When configuring dACLs for enforcement on Cisco IOS switches, which TWO of the following are true regarding the behavior of the dACL downloaded from Cisco ISE?
You are implementing Cisco TrustSec and need to restrict traffic between two different SGTs on a Cisco Catalyst switch. Which policy component enforces this communication restriction?
An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?
A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?
You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?
You are implementing SGT-based enforcement on a Catalyst switch. The switch is not correctly applying the SGACLs. What is the first step you should verify on the Cisco ISE side to ensure the SGT is being correctly communicated?
You are troubleshooting a scenario where an SGT is not being assigned to a session. You notice the Authorization Profile is correctly configured. What must be configured on the Network Access Device (NAD) to allow the SGT to be learned from the RADIUS Access-Accept?
A network engineer is configuring Cisco ISE to enforce a downloadable ACL (dACL) on a wired switch port. The dACL is defined in the Authorization Profile, but the switch is not applying it. Which configuration on the switch is required for the dACL to be enforced?
A security administrator is configuring Cisco ISE to enforce Security Group Tags (SGTs) for a wired deployment. The administrator wants to ensure that SGTs are properly assigned and enforced. Which two components are required to support SGT assignment and enforcement? (Choose two.)
A network administrator is configuring an Authorization Policy in Cisco ISE. The administrator wants to ensure that if a user is not a member of any specific group, they are placed into a guest VLAN. Which condition should be used in the Authorization Policy to identify users who are not members of any group?
A network administrator is configuring an authorization policy in Cisco ISE to assign a dynamic VLAN to authenticated endpoints. The administrator wants to use the VLAN ID 250 and has created an authorization profile named 'VLAN250'. When testing, the switch port is not assigned to VLAN 250. After checking the switch configuration, the administrator confirms that RADIUS is correctly configured and the port is in access mode. What is the most likely cause of the issue?
A network engineer is implementing a TACACS+ command authorization policy on Cisco ISE for a group of network administrators. The requirement is that administrators can execute all 'show' commands but are denied the 'configure' command. The engineer creates a command set with 'permit show.*' and 'deny configure.*'. However, when testing, administrators can still run 'configure terminal'. What is the most likely reason?
A network administrator is configuring a Cisco ISE authorization policy to assign a downloadable ACL (dACL) to endpoints. The administrator wants to use a dACL named 'DENY_HTTP' that is defined on the switch. Which configuration is required in the authorization profile to reference this dACL?
You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?
A TACACS+ command authorization policy is failing to restrict specific configuration changes on a Cisco IOS device. Which field in the TACACS+ Profile must be correctly configured to ensure the command list is evaluated?
A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?
During an 802.1X process, the NAD sends an Access-Request with a specific Calling-Station-ID. If ISE does not find this in its Endpoint DB, what is the default behavior for the 'Unknown' status?
A user is authenticated, but their authorization profile returns the wrong VLAN. Which troubleshooting tool in ISE is best suited to verify the attributes sent to the NAD?
You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?
You have a Cisco switch that supports both RADIUS and TACACS+. When using ISE for device administration, which protocol is mandatory for command-level authorization?
An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?
You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?
A user is failing to receive the expected dACL. The ISE logs show the correct authorization rule was matched, but the dACL is not applied. What is the most likely cause?
When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?
You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?
A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?
You have a policy set where authentication succeeds, but the user is hitting the 'Default' authorization rule instead of the expected rule. What should you check first?
A network engineer is configuring an authorization policy in Cisco ISE to enforce SGT-based segmentation on a Catalyst 9000 switch. The engineer wants to assign a static SGT to endpoints that authenticate via 802.1X and belong to a specific Active Directory group. The switch is already configured with 'cts manual' and 'propagate sgt' on the trunk. Which ISE configuration is required to assign the SGT to the endpoint?
A network administrator is implementing a TACACS+ command authorization policy on Cisco ISE for a group of network devices. The administrator wants to allow users in the 'NetOps' group to execute only 'show' commands and deny all other commands. The policy set for TACACS+ device administration is already configured with the correct conditions. Where in ISE should the administrator define the permitted commands and associate them with the 'NetOps' group?
A security administrator is configuring a policy set in Cisco ISE to enforce different authorization policies based on the endpoint's posture status. The administrator wants to ensure that non-compliant endpoints are placed in a remediation VLAN. Which condition should be used in the authorization policy to match endpoints that have failed posture assessment?
A network engineer is deploying Cisco ISE to enforce Security Group Tags (SGTs) in a wired environment. The engineer wants to ensure that the SGT is assigned to the endpoint during authorization and that the switch enforces the SGT-based policy. Which two actions are required to enable SGT enforcement on the switch? (Choose two.)