SISE Practice Test 6 — 10 Questions

Question 1

You are using the Feed Service to update your profiling policies. How can you ensure that custom profiling policies you have created are not overwritten during the update?

Accepted Answer

Custom policies are not affected by Feed Service updates.. Cisco ISE's Feed Service updates only the system-provided profiling policies that ship with ISE; custom profiling policies created by administrators are stored separately and are not overwritten or removed during a feed update. This design lets organizations receive updated fingerprints for new device types without losing their own customizations.

Answer

Place custom policies in the system policy folder.

Answer

Export custom policies before every update.

Answer

Disable automatic updates.

Question 2

You are configuring a policy to block access for non-compliant devices. Where do you configure the posture status as a policy condition?

Accepted Answer

Authorization Policy. Posture status (e.g., Compliant, Non-Compliant, Unknown) is evaluated as a condition within the Authorization Policy, where ISE checks the posture result and applies the appropriate authorization profile — such as a quarantine VLAN or restricted dACL for non-compliant devices. The Authorization Policy is the correct location because posture is an authorization-time attribute, not an authentication-time one.

Answer

Authentication Policy

Answer

Endpoint Group

Answer

Identity Source

Question 3

You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?

Accepted Answer

The necessary probes are not receiving enough attributes to match a policy.. Profiling in ISE relies on collecting attributes from various probes (DHCP, HTTP, RADIUS, SNMP, etc.) and matching them against profiling policies. If the endpoint shows as 'Unknown', the most likely cause is that the probes are not receiving enough attributes — or the attributes received do not match any existing policy condition. Without sufficient attribute data, ISE cannot classify the device even if it is obviously a Windows workstation to a human.

Answer

The device is using a static IP.

Answer

The endpoint is not authenticated.

Answer

The endpoint has a firewall enabled.

Question 4

What is the purpose of the 'Guest Flow' setting in the Authorization Profile?

Accepted Answer

It tells the ISE to trigger the Guest Portal.. The 'Guest Flow' setting in an ISE Authorization Profile tells ISE to redirect the endpoint to the Guest Portal for registration or sponsorship, rather than granting normal network access. It is the mechanism that triggers the guest onboarding workflow when a user or device is not yet known to ISE. This is distinct from session timeout, MAC caching, or group definition, which are separate authorization attributes.

Answer

It defines the session timeout.

Answer

It enables MAC caching.

Answer

It defines the Guest Group.

Question 5

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

Accepted Answer

Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. The BYOD checkbox for a specific device registration portal is enabled under Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. This is where the portal configuration includes the option to enable BYOD device registration. The path is specific to the Guest Access work center in ISE.

Answer

Policy > Policy Sets > [Set Name] > Authorization Policy

Answer

Operations > Troubleshoot > BYOD Settings

Answer

Administration > Device Portal Management

Question 6

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

Accepted Answer

To configure the native supplicant settings for secure network access. The Network Setup Assistant (NSA) is a client-side provisioning component in Cisco ISE BYOD flows that walks the end user through configuring the native supplicant (Windows WLAN AutoConfig, macOS, iOS, Android, etc.) with the correct SSID, EAP method (PEAP/EAP-TLS), and certificate settings so the device can authenticate via 802.1X. It is downloaded from the ISE Guest/BYOD portal and runs locally on the endpoint to install the required profile. This enables secure EAP-based network access without manual supplicant configuration by the user.

Answer

To provide a VPN tunnel to the internal network

Answer

To manage the user's Active Directory account

Answer

To scan the device for malware before allowing network access

Question 7

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

Accepted Answer

Operations > Reports > Endpoints and Users > Certificate Provisioning. The Certificate Provisioning report under Operations > Reports > Endpoints and Users is the dedicated location where ISE logs the outcome of CA interactions during BYOD onboarding, including certificate enrollment requests, successes, and failures. When devices register successfully but certificate issuance fails, this report captures the SCEP/PKCS or EST exchange between ISE and the CA, showing error codes returned by the CA.

Answer

Policy > Policy Elements > Results > Certificate Templates

Answer

Operations > RADIUS Livelog

Answer

Administration > System > Certificates > Certificate Signing Requests

Question 8

Which specific ISE process is responsible for managing the communication between the PAN and PSNs?

Accepted Answer

ISE Messaging Service. The ISE Messaging Service is the internal process that handles communication between the Policy Administration Node (PAN) and the Policy Service Nodes (PSNs). It uses a messaging bus to propagate policy configuration, session data, and administrative changes across the deployment.

Answer

Application Server

Answer

Radius Core

Answer

Monitoring Service

Question 9

How do you verify the current licensing status and consumption on your ISE deployment?

Accepted Answer

Administration > System > Licensing. In Cisco ISE, licensing status and consumption are viewed under Administration > System > Licensing. This page shows the license type (Base, Plus, Apex), the number of concurrent sessions consumed, and the evaluation period remaining. It is the authoritative location for verifying license compliance and usage.

Answer

Dashboard > Licensing

Answer

Policy > Licensing

Answer

Operations > Licensing

Question 10

You are troubleshooting a PSN that is not receiving configuration updates. Which log file on the PSN would provide the most insight into the configuration sync process?

Accepted Answer

config-dist.log. The config-dist.log file on a PSN records the configuration distribution process, including synchronization attempts, successes, and failures with the Primary PAN. When a PSN is not receiving configuration updates, this log provides the most direct insight into why the sync is failing (e.g., connectivity, certificate, or replication issues). It is the go-to log for troubleshooting configuration replication.

Answer

catalina.out

Answer

radius.log

Answer

prrt-server.log