SISE Policy Enforcement Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are benefits of using the Cisco TrustSec architecture?

Accepted Answer

Simplifies policy management by using SGTs. Option C is correct because Cisco TrustSec replaces traditional IP- and VLAN-based ACLs with Security Group Tags (SGTs), which are logical labels assigned to users, devices, or endpoints; policies are then written once between source and destination SGT pairs (SGACL matrix) rather than per-subnet, greatly simplifying policy management. Option E is correct because SGTs are carried in the packet's Cisco Metadata (CMD) field or inline tag, so enforcement depends on group membership rather than on where the device sits in the network, making the security policy topology-independent and consistent across wired, wireless, and remote locations. The unmarked options do not belong: TrustSec does not eliminate RADIUS (it typically relies on 802.1X/RADIUS for identity and SGT assignment), it does not inherently reduce network latency (it may add tagging overhead), and while SGACLs can be pushed to devices, automatic dACL creation is a feature associated with Cisco ISE/TrustSec deployment mechanics rather than a core architectural benefit, and it is not one of the two marked answers.

Answer

Eliminates the need for RADIUS

Answer

Reduces network latency

Answer

Automatic dACL creation

Question 2

Which TWO of the following are valid locations to check for policy match results in ISE?

Accepted Answer

Live Logs. Option B (Live Logs) is correct because ISE's Live Logs (Operations > Live Logs / RADIUS Live Logs) display real-time authentication and authorization results, including which policy set, authentication rule, and authorization rule matched for each session. Option D (Policy Simulation tool) is correct because the Policy Simulation tool lets you run a simulated authentication/authorization request and shows the exact policy match results, including the matched policy set and rules, without affecting live traffic. Option A (Device Administration console) is incorrect because it is a TACACS+ management area for device administration, not a location for viewing policy match results. Option C (Identity Group properties) is incorrect because identity groups only define group membership and attributes, not policy evaluation results. Option E (RADIUS Secret settings) is incorrect because it only configures the shared secret used between the NAD and ISE, not policy match outcomes.

Answer

Device Administration console

Answer

Identity Group properties

Answer

RADIUS Secret settings

Question 3

Which TWO of the following authentication protocols are supported by ISE for 802.1X?

Accepted Answer

EAP-TLS. EAP-TLS (Option B) is correct because Cisco ISE supports it as an 802.1X authentication method in which both the supplicant and the server authenticate using X.509 digital certificates, providing mutual certificate-based authentication over EAP. PEAP (Option D) is also correct because ISE supports Protected EAP, which establishes a TLS tunnel between the supplicant and the ISE server and then carries an inner authentication method such as MS-CHAPv2 or EAP-GTC. SNMPv2 (Option A) is a network management protocol used for monitoring and configuring devices, not an 802.1X authentication protocol. ICMP (Option C) is a control/diagnostic protocol (e.g., ping) and plays no role in 802.1X authentication. FTP (Option E) is a file transfer protocol and is unrelated to 802.1X authentication.

Answer

SNMPv2

Answer

ICMP

Answer

FTP

Question 4

Which THREE of the following are steps required to configure Cisco ISE for TACACS+ command authorization?

Accepted Answer

Define a Shell Profile. Option A (Define a Shell Profile) is correct because the Shell Profile in Cisco ISE specifies the TACACS+ privilege level and the default command set (permit/deny) applied to the administrative session, which is required for command authorization to function. Option C (Create a Device Administration Policy) is correct because the Device Administration authorization policy set maps the matched identity/group conditions to the Shell Profile and Command Set, thereby enforcing TACACS+ command authorization on network devices. Option D (Define a Command Set) is correct because a Command Set is the reusable list of permitted or denied CLI commands (with optional arguments) that ISE references when evaluating each command sent by the device. Option B (Configure an SGT) is not required, as Security Group Tags are used for TrustSec segmentation, not TACACS+ command authorization. Option E (Enable MAB) is not required, since MAC Authentication Bypass is a network access authentication method for endpoints, not a step in configuring device administration command authorization.

