SISE Practice Test 9 — 10 Questions

Question 1

Which THREE of the following are potential reasons a device might be placed in a 'Quarantine' VLAN during the BYOD process?

Accepted Answer

Device failed MDM compliance check. A device might be quarantined if it fails compliance, is missing a required certificate, or has an outdated OS version detected by the MDM.

Answer

User forgot their Wi-Fi password

Answer

The device is too new

Question 2

Which THREE actions are required when configuring a BYOD flow that involves an external MDM integration?

Accepted Answer

Configure the MDM server details in Administration > Network Resources > MDM. Integrating MDM requires establishing the server connection, defining the authorization policy to check compliance, and ensuring the device is correctly registered in the ISE endpoint database.

Answer

Set the 'Native Supplicant' to disabled

Answer

Configure the WLC to act as an MDM proxy

Question 3

A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?

Accepted Answer

Authorization Profile. Authorization Profiles are used in ISE to return attributes like VLAN, dACLs, or SGTs to the network access device after successful authentication.

Answer

Authentication Policy

Answer

Policy Set

Answer

Authorization Policy

Question 4

A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?

Accepted Answer

Assign SGTs to the server subnet and the IT group, then apply an SGACL. Assigning an SGT to the server subnet and using an SGACL policy that allows only the IT SGT is the most scalable TrustSec approach.

Answer

Configure individual dACLs for every employee

Answer

Hardcode ACLs on every access switch

Answer

Use standard RADIUS VLAN steering

Question 5

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

Accepted Answer

The switch is missing the 'cts role-based enforcement' command. If the switch does not have 'cts role-based enforcement' enabled, it will not perform the actual filtering between SGTs.

Answer

The SGT is not in the ISE database

Answer

RADIUS shared secret is wrong

Answer

The user is in the wrong AD group

Question 6

You are implementing 'Device Administration' (TACACS+) and want to restrict an admin to 'show' commands only. How do you construct this policy?

Accepted Answer

Create a command set with 'show' and assign to an authorization policy rule. Create a Command Set containing 'show .*' (regex) and assign it to an Authorization Policy rule for that user.

Answer

Use the 'Admin' group in the authentication policy

Answer

Create a shell profile with privilege level 1

Answer

Configure a dACL on the device

Question 7

Which THREE of the following are valid components of a RADIUS-based Authorization Policy rule in Cisco ISE?

Accepted Answer

Rule Name. Authorization rules consist of a name, a set of conditions, and an assigned authorization profile result.

Answer

Identity Source Sequence

Answer

Command Set

Question 8

Which attribute is used by the MAC OUI probe to determine the device manufacturer?

Accepted Answer

MAC Address prefix (first 3 bytes). The MAC OUI probe parses the first 3 bytes of the MAC address to identify the vendor.

Answer

User-Agent string

Answer

IP Address

Answer

DHCP Client ID

Question 9

You are configuring a BYOD flow for iOS devices and notice that the native supplicant provisioning process is failing during the installation of the mobile configuration profile. Where should you check the logs in ISE to determine if the issue is related to the SCEP proxy communication?

Accepted Answer

Operations > Troubleshoot > Debug Wizard > scep. The SCEP proxy logs are specifically located under the 'SCEP' category within the Operations > Troubleshooting > Debug Wizard or by monitoring the 'scep.log' file.

Answer

Policy > Policy Elements > Results > Certificate Profiles

Answer

Administration > System > Licensing

Answer

Operations > RADIUS Livelog

Question 10

Which menu path allows you to view the posture compliance status of all endpoints?

Accepted Answer

Context Visibility > Endpoints. Operations > Reports > Endpoints and Users > Posture Assessment is the standard path to view posture-specific reports.

Answer

Administration > Identity Management

Answer

Policy > Posture > Reports