SISE BYOD Practice Test 3 — 15 Questions

Question 1

If a user's certificate expires, how can the user renew it using the ISE BYOD flow?

Accepted Answer

Reconnect to the SSID and follow the re-enrollment prompt in the portal. When a user's certificate expires in an ISE BYOD flow, the user can renew it by reconnecting to the SSID and following the re-enrollment prompt in the portal. This triggers the BYOD onboarding process again, allowing the user to obtain a new certificate. The certificate does not renew automatically, nor does it require manual administrator intervention or re-installing the Network Setup Assistant.

Answer

The certificate renews automatically in the background

Answer

Re-install the Network Setup Assistant manually

Answer

Contact the administrator to manually push a new certificate

Question 2

Which protocol is used by ISE to communicate with the MDM server for device status checks?

Accepted Answer

REST API. ISE communicates with MDM servers using REST API calls to query device status and compliance information. This allows ISE to integrate with MDM solutions for device registration and compliance checks.

Answer

SNMP

Answer

RADIUS

Answer

LDAP

Question 3

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

Accepted Answer

Device Profiling. Device Profiling is the ISE component that identifies the device type (e.g., iPhone vs. Windows) by collecting attributes via probes such as DHCP, RADIUS, SNMP, and NMAP, then matching them against profiling policies. This identification drives the appropriate BYOD configuration and authorization.

Answer

RADIUS Accounting

Answer

Active Directory Identity Store

Answer

Policy Sets

Question 4

When a user's device is stolen, which action should be taken in the 'My Devices' portal?

Accepted Answer

Deregister or Blacklist the device. In the 'My Devices' portal, the appropriate action when a device is stolen is to deregister or blacklist the device. Deregistration removes the device from the user's profile, while blacklisting prevents it from reconnecting to the network. This mitigates risk by ensuring the stolen device cannot access corporate resources.

Answer

Perform a factory reset on the device remotely

Answer

Delete the user's account

Answer

Change the user's AD password

Question 5

You are configuring EAP-TLS for BYOD. What must be included in the 'Allowed Protocols' list in ISE?

Accepted Answer

EAP-TLS. EAP-TLS requires both the client and server to present digital certificates for mutual authentication, so EAP-TLS must be explicitly listed in ISE's Allowed Protocols for the BYOD flow to negotiate it. Without EAP-TLS in the allowed list, ISE will reject or fail the TLS handshake even if certificates are valid.

Answer

LEAP

Answer

EAP-FAST

Answer

PEAP-MSCHAPv2

Question 6

If a user is successfully registered but cannot connect after the BYOD flow, which status should you check in the 'Endpoints' menu?

Accepted Answer

Registration Status. The 'Registration Status' field in the Endpoints menu directly indicates whether a device completed the BYOD onboarding/registration process successfully. If a user is registered but cannot connect, checking Registration Status confirms whether the endpoint actually finished the registration handshake or is stuck in a pending/failed state. This is the authoritative field for diagnosing post-registration connectivity issues in the BYOD flow.

Answer

User ID

Answer

Last Access Date

Answer

Device Type

Question 7

You are troubleshooting a certificate provisioning failure where the error is 'Internal CA Error'. What is the most likely cause?

Accepted Answer

The ISE node is not configured as a subordinate CA correctly. The 'Internal CA Error' in Cisco ISE certificate provisioning typically indicates that the ISE node's internal Certificate Authority (CA) is not properly configured as a subordinate CA to the enterprise PKI, or the CA certificate chain is incomplete/misconfigured. ISE uses its internal CA to issue certificates for BYOD, posture, and admin services, and if the subordinate CA relationship is broken, provisioning fails with this error. The correct fix is to verify the subordinate CA configuration and certificate chain.

Answer

The user password has expired

Answer

The client certificate is too small

Answer

The network switch is blocking port 443

Question 8

What is the purpose of the 'Redirect ACL' on the network access device?

Accepted Answer

To permit access to the ISE portal while blocking all other traffic. The Redirect ACL on the NAD (switch/WLC) is a pre-auth ACL that permits only the traffic required to reach the ISE portal (DNS, DHCP, HTTP/HTTPS to ISE) and denies everything else, forcing the client into the guest/BYOD/posture flow. Once the client is authorized, ISE sends a CoA that replaces the redirect ACL with the appropriate authorization ACL (e.g., full access or limited access). This is the mechanism that makes centralized web authentication and BYOD onboarding work.

Answer

To encrypt the traffic between the client and the switch

Answer

To limit the bandwidth for BYOD users

Answer

To force the client to use a specific DNS server

Question 9

Which dashboard widget provides a quick summary of BYOD activity in your network?

Accepted Answer

BYOD Registration Status. The 'BYOD Registration Status' dashboard widget provides a quick summary of BYOD activity, including the number of registered devices, pending registrations, and other relevant metrics. This widget is specifically designed to monitor BYOD onboarding and registration trends.

Answer

System Resources

Answer

Active Directory Health

Answer

RADIUS Latency

Question 10

In the BYOD flow, what occurs immediately after the user provides credentials in the portal?

Accepted Answer

The device is provisioned with a certificate. In the BYOD flow, after the user authenticates to the device registration portal, ISE provisions the device with a certificate (typically an X.509 client certificate from the internal CA) so the device can be trusted for future 802.1X/EAP-TLS authentications. This certificate-based trust is the core of the BYOD onboarding process.

