SISE BYOD Practice Test 2 — 15 Questions

Question 1

Which THREE actions are required when configuring a BYOD flow that involves an external MDM integration?

Accepted Answer

Configure the MDM server details in Administration > Network Resources > MDM. Option A is correct because Cisco ISE requires the external MDM server to be registered under Administration > Network Resources > MDM, where you supply the MDM vendor, hostname/URL, and credentials so ISE can query device compliance via the MDM API. Option B is correct because ISE must trust the MDM server's certificate chain; importing the MDM server's Root CA into the ISE Trusted Certificates store enables the TLS connection used for the REST API calls to succeed. Option D is correct because the BYOD flow enforces compliance through an authorization policy: the 'Device Compliance' condition/result must be enabled so ISE checks the MDM's compliance status and grants or denies access accordingly. Option C is incorrect because the native supplicant is normally enabled (not disabled) for BYOD onboarding, since clients use it to provision 802.1X credentials. Option E is incorrect because the WLC does not act as an MDM proxy; ISE communicates directly with the external MDM server, and the WLC only handles wireless access and RADIUS/CoA interactions.

Answer

Set the 'Native Supplicant' to disabled

Answer

Configure the WLC to act as an MDM proxy

Question 2

Which TWO factors must be considered when designing certificate provisioning for BYOD?

Accepted Answer

The ISE Root CA must be installed on all BYOD devices prior to onboarding. The certificate chain must be trusted by the client, and the certificate template must allow for the necessary Subject Alternative Names (SAN) for authentication.

Answer

The SCEP proxy must be configured on the internal firewall

Answer

ISE must use self-signed certificates for all client nodes

Answer

The WLC must support local certificate signing

Question 3

A company uses Cisco ISE BYOD with a single SSID for employee onboarding. Employees report that after the native supplicant provisioning completes on Windows 10 laptops, the devices reconnect to the corporate SSID but fail authentication with 'EAP-TLS: certificate not found.' The certificate was issued successfully by the internal CA. Which ISE configuration element is most likely missing to ensure the certificate is presented during EAP-TLS?

Accepted Answer

The BYOD client provisioning policy does not include the Windows 10 native supplicant configuration profile with the correct certificate template.. The native supplicant profile in the client provisioning policy must match the operating system and point to the certificate template that was used for enrollment. When the profile is missing or misconfigured, Windows does not know which certificate to select for EAP-TLS, producing a 'certificate not found' error despite successful issuance. Verifying the client provisioning policy and its Windows 10 supplicant profile resolves the issue.

Answer

The authorization policy does not permit EAP-TLS for the BYOD endpoint identity group.

Answer

The internal CA is not included in the ISE trusted certificates store.

Answer

The endpoint is not registered in the BYOD endpoint identity group before provisioning.

Question 4

A network administrator is designing a BYOD onboarding flow for Android devices using Cisco ISE. The requirement is that devices must be enrolled automatically without user interaction after the user authenticates to the guest portal, and the certificate must be delivered to the device. Which two configuration elements are required to support this automated Android onboarding? (Choose two.)

Accepted Answer

A client provisioning policy that matches Android and references a native supplicant profile with the certificate template.. Automated Android BYOD onboarding requires two core ISE elements: an authorization policy that redirects unregistered endpoints to the BYOD registration portal, and a client provisioning policy that matches Android and references a native supplicant profile containing the certificate template. Together they trigger registration, provisioning, and certificate delivery without user interaction beyond initial authentication.

Answer

An external MDM integration that pushes the certificate to the Android device via an MDM profile.

Answer

A guest portal configured with self-registration and sponsor approval for Android devices.

Answer

A posture policy that requires Android devices to have the latest OS patch before provisioning.

Question 5

A network administrator is configuring a BYOD onboarding portal in Cisco ISE for employee personal devices. The requirement is that after onboarding, devices must be authorized using a certificate that is automatically installed on the device without requiring the user to manually download and install it. The administrator has already configured the certificate template and the client provisioning policy. Which ISE component must be configured to ensure the certificate is provisioned automatically during the onboarding flow?

