SISE BYOD — Timed 20 Questions

Question 1

When configuring an Authorization Policy for BYOD, which condition should be used to ensure the device has successfully performed BYOD registration?

Accepted Answer

Session:BYODRegistrationStatus EQUALS Registered. In Cisco ISE, the BYOD registration state is exposed to authorization policy as the Session:BYODRegistrationStatus attribute, with the value 'Registered' indicating the endpoint completed the BYOD onboarding flow (enrollment, certificate provisioning, or MDM registration). Using this condition in an Authorization Policy ensures only successfully onboarded devices receive the corporate access posture. This is the documented dictionary attribute specifically designed for this check.

Answer

Endpoint:Profile EQUALS RegisteredDevice

Answer

Session:RegistrationMode EQUALS Auto

Answer

Device:AccessType EQUALS BYOD

Question 2

During BYOD onboarding, the client is unable to download the Network Setup Assistant (NSA). You verify the portal settings and observe that the 'Client Provisioning' resource is correctly assigned to the policy. What is the most likely cause if the device fails to reach the download page?

Accepted Answer

The redirect ACL is blocking traffic to the ISE IP address on TCP port 8443. The Network Setup Assistant (NSA) is downloaded from the ISE portal over HTTPS on TCP port 8443, which is the default port for the client provisioning and BYOD registration portal. If the redirect ACL on the switch or WLC only permits traffic to the ISE node on ports 80/443 (or blocks 8443), the client will authenticate successfully but fail to reach the provisioning page. Since the Client Provisioning resource is correctly assigned, the failure is at the network enforcement layer, not the policy layer.

Answer

The user is not part of the Active Directory group assigned to the policy

Answer

The client does not have the native supplicant installed

Answer

The certificate on the ISE portal is expired

Question 3

You are integrating an MDM server with ISE for BYOD. The requirement is that ISE must check the compliance status of the device before granting full network access. Which feature must be enabled in the MDM configuration within ISE?

Accepted Answer

Enable 'Device Compliance' in the MDM server configuration object. Within ISE's MDM server configuration object, the 'Device Compliance' checkbox must be enabled so that ISE queries the MDM for the device's compliance state and receives it back as the MDM-compliance attribute used in authorization policies. Without this toggle, ISE can still perform MDM enrollment checks but will not evaluate compliance status. This is the specific configuration that activates the compliance-check workflow for BYOD.

Answer

Configure a 'Compliance' RADIUS attribute

Answer

Enable 'Allow full access' in the Authorization Policy

Answer

Enable 'MDM Enrollment' in the Policy Set

Question 4

Which state does an endpoint enter after a successful BYOD registration in ISE?

Accepted Answer

Registered. Endpoints that complete BYOD registration are moved from a 'Registered' state to a 'Compliant' or 'Authorized' status depending on the policy.

Answer

Pending

Answer

Blacklisted

Answer

Quarantined

Question 5

You have configured a BYOD flow where the user must approve the device. Which portal type must be used to allow this?

Accepted Answer

My Devices portal. The My Devices portal is the Cisco ISE portal designed for BYOD self-registration, where end users register their own devices and approve them. It supports the 'user must approve the device' flow by allowing the user to log in, add a device, and complete the registration/approval step before the device is granted network access.

Answer

Client Provisioning portal

Answer

Sponsor portal

Answer

Guest portal

Question 6

Which RADIUS attribute is commonly used to inform the Network Access Server (NAS) that a re-authentication is required after a successful BYOD provisioning?

Accepted Answer

Termination-Action: RADIUS-Request. The Termination-Action RADIUS attribute (RFC 2865) with the value RADIUS-Request instructs the NAS to re-authenticate the session after the current session ends. In BYOD provisioning, after a successful provisioning flow, ISE sends this attribute to tell the switch or wireless controller to trigger a re-authentication, allowing the device to be re-evaluated and placed in the appropriate authorization policy. This is a standard mechanism for session re-evaluation without disconnecting the user.

Answer

Class-Attribute: Re-Authenticate

Answer

Filter-Id: Refresh

Answer

Tunnel-Type: VLAN-Change

Question 7

In a multi-node ISE deployment, which node should handle the 'Certificate Authority' role for BYOD provisioning?

Accepted Answer

The Primary Policy Administration Node (PAN). The node designated as the Policy Administration Node (PAN) or a dedicated subordinate CA node is typically used to manage certificate requests.

Answer

The Monitoring Node (MnT)

Answer

Any Policy Service Node (PSN)

Answer

The secondary monitoring node

Question 8

Which of the following is a common reason for a 'Certificate Mismatch' error during EAP-TLS?

Accepted Answer

The client does not trust the Root CA that signed the server certificate. A 'Certificate Mismatch' error during EAP-TLS typically occurs when the client does not trust the Root CA that signed the ISE server certificate. The client validates the server certificate during the TLS handshake, and if the issuing CA is not in the client's trusted store, the validation fails, resulting in a mismatch error. Thus, option B is correct.

