SISE Policy Enforcement — 20 Questions

Question 1

When configuring a RADIUS authorization policy for a dot1x deployment, which TWO attributes are commonly used to assign a dynamic VLAN?

Accepted Answer

Tunnel-Type equals VLAN. Option C (Tunnel-Type equals VLAN) is correct because RFC 2868 defines Tunnel-Type as the attribute that specifies the tunneling protocol to use, and setting it to the value VLAN (13) tells the NAS to place the supplicant into a VLAN. Option D (Tunnel-Medium-Type equals 802) is correct because it specifies the tunnel medium as 802 (value 6), which is required alongside Tunnel-Type and Tunnel-Private-Group-ID to form the standard RADIUS VLAN assignment tuple used for dynamic VLANs in dot1x. Option A (Service-Type equals Framed) is not used for VLAN assignment; it indicates the type of service being requested and is not part of the tunnel attributes. Option B (Framed-IP-Address) assigns an IP address to the user, not a VLAN. Option E (Cisco-AV-Pair) is a vendor-specific attribute that can carry VLAN information on Cisco gear, but it is not the commonly standardized attribute pair for dynamic VLAN assignment and is not marked correct here.

Answer

Service-Type equals Framed

Answer

Framed-IP-Address

Answer

Cisco-AV-Pair

Question 2

When configuring dACLs for enforcement on Cisco IOS switches, which TWO of the following are true regarding the behavior of the dACL downloaded from Cisco ISE?

Accepted Answer

The dACL is pushed to the switch using RADIUS VSA 11.. Option C is correct because Cisco ISE delivers the downloadable ACL to the switch inside the RADIUS Access-Accept as the cisco-av-pair VSA (vendor-specific attribute, vendor ID 9, attribute 1), with the value formatted as 'ip:inacl#<number>=...' (or 'ip:outacl#...'), which the switch parses into a named dACL. Option E is correct because a dACL is bound to the individual authenticated session (the endpoint's authorization result) and is applied dynamically to that session's port/interface, so different users on the same switch can receive different ACLs. Option A is incorrect because the dACL is applied in addition to, not as a replacement for, any static ACL already configured on the interface. Option B is incorrect because the dACL is held in RAM and applied dynamically for the session; it is not written to NVRAM as a persistent configuration. Option D is incorrect because the dACL is not applied globally to the switch or to all interfaces — it is scoped to the specific authenticated session.

Answer

The dACL replaces existing static ACLs on the interface.

Answer

The dACL is downloaded to the switch NVRAM.

Answer

The dACL is applied globally to the switch interface.

Question 3

You are implementing Cisco TrustSec and need to restrict traffic between two different SGTs on a Cisco Catalyst switch. Which policy component enforces this communication restriction?

Accepted Answer

SGACL. SGACLs (Security Group ACLs) are the policy components in Cisco TrustSec that enforce traffic restrictions between different Security Group Tags (SGTs). They define permit/deny rules based on source and destination SGTs and are downloaded to the network device to filter traffic. SGACLs are applied in the egress direction on the switch port.

Answer

CTS Role-Based Policy

Answer

SGT Mapping

Answer

dACL

Question 4

An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?

Accepted Answer

Enable SGT propagation on the policy set. For SGT-based enforcement to work end-to-end, ISE must propagate the SGT to the network device as part of the authorization result, which requires enabling SGT propagation (inline tagging) on the relevant policy set/authorization profile. Without propagation, the switch never learns the SGT and cannot apply SGACLs between SGT 10 and SGT 20.

Answer

Manually map IP to SGT on all switches

Answer

Configure the SGACL on the client

Answer

Create a dACL with SGT 10

Question 5

A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?

Accepted Answer

Authorization Profile. In Cisco ISE, the Authorization Profile is the component that contains the actual network access attributes returned to the NAD, such as VLAN assignment (e.g., 'VLAN 100' or the IETF RADIUS attribute Tunnel-Private-Group-ID). The Authorization Policy rule matches conditions (like AD group membership) and then references an Authorization Profile to apply the VLAN. Therefore, the AD group-to-VLAN mapping is configured in the Authorization Profile.