Accepted Answer

Native supplicant provisioning with certificate provisioning enabled in the supplicant profile. Native supplicant provisioning is the ISE feature that configures the device's native supplicant and can automatically provision a certificate. When the supplicant profile includes certificate provisioning, ISE pushes the certificate during onboarding, eliminating manual installation. The client provisioning policy only selects the profile; it does not perform the provisioning. MDM integration and the onboarding wizard are auxiliary and do not directly install certificates in this flow.

Answer

External MDM integration with certificate authority proxy

Answer

BYOD onboarding wizard with certificate provisioning enabled

Answer

Client provisioning policy with a certificate provisioning profile

Question 6

A network administrator is setting up BYOD onboarding for the first time in Cisco ISE. The administrator wants to ensure that employees can register their devices and receive the necessary certificates and supplicant configurations. Which of the following is a required step to enable BYOD onboarding in ISE?

Accepted Answer

Configure a BYOD onboarding wizard to create the necessary portals, policies, and certificate templates. The BYOD onboarding wizard in Cisco ISE is the required step to enable BYOD onboarding. It creates the necessary client provisioning policy, BYOD portal, certificate templates, and authorization policies. Without running the wizard, the administrator would have to manually configure all these components, which is error-prone. The wizard ensures a consistent and complete BYOD configuration. Other options, such as global settings or guest portals, are not required or correct for enabling BYOD.

Answer

Manually create a guest portal and assign it to the BYOD flow

Answer

Configure an external MDM integration before enabling BYOD

Answer

Enable BYOD in the ISE global settings under Administration > System > Settings > BYOD

Question 7

A network administrator is deploying Cisco ISE BYOD with certificate-based authentication for employee devices. The administrator wants to ensure that devices are automatically onboarded and that certificates are provisioned without user intervention. Which two of the following are required to achieve automatic certificate provisioning during BYOD onboarding? (Choose two.)

Accepted Answer

Enable certificate provisioning in the native supplicant profile. To achieve automatic certificate provisioning during BYOD onboarding, two key steps are required: enabling certificate provisioning in the native supplicant profile, and enabling the 'Certificate Provisioning' option in the BYOD onboarding wizard. The supplicant profile setting ensures that the certificate is included in the provisioning process, while the wizard option configures the overall flow to support automatic certificate issuance. Without both, the device may onboard without a certificate or require manual certificate installation.

Answer

Ensure the certificate template used for BYOD has the 'Allow users to request certificates' permission

Answer

Configure the BYOD portal to automatically install the certificate

Answer

Configure the client provisioning policy to use a BYOD portal

Question 8

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

Accepted Answer

Operations > Reports > Endpoints and Users > Certificate Provisioning. The Certificate Provisioning report under Operations > Reports > Endpoints and Users is the dedicated location where ISE logs the outcome of CA interactions during BYOD onboarding, including certificate enrollment requests, successes, and failures. When devices register successfully but certificate issuance fails, this report captures the SCEP/PKCS or EST exchange between ISE and the CA, showing error codes returned by the CA.

Answer

Policy > Policy Elements > Results > Certificate Templates

Answer

Operations > RADIUS Livelog

Answer

Administration > System > Certificates > Certificate Signing Requests

Question 9

A user reports that their BYOD device is not being recognized as 'Compliant' even though the MDM shows it is compliant. Which ISE component is responsible for retrieving this status?

Accepted Answer

The ISE MDM Server connector. The ISE MDM Server connector is the component that communicates directly with external MDM systems (such as Intune, AirWatch, or MobileIron) to retrieve device compliance status. It uses the MDM API to poll or receive push notifications about device posture, then feeds that data into ISE's authorization policies. Without this connector, ISE would have no way to know whether a BYOD device meets compliance requirements, even if the MDM itself reports it as compliant.