Answer

Configure an SGT

Answer

Enable MAB

Question 5

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

Accepted Answer

SGT (Security Group Tag). Cisco TrustSec Security Group policy enforcement relies on three core building blocks. Option A, SGT (Security Group Tag), is correct because TrustSec classifies traffic by assigning a 16-bit SGT to a source identity, and that tag is what the fabric carries and enforces against. Option C, the enforcement device (e.g., Catalyst switch), is correct because TrustSec enforcement happens at the network device that receives the tagged packet and applies the policy, such as a Catalyst switch acting as an enforcement point. Option D, SGACL (Security Group Access Control List), is correct because SGACLs define the actual permissions between source and destination SGTs and are downloaded to enforcement devices to permit or deny traffic. Option B, TACACS+ command set, is not a TrustSec enforcement component; TACACS+ is used for device administration AAA and command authorization, not for SGT-based traffic policy. Option E, RADIUS shared secret, is also not a TrustSec enforcement component; a shared secret is an authentication credential used between a client and a RADIUS server, not a policy enforcement element.

Answer

TACACS+ command set

Answer

RADIUS shared secret

Question 6

Which TWO of the following are valid ways to restrict access based on posture status in ISE?

Accepted Answer

Create an Authorization Policy rule using Posture status. Option B is correct because ISE enforces posture-based access decisions in the Authorization Policy: you create an authorization rule whose conditions include the posture status attribute (e.g., PostureStatus = Compliant or NonCompliant), so endpoints are granted different authorizations depending on their posture result. Option C is correct because a downloadable ACL (dACL) applied in the authorization result can restrict traffic for non-compliant endpoints, for example by denying most traffic while permitting remediation or quarantine access, which is a valid way to enforce posture-based access restriction. Option A is not correct because the Identity Source Sequence only determines which identity stores are queried during authentication and has nothing to do with posture status. Option D is not correct because a Shell Profile defines CLI/session attributes for TACACS+ device administration, not posture-based network access control. Option E is not correct because the Authentication Policy runs before posture assessment and evaluates identity/authentication conditions, not posture status, which is only known after posture evaluation and is used in the Authorization Policy.

Answer

Change the Identity Source Sequence

Answer

Use a Shell Profile

Answer

Create an Authentication Policy rule using Posture status

Question 7

Which TWO of the following are types of Identity Sources in ISE?

Accepted Answer

Internal Users. In Cisco ISE, an Identity Source is a repository that ISE queries to authenticate and retrieve attributes about a user or endpoint, and both Internal Users (C) and Active Directory (E) are valid Identity Source types. Internal Users (C) is correct because ISE's built-in internal user database can serve as an identity store for local authentication, including users, passwords, and identity group assignments. Active Directory (E) is correct because ISE can join an AD domain and use it as an external identity source via the ISE AD connector for authentication and group/attribute retrieval. The other options are not identity sources: Policy Set (A) is a container that binds conditions to authentication/authorization policies, Authorization Profile (B) is a set of attributes (such as VLAN, dACL, or SGT) applied in an authorization rule result, and Command Set (D) is a TACACS+ construct that defines which CLI commands a user is permitted to run.

Answer

Policy Set

Answer

Authorization Profile

Answer

Command Set

Question 8

Which THREE of the following are found in an Authorization Profile's 'Advanced Attributes'?

Accepted Answer

Vendor Specific Attributes (VSAs). In Cisco ISE, an Authorization Profile's Advanced Attributes section is where you define RADIUS return attributes that are not part of the standard simple attribute list. Option A is correct because Vendor Specific Attributes (VSAs), such as Cisco-AVPair or other vendor-defined RADIUS attributes, are configured there to send vendor-specific authorization data to the NAD. Option B is correct because Custom RADIUS attributes (user-defined RADIUS dictionary attributes) are also added through Advanced Attributes. Option E is correct because the Advanced Attributes area lets you specify attribute name/value pairs (for example, cisco-av-pair = ...) that are returned in the Access-Accept. Option C is not correct because Policy Set conditions are evaluated in the policy set's authentication/authorization rules, not inside an Authorization Profile. Option D is not correct because Device Admin rules are a separate policy construct for TACACS+ device administration, not an Authorization Profile advanced attribute.

