SISE Hard Questions — 25 Difficult Questions

Question 1

When configuring a load balancer for a group of PSNs, what is the best practice for handling RADIUS traffic?

Accepted Answer

Source-IP affinity (persistence). RADIUS is a UDP-based protocol where the NAS and PSN maintain session state across the Access-Request/Access-Challenge/Access-Accept exchange. If a load balancer distributes successive packets from the same client to different PSNs, the challenge/response state is lost and authentication fails. Source-IP affinity (persistence) ensures all RADIUS packets from a given NAS or endpoint land on the same PSN for the duration of the session.

Answer

SSL-offloading

Answer

Active-passive failover only

Answer

Round-robin without persistence

Question 2

You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?

Accepted Answer

permit ip any any. A dACL is an ordered list of ACEs evaluated top-down, and IOS ACLs have an implicit 'deny ip any any' at the end. To deny a specific subnet while permitting all other traffic, you place the deny ACE for 10.1.1.0/24 first, then explicitly permit everything else with 'permit ip any any' as the final line. Without that explicit permit, the implicit deny would block all remaining traffic.

Answer

deny ip any 10.1.1.0 0.0.0.255

Answer

permit tcp any any

Answer

deny ip any any

Question 3

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

Accepted Answer

SGT (Security Group Tag). Cisco TrustSec Security Group policy enforcement relies on three core building blocks. Option A, SGT (Security Group Tag), is correct because TrustSec classifies traffic by assigning a 16-bit SGT to a source identity, and that tag is what the fabric carries and enforces against. Option C, the enforcement device (e.g., Catalyst switch), is correct because TrustSec enforcement happens at the network device that receives the tagged packet and applies the policy, such as a Catalyst switch acting as an enforcement point. Option D, SGACL (Security Group Access Control List), is correct because SGACLs define the actual permissions between source and destination SGTs and are downloaded to enforcement devices to permit or deny traffic. Option B, TACACS+ command set, is not a TrustSec enforcement component; TACACS+ is used for device administration AAA and command authorization, not for SGT-based traffic policy. Option E, RADIUS shared secret, is also not a TrustSec enforcement component; a shared secret is an authentication credential used between a client and a RADIUS server, not a policy enforcement element.

Answer

TACACS+ command set

Answer

RADIUS shared secret

Question 4

Which TWO of the following tasks are performed within the Sponsor Portal?

Accepted Answer

Creating new guest accounts.. The Sponsor Portal in Cisco ISE is a web interface used by designated sponsors to manage guest lifecycle tasks, so option D (Creating new guest accounts) is correct because sponsors can create guest accounts directly, specifying duration, login credentials, and other guest details. Option E (Approving guest access requests) is also correct because sponsors receive and act on pending guest access requests, approving or denying them so guests can authenticate. Option A (Mapping VLANs to specific guest SSIDs) is incorrect because VLAN-to-SSID mapping is configured on the wireless LAN controller or in the network access policy, not in the Sponsor Portal. Option B (Configuring global portal branding) is incorrect because portal branding and customization are configured in the Guest Portal settings within ISE administration, not by sponsors in the Sponsor Portal. Option C (Defining RADIUS shared secrets) is incorrect because RADIUS shared secrets are configured on network devices and in ISE's network device definitions, not in the Sponsor Portal.

Answer

Mapping VLANs to specific guest SSIDs.

Answer

Configuring global portal branding.

Answer

Defining RADIUS shared secrets.

Question 5

Which TWO settings in an Authorization Profile are commonly used to restrict a client's network access?

Accepted Answer

dACL name. In Cisco ISE, an Authorization Profile can return a downloadable ACL (dACL) name (option A), which the NAD (e.g., a WLC or switch) downloads and applies to the client's session to filter permitted traffic, directly restricting network access. VLAN assignment (option C) is also commonly used in an Authorization Profile to place the client into a specific VLAN, thereby limiting which network segment and resources it can reach. SGT propagation (B) is about carrying a Security Group Tag for TrustSec policy enforcement, not itself a restriction setting in the profile. Authentication protocol (D) is negotiated during authentication, not an authorization-profile restriction. Identity Source (E) is used during authentication/policy evaluation to look up the user, not to restrict the client's access.

Answer

SGT propagation

Answer

Authentication protocol

Answer

Identity Source

Question 6

Which THREE of the following are potential reasons a device might be placed in a 'Quarantine' VLAN during the BYOD process?

