SISE Architecture And Deployment Practice Test 1 — 15 Questions

Question 1

If you need to perform maintenance on a PSN, how do you prevent the node from processing new authentication requests while ensuring current sessions remain active?

Accepted Answer

Disable the node in the Deployment menu. You can disable the 'Policy Service' role or set the node to 'Disabled' state under Deployment, which allows current sessions to finish while preventing new ones.

Answer

Shut down the PSN server

Answer

Remove the PSN from the load balancer

Answer

Change the node to an MnT-only role

Question 2

Which protocol must be enabled on the network switches to support ISE posture assessment?

Accepted Answer

SNMP. ISE posture assessment often relies on SNMP or RADIUS attributes, but specifically, the network switches must allow the communication path and correctly handle the CoA required for posture changes.

Answer

TACACS+

Answer

FTP

Answer

DHCP

Question 3

You are upgrading an ISE deployment. Which order of operations is required to maintain the stability of the cluster?

Accepted Answer

Upgrade Primary PAN, then Secondary nodes. The standard upgrade path is to upgrade the Primary PAN first, followed by the Secondary PAN/MnT, and finally the PSNs.

Answer

Upgrade PSNs, then PAN

Answer

Upgrade all nodes simultaneously

Answer

Upgrade Secondary nodes, then Primary PAN

Question 4

What is the maximum number of nodes supported in a single ISE deployment cluster?

Accepted Answer

20 nodes. Cisco ISE supports up to 20 nodes in a single deployment (1 PAN, 1 MnT, 18 PSNs).

Answer

Unlimited

Answer

50 nodes

Answer

10 nodes

Question 5

Which THREE components are involved in the high-availability failover of a PAN?

Accepted Answer

Update of Messaging Service cluster. The failover process involves the manual promotion of the Secondary PAN, which triggers a database synchronization and the update of the messaging service cluster configuration.

Answer

Automatic heartbeat detection

Answer

External load balancer re-routing

Question 6

Which TWO of the following are necessary prerequisites before adding a secondary node to a deployment?

Accepted Answer

Network connectivity on TCP/UDP ports used by ISE. The nodes must be able to communicate on required management ports, and they must share the same base license or be in a compatible licensing state.

Answer

The secondary node must be pre-configured as a PAN

Answer

Both nodes must have different hostnames

Answer

The secondary node must have a different IP subnet

Question 7

Which THREE services can be explicitly enabled or disabled on a PSN node?

Accepted Answer

Monitoring Service. The PSN node allows granular control over which services run, including Policy Service (RADIUS/TACACS), Monitoring (locally), and pxGrid.

Answer

Database Migration Service

Answer

Administrator Service

Question 8

A customer is planning a large campus deployment with 50,000 concurrent endpoints. Which persona should be dedicated to handle the authentication load to ensure high performance?

Accepted Answer

Policy Service Node (PSN). Policy Service Nodes (PSNs) are the dedicated persona for handling RADIUS and TACACS+ authentication/authorization requests.

Answer

Policy Administration Node (PAN)

Answer

Standalone Node

Answer

Monitoring and Troubleshooting Node (MnT)

Question 9

When configuring a load balancer for a group of PSNs, what is the best practice for handling RADIUS traffic?

Accepted Answer

Source-IP affinity (persistence). For RADIUS, the load balancer should use source-IP persistence (sticky sessions) to ensure that the Access-Request and subsequent Access-Challenge/Response messages hit the same PSN.

Answer

SSL-offloading

Answer

Active-passive failover only

Answer

Round-robin without persistence

Question 10

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

Accepted Answer

Initiate registration from the Primary PAN under Administration > System > Deployment. You must register the secondary node from the Primary PAN GUI, providing the secondary node's credentials and IP.

Answer

Configure the Secondary node as an standalone node and merge databases

Answer

Run the join command from the secondary node's CLI

Answer

Create a cluster via the ISE CLI setup wizard

Question 11

In a high-availability deployment, you have a Primary PAN/MnT and a Secondary PAN/MnT. If the Primary PAN fails, what is the impact on the Monitoring (MnT) services?

Accepted Answer

Monitoring data remains logged to the Secondary MnT node. MnT services are independent of the PAN role; if the Primary MnT fails, the Secondary MnT assumes the role, but PAN failure does not automatically crash MnT unless they share the same physical node.

Answer

The Secondary PAN must be manually promoted to Primary to restore MnT functionality

Answer

ISE enters a read-only state for all PSNs

Answer

MnT services immediately stop on all nodes

Question 12

Which license type is required to enable advanced profiling and posture services on Cisco ISE?

Accepted Answer

ISE Advantage. ISE licenses are tiered, and 'ISE Advantage' is typically required for advanced context-aware features like profiling and posture.

Answer

ISE Premier

Answer

Device Admin License

Answer

ISE Essentials

Question 13

When designing an ISE deployment across WAN links, what is the primary recommendation regarding MnT nodes?

Accepted Answer

Keep the MnT node in the same high-speed network as the PAN. MnT nodes are bandwidth-heavy due to log aggregation; placing them across high-latency, low-bandwidth WAN links can cause replication delays and data loss.

Answer

Distributed MnTs across all WAN sites

Answer

Always place MnT in the cloud

Answer

Disable logging for remote sites

Question 14

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

Accepted Answer

Distributed Configuration Synchronization via HTTPS. The PAN uses a distributed configuration synchronization process via HTTPS/REST APIs to push configuration changes to all other nodes in the deployment.

Answer

Rsync over SSH

Answer

RADIUS Change of Authorization (CoA)

Answer

SNMPv3 Trap propagation

Question 15

Which menu path is used to view the status of all nodes in an ISE deployment?

Accepted Answer

Administration > System > Deployment. Administration > System > Deployment provides the status dashboard for all nodes in the cluster.

Answer

Operations > Reports

Answer

Administration > Maintenance

Answer

Policy > Policy Elements