Answer

Authentication Policy

Answer

Policy Set

Answer

Authorization Policy

Question 6

You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?

Accepted Answer

Session:AuthenticationStatus equals Guest. The 'Guest Type' or 'Guest Flow' attributes are specific to the Guest portal authentication process, ensuring the policy only applies after successful portal interaction.

Answer

Radius:Service-Type equals Framed

Answer

Device:DeviceType equals Wireless

Answer

Radius:Called-Station-ID

Question 7

Which attribute is used to enforce dACLs on a Cisco Catalyst switch from ISE?

Accepted Answer

cisco-av-pair. The cisco-av-pair attribute is a vendor-specific attribute (VSA) in RADIUS that allows Cisco devices to receive advanced authorization parameters from ISE. For dACLs (downloadable ACLs), ISE sends the cisco-av-pair with the value 'ip:inacl#=' or simply references a named ACL. This attribute is parsed by the switch to apply the ACL to the session. Other attributes like Filter-Id are used for standard ACLs but not for dACLs on Cisco Catalyst switches.

Answer

Filter-Id

Answer

Class attribute

Answer

Tunnel-Private-Group-ID

Question 8

Which of the following is a valid condition for an ISE Authorization Policy?

Accepted Answer

Device-Type EQUALS Switch. ISE conditions can be based on device type, user group, location, or protocol.

Answer

SGT EQUALS 5

Answer

VLAN EQUALS 10

Answer

Username EQUALS 'Admin'

Question 9

Which of the following is NOT a standard RADIUS attribute type used in ISE?

Accepted Answer

Protocol Header. In Cisco ISE, RADIUS attributes are categorized into three standard types: System Defined (Cisco-proprietary attributes), IETF (standard RADIUS attributes defined in RFC 2865/2866), and Vendor Specific (VSAs, defined in RFC 2865). 'Protocol Header' is not a RADIUS attribute type; it refers to the structure of the RADIUS packet itself (Code, Identifier, Length, Authenticator, Attributes). Therefore, 'Protocol Header' is the correct answer as it is NOT a standard attribute type used in ISE.

Answer

System Defined

Answer

IETF

Answer

Vendor Specific

Question 10

Which of the following is a key requirement for dACL enforcement on a Cisco switch?

Accepted Answer

The switch must support RADIUS dynamic authorization. dACL (downloadable ACL) enforcement on a Cisco switch requires the switch to support RADIUS dynamic authorization (RFC 5176, Change of Authorization / Disconnect). This allows ISE to push the dACL to the switch after authentication via a CoA packet, which the switch then applies to the port. Without dynamic authorization support, the switch cannot receive and enforce the dACL.

Answer

The switch must be in Layer 3 mode

Answer

The switch must be running in VTP Transparent mode

Answer

The switch must have 'aaa authorization auth-proxy' enabled

Question 11

What does the 'Fallthrough' option in an ISE Policy Set rule do?

Accepted Answer

It allows the request to continue to the next rule. The Fallthrough option in an ISE Policy Set rule tells ISE that if the request does not match the conditions of the current rule, it should continue evaluating the next rule in the policy set rather than stopping. This is the default behavior that allows multiple rules to be chained together so that a request can be matched against subsequent rules when the current one fails. Without Fallthrough, ISE would stop processing and apply the default behavior (typically a deny or the Default rule).

Answer

It drops the connection

Answer

It skips the current rule and goes to the next

Answer

It forces the request to the Default rule

Question 12

Which TWO of the following are valid ways to assign a VLAN in an ISE Authorization Profile?

