SISE Practice Test 7 — 10 Questions

Question 1

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

Accepted Answer

The FQDN of the Load Balancer VIP. The posture agent should point to the FQDN of the Load Balancer VIP to ensure it always reaches a PSN for assessment. In a high-availability environment, using a load balancer VIP provides a single, resilient endpoint that distributes requests across multiple PSNs. This avoids single points of failure and ensures that if one PSN goes down, the agent can still reach another PSN via the VIP.

Answer

The local gateway address

Answer

The IP address of the ISE Admin Node

Answer

A single static IP of the Primary PSN

Question 2

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

Accepted Answer

The switch is missing the 'cts role-based enforcement' command. For SGACL enforcement to occur on a switch, the switch must have the 'cts role-based enforcement' command enabled globally (and often on the interface). Without this command, the switch may receive the SGT via RADIUS but will not enforce any SGACL filtering, resulting in the described failure. This is the most likely reason when the SGT is assigned but filtering does not happen.

Answer

The SGT is not in the ISE database

Answer

RADIUS shared secret is wrong

Answer

The user is in the wrong AD group

Question 3

When configuring an SNMP Query probe, why is it recommended to use SNMPv3 instead of SNMPv1/v2c?

Accepted Answer

SNMPv3 provides authentication and encryption for the query.. SNMPv3 is recommended over SNMPv1/v2c for SNMP Query probes because it provides authentication and encryption, ensuring that the queries and responses are secure. SNMPv1/v2c use plaintext community strings, which are vulnerable to eavesdropping and unauthorized access. SNMPv3 also supports stronger security models like USM (User-based Security Model).

Answer

SNMPv3 is the only version supported by ISE.

Answer

SNMPv3 is faster.

Answer

SNMPv3 eliminates the need for a community string.

Question 4

You need to ensure that only specific ISE nodes perform the NMAP scan probe. Where is this configured?

Accepted Answer

Administration > System > Deployment > [Node Name] > Profiling Configuration. NMAP scan probe enablement is configured per-PSN under Administration > System > Deployment > [Node Name] > Profiling Configuration. This is where you enable or disable individual probes (NMAP, DHCP, RADIUS, SNMP, NetFlow, etc.) on a specific ISE node, allowing you to restrict scanning to dedicated PSNs rather than every node in the deployment.

Answer

Administration > System > Settings > Profiling Feed

Answer

Policy > Profiling > Profiling Policies

Answer

Policy > Policy Elements > Results

Question 5

Which of the following is NOT a valid probe type in Cisco ISE?

Accepted Answer

ICMP. Cisco ISE supports several active probe types for endpoint profiling: DHCP, RADIUS, SNMP Query, SNMP Trap, NetFlow, DNS, HTTP, and NMAP, among others. ICMP is not one of the configurable probe types in ISE's profiling configuration — while ISE may send pings internally for reachability, ICMP is not exposed as a profiling probe. Therefore ICMP is the option that is NOT a valid probe type.

Answer

SNMP Query

Answer

DHCP

Answer

RADIUS

Question 6

What is the primary benefit of using a Policy Set compared to the legacy 'Rule-Based' approach in ISE?

Accepted Answer

Improved logical organization and modularity. The primary benefit of a Policy Set over the legacy rule-based approach is improved logical organization and modularity. Policy Sets let you group authentication and authorization rules by use case (e.g., wired 802.1X, wireless guest, VPN) with their own conditions, making large deployments easier to manage and troubleshoot.

Answer

Requires fewer licenses

Answer

Eliminates the need for external identity sources

Answer

Faster performance

Question 7

Which TWO of the following are valid locations to check for policy match results in ISE?

Accepted Answer

Live Logs. Option B (Live Logs) is correct because ISE's Live Logs (Operations > Live Logs / RADIUS Live Logs) display real-time authentication and authorization results, including which policy set, authentication rule, and authorization rule matched for each session. Option D (Policy Simulation tool) is correct because the Policy Simulation tool lets you run a simulated authentication/authorization request and shows the exact policy match results, including the matched policy set and rules, without affecting live traffic. Option A (Device Administration console) is incorrect because it is a TACACS+ management area for device administration, not a location for viewing policy match results. Option C (Identity Group properties) is incorrect because identity groups only define group membership and attributes, not policy evaluation results. Option E (RADIUS Secret settings) is incorrect because it only configures the shared secret used between the NAD and ISE, not policy match outcomes.

Answer

Device Administration console

Answer

Identity Group properties

Answer

RADIUS Secret settings

Question 8

You want to improve profiling accuracy for endpoints that do not send DHCP options. You decide to use SNMP Trap profiling. What is a critical prerequisite for this to function?

Accepted Answer

The network device must be configured to send SNMP traps to the ISE PSN IP address.. SNMP Trap profiling requires the network device (switch, WLC, router) to be configured to send SNMP traps to the ISE PSN's IP address, because ISE relies on receiving those traps to extract endpoint attributes like MAC addresses, link up/down events, and CDP/LLDP neighbor data. Without the device actively sending traps to ISE, the SNMP Trap probe receives no data and profiling cannot occur.

Answer

The endpoint must support SNMP agents.

Answer

The ISE node must have the SNMP Query probe enabled.

Answer

RADIUS Accounting must be disabled.

Question 9

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

Accepted Answer

The user must manually 'Install' the configuration profile. Option A is correct because Native Supplicant Provisioning (NSP) on iOS requires the user to manually tap 'Install' to accept and install the generated .mobileconfig profile — iOS does not allow silent installation of Wi-Fi/802.1X profiles pushed by ISE. Option C is correct because the iOS device must reach the ISE Guest/Sponsor/ BYOD portal over HTTPS (TCP 443) to authenticate, download the provisioning profile, and complete the onboarding flow. Option D is correct because the configuration profile delivered during NSP must be signed by a certificate that the iOS device trusts (e.g., a publicly trusted CA or an internal CA whose root is already installed), otherwise iOS rejects the profile as unsigned/untrusted. Option B is not required — NSP operates over the existing Wi-Fi/HTTPS path to the ISE portal, not a VPN tunnel. Option E is not required — NSP is a supported, Apple-sanctioned workflow on non-jailbroken iOS devices.

Answer

The device must be connected via VPN

Answer

The device must be jailbroken

Question 10

You are troubleshooting a Guest flow where the client hits the portal but cannot authenticate. You notice the MAC address is not being cached properly. Which setting in the Guest Portal configuration is responsible for enabling MAC caching?

Accepted Answer

Enable MAC Caching. MAC caching in the ISE Guest Portal configuration allows the client's MAC address to be remembered after successful authentication, so subsequent connections bypass the portal and are authenticated automatically. If MAC caching is not enabled, the MAC address is not cached, and the client is forced to re-authenticate through the portal each time, which matches the reported symptom. Enabling MAC Caching in the Guest Portal settings resolves this.

Answer

Enable Auto-Login

Answer

Enable Guest Flow Bypass

Answer

Enable Device Registration