Answer

The ISE node time is out of sync

Answer

The device is not in the correct VLAN

Answer

The SSID is not configured for EAP-TLS

Question 9

Which THREE of the following are valid sources for the 'Device Compliance' status in Cisco ISE?

Accepted Answer

Mobile Device Management (MDM) server. ISE can receive compliance status via direct MDM integration, using the 'Cisco Context Directory Agent' (CDA), or via pxGrid.

Answer

RADIUS server

Answer

DNS server

Question 10

Which TWO of the following methods can be used to identify a device as 'BYOD' in ISE?

Accepted Answer

Bulk import of MAC addresses. Option B (Bulk import of MAC addresses) is correct because ISE can identify endpoints as BYOD by importing a list of MAC addresses into an endpoint identity group, allowing those devices to be recognized and authorized accordingly. Option E (Self-registration via the BYOD portal) is correct because ISE's BYOD portal lets users register their own devices, and during that flow ISE creates an endpoint record and can assign the device to a BYOD identity group. Option A (IP address range) is not a valid ISE method for identifying a device as BYOD, since IP addresses are not used as endpoint identity attributes for BYOD classification. Option C (SNMP community string) is not used by ISE to classify endpoints as BYOD; SNMP is for network device management, not endpoint identity. Option D (Switch port ID) is not a BYOD identification method in ISE, as port information is not used to mark an endpoint as BYOD.

Answer

IP address range

Answer

SNMP community string

Answer

Switch port ID

Question 11

Which THREE of the following are potential reasons a device might be placed in a 'Quarantine' VLAN during the BYOD process?

Accepted Answer

Device failed MDM compliance check. Option A is correct because when a BYOD device fails an MDM compliance check (e.g., no passcode, jailbroken/rooted, missing required apps), NAC/onboarding workflows commonly redirect it to a quarantine VLAN so it can remediate before gaining full network access. Option C is correct because an OS version below the organization's minimum requirement is a classic non-compliance condition that triggers quarantine until the device is updated. Option D is correct because a missing or expired client certificate fails the EAP-TLS/802.1X authentication or posture check, causing the supplicant to be placed in the quarantine VLAN for certificate enrollment or remediation. Option B is not a quarantine trigger because a forgotten Wi-Fi password simply causes an authentication failure, not a posture-based quarantine decision. Option E is not a valid reason because a newer device is generally more compliant, not less, and being 'too new' is not a standard quarantine criterion.

Answer

User forgot their Wi-Fi password

Answer

The device is too new

Question 12

An administrator needs to ensure that only devices enrolled in their corporate MDM (AirWatch) can gain full network access. How should the ISE authorization policy be configured to verify MDM compliance for a BYOD endpoint?

Accepted Answer

Use the 'MDMServer' and 'ComplianceStatus' attributes in the authorization policy condition.. The correct approach is to use the 'MDMServer' and 'ComplianceStatus' attributes in the authorization policy condition. ISE integrates with MDM servers like AirWatch via the MDM API, and these attributes are populated during the MDM compliance check. The 'MDMServer' attribute identifies which MDM server the endpoint is enrolled with, while 'ComplianceStatus' indicates whether the device meets the MDM's compliance rules (e.g., PIN enabled, jailbroken/rooted status). By combining these conditions, the policy ensures that only devices enrolled in the corporate MDM and compliant are granted full network access.

Answer

Configure a static IP address in the authorization profile.

Answer

Configure the WLC to send a CoA immediately upon association.

Answer

Use the 'DeviceRegistrationStatus' equals 'Registered' condition.

Question 13

Which component in the ISE BYOD architecture is responsible for generating the temporary network access credentials during the onboarding flow?

Accepted Answer

The BYOD Portal configuration. The Onboarding flow uses the 'BYOD Portal' to authenticate the user and trigger the creation of a unique credential for the client.

Answer

The ISE Internal CA

Answer

The WLC WebAuth service

Answer

The RADIUS Server service

Question 14

You are troubleshooting a scenario where an Android device is unable to complete the BYOD onboarding flow. You suspect the issue is with the supplicant provisioning wizard. Which tool should you use to verify if the provisioning payload was actually generated?

Accepted Answer

Work Centers > BYOD > Client Provisioning. Work Centers > BYOD > Client Provisioning is where you configure and monitor the supplicant provisioning wizard, including the generation of provisioning payloads (mobile configuration profiles). If the provisioning payload was not generated, this is the first place to check the provisioning policy and its associated configuration. It allows you to verify that the correct provisioning profile is being served to the Android device.

Answer

Administration > System > Settings > Proxy

Answer

Operations > Troubleshoot > TCP Dump

Answer

Policy > Policy Elements > Conditions > Other > BYOD

Question 15

An organization wants to implement EAP-TLS for BYOD. What is the correct sequence of the certificate lifecycle during the onboarding process?