Accepted Answer

Using the VLAN common task. Option A is correct because the VLAN common task in an ISE Authorization Profile is the standard, purpose-built mechanism for assigning a VLAN to the authorization result; ISE then translates it into the appropriate RADIUS attributes (typically the cisco-av-pair tunnel attributes) sent to the switch or WLC. Option E is correct because Tunnel-Private-Group-ID is the RADIUS attribute (RFC 2868) that carries the VLAN identifier for tunneled 802.1X authorization, and ISE can populate it directly in the authorization profile to convey the VLAN to the NAD. Option B is not correct because Filter-Id is used to pass a downloadable ACL name or filter identifier, not a VLAN. Option C is not correct because cisco-av-pair is a generic container attribute; while ISE may use it internally to encode VLAN information, it is not itself a valid way to assign a VLAN in the Authorization Profile UI. Option D is not correct because Framed-IP-Address assigns an IP address to the client, not a VLAN.

Answer

Using the Filter-Id attribute

Answer

Using the cisco-av-pair attribute

Answer

Using the Framed-IP-Address attribute

Question 13

Which THREE of the following are required to successfully implement SXP (SGT Exchange Protocol)?

Accepted Answer

Configure an SGT-to-IP mapping. SXP (SGT Exchange Protocol) is a Cisco TrustSec protocol that propagates SGT-to-IP mappings between network devices, so option C is correct: you must configure an SGT-to-IP mapping (either statically or learned via 802.1X/SGACL) for SXP to have something to advertise. Option D is correct because SXP requires defining an SXP connection between peers (using commands like 'cts sxp connection peer password mode local/speaker' and 'cts sxp enable') so the devices can exchange the SGT-to-IP bindings. Option E is correct because 'cts role-based enforcement' must be enabled on the device (globally and/or on the interface) for the device to actually enforce and propagate SGT-based policy; without it, the SGT information is not enforced. Option A is not required because 802.1X is only one possible method of assigning SGTs to endpoints; SXP can propagate SGTs learned via other means (e.g., static mappings, SGACL, or other identity sources), so enabling 802.1X on all ports is not mandatory. Option B is not required because DHCP snooping is a separate Layer 2 security feature used for IP-to-MAC binding and is not a prerequisite for SXP operation, even though it may be used in some deployments for other purposes.

Answer

Enable 802.1X on all ports

Answer

Enable DHCP snooping

Question 14

Which THREE of the following are valid Policy Set conditions?

Accepted Answer

NAS-Port-Type. In Cisco ISE, a Policy Set condition (the global condition that determines which policy set applies to a request) can be built from dictionary attributes such as NAS-Port-Type (option A), which is a valid RADIUS dictionary attribute used to match the type of access port (e.g., Wireless-IEEE-802.11, Ethernet). User Group (option B) is also valid because ISE exposes the IdentityGroup attribute (e.g., Endpoint Identity Groups or User Identity Groups) as a selectable condition component in policy sets. Location (option D) is valid because ISE provides a Location dictionary attribute (Device Location / Network Device location) that can be used to scope a policy set to a site or building. Switch Serial Number (option C) is not a standard condition attribute exposed for policy set matching, and RADIUS Secret (option E) is a shared secret used for authenticating the NAD-to-ISE RADIUS exchange, not a matchable condition in a policy set.

Answer

Switch Serial Number

Answer

RADIUS Secret

Question 15

Which THREE of the following are necessary to configure CWA (Centralized Web Authentication)?

Accepted Answer

Authorization Policy rule that triggers the redirection profile. Option A is correct because CWA requires an Authorization Policy rule on ISE that matches the endpoint/user condition and applies the redirect authorization result, which is what triggers the redirection profile during the MAB/redirect flow. Option B is correct because the switch must have a redirect ACL that permits traffic to the ISE portal and denies other traffic, so the client's HTTP request is intercepted and redirected to the central web portal. Option D is correct because the Authorization Profile must contain the redirection URL (the ISE guest/portal URL) and reference the redirect ACL, so ISE returns the URL and ACL name in the RADIUS Access-Accept to redirect the client. Option C is not needed because TACACS+ is used for device administration (AAA for CLI access), not for user web authentication. Option E is not needed because SGT mapping (TrustSec security group tagging) is a separate authorization mechanism and is not required to configure CWA.

Answer

TACACS+ profile

Answer

SGT mapping

Question 16

Which TWO of the following are steps to handle a user authentication failure in ISE?

