UDP-based protocol where the NAS and PSN maintain session state across the Access-Request/Access-Challenge/Access-Accept exchange. If a load balancer distributes successive packets from the same client to different PSNs, the challenge/response state is lost and authentication fails. Source-IP affinity (persistence) ensures all RADIUS packets from a given NAS or endpoint land on the same PSN for the duration of the session.

Answer

SSL-offloading

Answer

Active-passive failover only

Answer

Round-robin without persistence

Question 4

You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?

Accepted Answer

permit ip any any. A dACL is an ordered list of ACEs evaluated top-down, and IOS ACLs have an implicit 'deny ip any any' at the end. To deny a specific subnet while permitting all other traffic, you place the deny ACE for 10.1.1.0/24 first, then explicitly permit everything else with 'permit ip any any' as the final line. Without that explicit permit, the implicit deny would block all remaining traffic.

Answer

deny ip any 10.1.1.0 0.0.0.255

Answer

permit tcp any any

Answer

deny ip any any

Question 5

When configuring a secondary MnT node, what is the 'Primary' versus 'Secondary' relationship regarding log collection?

Accepted Answer

The Primary collects, Secondary is standby. In a two-node MnT deployment, the Primary MnT actively collects, stores, and processes logs from all PSNs and other nodes, while the Secondary MnT operates in standby mode and only takes over log collection if the Primary fails. This is an active/standby relationship, not active/active or load-balanced.

Answer

The Secondary collects from specific PSNs only

Answer

Both nodes log simultaneously

Answer

Nodes load balance the logs

Question 6

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

Accepted Answer

SGT (Security Group Tag). Cisco TrustSec Security Group policy enforcement relies on three core building blocks. Option A, SGT (Security Group Tag), is correct because TrustSec classifies traffic by assigning a 16-bit SGT to a source identity, and that tag is what the fabric carries and enforces against. Option C, the enforcement device (e.g., Catalyst switch), is correct because TrustSec enforcement happens at the network device that receives the tagged packet and applies the policy, such as a Catalyst switch acting as an enforcement point. Option D, SGACL (Security Group Access Control List), is correct because SGACLs define the actual permissions between source and destination SGTs and are downloaded to enforcement devices to permit or deny traffic. Option B, TACACS+ command set, is not a TrustSec enforcement component; TACACS+ is used for device administration AAA and command authorization, not for SGT-based traffic policy. Option E, RADIUS shared secret, is also not a TrustSec enforcement component; a shared secret is an authentication credential used between a client and a RADIUS server, not a policy enforcement element.

Answer

TACACS+ command set

Answer

RADIUS shared secret

Question 7

Which THREE of the following are standard probes available in Cisco ISE to gather device information?

Accepted Answer

HTTP. In Cisco ISE, standard probes used for endpoint profiling and gathering device information include HTTP, SNMP Query, and DHCP. Option B (HTTP) is correct because ISE uses HTTP probes to inspect User-Agent strings and other HTTP header data from web requests, which helps identify device type and operating system. Option D (SNMP Query) is correct because ISE sends SNMP queries to network devices to collect system information such as sysDescr, sysObjectID, and interface details for profiling. Option E (DHCP) is correct because ISE can use DHCP probes to capture DHCP requests and options (for example, option 55 parameter request list, hostname, and vendor class) to fingerprint endpoints. Options A (SMTP) and C (FTP) are not standard ISE probes for device information gathering; SMTP and FTP are application protocols unrelated to ISE profiling probes.

Answer

SMTP

Answer

FTP

Question 8

Which TWO of the following tasks are performed within the Sponsor Portal?

Accepted Answer

Creating new guest accounts.. The Sponsor Portal in Cisco ISE is a web interface used by designated sponsors to manage guest lifecycle tasks, so option D (Creating new guest accounts) is correct because sponsors can create guest accounts directly, specifying duration, login credentials, and other guest details. Option E (Approving guest access requests) is also correct because sponsors receive and act on pending guest access requests, approving or denying them so guests can authenticate. Option A (Mapping VLANs to specific guest SSIDs) is incorrect because VLAN-to-SSID mapping is configured on the wireless LAN controller or in the network access policy, not in the Sponsor Portal. Option B (Configuring global portal branding) is incorrect because portal branding and customization are configured in the Guest Portal settings within ISE administration, not by sponsors in the Sponsor Portal. Option C (Defining RADIUS shared secrets) is incorrect because RADIUS shared secrets are configured on network devices and in ISE's network device definitions, not in the Sponsor Portal.

