SISE Policy Enforcement — Timed 10 Questions

Question 1

When configuring a RADIUS authorization policy for a dot1x deployment, which TWO attributes are commonly used to assign a dynamic VLAN?

Accepted Answer

Tunnel-Type equals VLAN. Option C (Tunnel-Type equals VLAN) is correct because RFC 2868 defines Tunnel-Type as the attribute that specifies the tunneling protocol to use, and setting it to the value VLAN (13) tells the NAS to place the supplicant into a VLAN. Option D (Tunnel-Medium-Type equals 802) is correct because it specifies the tunnel medium as 802 (value 6), which is required alongside Tunnel-Type and Tunnel-Private-Group-ID to form the standard RADIUS VLAN assignment tuple used for dynamic VLANs in dot1x. Option A (Service-Type equals Framed) is not used for VLAN assignment; it indicates the type of service being requested and is not part of the tunnel attributes. Option B (Framed-IP-Address) assigns an IP address to the user, not a VLAN. Option E (Cisco-AV-Pair) is a vendor-specific attribute that can carry VLAN information on Cisco gear, but it is not the commonly standardized attribute pair for dynamic VLAN assignment and is not marked correct here.

Answer

Service-Type equals Framed

Answer

Framed-IP-Address

Answer

Cisco-AV-Pair

Question 2

When configuring dACLs for enforcement on Cisco IOS switches, which TWO of the following are true regarding the behavior of the dACL downloaded from Cisco ISE?

Accepted Answer

The dACL is pushed to the switch using RADIUS VSA 11.. Option C is correct because Cisco ISE delivers the downloadable ACL to the switch inside the RADIUS Access-Accept as the cisco-av-pair VSA (vendor-specific attribute, vendor ID 9, attribute 1), with the value formatted as 'ip:inacl#<number>=...' (or 'ip:outacl#...'), which the switch parses into a named dACL. Option E is correct because a dACL is bound to the individual authenticated session (the endpoint's authorization result) and is applied dynamically to that session's port/interface, so different users on the same switch can receive different ACLs. Option A is incorrect because the dACL is applied in addition to, not as a replacement for, any static ACL already configured on the interface. Option B is incorrect because the dACL is held in RAM and applied dynamically for the session; it is not written to NVRAM as a persistent configuration. Option D is incorrect because the dACL is not applied globally to the switch or to all interfaces — it is scoped to the specific authenticated session.

Answer

The dACL replaces existing static ACLs on the interface.

Answer

The dACL is downloaded to the switch NVRAM.

Answer

The dACL is applied globally to the switch interface.

Question 3

You are implementing Cisco TrustSec and need to restrict traffic between two different SGTs on a Cisco Catalyst switch. Which policy component enforces this communication restriction?

Accepted Answer

SGACL. SGACLs (Security Group ACLs) are the policy components in Cisco TrustSec that enforce traffic restrictions between different Security Group Tags (SGTs). They define permit/deny rules based on source and destination SGTs and are downloaded to the network device to filter traffic. SGACLs are applied in the egress direction on the switch port.

Answer

CTS Role-Based Policy

Answer

SGT Mapping

Answer

dACL

Question 4

An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?

Accepted Answer

Enable SGT propagation on the policy set. For SGT-based enforcement to work end-to-end, ISE must propagate the SGT to the network device as part of the authorization result, which requires enabling SGT propagation (inline tagging) on the relevant policy set/authorization profile. Without propagation, the switch never learns the SGT and cannot apply SGACLs between SGT 10 and SGT 20.

Answer

Manually map IP to SGT on all switches

Answer

Configure the SGACL on the client

Answer

Create a dACL with SGT 10

Question 5

A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?

Accepted Answer

Authorization Profile. In Cisco ISE, the Authorization Profile is the component that contains the actual network access attributes returned to the NAD, such as VLAN assignment (e.g., 'VLAN 100' or the IETF RADIUS attribute Tunnel-Private-Group-ID). The Authorization Policy rule matches conditions (like AD group membership) and then references an Authorization Profile to apply the VLAN. Therefore, the AD group-to-VLAN mapping is configured in the Authorization Profile.

Answer

Authentication Policy

Answer

Policy Set

Answer

Authorization Policy

Question 6

You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?

Accepted Answer

Session:AuthenticationStatus equals Guest. The 'Guest Type' or 'Guest Flow' attributes are specific to the Guest portal authentication process, ensuring the policy only applies after successful portal interaction.

Answer

Radius:Service-Type equals Framed

Answer

Device:DeviceType equals Wireless

Answer

Radius:Called-Station-ID

Question 7

Which attribute is used to enforce dACLs on a Cisco Catalyst switch from ISE?

Accepted Answer

cisco-av-pair. The cisco-av-pair attribute is a vendor-specific attribute (VSA) in RADIUS that allows Cisco devices to receive advanced authorization parameters from ISE. For dACLs (downloadable ACLs), ISE sends the cisco-av-pair with the value 'ip:inacl#=' or simply references a named ACL. This attribute is parsed by the switch to apply the ACL to the session. Other attributes like Filter-Id are used for standard ACLs but not for dACLs on Cisco Catalyst switches.

Answer

Filter-Id

Answer

Class attribute

Answer

Tunnel-Private-Group-ID

Question 8

Which of the following is a valid condition for an ISE Authorization Policy?

Accepted Answer

Device-Type EQUALS Switch. ISE conditions can be based on device type, user group, location, or protocol.

Answer

SGT EQUALS 5

Answer

VLAN EQUALS 10

Answer

Username EQUALS 'Admin'

Question 9

Which of the following is NOT a standard RADIUS attribute type used in ISE?

Accepted Answer

Protocol Header. In Cisco ISE, RADIUS attributes are categorized into three standard types: System Defined (Cisco-proprietary attributes), IETF (standard RADIUS attributes defined in RFC 2865/2866), and Vendor Specific (VSAs, defined in RFC 2865). 'Protocol Header' is not a RADIUS attribute type; it refers to the structure of the RADIUS packet itself (Code, Identifier, Length, Authenticator, Attributes). Therefore, 'Protocol Header' is the correct answer as it is NOT a standard attribute type used in ISE.

Answer

System Defined

Answer

IETF

Answer

Vendor Specific

Question 10

Which of the following is a key requirement for dACL enforcement on a Cisco switch?

Accepted Answer

The switch must support RADIUS dynamic authorization. dACL (downloadable ACL) enforcement on a Cisco switch requires the switch to support RADIUS dynamic authorization (RFC 5176, Change of Authorization / Disconnect). This allows ISE to push the dACL to the switch after authentication via a CoA packet, which the switch then applies to the port. Without dynamic authorization support, the switch cannot receive and enforce the dACL.

Answer

The switch must be in Layer 3 mode

Answer

The switch must be running in VTP Transparent mode

Answer

The switch must have 'aaa authorization auth-proxy' enabled