SISE Policy Enforcement — 30 Questions

Question 1

You are implementing SGT-based enforcement on a Catalyst switch. The switch is not correctly applying the SGACLs. What is the first step you should verify on the Cisco ISE side to ensure the SGT is being correctly communicated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the SGT configuration in the Policy Set Authorization Profile. You must ensure the SGT mapping is correctly configured in the Scalable Group Tag mapping section and that the SGT is included in the RADIUS Access-Accept packet via the Cisco-AV-Pair.

Answer

Configure a new SXP connection to the switch

Answer

null

Answer

Check the TrustSec matrix in the switch CLI

Answer

Change the Policy Set to use TACACS+

Question 2

Which THREE components are required to successfully deploy a Scalable Group Access (SGA) policy for SGT enforcement?

Accepted Answer

SGACL definition. SGA requires SGT definition, a policy matrix in the Cisco TrustSec configuration, and the enforcement device's capability to apply the SGACL.

Answer

TACACS+ Command Authorization

Answer

DHCP Snooping

Question 3

When configuring a RADIUS authorization policy for a dot1x deployment, which TWO attributes are commonly used to assign a dynamic VLAN?

Accepted Answer

Tunnel-Type equals VLAN. Tunnel-Type and Tunnel-Medium-Type are mandatory RADIUS attributes to signal to a switch that a VLAN assignment is intended.

Answer

Service-Type equals Framed

Answer

Framed-IP-Address

Answer

Cisco-AV-Pair

Question 4

When configuring dACLs for enforcement on Cisco IOS switches, which TWO of the following are true regarding the behavior of the dACL downloaded from Cisco ISE?

Accepted Answer

The dACL is pushed to the switch using RADIUS VSA 11.. dACLs are applied per-session and represent a list of ACEs pushed via RADIUS VSA 11.

Answer

The dACL replaces existing static ACLs on the interface.

Answer

The dACL is downloaded to the switch NVRAM.

Answer

The dACL is applied globally to the switch interface.

Question 5

You are implementing Cisco TrustSec and need to restrict traffic between two different SGTs on a Cisco Catalyst switch. Which policy component enforces this communication restriction?

Accepted Answer

SGACL. SGACLs are applied between source and destination SGTs on the enforcement device to control traffic based on group tags.

Answer

CTS Role-Based Policy

Answer

SGT Mapping

Answer

dACL

Question 6

An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?

Accepted Answer

Enable SGT propagation on the policy set. Before SGTs can be used, the TrustSec matrix must be defined and the ISE must be configured to send SGT information in RADIUS Access-Accept messages.

Answer

Manually map IP to SGT on all switches

Answer

Configure the SGACL on the client

Answer

Create a dACL with SGT 10

Question 7

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

Accepted Answer

NetworkDevice:Name. The Network Device property is used to filter policy sets based on the RADIUS client (WLC) IP or device profile.

Answer

Radius:NAS-IP-Address

Answer

Radius:Called-Station-ID

Answer

Device:Model

Question 8

A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?

Accepted Answer

Authorization Profile. Authorization Profiles are used in ISE to return attributes like VLAN, dACLs, or SGTs to the network access device after successful authentication.

Answer

Authentication Policy

Answer

Policy Set

Answer

Authorization Policy

Question 9

You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?

Accepted Answer

Session:AuthenticationStatus equals Guest. The 'Guest Type' or 'Guest Flow' attributes are specific to the Guest portal authentication process, ensuring the policy only applies after successful portal interaction.

Answer

Radius:Service-Type equals Framed

Answer

Device:DeviceType equals Wireless

Answer

Radius:Called-Station-ID

Question 10

Which component in ISE defines the 'result' of an authorization rule?

Accepted Answer

Authorization Profile. The Authorization Profile is the outcome object that is returned to the NAD to dictate session parameters.

Answer

Policy Set

Answer

Identity Source

Answer

Authorization Policy

Question 11

Which attribute is used to enforce dACLs on a Cisco Catalyst switch from ISE?

Accepted Answer

cisco-av-pair. The 'cisco-av-pair' attribute with the 'ip:inacl#x=...' format is the standard way to push dACLs.

Answer

Filter-Id

Answer

Class attribute

Answer

Tunnel-Private-Group-ID

Question 12

When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?

Accepted Answer

Cisco IOS-style extended access-list format. dACLs on ISE must be defined using standard IOS-style access-list syntax, and they are pushed to the NAD during the authorization phase.

Answer

SGACL tag format

Answer

JSON format

Answer

XML format

Question 13

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

Accepted Answer

Condition matching. Policy Sets are evaluated from top to bottom based on their defined conditions. The first matching condition wins.

Answer

Random selection

Answer

Alphabetical order

Answer

Authentication protocol

Question 14

A user is authenticating using EAP-TLS. Where is the certificate validation policy configured in ISE?

Accepted Answer

Allowed Protocols. The Allowed Protocols list contains the certificate settings, and this list is referenced within the Authentication Policy.

Answer

Identity Source Sequence

Answer

Authorization Profile

Answer

Policy Set Condition

Question 15

A TACACS+ command authorization policy is failing to restrict specific configuration changes on a Cisco IOS device. Which field in the TACACS+ Profile must be correctly configured to ensure the command list is evaluated?

Accepted Answer

Command Sets. The 'Command Sets' section within the TACACS+ profile allows you to define permitted or denied commands based on regex or explicit strings.

Answer

Device Administration Policy

Answer

Policy Set Condition

Answer

Shell Profile

Question 16

A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?

Accepted Answer

Assign SGTs to the server subnet and the IT group, then apply an SGACL. Assigning an SGT to the server subnet and using an SGACL policy that allows only the IT SGT is the most scalable TrustSec approach.

Answer

Configure individual dACLs for every employee

Answer

Hardcode ACLs on every access switch

Answer

Use standard RADIUS VLAN steering

Question 17

When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?

Accepted Answer

Authorization Policy. The 'Authorization Policy' column in the Live Logs displays the name of the rule that was triggered for a specific session.

Answer

Authentication Policy

Answer

Policy Set

Answer

Result

Question 18

What is the function of the 'Default' policy set in ISE?

Accepted Answer

It is a catch-all for traffic that does not match other Policy Sets. The Default policy set acts as a catch-all if no other policy set conditions are matched.

Answer

It is the only policy set allowed to process MAB requests

Answer

It is used to manage ISE internal traffic only

Answer

It cannot be modified

Question 19

Which of the following is a valid condition for an ISE Authorization Policy?

Accepted Answer

Device-Type EQUALS Switch. ISE conditions can be based on device type, user group, location, or protocol.

Answer

SGT EQUALS 5

Answer

VLAN EQUALS 10

Answer

Username EQUALS 'Admin'

Question 20

In an ISE Authorization Policy, what happens if no rules match a request?

Accepted Answer

The request hits the Default rule in the Policy Set. If no rules are matched, ISE falls through to the 'Default' rule within the policy set, which usually results in a 'Deny Access' action.

Answer

The request is sent to the primary PAN

Answer

The request is automatically permitted

Answer

The NAD closes the port