SISE BYOD — 10 Questions

Question 1

Which state does an endpoint enter after a successful BYOD registration in ISE?

Accepted Answer

Registered. Endpoints that complete BYOD registration are moved from a 'Registered' state to a 'Compliant' or 'Authorized' status depending on the policy.

Answer

Pending

Answer

Blacklisted

Answer

Quarantined

Question 2

In a multi-node ISE deployment, which node should handle the 'Certificate Authority' role for BYOD provisioning?

Accepted Answer

The Primary Policy Administration Node (PAN). The node designated as the Policy Administration Node (PAN) or a dedicated subordinate CA node is typically used to manage certificate requests.

Answer

The Monitoring Node (MnT)

Answer

Any Policy Service Node (PSN)

Answer

The secondary monitoring node

Question 3

Which THREE of the following are valid sources for the 'Device Compliance' status in Cisco ISE?

Accepted Answer

Mobile Device Management (MDM) server. ISE can receive compliance status via direct MDM integration, using the 'Cisco Context Directory Agent' (CDA), or via pxGrid.

Answer

RADIUS server

Answer

DNS server

Question 4

Which component in the ISE BYOD architecture is responsible for generating the temporary network access credentials during the onboarding flow?

Accepted Answer

The BYOD Portal configuration. The Onboarding flow uses the 'BYOD Portal' to authenticate the user and trigger the creation of a unique credential for the client.

Answer

The ISE Internal CA

Answer

The WLC WebAuth service

Answer

The RADIUS Server service

Question 5

Which TWO factors must be considered when designing certificate provisioning for BYOD?

Accepted Answer

The ISE Root CA must be installed on all BYOD devices prior to onboarding. The certificate chain must be trusted by the client, and the certificate template must allow for the necessary Subject Alternative Names (SAN) for authentication.

Answer

The SCEP proxy must be configured on the internal firewall

Answer

ISE must use self-signed certificates for all client nodes

Answer

The WLC must support local certificate signing

Question 6

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

Accepted Answer

Operations > Reports > Endpoints and Users > Certificate Provisioning. The 'Certificate Provisioning' logs are located under Operations > Reports > Endpoints and Users > Certificate Provisioning.

Answer

Policy > Policy Elements > Results > Certificate Templates

Answer

Operations > RADIUS Livelog

Answer

Administration > System > Certificates > Certificate Signing Requests

Question 7

A user reports that their BYOD device is not being recognized as 'Compliant' even though the MDM shows it is compliant. Which ISE component is responsible for retrieving this status?

Accepted Answer

The ISE MDM Server connector. The ISE MDM Server connector periodically polls or receives webhooks from the MDM to update the endpoint status in the ISE database.

Answer

The ISE Policy Information Point (PIP)

Answer

The ISE Monitoring node

Answer

The ISE RADIUS service

Question 8

When configuring an Authorization Policy for BYOD, which condition should be used to ensure the device has successfully performed BYOD registration?

Accepted Answer

Session:BYODRegistrationStatus EQUALS Registered. The 'BYOD Registered' attribute in the Session object (or Device Registration Status) is the standard way to verify if a device has completed the BYOD flow.

Answer

Endpoint:Profile EQUALS RegisteredDevice

Answer

Session:RegistrationMode EQUALS Auto

Answer

Device:AccessType EQUALS BYOD

Question 9

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

Accepted Answer

To configure the native supplicant settings for secure network access. The NSA is a small utility downloaded by the endpoint to configure the supplicant for secure wireless network access.

Answer

To provide a VPN tunnel to the internal network

Answer

To manage the user's Active Directory account

Answer

To scan the device for malware before allowing network access

Question 10

During BYOD onboarding, the client is unable to download the Network Setup Assistant (NSA). You verify the portal settings and observe that the 'Client Provisioning' resource is correctly assigned to the policy. What is the most likely cause if the device fails to reach the download page?

Accepted Answer

The redirect ACL is blocking traffic to the ISE IP address on TCP port 8443. The redirect ACL must permit traffic to the Cisco ISE server on ports 8443 or 8905 to ensure the client can reach the provisioning services.

Answer

The user is not part of the Active Directory group assigned to the policy

Answer

The client does not have the native supplicant installed

Answer

The certificate on the ISE portal is expired