SISE Architecture And Deployment — 25 Questions

Question 1

If you need to perform maintenance on a PSN, how do you prevent the node from processing new authentication requests while ensuring current sessions remain active?

Accepted Answer

Disable the node in the Deployment menu. You can disable the 'Policy Service' role or set the node to 'Disabled' state under Deployment, which allows current sessions to finish while preventing new ones.

Answer

Shut down the PSN server

Answer

Remove the PSN from the load balancer

Answer

Change the node to an MnT-only role

Question 2

Which protocol must be enabled on the network switches to support ISE posture assessment?

Accepted Answer

SNMP. ISE posture assessment often relies on SNMP or RADIUS attributes, but specifically, the network switches must allow the communication path and correctly handle the CoA required for posture changes.

Answer

TACACS+

Answer

FTP

Answer

DHCP

Question 3

You are upgrading an ISE deployment. Which order of operations is required to maintain the stability of the cluster?

Accepted Answer

Upgrade Primary PAN, then Secondary nodes. The standard upgrade path is to upgrade the Primary PAN first, followed by the Secondary PAN/MnT, and finally the PSNs.

Answer

Upgrade PSNs, then PAN

Answer

Upgrade all nodes simultaneously

Answer

Upgrade Secondary nodes, then Primary PAN

Question 4

What is the maximum number of nodes supported in a single ISE deployment cluster?

Accepted Answer

20 nodes. Cisco ISE supports up to 20 nodes in a single deployment (1 PAN, 1 MnT, 18 PSNs).

Answer

Unlimited

Answer

50 nodes

Answer

10 nodes

Question 5

Which THREE components are involved in the high-availability failover of a PAN?

Accepted Answer

Update of Messaging Service cluster. The failover process involves the manual promotion of the Secondary PAN, which triggers a database synchronization and the update of the messaging service cluster configuration.

Answer

Automatic heartbeat detection

Answer

External load balancer re-routing

Question 6

Which TWO of the following are necessary prerequisites before adding a secondary node to a deployment?

Accepted Answer

Network connectivity on TCP/UDP ports used by ISE. The nodes must be able to communicate on required management ports, and they must share the same base license or be in a compatible licensing state.

Answer

The secondary node must be pre-configured as a PAN

Answer

Both nodes must have different hostnames

Answer

The secondary node must have a different IP subnet

Question 7

Which THREE services can be explicitly enabled or disabled on a PSN node?

Accepted Answer

Monitoring Service. The PSN node allows granular control over which services run, including Policy Service (RADIUS/TACACS), Monitoring (locally), and pxGrid.

Answer

Database Migration Service

Answer

Administrator Service

Question 8

A customer is planning a large campus deployment with 50,000 concurrent endpoints. Which persona should be dedicated to handle the authentication load to ensure high performance?

Accepted Answer

Policy Service Node (PSN). Policy Service Nodes (PSNs) are the dedicated persona for handling RADIUS and TACACS+ authentication/authorization requests.

Answer

Policy Administration Node (PAN)

Answer

Standalone Node

Answer

Monitoring and Troubleshooting Node (MnT)

Question 9

When configuring a load balancer for a group of PSNs, what is the best practice for handling RADIUS traffic?

Accepted Answer

Source-IP affinity (persistence). For RADIUS, the load balancer should use source-IP persistence (sticky sessions) to ensure that the Access-Request and subsequent Access-Challenge/Response messages hit the same PSN.

Answer

SSL-offloading

Answer

Active-passive failover only

Answer

Round-robin without persistence

Question 10

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

Accepted Answer

Initiate registration from the Primary PAN under Administration > System > Deployment. You must register the secondary node from the Primary PAN GUI, providing the secondary node's credentials and IP.

Answer

Configure the Secondary node as an standalone node and merge databases

Answer

Run the join command from the secondary node's CLI

Answer

Create a cluster via the ISE CLI setup wizard

Question 11

In a high-availability deployment, you have a Primary PAN/MnT and a Secondary PAN/MnT. If the Primary PAN fails, what is the impact on the Monitoring (MnT) services?

Accepted Answer

Monitoring data remains logged to the Secondary MnT node. MnT services are independent of the PAN role; if the Primary MnT fails, the Secondary MnT assumes the role, but PAN failure does not automatically crash MnT unless they share the same physical node.

Answer

The Secondary PAN must be manually promoted to Primary to restore MnT functionality

Answer

ISE enters a read-only state for all PSNs

Answer

MnT services immediately stop on all nodes

Question 12

Which license type is required to enable advanced profiling and posture services on Cisco ISE?

Accepted Answer

ISE Advantage. ISE licenses are tiered, and 'ISE Advantage' is typically required for advanced context-aware features like profiling and posture.

Answer

ISE Premier

Answer

Device Admin License

Answer

ISE Essentials

Question 13

When designing an ISE deployment across WAN links, what is the primary recommendation regarding MnT nodes?

Accepted Answer

Keep the MnT node in the same high-speed network as the PAN. MnT nodes are bandwidth-heavy due to log aggregation; placing them across high-latency, low-bandwidth WAN links can cause replication delays and data loss.

Answer

Distributed MnTs across all WAN sites

Answer

Always place MnT in the cloud

Answer

Disable logging for remote sites

Question 14

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

Accepted Answer

Distributed Configuration Synchronization via HTTPS. The PAN uses a distributed configuration synchronization process via HTTPS/REST APIs to push configuration changes to all other nodes in the deployment.

Answer

Rsync over SSH

Answer

RADIUS Change of Authorization (CoA)

Answer

SNMPv3 Trap propagation

Question 15

Which menu path is used to view the status of all nodes in an ISE deployment?

Accepted Answer

Administration > System > Deployment. Administration > System > Deployment provides the status dashboard for all nodes in the cluster.

Answer

Operations > Reports

Answer

Administration > Maintenance

Answer

Policy > Policy Elements

Question 16

In a distributed environment, if the Primary PAN goes offline, what happens to the Secondary PAN?

Accepted Answer

It remains in Secondary mode until manually promoted. The Secondary PAN does not automatically promote itself to Primary. An administrator must manually promote it.

Answer

It disconnects from the PSNs

Answer

It stops accepting configuration changes

Answer

It automatically assumes the Primary role

Question 17

Which specific ISE process is responsible for managing the communication between the PAN and PSNs?

Accepted Answer

ISE Messaging Service. The 'ISE Messaging Service' (based on RabbitMQ) is the backbone for communication and state synchronization between nodes.

Answer

Application Server

Answer

Radius Core

Answer

Monitoring Service

Question 18

When adding a secondary PAN, what is the consequence if the time synchronization (NTP) differs significantly between nodes?

Accepted Answer

The registration process will fail. ISE requires tight time synchronization between all nodes in the deployment for certificate validation and log timestamps; large drifts cause replication failure.

Answer

The node will operate in read-only mode

Answer

The node will join but logs will be out of order

Answer

Only TACACS+ services will be impacted

Question 19

What is the default persona of a newly installed Cisco ISE appliance before any configuration changes?

Accepted Answer

Standalone. A fresh ISE installation defaults to a standalone node, which includes all personas enabled.

Answer

PSN

Answer

Monitoring node

Answer

Primary PAN

Question 20

What is the function of the 'PassiveID' feature in a distributed ISE deployment?

Accepted Answer

It provides user identity mapping without active probing. PassiveID allows ISE to collect user-to-IP mapping information from external sources without active polling, which is critical for identity-based access control.

Answer

It enables redundant authentication

Answer

It replaces the need for PSNs

Answer

It caches RADIUS requests