SISE Policy Enforcement Practice Test 2 — 15 Questions

Question 1

Which TWO of the following are steps to handle a user authentication failure in ISE?

Accepted Answer

Configure an Authentication Policy rule to match failures. Option A is correct because in Cisco ISE you handle authentication failures by creating an Authentication Policy rule whose conditions match the failed authentication result (e.g., matching on the 'AuthenticationStatus' or 'Failed' identity/result attributes), so the failure is caught and processed by a dedicated rule rather than falling through to a default deny. Option C is correct because enabling the 'Continue' option on an Authentication Policy rule allows ISE to keep evaluating subsequent rules after a match, which is required when you want a failure-handling rule to apply additional authorization or logging logic instead of stopping at the first match. Disabling the NAD port (B) is a switch-level action that blocks all traffic and does not process or remediate the authentication failure in ISE. Deleting the user account (D) removes the identity entirely and does not constitute a failure-handling step. Changing the device password (E) is a credential change, not a policy-based mechanism for handling authentication failures.

Answer

Disable the NAD port

Answer

Delete the user account

Answer

Change the device password

Question 2

You are implementing SGT-based enforcement on a Catalyst switch. The switch is not correctly applying the SGACLs. What is the first step you should verify on the Cisco ISE side to ensure the SGT is being correctly communicated?

Accepted Answer

Verify the SGT configuration in the Policy Set Authorization Profile. You must ensure the SGT mapping is correctly configured in the Scalable Group Tag mapping section and that the SGT is included in the RADIUS Access-Accept packet via the Cisco-AV-Pair.

Answer

Configure a new SXP connection to the switch

Answer

null

Answer

Check the TrustSec matrix in the switch CLI

Answer

Change the Policy Set to use TACACS+

Question 3

You are troubleshooting a scenario where an SGT is not being assigned to a session. You notice the Authorization Profile is correctly configured. What must be configured on the Network Access Device (NAD) to allow the SGT to be learned from the RADIUS Access-Accept?

Accepted Answer

Configure the CTS environment to support SGTs. For a Cisco TrustSec SGT to be learned from a RADIUS Access-Accept, the NAD must have the CTS environment enabled. This is done with the global configuration command 'cts credentials' or by enabling CTS on the device, which allows the NAD to process the cisco-av-pair attribute containing the SGT value. Without CTS enabled, the switch will ignore the SGT information even if the Authorization Profile is correct. Thus, option D is the required configuration on the NAD.

Answer

Set the switch port to trunk mode

Answer

Enable Device Tracking

Answer

Enable 802.1X globally

Question 4

When creating a Policy Condition in Cisco ISE, which attribute is most commonly used to identify a user's location?

Accepted Answer

Network Device Location. The Network Device Location attribute in Cisco ISE is a predefined condition that identifies the location of a network device (switch or wireless controller) based on its configured Location group in ISE. It is the most common attribute for location-based policy because it directly maps to the network topology and is easy to manage. Other attributes like NAS-IP-Address can also indicate location, but they require manual mapping and are less intuitive. Thus, Network Device Location is the standard choice for identifying a user's location in policy conditions.

Answer

User-Name

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 5

Which THREE attributes can be used within a Cisco ISE Authorization Policy condition?

Accepted Answer

Device Type. In Cisco ISE, an Authorization Policy condition can reference dictionary attributes such as Device Type (A), which is derived from endpoint profiling and stored in the EndPoints dictionary, allowing rules to match on the profiled device category. Internal Endpoint Group (B) is also a valid condition attribute, since endpoints can be statically or dynamically assigned to identity groups in the Endpoints dictionary that authorization rules can evaluate. Network Device Location (D) is likewise usable, as ISE's Network Device dictionary includes location attributes (for example, Device Location or Network Device Location) that can be matched in authorization conditions. TACACS+ Command (C) is not an authorization condition attribute; TACACS+ command authorization is enforced through command sets and shell profiles in device administration policy, not as an ISE authorization condition. SGT Value (E) is not a standard ISE authorization condition attribute either, since Security Group Tags are typically used in TrustSec policy and are conveyed via SXP or inline tagging rather than being selectable as an ISE authorization condition.

Answer

TACACS+ Command

Answer

SGT Value

Question 6

Which TWO settings in an Authorization Profile are commonly used to restrict a client's network access?

