SISE Policy Enforcement Practice Test 3 — 15 Questions

Question 1

Which component in ISE defines the 'result' of an authorization rule?

Accepted Answer

Authorization Profile. In ISE, an Authorization Profile defines the actual result of an authorization rule, such as VLAN assignment, DACL, SGT, or reauthentication timers. The authorization policy contains rules that reference authorization profiles as the 'then' action. Therefore, the component that defines the 'result' is the Authorization Profile.

Answer

Policy Set

Answer

Identity Source

Answer

Authorization Policy

Question 2

When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?

Accepted Answer

Cisco IOS-style extended access-list format. When you create a downloadable ACL in Cisco ISE, the ACE entries must be written in Cisco IOS-style extended ACL syntax (e.g., 'permit tcp any host 10.1.1.5 eq 443'). ISE does not translate from other formats — it passes the ACE text verbatim to the NAD inside the RADIUS cisco-av-pair attribute, so the syntax must match what the switch's IOS parser expects.

Answer

SGACL tag format

Answer

JSON format

Answer

XML format

Question 3

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

Accepted Answer

Condition matching. In Cisco ISE, each Policy Set contains a set of conditions that are evaluated against incoming RADIUS request attributes (such as NAS-IP-Address, Calling-Station-ID, or Service-Type). The first Policy Set whose conditions match the request is selected for further processing. This condition-based matching allows granular control over which authentication and authorization policies apply to different users, devices, or locations.

Answer

Random selection

Answer

Alphabetical order

Answer

Authentication protocol

Question 4

A user is authenticating using EAP-TLS. Where is the certificate validation policy configured in ISE?

Accepted Answer

Allowed Protocols. In ISE, the certificate validation policy for EAP-TLS is configured under Allowed Protocols. This is where you enable EAP-TLS and configure whether to validate the client certificate against a specific CA, check certificate revocation, and set other TLS-specific options. The Allowed Protocols service is the central place for EAP method configuration.

Answer

Identity Source Sequence

Answer

Authorization Profile

Answer

Policy Set Condition

Question 5

A TACACS+ command authorization policy is failing to restrict specific configuration changes on a Cisco IOS device. Which field in the TACACS+ Profile must be correctly configured to ensure the command list is evaluated?

Accepted Answer

Command Sets. In a TACACS+ Profile in Cisco ISE, the Command Sets field is where you define the list of commands (permit/deny) that will be evaluated for command authorization. If the command list is not correctly configured in the Command Sets, the device will not receive the proper authorization response, and the policy will fail to restrict commands. Therefore, Command Sets is the field that must be correctly configured.

Answer

Device Administration Policy

Answer

Policy Set Condition

Answer

Shell Profile

Question 6

A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?

Accepted Answer

Assign SGTs to the server subnet and the IT group, then apply an SGACL. Cisco TrustSec uses Security Group Tags (SGTs) and Security Group ACLs (SGACLs) to enforce policy based on group membership rather than IP addresses. Assigning an SGT to the server subnet and an SGT to the IT group, then applying an SGACL that permits IT-to-server and denies everyone else, is the most scalable approach because the policy is defined once and enforced across all TrustSec-enabled devices. This avoids per-device or per-user ACL maintenance.

Answer

Configure individual dACLs for every employee

Answer

Hardcode ACLs on every access switch

Answer

Use standard RADIUS VLAN steering

Question 7

When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?

Accepted Answer

Authorization Policy. The Authorization Policy column in the ISE live logs shows the exact authorization rule that was evaluated and matched for a given session. When a user or endpoint attempts access, ISE processes the request through the authentication policy, then the authorization policy, and the live log records which specific rule within the authorization policy was hit. This allows administrators to quickly identify which condition (e.g., AD group, posture status, device type) triggered the result, such as PermitAccess or DenyAccess.

Answer

Authentication Policy

Answer

Policy Set

Answer

Result

Question 8

What is the function of the 'Default' policy set in ISE?

Accepted Answer

It is a catch-all for traffic that does not match other Policy Sets. The 'Default' policy set in ISE is a catch-all that processes any authentication or authorization request that does not match any other policy set. It is the last policy set evaluated and ensures that no traffic is left unprocessed. It can be modified, but it cannot be deleted.

