SISE Architecture And Deployment — Timed 10 Questions

Question 1

In a high-availability deployment, you have a Primary PAN/MnT and a Secondary PAN/MnT. If the Primary PAN fails, what is the impact on the Monitoring (MnT) services?

Accepted Answer

Monitoring data remains logged to the Secondary MnT node. In a Cisco ISE high-availability deployment, the Secondary PAN/MnT node continuously replicates monitoring data from the Primary. If the Primary PAN fails, the Secondary MnT continues to log monitoring data, ensuring no loss of visibility. The Secondary PAN can be promoted to Primary, but MnT logging persists on the Secondary throughout.

Answer

The Secondary PAN must be manually promoted to Primary to restore MnT functionality

Answer

ISE enters a read-only state for all PSNs

Answer

MnT services immediately stop on all nodes

Question 2

If you need to perform maintenance on a PSN, how do you prevent the node from processing new authentication requests while ensuring current sessions remain active?

Accepted Answer

Disable the node in the Deployment menu. You can disable the 'Policy Service' role or set the node to 'Disabled' state under Deployment, which allows current sessions to finish while preventing new ones.

Answer

Shut down the PSN server

Answer

Remove the PSN from the load balancer

Answer

Change the node to an MnT-only role

Question 3

Which protocol must be enabled on the network switches to support ISE posture assessment?

Accepted Answer

SNMP. ISE posture assessment often relies on SNMP or RADIUS attributes, but specifically, the network switches must allow the communication path and correctly handle the CoA required for posture changes.

Answer

TACACS+

Answer

FTP

Answer

DHCP

Question 4

You are upgrading an ISE deployment. Which order of operations is required to maintain the stability of the cluster?

Accepted Answer

Upgrade Primary PAN, then Secondary nodes. The standard upgrade path is to upgrade the Primary PAN first, followed by the Secondary PAN/MnT, and finally the PSNs.

Answer

Upgrade PSNs, then PAN

Answer

Upgrade all nodes simultaneously

Answer

Upgrade Secondary nodes, then Primary PAN

Question 5

What is the maximum number of nodes supported in a single ISE deployment cluster?

Accepted Answer

20 nodes. Cisco ISE supports up to 20 nodes in a single deployment (1 PAN, 1 MnT, 18 PSNs).

Answer

Unlimited

Answer

50 nodes

Answer

10 nodes

Question 6

When utilizing pxGrid in a distributed deployment, which node should be configured as the pxGrid controller?

Accepted Answer

Any PSN with the service enabled. In a distributed Cisco ISE deployment, pxGrid is a service that can be enabled on any Policy Service Node (PSN). The pxGrid controller is the node that manages the pxGrid fabric and is automatically elected from among the PSNs that have the pxGrid service enabled. It is not restricted to a dedicated node, the Monitoring node, or the Primary PAN. Therefore, any PSN with the pxGrid service enabled can serve as the pxGrid controller.

Answer

Dedicated pxGrid node only

Answer

Monitoring node only

Answer

Primary PAN only

Question 7

Which TWO of the following are valid ISE deployment personas?

Accepted Answer

Policy Administration Node. In Cisco ISE, the two valid deployment personas among the listed options are the Policy Administration Node (C) and the Policy Service Node (D). The Policy Administration Node is the persona that provides the GUI, CLI, and API for configuration and policy management, and it also performs monitoring and troubleshooting functions for the deployment. The Policy Service Node is the persona that provides network access, guest access, client provisioning, posture, and profiling services to the network. The other options are not ISE personas: Authentication Proxy Node (A) is not a defined ISE persona, Database Node (B) is not a persona (ISE uses an internal database rather than a separate database persona), and Reporting Node (E) is not a persona (reporting is a function of the Administration or Monitoring persona, not a standalone deployment persona).

Answer

Authentication Proxy Node

Answer

Database Node

Answer

Reporting Node

Question 8

Which THREE components are involved in the high-availability failover of a PAN?

Accepted Answer

Update of Messaging Service cluster. The failover process involves the manual promotion of the Secondary PAN, which triggers a database synchronization and the update of the messaging service cluster configuration.

Answer

Automatic heartbeat detection

Answer

External load balancer re-routing

Question 9

Which TWO of the following are necessary prerequisites before adding a secondary node to a deployment?

Accepted Answer

Network connectivity on TCP/UDP ports used by ISE. The nodes must be able to communicate on required management ports, and they must share the same base license or be in a compatible licensing state.

Answer

The secondary node must be pre-configured as a PAN

Answer

Both nodes must have different hostnames

Answer

The secondary node must have a different IP subnet

Question 10

Which TWO items are required to register a secondary node to the Primary PAN?

Accepted Answer

Administrative credentials for the secondary node. To register a secondary node to the Primary PAN, the Primary PAN must be able to reach and authenticate to the secondary node, so option C (Administrative credentials for the secondary node) is required — the Primary PAN uses these admin credentials to log into the secondary and push the registration/bootstrap configuration. Option E (Secondary node hostname or IP) is also required because the Primary PAN needs the address to establish that connection and identify the node being added to the cluster. Option A is not needed at registration time, since the Primary PAN already knows the cluster topology and distributes the node list itself. Option B is unrelated — a RADIUS shared secret is for AAA communication, not node registration. Option D is incorrect because licensing is applied/managed through the Primary PAN and a separate license file is not a prerequisite for registering the secondary node.

Answer

A list of all other nodes in the cluster

Answer

A shared secret for RADIUS

Answer

A valid license file for the secondary node