SISE BYOD — 15 Questions

Question 1

Which state does an endpoint enter after a successful BYOD registration in ISE?

Accepted Answer

Registered. Endpoints that complete BYOD registration are moved from a 'Registered' state to a 'Compliant' or 'Authorized' status depending on the policy.

Answer

Pending

Answer

Blacklisted

Answer

Quarantined

Question 2

In a multi-node ISE deployment, which node should handle the 'Certificate Authority' role for BYOD provisioning?

Accepted Answer

The Primary Policy Administration Node (PAN). The node designated as the Policy Administration Node (PAN) or a dedicated subordinate CA node is typically used to manage certificate requests.

Answer

The Monitoring Node (MnT)

Answer

Any Policy Service Node (PSN)

Answer

The secondary monitoring node

Question 3

Which THREE of the following are valid sources for the 'Device Compliance' status in Cisco ISE?

Accepted Answer

Mobile Device Management (MDM) server. ISE can receive compliance status via direct MDM integration, using the 'Cisco Context Directory Agent' (CDA), or via pxGrid.

Answer

RADIUS server

Answer

DNS server

Question 4

Which component in the ISE BYOD architecture is responsible for generating the temporary network access credentials during the onboarding flow?

Accepted Answer

The BYOD Portal configuration. The Onboarding flow uses the 'BYOD Portal' to authenticate the user and trigger the creation of a unique credential for the client.

Answer

The ISE Internal CA

Answer

The WLC WebAuth service

Answer

The RADIUS Server service

Question 5

Which TWO factors must be considered when designing certificate provisioning for BYOD?

Accepted Answer

The ISE Root CA must be installed on all BYOD devices prior to onboarding. The certificate chain must be trusted by the client, and the certificate template must allow for the necessary Subject Alternative Names (SAN) for authentication.

Answer

The SCEP proxy must be configured on the internal firewall

Answer

ISE must use self-signed certificates for all client nodes

Answer

The WLC must support local certificate signing

Question 6

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

Accepted Answer

Operations > Reports > Endpoints and Users > Certificate Provisioning. The 'Certificate Provisioning' logs are located under Operations > Reports > Endpoints and Users > Certificate Provisioning.

Answer

Policy > Policy Elements > Results > Certificate Templates

Answer

Operations > RADIUS Livelog

Answer

Administration > System > Certificates > Certificate Signing Requests

Question 7

A user reports that their BYOD device is not being recognized as 'Compliant' even though the MDM shows it is compliant. Which ISE component is responsible for retrieving this status?

Accepted Answer

The ISE MDM Server connector. The ISE MDM Server connector periodically polls or receives webhooks from the MDM to update the endpoint status in the ISE database.

Answer

The ISE Policy Information Point (PIP)

Answer

The ISE Monitoring node

Answer

The ISE RADIUS service

Question 8

When configuring an Authorization Policy for BYOD, which condition should be used to ensure the device has successfully performed BYOD registration?

Accepted Answer

Session:BYODRegistrationStatus EQUALS Registered. The 'BYOD Registered' attribute in the Session object (or Device Registration Status) is the standard way to verify if a device has completed the BYOD flow.

Answer

Endpoint:Profile EQUALS RegisteredDevice

Answer

Session:RegistrationMode EQUALS Auto

Answer

Device:AccessType EQUALS BYOD

Question 9

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

Accepted Answer

To configure the native supplicant settings for secure network access. The NSA is a small utility downloaded by the endpoint to configure the supplicant for secure wireless network access.

Answer

To provide a VPN tunnel to the internal network

Answer

To manage the user's Active Directory account

Answer

To scan the device for malware before allowing network access

Question 10

During BYOD onboarding, the client is unable to download the Network Setup Assistant (NSA). You verify the portal settings and observe that the 'Client Provisioning' resource is correctly assigned to the policy. What is the most likely cause if the device fails to reach the download page?

Accepted Answer

The redirect ACL is blocking traffic to the ISE IP address on TCP port 8443. The redirect ACL must permit traffic to the Cisco ISE server on ports 8443 or 8905 to ensure the client can reach the provisioning services.

Answer

The user is not part of the Active Directory group assigned to the policy

Answer

The client does not have the native supplicant installed

Answer

The certificate on the ISE portal is expired

Question 11

You are integrating an MDM server with ISE for BYOD. The requirement is that ISE must check the compliance status of the device before granting full network access. Which feature must be enabled in the MDM configuration within ISE?

Accepted Answer

Enable 'Device Compliance' in the MDM server configuration object. The 'Device Compliance' checkbox must be enabled in the MDM server configuration to trigger the API calls for status checks.

Answer

Configure a 'Compliance' RADIUS attribute

Answer

Enable 'Allow full access' in the Authorization Policy

Answer

Enable 'MDM Enrollment' in the Policy Set

Question 12

You are configuring a BYOD flow where users must register their devices via the self-service portal. Which ISE component is responsible for triggering the redirection to the BYOD portal after an initial MAC Authentication Bypass (MAB) success?

Accepted Answer

Authorization Profile with a redirect ACL and URL redirect. The Authorization Profile containing the 'Redirect' attribute is what forces the client to the portal.

Answer

Policy Set with a global redirect object

Answer

Authentication Policy with a portal trigger

Answer

RADIUS server-side redirect attribute

Question 13

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

Accepted Answer

Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. The BYOD setting is enabled within the Portal Settings page of a specific Guest or My Devices portal.

Answer

Policy > Policy Sets > [Set Name] > Authorization Policy

Answer

Operations > Troubleshoot > BYOD Settings

Answer

Administration > Device Portal Management

Question 14

You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?

Accepted Answer

To allow devices to request certificates from the CA via the ISE node. The SCEP proxy allows the endpoint to request a certificate from an internal CA through the ISE node, keeping the CA hidden from the internal network.

Answer

To sign certificates for the endpoints

Answer

To encrypt the SCEP traffic between ISE and the endpoint

Answer

To store the Private Keys of the issued certificates

Question 15

Which of the following is a requirement for a successful BYOD certificate provisioning flow?

Accepted Answer

The client must have the Root CA certificate installed in its trusted store. The client must trust the Root CA that signed the ISE portal/certificate to ensure the enrollment process is secure.

Answer

The client must use a specific third-party supplicant

Answer

The client must be joined to the Active Directory domain

Answer

The device must be managed by the same MDM as the enterprise devices