Answer

It is the only policy set allowed to process MAB requests

Answer

It is used to manage ISE internal traffic only

Answer

It cannot be modified

Question 9

In an ISE Authorization Policy, what happens if no rules match a request?

Accepted Answer

The request hits the Default rule in the Policy Set. If no rules match a request in an ISE Authorization Policy, the request hits the Default rule in the Policy Set. The Default rule is a catch-all that typically has a result of 'DenyAccess' unless explicitly configured otherwise. This ensures that unmatched requests are handled consistently, often denying access by default.

Answer

The request is sent to the primary PAN

Answer

The request is automatically permitted

Answer

The NAD closes the port

Question 10

You want to implement a 'Change of Authorization' (CoA) after a user changes their location. How is the CoA triggered by ISE?

Accepted Answer

ISE sends a RADIUS CoA message to the NAD. ISE triggers a Change of Authorization (CoA) by sending a RADIUS Disconnect-Request (code 40) or CoA-Request (code 43) packet directly to the Network Access Device (NAD) that currently has the user's session. This allows ISE to dynamically modify the user's authorization (e.g., VLAN, ACL, SGT) without requiring re-authentication. The NAD must support CoA (RFC 5176) and have the ISE node configured as a CoA client. This is the standard mechanism for enforcing policy changes mid-session.

Answer

The NAD sends a re-authentication request

Answer

It requires a manual port bounce

Answer

The user must log out and back in

Question 11

Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?

Accepted Answer

Common Tasks -> Web Redirection. The Web Redirection option is located under Common Tasks in an Authorization Profile, where you select the redirect type (Centralized Web Auth, Hotspot, Client Provisioning, MDM, etc.) and specify the ACL and redirect URL. This is the standard mechanism for sending endpoints to a WebAuth portal for guest or BYOD flows.

Answer

RADIUS Attributes -> Tunnel-Private-Group-ID

Answer

Advanced Attributes -> ACL

Answer

VLAN/dACL Filters

Question 12

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

Accepted Answer

The switch is missing the 'cts role-based enforcement' command. For SGACL enforcement to occur on a switch, the switch must have the 'cts role-based enforcement' command enabled globally (and often on the interface). Without this command, the switch may receive the SGT via RADIUS but will not enforce any SGACL filtering, resulting in the described failure. This is the most likely reason when the SGT is assigned but filtering does not happen.

Answer

The SGT is not in the ISE database

Answer

RADIUS shared secret is wrong

Answer

The user is in the wrong AD group

Question 13

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

Accepted Answer

It defines the privilege level for the session. The Shell Profile in TACACS+ defines the privilege level for the session. When a user authenticates via TACACS+, the Shell Profile is used to specify the privilege level (e.g., privilege 15) that the user will have on the device. This determines what commands the user can execute. The Shell Profile is part of the authorization process and is often configured on the TACACS+ server.

Answer

It stores the device credentials

Answer

It defines which users can access the device

Answer

It defines the list of allowed commands

Question 14

You are configuring a policy to block access for non-compliant devices. Where do you configure the posture status as a policy condition?

Accepted Answer

Authorization Policy. Posture status (e.g., Compliant, Non-Compliant, Unknown) is evaluated as a condition within the Authorization Policy, where ISE checks the posture result and applies the appropriate authorization profile — such as a quarantine VLAN or restricted dACL for non-compliant devices. The Authorization Policy is the correct location because posture is an authorization-time attribute, not an authentication-time one.

Answer

Authentication Policy

Answer

Endpoint Group

Answer

Identity Source

Question 15

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

Accepted Answer

Authorization Policy Condition. In Cisco ISE, MAB (MAC Authentication Bypass) authorization decisions are made by the Authorization Policy, and the specific conditions that match attributes like MAC address, OUI, or endpoint identity group are configured as conditions within an Authorization Policy rule. To restrict access to specific MAC OUI addresses, you create a condition (e.g., using the 'MACAddress' or 'EndPointMacAddress' attribute with an OUI prefix match) inside the Authorization Policy rule, which then determines the resulting Authorization Profile.

Answer

Authentication Policy

Answer

Identity Source Sequence

Answer

Authorization Profile