Answer

The ISE Policy Information Point (PIP)

Answer

The ISE Monitoring node

Answer

The ISE RADIUS service

Question 10

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

Accepted Answer

To configure the native supplicant settings for secure network access. The Network Setup Assistant (NSA) is a client-side provisioning component in Cisco ISE BYOD flows that walks the end user through configuring the native supplicant (Windows WLAN AutoConfig, macOS, iOS, Android, etc.) with the correct SSID, EAP method (PEAP/EAP-TLS), and certificate settings so the device can authenticate via 802.1X. It is downloaded from the ISE Guest/BYOD portal and runs locally on the endpoint to install the required profile. This enables secure EAP-based network access without manual supplicant configuration by the user.

Answer

To provide a VPN tunnel to the internal network

Answer

To manage the user's Active Directory account

Answer

To scan the device for malware before allowing network access

Question 11

You are configuring a BYOD flow where users must register their devices via the self-service portal. Which ISE component is responsible for triggering the redirection to the BYOD portal after an initial MAC Authentication Bypass (MAB) success?

Accepted Answer

Authorization Profile with a redirect ACL and URL redirect. The Authorization Profile with a redirect ACL and URL redirect is responsible for triggering the redirection to the BYOD portal after an initial MAB success. When a device authenticates via MAB, ISE evaluates the authorization policy and returns an Authorization Profile that includes a redirect ACL and a URL redirect to the BYOD portal. The NAS then applies the redirect ACL and sends the user's HTTP traffic to the portal.

Answer

Policy Set with a global redirect object

Answer

Authentication Policy with a portal trigger

Answer

RADIUS server-side redirect attribute

Question 12

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

Accepted Answer

Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. The BYOD checkbox for a specific device registration portal is enabled under Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. This is where the portal configuration includes the option to enable BYOD device registration. The path is specific to the Guest Access work center in ISE.

Answer

Policy > Policy Sets > [Set Name] > Authorization Policy

Answer

Operations > Troubleshoot > BYOD Settings

Answer

Administration > Device Portal Management

Question 13

You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?

Accepted Answer

To allow devices to request certificates from the CA via the ISE node. The SCEP proxy in ISE acts as an intermediary between the endpoint and the Certificate Authority (CA). Instead of the endpoint contacting the CA directly, it sends its SCEP request to ISE, which forwards it to the CA, obtains the certificate, and returns it to the endpoint. This allows ISE to enforce BYOD policies, apply authorization, and avoid exposing the CA directly to endpoints.

Answer

To sign certificates for the endpoints

Answer

To encrypt the SCEP traffic between ISE and the endpoint

Answer

To store the Private Keys of the issued certificates

Question 14

Which of the following is a requirement for a successful BYOD certificate provisioning flow?

Accepted Answer

The client must have the Root CA certificate installed in its trusted store. For BYOD certificate provisioning (e.g., via the native supplicant or Cisco Network Setup Assistant), the client must trust the ISE certificate chain, which requires the Root CA certificate to be installed in the client's trusted store. Without that trust anchor, the TLS handshake during enrollment fails and the certificate cannot be provisioned. This is a fundamental PKI requirement for any certificate-based onboarding flow.

Answer

The client must use a specific third-party supplicant

Answer

The client must be joined to the Active Directory domain

Answer

The device must be managed by the same MDM as the enterprise devices

Question 15

What is the primary benefit of using native supplicant provisioning in ISE?

Accepted Answer

It leverages the built-in OS capabilities for connectivity. Native supplicant provisioning in Cisco ISE leverages the built-in 802.1X supplicant already present in the operating system (e.g., Windows Wired AutoConfig, macOS native supplicant) to establish network connectivity, rather than deploying a third-party supplicant like Cisco AnyConnect NAM. This reduces deployment complexity and cost while still enabling ISE to push configuration profiles and certificates to the endpoint.

Answer

It provides complete control over the device's file system

Answer

It encrypts the entire hard drive

Answer

It removes the need for RADIUS authentication