Accepted Answer

Device failed MDM compliance check. Option A is correct because when a BYOD device fails an MDM compliance check (e.g., no passcode, jailbroken/rooted, missing required apps), NAC/onboarding workflows commonly redirect it to a quarantine VLAN so it can remediate before gaining full network access. Option C is correct because an OS version below the organization's minimum requirement is a classic non-compliance condition that triggers quarantine until the device is updated. Option D is correct because a missing or expired client certificate fails the EAP-TLS/802.1X authentication or posture check, causing the supplicant to be placed in the quarantine VLAN for certificate enrollment or remediation. Option B is not a quarantine trigger because a forgotten Wi-Fi password simply causes an authentication failure, not a posture-based quarantine decision. Option E is not a valid reason because a newer device is generally more compliant, not less, and being 'too new' is not a standard quarantine criterion.

Answer

User forgot their Wi-Fi password

Answer

The device is too new

Question 7

An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?

Accepted Answer

Enable SGT propagation on the policy set. For SGT-based enforcement to work end-to-end, ISE must propagate the SGT to the network device as part of the authorization result, which requires enabling SGT propagation (inline tagging) on the relevant policy set/authorization profile. Without propagation, the switch never learns the SGT and cannot apply SGACLs between SGT 10 and SGT 20.

Answer

Manually map IP to SGT on all switches

Answer

Configure the SGACL on the client

Answer

Create a dACL with SGT 10

Question 8

You are troubleshooting a scenario where guest users are not being redirected when connecting to an open SSID. The WLC reports that the client is stuck in the 'Webauth' state but the portal never loads. Which component should you verify first?

Accepted Answer

Check if the client can resolve the ISE FQDN via DNS.. When a client is stuck in 'Webauth' state and the portal never loads, the most likely cause is that the client cannot resolve the ISE FQDN to an IP address, so the redirect fails. Verifying DNS resolution is the first troubleshooting step because the WLC redirects the client to the ISE portal by FQDN, and without DNS the client cannot reach the portal.

Answer

Increase the idle timeout on the WLC's WLAN configuration.

Answer

Verify the WLC's 'Web Auth Redirect' configuration and ensure the 'Virtual Gateway' address is reachable.

Answer

Re-import the Guest Portal certificate on the WLC.

Question 9

During a troubleshooting session, you notice that the AnyConnect agent is not receiving the posture policy. Which log file on the ISE Policy Service Node (PSN) should you examine?

Accepted Answer

ise-psc.log. The ise-psc.log on the Policy Service Node records Policy Service Node (PSN) activity, including posture policy delivery and AnyConnect posture agent interactions. When the agent is not receiving the posture policy, this log captures the policy evaluation and communication between ISE and the endpoint agent, making it the correct file to examine.

Answer

prrt-server.log

Answer

guest.log

Answer

admin.log

Question 10

If you want to use a script remediation, where do you define the script content?

Accepted Answer

Directly in the 'Script Remediation' action in ISE. In Cisco ISE, when configuring a posture policy with a script remediation action, the script content is defined directly within the 'Script Remediation' action itself. This allows the administrator to embed the script that will be executed on the endpoint to remediate the non-compliance.

Answer

In the Client Provisioning Resource file

Answer

In the Posture Policy XML

Answer

On the endpoint in the AnyConnect directory

Question 11

A posture condition is defined to check for a registry key, but it always returns 'Non-Compliant'. You suspect the 'Expected Value' is wrong. Where can you see what the agent actually found on the endpoint?

Accepted Answer

Operations > Reports > Endpoints > Posture Assessment. The Operations > Reports > Endpoints > Posture Assessment report provides detailed information about posture assessments, including the actual values found on the endpoint for each condition. This allows you to compare the expected value with what the agent reported, helping to diagnose why a condition is returning Non-Compliant.

Answer

Context Visibility > Endpoints

Answer

Client Provisioning > Resources

Answer

Policy > Posture > Conditions

Question 12

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

Accepted Answer

Called-Station-ID. Called-Station-ID is the RADIUS attribute that carries the identifier of the network access point (e.g., the SSID or the MAC address of the wireless controller/AP) that the guest is connecting to. In a guest flow, this attribute is used to determine the physical location of the request because it identifies the specific access device. Cisco ISE uses Called-Station-ID in authorization policies to apply location-based restrictions or to track where a guest session originates.

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 13

A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?

