SISE Architecture And Deployment Practice Test 3 — 15 Questions

Question 1

What is the function of the 'PassiveID' feature in a distributed ISE deployment?

Accepted Answer

It provides user identity mapping without active probing. PassiveID in Cisco ISE is a service that listens to and analyzes existing network traffic (such as RADIUS accounting, DHCP, and SNMP) to build a user identity mapping without actively probing endpoints. It passively collects user and device information from sources like Active Directory logs, syslog, and NetFlow, associating IP addresses with usernames. This is especially useful for devices that cannot run an active supplicant or for guest/BYOD scenarios where active probing is not feasible. Thus, it provides identity mapping without generating additional network traffic or requiring active probes.

Answer

It enables redundant authentication

Answer

It replaces the need for PSNs

Answer

It caches RADIUS requests

Question 2

If a PSN loses connectivity to the PAN, what happens to existing user sessions?

Accepted Answer

Sessions remain active and the PSN continues to authenticate. When a PSN loses connectivity to the PAN, existing user sessions remain active and the PSN continues to authenticate new sessions using its last known policy configuration. This is by design to maintain network access during PAN outages.

Answer

All sessions are terminated

Answer

The PSN enters emergency mode

Answer

The PSN reboots

Question 3

Which service is required to be enabled on a PSN to allow it to receive RADIUS requests from network access devices?

Accepted Answer

Policy Service. The Policy Service is the Cisco ISE service that must be enabled on a Policy Services Node (PSN) to allow it to receive RADIUS requests from network access devices (NADs). The Policy Service handles authentication, authorization, and accounting (AAA) decisions for RADIUS traffic. Without it, the PSN cannot process RADIUS requests.

Answer

Registration Service

Answer

Administration Service

Answer

Monitoring Service

Question 4

When configuring a secondary MnT node, what is the 'Primary' versus 'Secondary' relationship regarding log collection?

Accepted Answer

The Primary collects, Secondary is standby. In a two-node MnT deployment, the Primary MnT actively collects, stores, and processes logs from all PSNs and other nodes, while the Secondary MnT operates in standby mode and only takes over log collection if the Primary fails. This is an active/standby relationship, not active/active or load-balanced.

Answer

The Secondary collects from specific PSNs only

Answer

Both nodes log simultaneously

Answer

Nodes load balance the logs

Question 5

You are troubleshooting a PSN that is not receiving configuration updates. Which log file on the PSN would provide the most insight into the configuration sync process?

Accepted Answer

config-dist.log. The config-dist.log file on a PSN records the configuration distribution process, including synchronization attempts, successes, and failures with the Primary PAN. When a PSN is not receiving configuration updates, this log provides the most direct insight into why the sync is failing (e.g., connectivity, certificate, or replication issues). It is the go-to log for troubleshooting configuration replication.

Answer

catalina.out

Answer

radius.log

Answer

prrt-server.log

Question 6

What is the purpose of the 'PAN' role in a deployment?

Accepted Answer

Centralized policy management. The Policy Administration Node (PAN) in Cisco ISE is the central controller that hosts the policy repository, manages all configuration, and distributes policies to Policy Service Nodes (PSNs). It provides centralized policy management for the entire distributed deployment.

Answer

Log aggregation and reports

Answer

Authentication of endpoints

Answer

Database backups

Question 7

How do you verify the current licensing status and consumption on your ISE deployment?

Accepted Answer

Administration > System > Licensing. In Cisco ISE, licensing status and consumption are viewed under Administration > System > Licensing. This page shows the license type (Base, Plus, Apex), the number of concurrent sessions consumed, and the evaluation period remaining. It is the authoritative location for verifying license compliance and usage.

Answer

Dashboard > Licensing

Answer

Policy > Licensing

Answer

Operations > Licensing

Question 8

Which of the following describes the 'Standalone' deployment model?

Accepted Answer

All personas on a single node. The 'Standalone' deployment model in Cisco ISE refers to a configuration where all personas (Policy Administration Node, Policy Service Node, Monitoring and Troubleshooting Node) are installed on a single node. This is typical for small deployments or lab environments where high availability and scalability are not required. It simplifies management but lacks redundancy.

Answer

PAN and PSN on separate nodes

Answer

Only PSN role is active

Answer

Multiple nodes in a cluster

Question 9

When decommissioning an ISE node, what is the correct order of steps?

Accepted Answer

Remove from deployment, then shut down. The correct decommissioning sequence is to first remove the node from the ISE deployment via the PAN (Deregister), then shut it down. Removing the node from the deployment first ensures the PAN stops replicating configuration to it and other nodes stop forwarding logs or authentication requests to it, preventing orphaned references and replication errors.

Answer

Change node to standalone, then remove

Answer

Shut down the node, then remove from deployment

Answer

Re-image the node, then remove from deployment

Question 10

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

Accepted Answer

Reporting and analytics. The Monitoring and Troubleshooting (MnT) persona in Cisco ISE is responsible for collecting and storing operational data, so option B (Reporting and analytics) is correct because MnT nodes host the reporting and analytics services that let administrators run operational reports, live logs, and dashboards on authentication, authorization, and accounting events. Option D (Log aggregation from all nodes) is also correct because all Policy Services Nodes (PSNs) and other ISE nodes forward their syslog and session data to the MnT node, which aggregates and stores it in the MnT database for troubleshooting and audit purposes. Option A (Policy distribution) is not an MnT function; policy configuration and distribution are handled by the Policy Administration Node (PAN), which pushes policies to PSNs. Option C (RADIUS authentication) is performed by Policy Services Nodes, which handle RADIUS and TACACS+ authentication, authorization, and accounting, not the MnT persona. Option E (Endpoint profiling probe) is a function of the PSN, where profiling probes (e.g., RADIUS, SNMP, DHCP, NetFlow) collect endpoint attributes, not the MnT node.

