SISE Web Auth And Guest Services — 10 Questions

Question 1

When configuring an LWA portal, you notice that the HTTP traffic is not being redirected. What is a primary requirement for LWA that differs from CWA?

Accepted Answer

The NAD must have the 'ip http server' enabled.. For Local Web Authentication (LWA), the network access device (NAD) must have the 'ip http server' enabled to host the web login page locally. This differs from Centralized Web Authentication (CWA), where the NAD redirects to a central portal on Cisco ISE. LWA requires the NAD to serve the portal, hence the HTTP server must be active.

Answer

The endpoint must be statically assigned an IP.

Answer

A redirect ACL must be applied to the ISE interface.

Answer

The ISE node must be the default gateway.

Question 2

A sponsor wants to approve guest accounts via email. Where in ISE must the sponsor account be created and configured to allow this capability?

Accepted Answer

Guest Access > Configure > Sponsor Portals. The Sponsor Portal is where sponsors manage guest accounts, including approval workflows and email notifications.

Answer

Administration > Identity Management > Identities

Answer

Work Centers > Guest Access > Sponsor Groups

Answer

Policy > Policy Elements > Results

Question 3

You are implementing a Guest flow that requires the user to accept an Acceptable Use Policy (AUP). Where is the AUP text configured within the Cisco ISE portal settings?

Accepted Answer

Guest Access > Configure > Guest Portals > [Portal Name] > Portal Page Customization. The AUP text for a guest flow is configured per guest portal under Work Centers > Guest Access > Configure > Guest Portals > [Portal Name] > Portal Page Customization, where the AUP content and the 'Require AUP' toggle are defined. This ties the AUP to the specific portal that presents it, allowing different portals to display different policies.

Answer

Policy > Policy Elements > Results > Authorization Profiles

Answer

Work Centers > Guest Access > Settings > AUP

Answer

Administration > System > Settings > Guest

Question 4

A network administrator is configuring Central Web Authentication (CWA) and needs to ensure that the initial redirect is handled correctly by the switch. Which attribute must the Cisco ISE send to the network access device (NAD) to trigger the redirection?

Accepted Answer

cisco-av-pair = url-redirect=https://ise.example.com:8443/guestportal/gateway. For Central Web Authentication (CWA), ISE must return the cisco-av-pair AV pair 'url-redirect' containing the full HTTPS URL of the ISE guest/central portal gateway so the NAD (switch/WLC) can intercept the HTTP session and redirect the client. The value must include the portal path and port (e.g., :8443/guestportal/gateway) because the NAD uses this exact string in the HTTP 302 redirect it generates. Without this AV pair, the switch has no URL to send the client to and CWA cannot complete.

Answer

cisco-av-pair = redirect-url=http://ise.example.com

Answer

cisco-av-pair = redirect-to=https://ise.example.com

Answer

cisco-av-pair = url-redirect-acl=REDIRECT_ACL

Question 5

Which type of guest account is best suited for a visitor who needs access for exactly one business day and should have their account automatically deleted thereafter?

Accepted Answer

Daily Guest Account. A Daily Guest Account in Cisco ISE is a guest account type with a predefined lifetime of one day (24 hours), after which the account is automatically expired and deleted by the ISE guest account purge process. This matches the requirement for a visitor needing exactly one business day of access with automatic cleanup.

Answer

Self-Registered Guest

Answer

Hotspot Guest

Answer

Sponsored Guest

Question 6

A Guest user is stuck in a loop and cannot access the internet after authenticating. The NAD log shows the session is bouncing between the redirect state and authorized state. What is the most likely cause?

Accepted Answer

The Redirect ACL does not permit traffic to the ISE PSN IP.. A redirect loop between the redirect state and authorized state typically occurs when the Redirect ACL on the NAD does not permit traffic to the ISE PSN IP address, so the guest's browser cannot reach the portal to complete authentication. Without access to the PSN, the NAD keeps redirecting the client, and the session oscillates between states.

Answer

The guest user account is expired.

Answer

The switch is configured for redundant ISE nodes.

Answer

The CoA port is blocked by a firewall.

Question 7

When designing a guest network, you want to ensure that guests cannot reach each other. What is the most effective way to prevent this?

Accepted Answer

Apply a dACL that denies all traffic to the guest subnet.. Private VLANs (PVLANs) or client isolation on the wireless controller are the standard methods to prevent direct client-to-client communication at the link layer.

Answer

Enable MAC filtering on the ISE.

Answer

Configure a higher VLAN for the guests.

Answer

Configure a static route on the default gateway.

Question 8

Which TWO of the following are mandatory components for a CWA deployment?

Accepted Answer

A redirect ACL configured on the NAD.. Option C is correct because Cisco Central Web Authentication (CWA) requires the NAD (switch or WLC) to have a redirect ACL that intercepts the client's initial HTTP/HTTPS traffic and redirects it to the ISE guest portal before authorization completes. Option E is correct because CWA fundamentally depends on a guest portal configured in ISE, which is where the client authenticates via web credentials and triggers the posture/authorization flow. Option A is not required, since CWA works with standard 802.1X/MAC authentication and does not mandate WPA3-Enterprise on the WLC. Option B is not required, as user credentials are validated by ISE, not a local switch database. Option D is not required, because guest clients typically receive addresses via DHCP rather than needing static IPs.

Answer

A WLC with WPA3-Enterprise.

Answer

A local user database on the switch.

Answer

A static IP address for all guest clients.

Question 9

Which TWO of the following can be used to identify a guest device for MAC caching?

Accepted Answer

The Guest Portal ID.. MAC caching relies on the device's MAC address and sometimes the specific portal being accessed to differentiate sessions and cache the device status.

Answer

The user's email address.

Answer

The switch's hostname.

Answer

The user's IP address.

Question 10

Which THREE of the following are mandatory fields for configuring a new Guest Portal in ISE?

Accepted Answer

Portal Name.. Creating a portal requires a unique name, a defined portal type (Hotspot, Guest, etc.), and the selection of the Policy Service Node (PSN) that will host the portal.

Answer

Default Sponsor email.

Answer

Primary DNS server IP.