Answer

Mapping VLANs to specific guest SSIDs.

Answer

Configuring global portal branding.

Answer

Defining RADIUS shared secrets.

Question 9

Which dashboard widget provides a quick summary of BYOD activity in your network?

Accepted Answer

BYOD Registration Status. The 'BYOD Registration Status' dashboard widget provides a quick summary of BYOD activity, including the number of registered devices, pending registrations, and other relevant metrics. This widget is specifically designed to monitor BYOD onboarding and registration trends.

Answer

System Resources

Answer

Active Directory Health

Answer

RADIUS Latency

Question 10

You need to allow guest users to access specific internal resources (like a printer) while they are connected to the Guest network. How do you configure this in ISE?

Accepted Answer

Assign a downloadable ACL (dACL) in the Authorization Profile.. A downloadable ACL (dACL) is a Cisco AV pair that ISE sends to the switch in the RADIUS Access-Accept. The switch then applies this ACL to the client's port to filter traffic. This allows granular control, such as permitting access only to a specific printer IP while denying other internal resources. The dACL is defined in the Authorization Profile, which is referenced in the authorization policy rule for guest users.

Answer

Enable Guest VLAN assignment.

Answer

Modify the Redirect ACL on the switch.

Answer

Configure a port-based ACL on the switch interface.

Question 11

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

Accepted Answer

File Remediation Action. A File Remediation Action in Cisco ISE is specifically designed to provide users with a downloadable link or instructions to obtain the required compliance software when a posture check fails. It is the remediation component that bridges the gap between a failed posture condition and the user's ability to fix it.

Answer

Post-Posture Authorization Rule

Answer

Client Provisioning Policy

Answer

Posture Requirement

Question 12

Which of the following describes the 'Standalone' deployment model?

Accepted Answer

All personas on a single node. The 'Standalone' deployment model in Cisco ISE refers to a configuration where all personas (Policy Administration Node, Policy Service Node, Monitoring and Troubleshooting Node) are installed on a single node. This is typical for small deployments or lab environments where high availability and scalability are not required. It simplifies management but lacks redundancy.

Answer

PAN and PSN on separate nodes

Answer

Only PSN role is active

Answer

Multiple nodes in a cluster

Question 13

When a new device connects, you notice it stays in the 'Unknown' profile state. You have confirmed the probes are active. What is the most likely step to fix this?

Accepted Answer

Create or update a Profiling Policy to match the collected attributes.. If a device remains in the 'Unknown' profile state despite active probes, it means ISE is collecting attributes but no profiling policy matches those attributes to assign a known profile. Creating or updating a profiling policy to match the collected attributes will allow ISE to classify the device correctly. The other options do not address the root cause: SNMP timeout, PSN service restart, or deleting the endpoint are not relevant to policy matching.

Answer

Increase the SNMP timeout.

Answer

Disable and re-enable the PSN service.

Answer

Delete the endpoint from the database.

Question 14

Which statement best describes the role of the TACACS+ 'Accounting' feature?

Accepted Answer

It records command execution details. TACACS+ separates AAA functions into distinct roles: Authentication verifies identity, Authorization determines what a user may do, and Accounting logs what the user actually did. The Accounting feature specifically records command execution details such as the command entered, the user, timestamp, and result, sending them to the TACACS+ server for auditing. This makes it the mechanism for tracking administrative activity on network devices.

Answer

It validates user credentials

Answer

It limits the commands a user can run

Answer

It encrypts the communication channel

Question 15

Which TWO of the following are true about Shell Profiles? (Choose two)

Accepted Answer

They can include custom attributes for specific vendors. Shell Profiles in Cisco ISE (TACACS+) are policy elements that define the authorization attributes returned to a network device after successful authentication. Option B is correct because Shell Profiles can include custom attributes (such as Cisco AV pairs) tailored to specific vendors, allowing device-specific authorization behavior. Option D is correct because Shell Profiles define the initial privilege level (for example, privilege level 15) assigned to the user's session upon login. Option A is incorrect because accounting is a separate TACACS+ function that logs user activity and is not replaced by Shell Profiles. Option C is incorrect because the command set is defined by Command Sets, not Shell Profiles, although both are authorization policy elements. Option E is incorrect because Shell Profiles are used with TACACS+ authorization, not exclusively with RADIUS authentication.

