SISE BYOD Practice Test 3 — 15 Questions

Question 1

Which of the following is a common reason for a 'Certificate Mismatch' error during EAP-TLS?

Accepted Answer

The client does not trust the Root CA that signed the server certificate. This occurs when the Root CA certificate on the client does not match the CA that signed the certificate provided by the ISE server.

Answer

The ISE node time is out of sync

Answer

The device is not in the correct VLAN

Answer

The SSID is not configured for EAP-TLS

Question 2

Which TWO of the following methods can be used to identify a device as 'BYOD' in ISE?

Accepted Answer

Bulk import of MAC addresses. Devices can be identified via manual registration by the user or through automated enrollment via the BYOD flow.

Answer

IP address range

Answer

SNMP community string

Answer

Switch port ID

Question 3

Which THREE of the following items are required for the EAP-TLS authentication process to succeed?

Accepted Answer

Client certificate installed on the device. EAP-TLS requires the client to have a certificate, the server to have a certificate, and both to trust the CA chain.

Answer

User password stored in the endpoint registry

Answer

Active Directory GPO to force login

Question 4

Which TWO of the following are benefits of integrating MDM with Cisco ISE for BYOD?

Accepted Answer

Ability to trigger remote wipe or lock commands. MDM integration enables automated compliance checks and the ability to wipe or lock devices if they are lost.

Answer

Faster SSID connection speed

Answer

Automatic creation of Active Directory accounts

Answer

Increased bandwidth for BYOD users

Question 5

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

Accepted Answer

HTTPS. SCEP is for certificates, HTTPS is for the portal, and RADIUS is for network access control.

Answer

SMTP

Answer

FTP

Question 6

Which TWO of the following are common troubleshooting steps for a failed BYOD portal redirection?

Accepted Answer

Check the Authorization Policy for the correct URL-Redirect attribute. Verifying the redirect ACL and checking the Authorization Policy for the correct URL redirect attribute are the first steps.

Answer

Restart the Active Directory domain controller

Answer

Re-configure the DHCP server

Answer

Change the switch model

Question 7

Which THREE of the following are potential reasons a device might be placed in a 'Quarantine' VLAN during the BYOD process?

Accepted Answer

Device failed MDM compliance check. A device might be quarantined if it fails compliance, is missing a required certificate, or has an outdated OS version detected by the MDM.

Answer

User forgot their Wi-Fi password

Answer

The device is too new

Question 8

Which TWO of the following are components of the Cisco ISE 'Endpoint' object?

Accepted Answer

Custom Attributes. Endpoint objects contain the MAC address and a collection of custom and system attributes related to the device.

Answer

User's home address

Answer

The user's password hash

Answer

Device's hard drive serial number

Question 9

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

Accepted Answer

The user must manually 'Install' the configuration profile. iOS requires an Apple-signed profile, which ISE generates. The device must be able to reach the portal via HTTPS, and the profile must be trusted by the OS.

Answer

The device must be connected via VPN

Answer

The device must be jailbroken

Question 10

You are configuring a BYOD flow for iOS devices and notice that the native supplicant provisioning process is failing during the installation of the mobile configuration profile. Where should you check the logs in ISE to determine if the issue is related to the SCEP proxy communication?

Accepted Answer

Operations > Troubleshoot > Debug Wizard > scep. The SCEP proxy logs are specifically located under the 'SCEP' category within the Operations > Troubleshooting > Debug Wizard or by monitoring the 'scep.log' file.

Answer

Policy > Policy Elements > Results > Certificate Profiles

Answer

Administration > System > Licensing

Answer

Operations > RADIUS Livelog

Question 11

An administrator needs to ensure that only devices enrolled in their corporate MDM (AirWatch) can gain full network access. How should the ISE authorization policy be configured to verify MDM compliance for a BYOD endpoint?

Accepted Answer

Use the 'MDMServer' and 'ComplianceStatus' attributes in the authorization policy condition.. The 'MDM Compliance' attribute is returned by the MDM server to ISE during the authorization process, which can then be checked in the authorization policy condition.

Answer

Configure a static IP address in the authorization profile.

Answer

Configure the WLC to send a CoA immediately upon association.

Answer

Use the 'DeviceRegistrationStatus' equals 'Registered' condition.

Question 12

During the BYOD onboarding process, a user is successfully redirected to the portal, but the certificate installation fails because the client cannot trust the root CA. Which configuration is required to resolve this?

Accepted Answer

Import the Root CA certificate into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled.. The Root CA certificate must be uploaded to the 'Trusted Certificates' store in ISE and marked as trusted for 'Client Authentication'.

Answer

Install the CA certificate on the local WLC controller under the WLAN configuration.

Answer

Add the Root CA to the 'System Certificates' store instead of 'Trusted Certificates'.

Answer

Enable 'Allow Weak Ciphers' in the global BYOD settings.

Question 13

You are troubleshooting a scenario where an Android device is unable to complete the BYOD onboarding flow. You suspect the issue is with the supplicant provisioning wizard. Which tool should you use to verify if the provisioning payload was actually generated?

Accepted Answer

Work Centers > BYOD > Client Provisioning. The 'Provisioning' resources tab in the ISE portal configuration lists the resources generated for different operating systems.

Answer

Administration > System > Settings > Proxy

Answer

Operations > Troubleshoot > TCP Dump

Answer

Policy > Policy Elements > Conditions > Other > BYOD

Question 14

An organization wants to implement EAP-TLS for BYOD. What is the correct sequence of the certificate lifecycle during the onboarding process?

Accepted Answer

Authentication > Certificate Signing Request > CA Signing > Installation. After the user authenticates, the client submits a CSR, ISE (via SCEP) signs it, and the certificate is pushed back to the client.

Answer

Certificate Request > Authentication > Signing > Installation

Answer

CA Signing > Authentication > Request > Installation

Answer

Installation > Signing > Authentication > Request

Question 15

What is the primary function of the 'Client Provisioning' policy in the context of BYOD?

Accepted Answer

To determine which provisioning resources are delivered to the device based on its attributes.. The Client Provisioning policy determines which provisioning resources (such as installers or profiles) are pushed to the device based on its OS and requirements.

Answer

To restrict the number of devices a user can register.

Answer

To define which users are authorized to access the network.

Answer

To configure the MDM server connection settings.