SISE Architecture And Deployment — Timed 15 Questions

Question 1

In a high-availability deployment, you have a Primary PAN/MnT and a Secondary PAN/MnT. If the Primary PAN fails, what is the impact on the Monitoring (MnT) services?

Accepted Answer

Monitoring data remains logged to the Secondary MnT node. In a Cisco ISE high-availability deployment, the Secondary PAN/MnT node continuously replicates monitoring data from the Primary. If the Primary PAN fails, the Secondary MnT continues to log monitoring data, ensuring no loss of visibility. The Secondary PAN can be promoted to Primary, but MnT logging persists on the Secondary throughout.

Answer

The Secondary PAN must be manually promoted to Primary to restore MnT functionality

Answer

ISE enters a read-only state for all PSNs

Answer

MnT services immediately stop on all nodes

Question 2

If you need to perform maintenance on a PSN, how do you prevent the node from processing new authentication requests while ensuring current sessions remain active?

Accepted Answer

Disable the node in the Deployment menu. You can disable the 'Policy Service' role or set the node to 'Disabled' state under Deployment, which allows current sessions to finish while preventing new ones.

Answer

Shut down the PSN server

Answer

Remove the PSN from the load balancer

Answer

Change the node to an MnT-only role

Question 3

Which protocol must be enabled on the network switches to support ISE posture assessment?

Accepted Answer

SNMP. ISE posture assessment often relies on SNMP or RADIUS attributes, but specifically, the network switches must allow the communication path and correctly handle the CoA required for posture changes.

Answer

TACACS+

Answer

FTP

Answer

DHCP

Question 4

You are upgrading an ISE deployment. Which order of operations is required to maintain the stability of the cluster?

Accepted Answer

Upgrade Primary PAN, then Secondary nodes. The standard upgrade path is to upgrade the Primary PAN first, followed by the Secondary PAN/MnT, and finally the PSNs.

Answer

Upgrade PSNs, then PAN

Answer

Upgrade all nodes simultaneously

Answer

Upgrade Secondary nodes, then Primary PAN

Question 5

What is the maximum number of nodes supported in a single ISE deployment cluster?

Accepted Answer

20 nodes. Cisco ISE supports up to 20 nodes in a single deployment (1 PAN, 1 MnT, 18 PSNs).

Answer

Unlimited

Answer

50 nodes

Answer

10 nodes

Question 6

When utilizing pxGrid in a distributed deployment, which node should be configured as the pxGrid controller?

Accepted Answer

Any PSN with the service enabled. In a distributed Cisco ISE deployment, pxGrid is a service that can be enabled on any Policy Service Node (PSN). The pxGrid controller is the node that manages the pxGrid fabric and is automatically elected from among the PSNs that have the pxGrid service enabled. It is not restricted to a dedicated node, the Monitoring node, or the Primary PAN. Therefore, any PSN with the pxGrid service enabled can serve as the pxGrid controller.

Answer

Dedicated pxGrid node only

Answer

Monitoring node only

Answer

Primary PAN only

Question 7

Which TWO of the following are valid ISE deployment personas?

Accepted Answer

Policy Administration Node. In Cisco ISE, the two valid deployment personas among the listed options are the Policy Administration Node (C) and the Policy Service Node (D). The Policy Administration Node is the persona that provides the GUI, CLI, and API for configuration and policy management, and it also performs monitoring and troubleshooting functions for the deployment. The Policy Service Node is the persona that provides network access, guest access, client provisioning, posture, and profiling services to the network. The other options are not ISE personas: Authentication Proxy Node (A) is not a defined ISE persona, Database Node (B) is not a persona (ISE uses an internal database rather than a separate database persona), and Reporting Node (E) is not a persona (reporting is a function of the Administration or Monitoring persona, not a standalone deployment persona).

Answer

Authentication Proxy Node

Answer

Database Node

Answer

Reporting Node

Question 8

Which THREE components are involved in the high-availability failover of a PAN?

Accepted Answer

Update of Messaging Service cluster. The failover process involves the manual promotion of the Secondary PAN, which triggers a database synchronization and the update of the messaging service cluster configuration.

Answer

Automatic heartbeat detection

Answer

External load balancer re-routing

Question 9

Which TWO of the following are necessary prerequisites before adding a secondary node to a deployment?

Accepted Answer

Network connectivity on TCP/UDP ports used by ISE. The nodes must be able to communicate on required management ports, and they must share the same base license or be in a compatible licensing state.

Answer

The secondary node must be pre-configured as a PAN

Answer

Both nodes must have different hostnames

Answer

The secondary node must have a different IP subnet

Question 10

Which TWO items are required to register a secondary node to the Primary PAN?

Accepted Answer

Administrative credentials for the secondary node. To register a secondary node to the Primary PAN, the Primary PAN must be able to reach and authenticate to the secondary node, so option C (Administrative credentials for the secondary node) is required — the Primary PAN uses these admin credentials to log into the secondary and push the registration/bootstrap configuration. Option E (Secondary node hostname or IP) is also required because the Primary PAN needs the address to establish that connection and identify the node being added to the cluster. Option A is not needed at registration time, since the Primary PAN already knows the cluster topology and distributes the node list itself. Option B is unrelated — a RADIUS shared secret is for AAA communication, not node registration. Option D is incorrect because licensing is applied/managed through the Primary PAN and a separate license file is not a prerequisite for registering the secondary node.

