SISE Practice Questions 2 — 50 Questions

Question 1

Which AnyConnect module is specifically required to perform posture assessment in ISE?

Accepted Answer

AnyConnect Compliance Module. The 'AnyConnect Compliance Module' (formerly known as the posture module) is required.

Answer

AnyConnect AMP Enabler

Answer

AnyConnect Web Security Module

Answer

AnyConnect VPN Module

Question 2

Which THREE conditions are required for successful AnyConnect posture assessment in a wired network environment?

Accepted Answer

The endpoint must have the AnyConnect agent installed.. Posture requires a working authorization profile, a properly provisioned agent, and a clear communication path between the agent and the ISE Policy Services Node (PSN).

Answer

The switch must be configured for WebAuth.

Answer

The endpoint must be joined to an Active Directory domain.

Question 3

Which protocol is used by ISE to communicate with the MDM server for device status checks?

Accepted Answer

REST API. ISE uses REST APIs to communicate with most modern MDM solutions like AirWatch or Intune.

Answer

SNMP

Answer

RADIUS

Answer

LDAP

Question 4

A user is unable to pass posture assessment because the 'AnyConnect Compliance Module' is not detecting the antivirus software. Which log file on the endpoint should be reviewed to troubleshoot the compliance module's scanning logic?

Accepted Answer

AnyConnect Compliance Module log (ac_ise_posture.log). The ACLog.txt or the Compliance Module logs (typically found in %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture) contain details about scan results.

Answer

NAC Agent Log (nac_agent.log)

Answer

Windows Event Viewer - Application Log

Answer

ISE Posture Log (ise_posture.log)

Question 5

When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?

Accepted Answer

Greater Than or Equal. The 'Greater Than or Equal' operator is necessary to ensure the version meets or exceeds the security requirement.

Answer

Matches

Answer

Equals

Answer

Contains

Question 6

What is the effect of setting a Posture Requirement to 'Optional'?

Accepted Answer

The user can choose to bypass the check without being blocked. Optional means the agent will perform the check, but if the endpoint is non-compliant, the access is not restricted based on that specific requirement.

Answer

The agent only checks when requested by the user

Answer

The agent will not perform the check at all

Answer

The device is automatically granted access

Question 7

You are configuring a 'Registry' check as part of a posture requirement. The goal is to ensure a specific registry key exists to prove a corporate application is configured correctly. What is the correct way to specify the path if the key is located in HKEY_LOCAL_MACHINE?

Accepted Answer

Use 'HKLM' as the root of the path.. In Cisco ISE posture requirement configurations, you must use the 'HKLM' abbreviation for the HKEY_LOCAL_MACHINE root key when defining the path.

Answer

Use 'ROOT:HKLM'.

Answer

The path must be relative to the user profile, so HKLM is invalid.

Answer

Use a backslash prefix like '\HKLM'.

Answer

Use the full string 'HKEY_LOCAL_MACHINE' at the start of the path.

Question 8

Which THREE of the following are valid remediation actions?

Accepted Answer

Service Remediation. File, Registry, and Service remediation are standard in Cisco ISE.

Answer

VLAN Remediation

Answer

ACL Remediation

Question 9

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

Accepted Answer

Device Profiling. ISE uses 'Device Profiling' (via DHCP fingerprinting, HTTP User-Agent, etc.) to identify the device and trigger the correct provisioning flow.

Answer

RADIUS Accounting

Answer

Active Directory Identity Store

Answer

Policy Sets

Question 10

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

Accepted Answer

By creating a Network Device Group. Network Device Groups (NDGs) allow you to logically group devices and use them in policy conditions.

Answer

By using IP address ranges in the policy

Answer

By tagging them with SGTs

Answer

By using the Device Name in the condition

Question 11

Which THREE attributes can be used within a Cisco ISE Authorization Policy condition?

Accepted Answer

Device Type. ISE allows matching based on a wide range of attributes from dictionaries including Network Device, Endpoint, and Session attributes.

Answer

TACACS+ Command

Answer

SGT Value

Question 12

Which of the following is a valid remediation action type in Cisco ISE?

Accepted Answer

File Remediation. File, Registry, and Service remediation are standard options.

Answer

Process Kill Remediation

Answer

Network Remediation

Answer

User Prompt Remediation

Question 13

What is the purpose of the 'Posture Discovery' phase?

Accepted Answer

To identify if posture is required for the session. Discovery is the initial communication where the agent identifies the ISE PSN and checks if a posture policy exists.

Answer

To verify the user credentials

Answer

To remediate non-compliant endpoints

Answer

To determine if the endpoint is compliant

Question 14

In the BYOD flow, what occurs immediately after the user provides credentials in the portal?

Accepted Answer

The device is provisioned with a certificate. After credentials are verified, the ISE portal triggers the download of the Network Setup Assistant or the SCEP enrollment process.

Answer

The device is automatically moved to the production VLAN

Answer

The user is disconnected from the network

Answer

The device is registered in the Active Directory

Question 15

Which THREE of the following are valid operators for a Registry Condition?

Accepted Answer

Equals. Standard operators include Equals, Contains, and Starts With.

Answer

Includes All

Answer

Exists Only

Question 16

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

Accepted Answer

Enable BYOD settings in the device portal configuration. The two core requirements are enabling the BYOD portal and configuring the authorization policy to handle the registration flow.

Answer

Install a dedicated agent on every switch

Answer

Create a local user account for every device

Answer

Disable RADIUS authentication

Question 17

What is the benefit of using multiple TACACS+ Policy Sets?

Accepted Answer

To segment policies by device type or user group. Policy Sets allow for granular control and different rules for different types of devices or users.

Answer

To increase the speed of authentication

Answer

To reduce the need for shared secrets

Answer

To increase the number of users allowed

Question 18

Which of the following is NOT a standard RADIUS attribute type used in ISE?

Accepted Answer

Protocol Header. Standard RADIUS attributes follow specific RFC formats; custom vendor-specific attributes (VSAs) are used for Cisco proprietary functions.

Answer

System Defined

Answer

IETF

Answer

Vendor Specific

Question 19

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

Accepted Answer

To test the policy before enforcing access control. Monitoring mode allows the admin to see if 802.1X/MAB would pass or fail without actually blocking traffic.

Answer

To force the port to shutdown

Answer

To provide internet access to guests

Answer

To perform vulnerability scanning

Question 20

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

Accepted Answer

To gather compliance data without restricting network access. Monitor Mode allows administrators to log posture results without denying access, facilitating testing before enforcement.

Answer

To automatically remediate endpoints

Answer

To bypass the posture check entirely

Answer

To block all traffic until the agent is installed