SISE Practice Test 8 — 10 Questions

Question 1

If a user's certificate expires, how can the user renew it using the ISE BYOD flow?

Accepted Answer

Reconnect to the SSID and follow the re-enrollment prompt in the portal. When a user's certificate expires in an ISE BYOD flow, the user can renew it by reconnecting to the SSID and following the re-enrollment prompt in the portal. This triggers the BYOD onboarding process again, allowing the user to obtain a new certificate. The certificate does not renew automatically, nor does it require manual administrator intervention or re-installing the Network Setup Assistant.

Answer

The certificate renews automatically in the background

Answer

Re-install the Network Setup Assistant manually

Answer

Contact the administrator to manually push a new certificate

Question 2

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

Accepted Answer

Device Profiling. Device Profiling is the ISE component that identifies the device type (e.g., iPhone vs. Windows) by collecting attributes via probes such as DHCP, RADIUS, SNMP, and NMAP, then matching them against profiling policies. This identification drives the appropriate BYOD configuration and authorization.

Answer

RADIUS Accounting

Answer

Active Directory Identity Store

Answer

Policy Sets

Question 3

When deploying the AnyConnect Posture agent, which specific file must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment?

Accepted Answer

AnyConnect Compliance Module. The AnyConnect Compliance Module is the specific file that must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment. It contains the posture policies and checks that the AnyConnect ISE Posture Agent uses to evaluate endpoint compliance. Without this module, the agent cannot perform posture checks, so it is essential for posture assessment.

Answer

AnyConnect Diagnostic and Reporting Tool

Answer

AnyConnect ISE Posture Agent profile

Answer

AnyConnect VPN package

Question 4

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

Accepted Answer

Verify SXP connection status and configuration on both peers. SXP (SGT Exchange Protocol) propagates SGTs between devices that cannot natively carry them (e.g., non-Cisco or older switches). If an SGT is not being embedded in SXP, the first thing to verify is the SXP connection status and configuration on both peers — the connection must be established and the correct SGTs permitted. This is the direct troubleshooting step for SXP propagation failures.

Answer

Verify the dACL configuration

Answer

Verify the RADIUS shared secret

Answer

Verify the EAP protocol version

Question 5

You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?

Accepted Answer

It sets the guest account status to 'Pending' until approved.. The 'Sponsor Approval' setting in a Guest Portal configuration sets the guest account status to 'Pending' until a sponsor approves the request. This means the guest cannot access the network until the sponsor explicitly grants approval, typically via the Sponsor Portal. The setting enforces a workflow where guest access is gated by sponsor action.

Answer

It automatically emails the sponsor.

Answer

It sends a RADIUS request to the sponsor's device.

Answer

It allows the guest to bypass the login screen.

Question 6

In an ISE Authorization Policy, what happens if no rules match a request?

Accepted Answer

The request hits the Default rule in the Policy Set. If no rules match a request in an ISE Authorization Policy, the request hits the Default rule in the Policy Set. The Default rule is a catch-all that typically has a result of 'DenyAccess' unless explicitly configured otherwise. This ensures that unmatched requests are handled consistently, often denying access by default.

Answer

The request is sent to the primary PAN

Answer

The request is automatically permitted

Answer

The NAD closes the port

Question 7

Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?

Accepted Answer

Common Tasks -> Web Redirection. The Web Redirection option is located under Common Tasks in an Authorization Profile, where you select the redirect type (Centralized Web Auth, Hotspot, Client Provisioning, MDM, etc.) and specify the ACL and redirect URL. This is the standard mechanism for sending endpoints to a WebAuth portal for guest or BYOD flows.

Answer

RADIUS Attributes -> Tunnel-Private-Group-ID

Answer

Advanced Attributes -> ACL

Answer

VLAN/dACL Filters

Question 8

You are implementing TACACS+ device administration for a group of routers. You need to assign specific privilege levels to different users. Where in the ISE policy set is this privilege assignment configured?

Accepted Answer

In the Shell Profile assigned to the Authorization Policy.. Privilege level assignment in ISE TACACS+ is configured in the Shell Profile, which is then referenced by the Authorization Policy. The shell profile contains the Privilege Level field (and other AV pairs) that ISE returns to the network device to set the user's EXEC privilege after authentication.

Answer

In the Network Device Group settings.

Answer

In the Command Set configuration.

Answer

In the Network Device definition.

Question 9

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

Accepted Answer

The NAD is missing the 'aaa server radius dynamic-author' configuration.. In a CWA (Central Web Authentication) flow, after the user authenticates on the portal, ISE must send a Change of Authorization (CoA) to the NAD to move the session from redirected to authenticated. This requires the NAD to be configured with the 'aaa server radius dynamic-author' command so it can accept CoA requests from ISE. Without it, the NAD ignores the CoA and the session remains in the redirected state.

Answer

The Guest user group is missing from the Policy Set.

Answer

The Redirect ACL is applied to the wrong interface.

Answer

The portal URL is incorrect.

Question 10

You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?

Accepted Answer

Set the Access Type to Permit Access and enable URL Redirect with the portal ID.. Central Web Authentication requires the authorization profile to permit access and simultaneously return a URL redirect AV pair pointing to the ISE guest/central portal. In ISE, the authorization profile's 'Access Type = ACCESS_ACCEPT' plus the 'Web Redirection (CWA)' setting with the correct portal ID is what tells the WLC/switch to redirect the client's HTTP traffic to the ISE portal. Without the URL redirect attribute, the client is simply permitted and never sees the portal.

Answer

Enable 'Authentication Bypass' in the authorization profile to allow the traffic to hit the redirect rule.

Answer

Configure the profile as a standard permit access profile with a dynamic VLAN assignment.

Answer

Set the Access Type to Web Auth and manually input the redirect IP address in the Custom Attributes field.