SISE BYOD — 10 Questions

Question 1

When configuring an Authorization Policy for BYOD, which condition should be used to ensure the device has successfully performed BYOD registration?

Accepted Answer

Session:BYODRegistrationStatus EQUALS Registered. In Cisco ISE, the BYOD registration state is exposed to authorization policy as the Session:BYODRegistrationStatus attribute, with the value 'Registered' indicating the endpoint completed the BYOD onboarding flow (enrollment, certificate provisioning, or MDM registration). Using this condition in an Authorization Policy ensures only successfully onboarded devices receive the corporate access posture. This is the documented dictionary attribute specifically designed for this check.

Answer

Endpoint:Profile EQUALS RegisteredDevice

Answer

Session:RegistrationMode EQUALS Auto

Answer

Device:AccessType EQUALS BYOD

Question 2

During BYOD onboarding, the client is unable to download the Network Setup Assistant (NSA). You verify the portal settings and observe that the 'Client Provisioning' resource is correctly assigned to the policy. What is the most likely cause if the device fails to reach the download page?

Accepted Answer

The redirect ACL is blocking traffic to the ISE IP address on TCP port 8443. The Network Setup Assistant (NSA) is downloaded from the ISE portal over HTTPS on TCP port 8443, which is the default port for the client provisioning and BYOD registration portal. If the redirect ACL on the switch or WLC only permits traffic to the ISE node on ports 80/443 (or blocks 8443), the client will authenticate successfully but fail to reach the provisioning page. Since the Client Provisioning resource is correctly assigned, the failure is at the network enforcement layer, not the policy layer.

Answer

The user is not part of the Active Directory group assigned to the policy

Answer

The client does not have the native supplicant installed

Answer

The certificate on the ISE portal is expired

Question 3

You are integrating an MDM server with ISE for BYOD. The requirement is that ISE must check the compliance status of the device before granting full network access. Which feature must be enabled in the MDM configuration within ISE?

Accepted Answer

Enable 'Device Compliance' in the MDM server configuration object. Within ISE's MDM server configuration object, the 'Device Compliance' checkbox must be enabled so that ISE queries the MDM for the device's compliance state and receives it back as the MDM-compliance attribute used in authorization policies. Without this toggle, ISE can still perform MDM enrollment checks but will not evaluate compliance status. This is the specific configuration that activates the compliance-check workflow for BYOD.

Answer

Configure a 'Compliance' RADIUS attribute

Answer

Enable 'Allow full access' in the Authorization Policy

Answer

Enable 'MDM Enrollment' in the Policy Set

Question 4

Which state does an endpoint enter after a successful BYOD registration in ISE?

Accepted Answer

Registered. Endpoints that complete BYOD registration are moved from a 'Registered' state to a 'Compliant' or 'Authorized' status depending on the policy.

Answer

Pending

Answer

Blacklisted

Answer

Quarantined

Question 5

You have configured a BYOD flow where the user must approve the device. Which portal type must be used to allow this?

Accepted Answer

My Devices portal. The My Devices portal is the Cisco ISE portal designed for BYOD self-registration, where end users register their own devices and approve them. It supports the 'user must approve the device' flow by allowing the user to log in, add a device, and complete the registration/approval step before the device is granted network access.

Answer

Client Provisioning portal

Answer

Sponsor portal

Answer

Guest portal

Question 6

Which RADIUS attribute is commonly used to inform the Network Access Server (NAS) that a re-authentication is required after a successful BYOD provisioning?

Accepted Answer

Termination-Action: RADIUS-Request. The Termination-Action RADIUS attribute (RFC 2865) with the value RADIUS-Request instructs the NAS to re-authenticate the session after the current session ends. In BYOD provisioning, after a successful provisioning flow, ISE sends this attribute to tell the switch or wireless controller to trigger a re-authentication, allowing the device to be re-evaluated and placed in the appropriate authorization policy. This is a standard mechanism for session re-evaluation without disconnecting the user.

Answer

Class-Attribute: Re-Authenticate

Answer

Filter-Id: Refresh

Answer

Tunnel-Type: VLAN-Change

Question 7

In a multi-node ISE deployment, which node should handle the 'Certificate Authority' role for BYOD provisioning?

Accepted Answer

The Primary Policy Administration Node (PAN). The node designated as the Policy Administration Node (PAN) or a dedicated subordinate CA node is typically used to manage certificate requests.

Answer

The Monitoring Node (MnT)

Answer

Any Policy Service Node (PSN)

Answer

The secondary monitoring node

Question 8

Which of the following is a common reason for a 'Certificate Mismatch' error during EAP-TLS?

Accepted Answer

The client does not trust the Root CA that signed the server certificate. A 'Certificate Mismatch' error during EAP-TLS typically occurs when the client does not trust the Root CA that signed the ISE server certificate. The client validates the server certificate during the TLS handshake, and if the issuing CA is not in the client's trusted store, the validation fails, resulting in a mismatch error. Thus, option B is correct.

Answer

The ISE node time is out of sync

Answer

The device is not in the correct VLAN

Answer

The SSID is not configured for EAP-TLS

Question 9

Which THREE of the following are valid sources for the 'Device Compliance' status in Cisco ISE?

Accepted Answer

Mobile Device Management (MDM) server. ISE can receive compliance status via direct MDM integration, using the 'Cisco Context Directory Agent' (CDA), or via pxGrid.

Answer

RADIUS server

Answer

DNS server

Question 10

Which TWO of the following methods can be used to identify a device as 'BYOD' in ISE?

Accepted Answer

Bulk import of MAC addresses. Option B (Bulk import of MAC addresses) is correct because ISE can identify endpoints as BYOD by importing a list of MAC addresses into an endpoint identity group, allowing those devices to be recognized and authorized accordingly. Option E (Self-registration via the BYOD portal) is correct because ISE's BYOD portal lets users register their own devices, and during that flow ISE creates an endpoint record and can assign the device to a BYOD identity group. Option A (IP address range) is not a valid ISE method for identifying a device as BYOD, since IP addresses are not used as endpoint identity attributes for BYOD classification. Option C (SNMP community string) is not used by ISE to classify endpoints as BYOD; SNMP is for network device management, not endpoint identity. Option D (Switch port ID) is not a BYOD identification method in ISE, as port information is not used to mark an endpoint as BYOD.

Answer

IP address range

Answer

SNMP community string

Answer

Switch port ID