SISE Policy Enforcement Practice Test 4 — 15 Questions

Question 1

During an 802.1X process, the NAD sends an Access-Request with a specific Calling-Station-ID. If ISE does not find this in its Endpoint DB, what is the default behavior for the 'Unknown' status?

Accepted Answer

Process based on Authorization Policy match. When ISE receives an Access-Request with a Calling-Station-ID (MAC address) that is not present in the Endpoint Database, the endpoint is assigned the 'Unknown' identity group by default. ISE does not automatically deny or permit — it simply proceeds to evaluate the Authorization Policy, where the 'Unknown' group can be matched by a specific rule (e.g., redirect to guest portal, apply a restrictive dACL, or deny). The outcome is entirely determined by which authorization rule matches.

Answer

Always deny

Answer

Always permit

Answer

Automatically add to database

Question 2

A user is authenticated, but their authorization profile returns the wrong VLAN. Which troubleshooting tool in ISE is best suited to verify the attributes sent to the NAD?

Accepted Answer

Live Logs. Live Logs in ISE provides real-time detailed authentication and authorization logs, including the exact attributes returned to the NAD in the authorization profile. It shows the RADIUS response attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID (VLAN), making it the best tool to verify what was sent to the switch.

Answer

Monitoring -> Alarms

Answer

Policy Simulation

Answer

TCP Dump

Question 3

What is the primary benefit of using a Policy Set compared to the legacy 'Rule-Based' approach in ISE?

Accepted Answer

Improved logical organization and modularity. The primary benefit of a Policy Set over the legacy rule-based approach is improved logical organization and modularity. Policy Sets let you group authentication and authorization rules by use case (e.g., wired 802.1X, wireless guest, VPN) with their own conditions, making large deployments easier to manage and troubleshoot.

Answer

Requires fewer licenses

Answer

Eliminates the need for external identity sources

Answer

Faster performance

Question 4

You are implementing 'Device Administration' (TACACS+) and want to restrict an admin to 'show' commands only. How do you construct this policy?

Accepted Answer

Create a command set with 'show' and assign to an authorization policy rule. To restrict a TACACS+ admin to 'show' commands only, you create a Command Set that defines the permitted commands (e.g., 'show') and then assign that Command Set to an Authorization Policy rule that matches the admin's identity or group. The Command Set is the ISE object that specifies which commands are allowed or denied, and the Authorization Policy rule applies it to the session.

Answer

Use the 'Admin' group in the authentication policy

Answer

Create a shell profile with privilege level 1

Answer

Configure a dACL on the device

Question 5

In the ISE Policy Set, which component is used to define the user credentials' verification method?

Accepted Answer

Authentication Policy. The Authentication Policy within an ISE Policy Set defines the method used to verify user credentials — for example, whether ISE uses an internal identity store, Active Directory, LDAP, or a certificate-based method. It answers the 'how are credentials validated' question, whereas the Authorization Policy answers 'what is the user allowed to do' after authentication succeeds.

Answer

Policy Set Condition

Answer

Result Profile

Answer

Authorization Policy

Question 6

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

Accepted Answer

To test the policy before enforcing access control. Monitoring Mode in Cisco ISE is a deployment phase where the switch port is configured to authenticate and authorize endpoints but does not enforce the result. The purpose is to test policies and gather data without impacting network access, allowing administrators to validate configurations before moving to enforcement. Thus, the correct answer is to test the policy before enforcing access control.

Answer

To force the port to shutdown

Answer

To provide internet access to guests

Answer

To perform vulnerability scanning

Question 7

Which ISE menu path is used to create a new Authorization Profile?

Accepted Answer

Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. In Cisco ISE, Authorization Profiles define the actual permissions or attributes (e.g., VLAN, dACL, SGT) that are applied to a session after a successful authorization policy match. They are created and managed under Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. This is the only path among the options that leads to the Authorization Profiles configuration page.

Answer

Policy -> Policy Sets -> Add

Answer

Policy -> Policy Elements -> Conditions

Answer

Administration -> Identity Management -> Groups

Question 8

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

Accepted Answer

Verify SXP connection status and configuration on both peers. SXP (SGT Exchange Protocol) propagates SGTs between devices that cannot natively carry them (e.g., non-Cisco or older switches). If an SGT is not being embedded in SXP, the first thing to verify is the SXP connection status and configuration on both peers — the connection must be established and the correct SGTs permitted. This is the direct troubleshooting step for SXP propagation failures.

Answer

Verify the dACL configuration

Answer

Verify the RADIUS shared secret

Answer

Verify the EAP protocol version

Question 9

Which of the following is an example of an 'Exception' policy in ISE?