Accepted Answer

dACL name. In Cisco ISE, an Authorization Profile can return a downloadable ACL (dACL) name (option A), which the NAD (e.g., a WLC or switch) downloads and applies to the client's session to filter permitted traffic, directly restricting network access. VLAN assignment (option C) is also commonly used in an Authorization Profile to place the client into a specific VLAN, thereby limiting which network segment and resources it can reach. SGT propagation (B) is about carrying a Security Group Tag for TrustSec policy enforcement, not itself a restriction setting in the profile. Authentication protocol (D) is negotiated during authentication, not an authorization-profile restriction. Identity Source (E) is used during authentication/policy evaluation to look up the user, not to restrict the client's access.

Answer

SGT propagation

Answer

Authentication protocol

Answer

Identity Source

Question 7

Which THREE items are required when configuring a new Policy Set in Cisco ISE?

Accepted Answer

Authentication Policy. When creating a new Policy Set in Cisco ISE, the Policy Set Name (option B) is required because it uniquely identifies the policy set within the Policy Sets hierarchy and is the first field you must supply on the Policy Set configuration page. The Policy Set Condition (option D) is also required, as it defines the matching criteria (e.g., based on RADIUS attributes like NAS-IP-Address, Device Type, or AD group) that determines which policy set a request is evaluated against; without a condition, ISE cannot select the policy set. The Authentication Policy (option A) is required because every policy set must contain at least one authentication policy rule that specifies the identity source and authentication protocol (e.g., PAP, EAP-MSCHAPv2, PEAP) used to validate the supplicant. Authorization Profile (option C) is not required at the policy set level — it is an optional component referenced within authorization policy rules and can be left unassigned. SXP Connection (option E) is unrelated to Policy Set configuration; SXP is a protocol used for IP-to-SGT mapping propagation in TrustSec, not a required element of a policy set.

Answer

Authorization Profile

Answer

SXP Connection

Question 8

A network engineer is configuring Cisco ISE to enforce a downloadable ACL (dACL) on a wired switch port. The dACL is defined in the Authorization Profile, but the switch is not applying it. Which configuration on the switch is required for the dACL to be enforced?

Accepted Answer

Configure the switch to use 'aaa authorization network' with a method list that includes the ISE RADIUS server.. When ISE returns a dACL in the Access-Accept, the switch must be configured to request and apply authorization attributes. This is done by configuring 'aaa authorization network' with a method list that points to the RADIUS server. Without this, the switch will not enforce the dACL, even if the Authorization Profile is correct. The other options do not enable the switch to process the dACL attribute.

Answer

Enable AAA authorization with the 'auth-list' keyword for the interface.

Answer

Enable IP device tracking globally on the switch.

Answer

Configure the switch to send the Cisco AV pair 'ip:inacl' in the RADIUS Access-Accept.

Question 9

A security administrator is configuring Cisco ISE to enforce Security Group Tags (SGTs) for a wired deployment. The administrator wants to ensure that SGTs are properly assigned and enforced. Which two components are required to support SGT assignment and enforcement? (Choose two.)

Accepted Answer

Configure the switch to use 'aaa authorization network' with a method list that includes the ISE RADIUS server.. Dynamic SGT assignment requires ISE to include the SGT in the Authorization Profile using the Cisco AV pair 'cts:security-group-tag'. The switch must also be configured to authorize the session with ISE so it can receive and apply the SGT. Without both, the SGT will not be assigned or enforced. SXP and 'cts manual' are not required for this dynamic assignment process.

Answer

Configure the switch to send the SGT in the RADIUS request using the 'cts' attribute.

Answer

Enable SXP on the switch to propagate SGTs to other devices.

Answer

Configure the switch to use 'cts manual' on the interface.

Question 10

A network administrator is configuring an Authorization Policy in Cisco ISE. The administrator wants to ensure that if a user is not a member of any specific group, they are placed into a guest VLAN. Which condition should be used in the Authorization Policy to identify users who are not members of any group?

Accepted Answer

Use a condition with 'AD-UserGroup' and the operator 'IS_EMPTY'.. To identify users who are not members of any group, the Authorization Policy condition should check if the 'AD-UserGroup' attribute is empty. The 'IS_EMPTY' operator does exactly that. Using 'EQUALS' or 'NOT_EQUALS' to a specific group would only match or exclude that one group, not all groups. The 'CONTAINS' operator with an empty value is not valid. Therefore, 'IS_EMPTY' is the correct choice.

Answer

Use a condition with 'AD-UserGroup' and the operator 'EQUALS' to a specific group.

Answer

Use a condition with 'AD-UserGroup' and the operator 'CONTAINS' with an empty value.

Answer

Use a condition with 'AD-UserGroup' and the operator 'NOT_EQUALS' to a specific group.