Accepted Answer

Authentication > Certificate Signing Request > CA Signing > Installation. The correct EAP-TLS BYOD onboarding sequence is: the client authenticates to the onboarding portal, then generates a Certificate Signing Request (CSR), the CA signs the certificate, and finally the certificate is installed on the client. This sequence ensures the client is authorized before receiving a certificate for EAP-TLS authentication.

Answer

Certificate Request > Authentication > Signing > Installation

Answer

CA Signing > Authentication > Request > Installation

Answer

Installation > Signing > Authentication > Request

Question 16

Which THREE actions are required when configuring a BYOD flow that involves an external MDM integration?

Accepted Answer

Configure the MDM server details in Administration > Network Resources > MDM. Option A is correct because Cisco ISE requires the external MDM server to be registered under Administration > Network Resources > MDM, where you supply the MDM vendor, hostname/URL, and credentials so ISE can query device compliance via the MDM API. Option B is correct because ISE must trust the MDM server's certificate chain; importing the MDM server's Root CA into the ISE Trusted Certificates store enables the TLS connection used for the REST API calls to succeed. Option D is correct because the BYOD flow enforces compliance through an authorization policy: the 'Device Compliance' condition/result must be enabled so ISE checks the MDM's compliance status and grants or denies access accordingly. Option C is incorrect because the native supplicant is normally enabled (not disabled) for BYOD onboarding, since clients use it to provision 802.1X credentials. Option E is incorrect because the WLC does not act as an MDM proxy; ISE communicates directly with the external MDM server, and the WLC only handles wireless access and RADIUS/CoA interactions.

Answer

Set the 'Native Supplicant' to disabled

Answer

Configure the WLC to act as an MDM proxy

Question 17

Which TWO factors must be considered when designing certificate provisioning for BYOD?

Accepted Answer

The ISE Root CA must be installed on all BYOD devices prior to onboarding. The certificate chain must be trusted by the client, and the certificate template must allow for the necessary Subject Alternative Names (SAN) for authentication.

Answer

The SCEP proxy must be configured on the internal firewall

Answer

ISE must use self-signed certificates for all client nodes

Answer

The WLC must support local certificate signing

Question 18

A company uses Cisco ISE BYOD with a single SSID for employee onboarding. Employees report that after the native supplicant provisioning completes on Windows 10 laptops, the devices reconnect to the corporate SSID but fail authentication with 'EAP-TLS: certificate not found.' The certificate was issued successfully by the internal CA. Which ISE configuration element is most likely missing to ensure the certificate is presented during EAP-TLS?

Accepted Answer

The BYOD client provisioning policy does not include the Windows 10 native supplicant configuration profile with the correct certificate template.. The native supplicant profile in the client provisioning policy must match the operating system and point to the certificate template that was used for enrollment. When the profile is missing or misconfigured, Windows does not know which certificate to select for EAP-TLS, producing a 'certificate not found' error despite successful issuance. Verifying the client provisioning policy and its Windows 10 supplicant profile resolves the issue.

Answer

The authorization policy does not permit EAP-TLS for the BYOD endpoint identity group.

Answer

The internal CA is not included in the ISE trusted certificates store.

Answer

The endpoint is not registered in the BYOD endpoint identity group before provisioning.

Question 19

A network administrator is designing a BYOD onboarding flow for Android devices using Cisco ISE. The requirement is that devices must be enrolled automatically without user interaction after the user authenticates to the guest portal, and the certificate must be delivered to the device. Which two configuration elements are required to support this automated Android onboarding? (Choose two.)

Accepted Answer

A client provisioning policy that matches Android and references a native supplicant profile with the certificate template.. Automated Android BYOD onboarding requires two core ISE elements: an authorization policy that redirects unregistered endpoints to the BYOD registration portal, and a client provisioning policy that matches Android and references a native supplicant profile containing the certificate template. Together they trigger registration, provisioning, and certificate delivery without user interaction beyond initial authentication.

Answer

An external MDM integration that pushes the certificate to the Android device via an MDM profile.

Answer

A guest portal configured with self-registration and sponsor approval for Android devices.

Answer

A posture policy that requires Android devices to have the latest OS patch before provisioning.

Question 20

A network administrator is configuring a BYOD onboarding portal in Cisco ISE for employee personal devices. The requirement is that after onboarding, devices must be authorized using a certificate that is automatically installed on the device without requiring the user to manually download and install it. The administrator has already configured the certificate template and the client provisioning policy. Which ISE component must be configured to ensure the certificate is provisioned automatically during the onboarding flow?

Accepted Answer

Native supplicant provisioning with certificate provisioning enabled in the supplicant profile. Native supplicant provisioning is the ISE feature that configures the device's native supplicant and can automatically provision a certificate. When the supplicant profile includes certificate provisioning, ISE pushes the certificate during onboarding, eliminating manual installation. The client provisioning policy only selects the profile; it does not perform the provisioning. MDM integration and the onboarding wizard are auxiliary and do not directly install certificates in this flow.

Answer

External MDM integration with certificate authority proxy

Answer

BYOD onboarding wizard with certificate provisioning enabled

Answer

Client provisioning policy with a certificate provisioning profile