Answer

A list of all other nodes in the cluster

Answer

A shared secret for RADIUS

Answer

A valid license file for the secondary node

Question 11

Which THREE conditions must be met for a successful ISE node upgrade?

Accepted Answer

All nodes in the deployment are in a 'Connected' state. Option B is correct because Cisco ISE requires every node in the deployment to show a 'Connected' state in the deployment status before an upgrade can proceed, ensuring all nodes can communicate and synchronize during the upgrade process. Option C is correct because a successful database consistency check must be completed to verify the ISE database is healthy and free of inconsistencies, which is a prerequisite for upgrade. Option E is correct because sufficient free disk space on all partitions is required to accommodate the new software image, logs, and temporary files created during the upgrade. Option A is incorrect because a factory reset is not required for an upgrade and would actually erase configuration; it is used for reimaging or recovery scenarios. Option D is incorrect because the node does not need to be in 'Standalone' mode; in fact, ISE nodes typically operate in a distributed deployment, and standalone mode is not a prerequisite for upgrade.

Answer

A factory reset is performed

Answer

The node is in 'Standalone' mode

Question 12

Which TWO are common causes for a node to fail to join a deployment?

Accepted Answer

Blocked network ports. Option B is correct because a node must be able to reach the deployment's manager/control plane over specific network ports (for example, TCP 2377 for cluster management, TCP/UDP 7946 for node-to-node gossip, and UDP 4789 for overlay VXLAN traffic in Docker Swarm); if any of these are blocked by a firewall or security group, the join handshake fails. Option D is correct because joining a cluster requires mutual TLS authentication, so if the joining node does not trust the cluster's CA certificate (or presents a certificate the cluster does not trust), the TLS handshake is rejected and the node cannot join. Option A is not a typical join failure cause because insufficient memory usually causes runtime instability or scheduling failures rather than preventing the join handshake itself. Option C is not correct because license mismatches are not a standard mechanism that blocks node joining in cluster deployments. Option E is not correct because the browser version is irrelevant to the node's ability to join a deployment, which is handled by the node agent and network/TLS configuration.

Answer

Insufficient memory on the node

Answer

License mismatch between nodes

Answer

Incorrect browser version

Question 13

Which THREE services can be explicitly enabled or disabled on a PSN node?

Accepted Answer

Monitoring Service. The PSN node allows granular control over which services run, including Policy Service (RADIUS/TACACS), Monitoring (locally), and pxGrid.

Answer

Database Migration Service

Answer

Administrator Service

Question 14

An engineer is deploying a Cisco ISE 3.1 distributed deployment with one Primary PAN, one Secondary PAN, and four PSNs across two data centers. The design requires that if the Primary PAN becomes unavailable, the Secondary PAN must take over administration automatically, but no manual promotion should ever be required. The engineer must also ensure that the Secondary PAN can perform policy configuration changes while the Primary is online for change-control testing. Which statement describes the correct behavior of the Cisco ISE PAN HA pair in this scenario?

Accepted Answer

The Secondary PAN operates in read-only mode and automatically becomes the Primary PAN when the Primary PAN fails, requiring no manual intervention.. The Secondary PAN in a Cisco ISE deployment serves as a standby administrative node that receives replicated configuration from the Primary PAN. It does not accept concurrent configuration changes while the Primary is active, and it automatically assumes the Primary role if the Primary fails. This design provides administrative high availability without manual promotion, which matches the stated requirement for automatic takeover and no manual intervention.

Answer

The Secondary PAN must be manually promoted using the ise/admin CLI before it can take over, and it cannot receive configuration updates until promotion occurs.

Answer

Both PANs operate in active/active mode, and configuration changes made on either PAN are immediately replicated to the other, providing simultaneous administrative access.

Answer

The Secondary PAN can accept configuration changes only after the Primary PAN is shut down, and it never receives automatic configuration updates from the Primary PAN.

Question 15

An engineer is designing a Cisco ISE deployment for a hospital network that must support guest access, BYOD onboarding, and 802.1X for wired and wireless. The hospital requires that certificate provisioning for BYOD devices be performed without requiring the endpoint to trust a publicly signed certificate. Which ISE node persona should be deployed to handle this requirement?

Accepted Answer

Policy Service Node (PSN) with the Certificate Provisioning Portal enabled. The Certificate Provisioning Portal is hosted on a Policy Service Node (PSN). It allows endpoints to enroll and receive certificates from the internal ISE Certificate Authority, which does not require the endpoint to trust a publicly signed certificate. The PAN, MnT, and pxGrid personas do not provide this service, so the PSN is the correct choice to meet the hospital's BYOD certificate provisioning requirement.

Answer

Monitoring and Troubleshooting Node (MnT)

Answer

pxGrid controller node

Answer

Policy Administration Node (PAN)