Answer

They replace the need for accounting

Answer

They define the command set to be used

Answer

They are used for RADIUS authentication only

Question 16

When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?

Accepted Answer

ISE Live Logs. ISE Live Logs (A) are the primary real-time troubleshooting tool because they show the posture policy evaluation, the exact posture condition that failed, and the authorization result for the session as it happens. ISE Posture Reports (B) aggregate posture compliance data and show which posture policies and conditions are failing across endpoints, which helps confirm the specific compliance check that caused the failure. The AnyConnect DART bundle (E) collects the client-side posture logs, including the Posture Agent (cscan/ISEPosture) and compliance module logs, which reveal why the endpoint's posture assessment failed on the client. Cisco IOS syslog (C) only records router/switch events and does not contain posture policy evaluation details, and AnyConnect VPN Gateway logs (D) cover tunnel establishment and connection events rather than the posture compliance decision made by ISE.

Answer

Cisco IOS syslog

Answer

AnyConnect VPN Gateway logs

Question 17

You are configuring a device sensor on a Cisco switch to help with ISE profiling. What is the primary benefit of using Device Sensor?

Accepted Answer

It enables the switch to send collected device attributes to ISE via RADIUS accounting.. The primary benefit of Device Sensor on a Cisco switch is that it collects device attributes (e.g., CDP, LLDP, DHCP, HTTP) and sends them to Cisco ISE via RADIUS accounting packets. This enriches ISE's profiling database, allowing ISE to more accurately identify and classify endpoints. Device Sensor offloads the collection from ISE to the switch, improving scalability and reducing network traffic.

Answer

It replaces the need for DHCP snooping.

Answer

It allows the switch to act as a RADIUS server.

Answer

It increases the throughput of the switch.

Question 18

How does Cisco ISE handle requests that do not match any configured TACACS+ Authorization Policy?

Accepted Answer

It denies access. Cisco ISE uses a default-deny model for TACACS+ authorization: if an authorization request does not match any configured policy rule, ISE returns a deny, and the device will not grant the requested command or privilege. This mirrors the implicit deny at the end of an ACL and ensures no unauthorized access is granted by omission.

Answer

It defaults to local switch authentication

Answer

It prompts the user to select a profile

Answer

It permits access with default privileges

Question 19

Which TWO of the following settings are available for customizing the guest portal login page?

Accepted Answer

Inclusion of a mandatory AUP checkbox.. Option B is correct because guest portal configurations in ClearPass (and similar NAC solutions) allow administrators to enable a mandatory Acceptable Use Policy checkbox that users must acknowledge before authenticating, which is a standard customization on the login page. Option E is correct because the login form's header and footer text are editable fields within the guest portal customization settings, letting administrators add branding, instructions, or legal notices. Option A is not a guest portal login page setting; switch interface selection relates to network infrastructure configuration, not portal appearance. Option C is incorrect because direct editing of Apache server config files is not a supported or exposed customization method in the portal UI and would be an unsupported modification. Option D is incorrect because the RADIUS shared secret is an authentication service configuration parameter, not a login page customization option.

Answer

Selection of the switch interface.

Answer

Direct editing of the Apache server config files.

Answer

Configuration of the RADIUS shared secret.

Question 20

You are reviewing the ISE logs and see that the Guest Portal authentication is failing. Where should you look to find the exact reason for the failure?

Accepted Answer

Operations > RADIUS Livelogs. Operations > RADIUS Livelogs provides real-time, detailed RADIUS authentication and authorization logs, including the exact failure reason for guest portal authentication attempts. It shows the full RADIUS request/response exchange, the policy set matched, and any error codes. This is the primary place to diagnose why a guest authentication is failing.

Answer

Monitoring > Reports > Guest

Answer

Policy > Policy Sets

Answer

Administration > System > Logging