Answer

The device is automatically moved to the production VLAN

Answer

The user is disconnected from the network

Answer

The device is registered in the Active Directory

Question 11

You want to enforce a policy where personal devices are allowed access, but only if they are not jailbroken. How is this achieved in a BYOD scenario?

Accepted Answer

Integrate an MDM that performs jailbreak detection. Jailbreak (root) detection requires inspecting the device's OS integrity state — checking for modified system partitions, sideloaded root binaries (e.g., Cydia, Magisk), or disabled code signing. ISE cannot natively detect jailbreaks because profiling only inspects network-visible attributes like DHCP fingerprints, MAC OUI, and HTTP user-agent strings. An MDM agent runs on the endpoint with elevated privileges and can query the OS for tampering indicators, then report compliance status back to ISE via the MDM API (e.g., Cisco MDM/EMM integration using the Cisco ISE MDM REST API), enabling a posture-based authorization decision.

Answer

Use ISE profiling only

Answer

Use an ACL on the switch

Answer

Configure a WLC-based check

Question 12

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

Accepted Answer

Enable BYOD settings in the device portal configuration. Option B is correct because enabling BYOD settings in the device portal configuration is a mandatory step: the Cisco ISE device portal (the client provisioning and BYOD portal) must have BYOD functionality turned on so that endpoints can be onboarded, registered, and have supplicant/certificate provisioning performed. Option D is correct because a mandatory part of BYOD is an authorization policy that matches non-compliant or unregistered BYOD endpoints and redirects them to the BYOD/guest portal for onboarding, typically using a redirect URL (e.g., the client provisioning portal) before granting full network access. Option A is incorrect because BYOD onboarding does not require installing a dedicated agent on every switch; Cisco ISE uses RADIUS, web portals, and supplicant provisioning instead. Option C is incorrect because BYOD does not require creating a local user account for every device; identity is handled through ISE's identity stores, certificates, and endpoint registration. Option E is incorrect because disabling RADIUS authentication would break the 802.1X/MAC authentication and authorization that ISE relies on for BYOD, so it is the opposite of a required step.

Answer

Install a dedicated agent on every switch

Answer

Create a local user account for every device

Answer

Disable RADIUS authentication

Question 13

Which THREE of the following items are required for the EAP-TLS authentication process to succeed?

Accepted Answer

Client certificate installed on the device. EAP-TLS is a mutual certificate-based authentication method, so the client must present its own identity certificate: option B (client certificate installed on the device) is required for the supplicant to authenticate to the network. The authentication server must also prove its identity, so option C (ISE server certificate installed on the PSN) is required for the Policy Service Node to present a valid server certificate during the TLS handshake. Both sides must validate the other's certificate chain, so option D (trust anchor/Root CA installed on both client and server) is required to build and verify the certificate path. Option A is incorrect because EAP-TLS does not use a user password in the registry; authentication is based on certificates, not stored credentials. Option E is incorrect because an Active Directory GPO forcing login is not a prerequisite for the EAP-TLS handshake itself, even if AD may be used for authorization or identity mapping.

Answer

User password stored in the endpoint registry

Answer

Active Directory GPO to force login

Question 14

Which TWO of the following are benefits of integrating MDM with Cisco ISE for BYOD?

Accepted Answer

Ability to trigger remote wipe or lock commands. Option A (Ability to trigger remote wipe or lock commands) is correct because integrating an MDM with Cisco ISE allows ISE to invoke MDM APIs to issue remote wipe or lock actions on noncompliant or lost/stolen BYOD endpoints, typically via the MDM's REST API during posture or remediation workflows. Option C (Automated device compliance status checks) is correct because the ISE-MDM integration uses the MDM's API to poll or receive device compliance attributes (e.g., jailbroken/rooted status, OS version, PIN enforcement, encryption), which ISE then uses in authorization policies to grant, restrict, or quarantine network access. Option B is incorrect because SSID connection speed is determined by wireless RF conditions, PHY rates, and 802.11 negotiation, not by MDM-ISE integration. Option D is incorrect because ISE-MDM integration does not create Active Directory accounts; AD account provisioning is handled by separate identity management or directory tools. Option E is incorrect because bandwidth allocation is governed by QoS, WLAN policies, and network capacity, not by MDM-ISE integration.

Answer

Faster SSID connection speed

Answer

Automatic creation of Active Directory accounts

Answer

Increased bandwidth for BYOD users

Question 15

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

Accepted Answer

HTTPS. HTTPS (B) is critical because BYOD enrollment, policy delivery, and MDM/UEM management traffic must be encrypted and authenticated over TLS, typically on TCP 443, protecting device and user data in transit. RADIUS (D) is essential for authenticating BYOD devices and users to the network, commonly via 802.1X/EAP, enabling access control and dynamic VLAN or role assignment. SCEP (E) is the Simple Certificate Enrollment Protocol used to automate certificate issuance to BYOD devices, which underpins identity, Wi-Fi/EAP-TLS authentication, and VPN trust in the lifecycle. SMTP (A) is only for sending email and FTP (C) is a legacy cleartext file-transfer protocol; neither provides the authentication, encryption, or certificate provisioning functions required for BYOD onboarding and management.

Answer

SMTP

Answer

FTP