Accepted Answer

Configure an Authentication Policy rule to match failures. Option A is correct because in Cisco ISE you handle authentication failures by creating an Authentication Policy rule whose conditions match the failed authentication result (e.g., matching on the 'AuthenticationStatus' or 'Failed' identity/result attributes), so the failure is caught and processed by a dedicated rule rather than falling through to a default deny. Option C is correct because enabling the 'Continue' option on an Authentication Policy rule allows ISE to keep evaluating subsequent rules after a match, which is required when you want a failure-handling rule to apply additional authorization or logging logic instead of stopping at the first match. Disabling the NAD port (B) is a switch-level action that blocks all traffic and does not process or remediate the authentication failure in ISE. Deleting the user account (D) removes the identity entirely and does not constitute a failure-handling step. Changing the device password (E) is a credential change, not a policy-based mechanism for handling authentication failures.

Answer

Disable the NAD port

Answer

Delete the user account

Answer

Change the device password

Question 17

You are implementing SGT-based enforcement on a Catalyst switch. The switch is not correctly applying the SGACLs. What is the first step you should verify on the Cisco ISE side to ensure the SGT is being correctly communicated?

Accepted Answer

Verify the SGT configuration in the Policy Set Authorization Profile. You must ensure the SGT mapping is correctly configured in the Scalable Group Tag mapping section and that the SGT is included in the RADIUS Access-Accept packet via the Cisco-AV-Pair.

Answer

Configure a new SXP connection to the switch

Answer

null

Answer

Check the TrustSec matrix in the switch CLI

Answer

Change the Policy Set to use TACACS+

Question 18

You are troubleshooting a scenario where an SGT is not being assigned to a session. You notice the Authorization Profile is correctly configured. What must be configured on the Network Access Device (NAD) to allow the SGT to be learned from the RADIUS Access-Accept?

Accepted Answer

Configure the CTS environment to support SGTs. For a Cisco TrustSec SGT to be learned from a RADIUS Access-Accept, the NAD must have the CTS environment enabled. This is done with the global configuration command 'cts credentials' or by enabling CTS on the device, which allows the NAD to process the cisco-av-pair attribute containing the SGT value. Without CTS enabled, the switch will ignore the SGT information even if the Authorization Profile is correct. Thus, option D is the required configuration on the NAD.

Answer

Set the switch port to trunk mode

Answer

Enable Device Tracking

Answer

Enable 802.1X globally

Question 19

When creating a Policy Condition in Cisco ISE, which attribute is most commonly used to identify a user's location?

Accepted Answer

Network Device Location. The Network Device Location attribute in Cisco ISE is a predefined condition that identifies the location of a network device (switch or wireless controller) based on its configured Location group in ISE. It is the most common attribute for location-based policy because it directly maps to the network topology and is easy to manage. Other attributes like NAS-IP-Address can also indicate location, but they require manual mapping and are less intuitive. Thus, Network Device Location is the standard choice for identifying a user's location in policy conditions.

Answer

User-Name

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 20

Which THREE attributes can be used within a Cisco ISE Authorization Policy condition?

Accepted Answer

Device Type. In Cisco ISE, an Authorization Policy condition can reference dictionary attributes such as Device Type (A), which is derived from endpoint profiling and stored in the EndPoints dictionary, allowing rules to match on the profiled device category. Internal Endpoint Group (B) is also a valid condition attribute, since endpoints can be statically or dynamically assigned to identity groups in the Endpoints dictionary that authorization rules can evaluate. Network Device Location (D) is likewise usable, as ISE's Network Device dictionary includes location attributes (for example, Device Location or Network Device Location) that can be matched in authorization conditions. TACACS+ Command (C) is not an authorization condition attribute; TACACS+ command authorization is enforced through command sets and shell profiles in device administration policy, not as an ISE authorization condition. SGT Value (E) is not a standard ISE authorization condition attribute either, since Security Group Tags are typically used in TrustSec policy and are conveyed via SXP or inline tagging rather than being selectable as an ISE authorization condition.

Answer

TACACS+ Command

Answer

SGT Value