Accepted Answer

A rule placed at the top of the Authorization Policy. In Cisco ISE, an 'Exception' policy is an authorization rule placed at the top of the Authorization Policy set that matches specific conditions and applies a result before the normal rule flow. It is used to override standard authorization for special cases (e.g., a specific user, endpoint, or device) without disturbing the main policy logic. Placing it at the top ensures it is evaluated first.

Answer

A Policy Set condition

Answer

An Identity Source Sequence

Answer

The Default policy set

Question 10

You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?

Accepted Answer

permit ip any any. A dACL is an ordered list of ACEs evaluated top-down, and IOS ACLs have an implicit 'deny ip any any' at the end. To deny a specific subnet while permitting all other traffic, you place the deny ACE for 10.1.1.0/24 first, then explicitly permit everything else with 'permit ip any any' as the final line. Without that explicit permit, the implicit deny would block all remaining traffic.

Answer

deny ip any 10.1.1.0 0.0.0.255

Answer

permit tcp any any

Answer

deny ip any any

Question 11

Which TWO of the following are valid components of an ISE Authorization Policy rule?

Accepted Answer

Results. In Cisco ISE, an Authorization Policy rule is built from two main parts: Conditions and Results. Option E (Conditions) is correct because the rule's conditions define the matching criteria — such as identity group, AD group, device type, or posture status — that determine whether the rule applies to a session. Option A (Results) is correct because the results define what authorization profile or permissions (e.g., VLAN, dACL, SGT, or downloadable ACL) are applied when the conditions match. Option D (Identity Source) is not a component of the authorization rule itself; identity sources are referenced in authentication policy rules to validate credentials. Option B (Device Groups) is used in network device definitions and policy sets, not as a direct authorization rule component. Option C (Authentication protocols) are configured in authentication policy rules, not in authorization policy rules.

Answer

Device Groups

Answer

Authentication protocols

Answer

Identity Source

Question 12

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

Accepted Answer

NAS-Port-Type. The NAS-Port-Type RADIUS attribute (attribute 61) identifies the physical port type used by the network access server (NAS) to authenticate the user. Common values include Ethernet (15) for wired and Wireless-IEEE-802.11 (19) for wireless. ISE policy sets commonly use this attribute to differentiate between wired and wireless requests because it is sent by the NAD in the Access-Request and reliably indicates the access medium.

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

Device-Name

Question 13

What is the purpose of an Authorization Profile's 'Common Tasks'?

Accepted Answer

To configure standard RADIUS attributes easily. The 'Common Tasks' section within an Authorization Profile in Cisco ISE provides a simplified interface for configuring frequently used RADIUS attributes, such as VLAN assignment, dACL, and reauthentication timers. These tasks map to standard RADIUS attributes (e.g., Tunnel-Type, Tunnel-Private-Group-ID, Cisco-AVPair) without requiring manual attribute entry. This streamlines policy creation for common network access scenarios.

Answer

To group devices together

Answer

To define user permissions for ISE UI

Answer

To store identity sources

Question 14

You have a Cisco switch that supports both RADIUS and TACACS+. When using ISE for device administration, which protocol is mandatory for command-level authorization?

Accepted Answer

TACACS+. TACACS+ is mandatory for command-level authorization in Cisco ISE device administration because it separates authentication, authorization, and accounting (AAA) and supports per-command authorization. RADIUS, while used for network access, does not provide the granular command authorization that TACACS+ offers. Therefore, to enforce command-level authorization on a Cisco switch, TACACS+ must be used.

Answer

SSH

Answer

RADIUS

Answer

SNMPv3

Question 15

Which THREE of the following items can be included in an ISE 'Common Task' for authorization?

Accepted Answer

dACL assignment. In Cisco ISE, an authorization policy's Common Tasks are the standard result types that can be returned to a network device after a successful authentication, and they include dACL assignment (B), SGT assignment (C), and VLAN assignment (E). Option B is correct because ISE can push a downloadable ACL (dACL) name to the switch or WLC, which the NAD then applies to the session to filter traffic. Option C is correct because ISE can return a Security Group Tag (SGT) via the RADIUS Cisco-AVPair attribute (cts:security-group-tag), enabling TrustSec enforcement on the network device. Option E is correct because ISE can return a VLAN ID or VLAN name in the RADIUS Tunnel attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) to place the endpoint into a specific VLAN. Option A is not part of a Common Task because password complexity is configured in authentication/identity policies or the identity store, not returned as an authorization result. Option D is not a Common Task because RADIUS session timeout is a session attribute (Session-Timeout) typically set in authorization profiles or global settings, not one of the standard Common Task result categories.

Answer

Password complexity policy

Answer

RADIUS session timeout