Question 11

A network administrator is configuring an authorization policy in Cisco ISE to assign a dynamic VLAN to authenticated endpoints. The administrator wants to use the VLAN ID 250 and has created an authorization profile named 'VLAN250'. When testing, the switch port is not assigned to VLAN 250. After checking the switch configuration, the administrator confirms that RADIUS is correctly configured and the port is in access mode. What is the most likely cause of the issue?

Accepted Answer

The authorization profile does not have the 'VLAN ID' configured in the common tasks.. Dynamic VLAN assignment requires the authorization profile to include the VLAN ID in the common tasks, which generates the appropriate RADIUS tunnel attributes. Without this, the switch cannot assign the endpoint to the desired VLAN. The profile name alone does not configure the attributes; the VLAN ID must be explicitly set in the profile configuration.

Answer

The authorization profile does not have the 'Tunnel-Private-Group-ID' attribute set to 250.

Answer

The switch port is not configured with the 'authentication host-mode multi-domain' command.

Answer

The authorization profile is missing the 'Tunnel-Type' attribute set to VLAN.

Question 12

A network engineer is implementing a TACACS+ command authorization policy on Cisco ISE for a group of network administrators. The requirement is that administrators can execute all 'show' commands but are denied the 'configure' command. The engineer creates a command set with 'permit show.*' and 'deny configure.*'. However, when testing, administrators can still run 'configure terminal'. What is the most likely reason?

Accepted Answer

The command set has a 'permit' statement that matches 'configure' before the 'deny' statement.. In TACACS+ command authorization, the command set is evaluated in order, and the first matching entry is applied. If a permit statement that matches 'configure' precedes the deny, the command will be permitted. The engineer must ensure that deny statements for restricted commands are placed before any broad permit statements, or use specific permits that do not inadvertently match 'configure'.

Answer

The command set is not applied to the correct authorization policy.

Answer

The command set is missing an explicit 'deny' for 'configure' after the 'permit' statements.

Answer

The command set uses regular expressions that are not anchored, causing 'configure' to match 'show' commands.

Question 13

A network administrator is configuring a Cisco ISE authorization policy to assign a downloadable ACL (dACL) to endpoints. The administrator wants to use a dACL named 'DENY_HTTP' that is defined on the switch. Which configuration is required in the authorization profile to reference this dACL?

Accepted Answer

In the authorization profile, set the 'ACL Name' to 'DENY_HTTP' and do not check the 'Downloadable ACL' checkbox.. To reference a locally defined dACL on a switch, the authorization profile must specify the ACL name in the 'ACL Name' field and leave the 'Downloadable ACL' checkbox unchecked. This causes ISE to send the ACL name to the switch, which applies the local ACL. Checking the checkbox would attempt to download the ACL from ISE, which is not desired when the ACL is already on the switch.

Answer

In the authorization profile, set the 'ACL Name' to 'DENY_HTTP' and check the 'Downloadable ACL' checkbox.

Answer

In the authorization profile, set the 'ACL Name' to 'DENY_HTTP' and check the 'Downloadable ACL' checkbox, then define the ACL content in ISE.

Answer

In the authorization profile, set the 'dACL' field to 'DENY_HTTP' and select 'Local' as the ACL type.

Question 14

Which THREE components are required to successfully deploy a Scalable Group Access (SGA) policy for SGT enforcement?

Accepted Answer

SGACL definition. Option C (SGACL definition) is required because Scalable Group Access enforcement relies on Security Group ACLs that specify the permitted or denied traffic between source and destination SGTs; without an SGACL there is no policy to enforce. Option D (TrustSec Matrix configuration) is required because the TrustSec matrix binds source SGTs to destination SGTs and references the SGACLs, defining the actual enforcement policy that the network devices download. Option E (SGT mapping) is required because devices must know which SGT to assign to endpoints or users (via static IP-to-SGT, VLAN-to-SGT, or 802.1X/ISE authorization), otherwise traffic cannot be classified and the matrix/SGACL policy cannot be applied. Option A (TACACS+ Command Authorization) is not required for SGA/SGT enforcement; it controls CLI command privileges, not group-based traffic policy. Option B (DHCP Snooping) is not required for SGA/SGT enforcement; it is a Layer 2 security feature for DHCP and does not perform SGT classification or SGACL enforcement.

Answer

TACACS+ Command Authorization

Answer

DHCP Snooping

Question 15

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

Accepted Answer

NetworkDevice:Name. The NetworkDevice:Name condition in Cisco ISE allows you to match requests based on the name of the network device (WLC) as defined in ISE's network device repository. This is the correct condition to ensure a policy set only applies to requests originating from a specific WLC, because the WLC is a network device and its name is a unique identifier in ISE.

Answer

Radius:NAS-IP-Address

Answer

Radius:Called-Station-ID

Answer

Device:Model