Answer

Policy Set conditions

Answer

Device admin rules

Question 9

An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?

Accepted Answer

Authorization Profile. The Authorization Profile is the ISE object that contains the dACL name (and other authorization attributes like VLAN, SGT, or URL redirect) returned to the NAD in the RADIUS Access-Accept. The authorization rule references the Authorization Profile, and ISE pushes the dACL to the switch as part of the authorization result. Without configuring the dACL in an Authorization Profile, ISE has no mechanism to deliver it.

Answer

Network Device Group

Answer

Policy Set Authentication Sequence

Answer

Device Administration Policy Set

Question 10

You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?

Accepted Answer

In the Authorization Policy rule conditions. In Cisco ISE, policy sets are composed of authentication and authorization policies. The authorization policy is where you define conditions based on attributes like Endpoint Identity Groups to determine the level of access granted. Therefore, to ensure only devices matching a specific internal endpoint group are granted access, you must define this requirement in the Authorization Policy rule conditions. This allows ISE to evaluate the endpoint's group membership and enforce the appropriate authorization result.

Answer

In the Results section of the Authentication Policy

Answer

In the RADIUS dictionary under Policy Elements

Answer

In the Policy Set general authentication settings

Question 11

Which Cisco ISE construct is used to combine authentication and authorization policies into a single logical container?

Accepted Answer

Policy Set. A Policy Set in Cisco ISE is the top-level container that binds together authentication and authorization policies for a specific set of conditions (e.g., matching a device type, protocol, or network device). It allows you to define a single logical unit where the authentication policy (who can authenticate) and authorization policy (what they are allowed to do) are evaluated in sequence. This structure simplifies management by grouping related rules, and ISE evaluates policy sets in a top-down order based on their rank. The correct answer is Policy Set because it is explicitly designed to combine these two policy types into one container.

Answer

Identity Source Sequence

Answer

Policy Elements

Answer

Authorization Profile

Question 12

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

Accepted Answer

Authorization Profile. The Authorization Profile in Cisco ISE is where you set attributes like VLAN assignment, dACL, SGT, and reauthentication timers that are returned to the NAD after successful authorization. For wireless clients, the VLAN is typically delivered via RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) configured in the Authorization Profile.

Answer

Policy Set Condition

Answer

Identity Source Sequence

Answer

Authentication Policy

Question 13

A user is failing to receive the expected dACL. The ISE logs show the correct authorization rule was matched, but the dACL is not applied. What is the most likely cause?

Accepted Answer

The Authorization Profile lacks the correct cisco-av-pair attribute. The most likely cause is that the Authorization Profile in ISE lacks the correct cisco-av-pair attribute that defines the dACL name to be returned to the switch. Even if the authorization rule matches, the switch cannot apply a dACL if the RADIUS response does not include the dACL attribute (typically cisco-av-pair with 'ip:inacl#'). The ISE logs show the rule matched, but the dACL is not applied because the profile is missing the attribute.

Answer

The dACL is not assigned to the correct interface on the switch

Answer

The user is in the wrong AD group

Answer

The device is in the wrong network device group

Question 14

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

Accepted Answer

In the Command Set Policy Element. In ISE TACACS+ command authorization, the specific set of commands a user is permitted (or denied) to run is defined inside a Command Set, which is a Policy Element. The Command Set is then referenced by an Authorization Policy rule, which applies it when the user's session matches the rule conditions. This separation lets you reuse the same command list across multiple rules and policy sets.

Answer

In the Policy Set Authentication rule

Answer

In the Authorization Profile

Answer

In the User Identity Group

Question 15

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

Accepted Answer

By creating a Network Device Group. Creating a Network Device Group (NDG) is the best way to group network devices by location so that authorization policies can differentiate them. NDGs can be hierarchical (e.g., Location#Branch) and are referenced directly in policy conditions, making location-based policy enforcement clean and scalable.

Answer

By using IP address ranges in the policy

Answer

By tagging them with SGTs

Answer

By using the Device Name in the condition