Answer

Policy distribution

Answer

RADIUS authentication

Answer

Endpoint profiling probe

Question 11

Which THREE factors influence the decision to use multiple PSNs in a deployment?

Accepted Answer

Geographical distribution. Option C (Geographical distribution) is correct because deploying multiple Policy Service Nodes (PSNs) across different sites lets each location authenticate its own users locally, avoiding WAN latency and link dependency for RADIUS traffic. Option D (Load balancing of RADIUS requests) is correct because multiple PSNs distribute the authentication, authorization, and accounting load, preventing any single PSN from becoming a bottleneck as endpoint counts grow. Option E (Redundancy for node failure) is correct because if one PSN becomes unavailable, NADs can fail over to another PSN, preserving network access during outages. Options A (Increased log storage capacity) and B (Centralized database backup) are not valid factors: logging and backup are handled by the Monitoring and Policy nodes (MnT/PAN), not by adding PSNs, so they do not drive the decision to deploy multiple PSNs.

Answer

Increased log storage capacity

Answer

Centralized database backup

Question 12

Which THREE features are configured at the node level in the ISE Administration console?

Accepted Answer

Logging categories. In the Cisco ISE Administration console, node-level configuration is scoped to a specific ISE node rather than the whole deployment. Logging categories (B) are configured per node under Administration > System > Logging > Logging Categories, allowing each node's logging levels and targets to be tuned independently. Profiling probes (D) are enabled and configured per node under Administration > System > Profiling Configuration, since probes such as SNMP, RADIUS, DHCP, and NetFlow run on individual PSNs. Network interface settings (E) are also node-specific, configured under Administration > System > Settings > Network Interfaces, because each node has its own NIC, IP address, and VLAN configuration. Global policy rules (A) and external ID store configuration (C) are deployment-wide settings managed at the system level, not per node, so they are not correct answers.

Answer

Global policy rules

Answer

External ID store configuration

Question 13

Which THREE resources are monitored via the ISE dashboard to ensure deployment health?

Accepted Answer

CPU utilization. The Cisco ISE dashboard's System Health/Deployment Health monitoring reports the appliance's core system resources, and CPU utilization (A) is one of them because sustained high CPU on a PSN or PAN degrades authentication and policy-processing throughput. Memory usage (B) is also monitored, since ISE services such as the profiler, session directory, and M&T database can exhaust RAM and cause service failures if not tracked. Disk space usage (E) is the third monitored resource, as ISE depends on local disk for logging, the M&T data store, and backups, and low disk space triggers alarms and can halt logging or database operations. Bandwidth per user (C) is not a node-level health resource tracked by the ISE dashboard; it is a network-traffic metric, not an ISE appliance resource. Temperature of the appliance (D) is not reported by the ISE dashboard either; hardware thermal status is handled by the underlying platform/CIMC or hypervisor, not by ISE's deployment-health monitoring.

Answer

Bandwidth per user

Answer

Temperature of the appliance

Question 14

A security architect is designing a Cisco ISE deployment for a large enterprise with 20,000 endpoints. The design must ensure that RADIUS authentication and authorization continue even if the Primary PAN and Secondary PAN both become unreachable. The architect is evaluating the roles and services that must be enabled on the PSNs to support this requirement. Which two statements correctly describe the behavior or configuration needed to meet this goal? (Choose two.)

Accepted Answer

PSNs cache the last known policy configuration and can continue to process RADIUS authentications and authorizations for a limited time when PAN connectivity is lost.. To maintain RADIUS authentication and authorization during a PAN outage, PSNs must have the Policy Service enabled and must be able to rely on their cached policy configuration. The Policy Service is the persona that processes RADIUS requests, and the cache allows continued operation when the PAN is unreachable. Together, these two statements correctly describe the required configuration and behavior for high availability of AAA services.

Answer

The PassiveID service must be enabled on each PSN to ensure RADIUS requests are processed during a PAN outage.

Answer

The Administration service must be enabled on at least one PSN to allow it to process RADIUS requests when the PANs are unavailable.

Answer

PSNs must be manually reconfigured to point to a temporary PAN before they can resume RADIUS processing after a PAN outage.

Question 15

A network administrator is preparing to add a new Cisco ISE node to an existing distributed deployment. The new node will serve as a PSN in a remote branch office. Before registering the node, the administrator must ensure that the node meets the prerequisites for joining the deployment. Which prerequisite is required for the new node to successfully register with the Primary PAN?

Accepted Answer

The new node must have the same ISE software version as the Primary PAN.. For a new node to join a Cisco ISE deployment, it must run the same software version as the Primary PAN. This ensures that the configuration database, policy model, and replication mechanisms are compatible. While unique hostname and IP address are also required, matching the software version is a critical prerequisite that is often overlooked. Without version parity, registration will fail or produce an unsupported deployment.

Answer

The new node must have a different hostname and IP address from all other nodes, but no other prerequisites apply.

Answer

The new node must be manually added to the PAN's database using the ise/admin CLI before it can register.

Answer

The new node must be configured with the Administration persona before it can join the deployment.