Accepted Answer

Adjust the Policy Set conditions. Policy Set conditions are the top-level matching criteria that determine which policy set a request is evaluated against. If guest traffic is landing in the wrong policy set, the fix is to adjust the conditions (e.g., SSID, NAS-IP-Address, device type, or RADIUS attributes) so the guest session matches the 'Guest' policy set. Reordering only changes evaluation order among policy sets that already match — it does not change which conditions cause a match.

Answer

Modify the guest portal settings

Answer

Change the authentication sequence

Answer

Reorder the policy sets

Question 14

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

Accepted Answer

The device remains Non-Compliant. If an endpoint is determined to be Non-Compliant and no remediation action is configured, the device remains Non-Compliant. The posture policy will not automatically remediate or grant full access; the status persists until remediation is applied or the policy changes. Thus, option D is correct.

Answer

The agent automatically remediates the issue

Answer

The device is granted full access

Answer

The posture agent crashes

Question 15

Which TWO methods can be used to verify that a TACACS+ request from a network device is reaching the Cisco ISE PSN?

Accepted Answer

Reviewing the Operations > TACACS Livelogs in the ISE GUI.. Option B is correct because the Operations > TACACS Livelogs page in the ISE GUI shows TACACS+ authentication and authorization requests as they arrive at the PSN, confirming the request reached ISE. Option D is correct because running a packet capture (tcpdump) on the PSN interface lets you see the inbound TCP port 49 traffic from the network device, directly proving the TACACS+ request arrived. Option A is wrong because Network Device Group membership only defines device classification, not whether a request reached the PSN. Option C is wrong because Policy Set order of precedence controls rule evaluation, not request arrival. Option E is wrong because switch console AAA server status shows local client-side state, not whether the request reached the ISE PSN.

Answer

Checking the Network Device Group membership list.

Answer

Viewing the Policy Set order of precedence.

Answer

Checking the switch console logs for AAA server status.

Question 16

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

Accepted Answer

TACACS+ Livelogs. TACACS+ Livelogs in Cisco ISE is the dedicated real-time log view that shows TACACS+ authentication and authorization request details, including the policy set and rule that matched. When troubleshooting TACACS+ authentication issues, this is the correct log to monitor because it captures the full request/response exchange and the policy evaluation result. RADIUS Livelogs, by contrast, only show RADIUS traffic and would not display TACACS+ request details.

Answer

System Summary Dashboard

Answer

Endpoint Context Visibility

Answer

RADIUS Livelogs

Question 17

If a PSN loses connectivity to the PAN, what happens to existing user sessions?

Accepted Answer

Sessions remain active and the PSN continues to authenticate. When a PSN loses connectivity to the PAN, existing user sessions remain active and the PSN continues to authenticate new sessions using its last known policy configuration. This is by design to maintain network access during PAN outages.

Answer

All sessions are terminated

Answer

The PSN enters emergency mode

Answer

The PSN reboots

Question 18

You are using the Feed Service to update your profiling policies. How can you ensure that custom profiling policies you have created are not overwritten during the update?

Accepted Answer

Custom policies are not affected by Feed Service updates.. Cisco ISE's Feed Service updates only the system-provided profiling policies that ship with ISE; custom profiling policies created by administrators are stored separately and are not overwritten or removed during a feed update. This design lets organizations receive updated fingerprints for new device types without losing their own customizations.

Answer

Place custom policies in the system policy folder.

Answer

Export custom policies before every update.

Answer

Disable automatic updates.

Question 19

You are configuring a policy to block access for non-compliant devices. Where do you configure the posture status as a policy condition?

Accepted Answer

Authorization Policy. Posture status (e.g., Compliant, Non-Compliant, Unknown) is evaluated as a condition within the Authorization Policy, where ISE checks the posture result and applies the appropriate authorization profile — such as a quarantine VLAN or restricted dACL for non-compliant devices. The Authorization Policy is the correct location because posture is an authorization-time attribute, not an authentication-time one.

Answer

Authentication Policy

Answer

Endpoint Group

Answer

Identity Source

Question 20

You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?

Accepted Answer

The necessary probes are not receiving enough attributes to match a policy.. Profiling in ISE relies on collecting attributes from various probes (DHCP, HTTP, RADIUS, SNMP, etc.) and matching them against profiling policies. If the endpoint shows as 'Unknown', the most likely cause is that the probes are not receiving enough attributes — or the attributes received do not match any existing policy condition. Without sufficient attribute data, ISE cannot classify the device even if it is obviously a Windows workstation to a human.

Answer

The device is using a static IP.

Answer

The endpoint is not authenticated.

Answer

The endpoint has a firewall enabled.