SISE Web Auth And Guest Services Practice Test 2 — 15 Questions

Question 1

Which THREE components are part of the 'Guest Access' workflow in Cisco ISE?

Accepted Answer

ISE Policy Sets.. In Cisco ISE, the Guest Access workflow is built around three core components: the Guest Portal (C), which is the web interface where guests self-register or log in and accept acceptable-use policies; the Sponsor Portal (E), which allows authorized sponsors to create, approve, and manage guest accounts and credentials; and ISE Policy Sets (A), which contain the authentication and authorization rules that determine how guest traffic is processed and which portals or access levels guests receive. These three elements together form the end-to-end guest onboarding and access-control flow. Device Sensor Service (B) is incorrect because it is used to collect endpoint profiling attributes from network devices, not to support guest access. Active Directory Join (D) is incorrect because it is an identity-source integration used for authenticating domain users, not a required component of the guest workflow.

Answer

Device Sensor Service.

Answer

Active Directory Join.

Question 2

A network administrator is deploying a Central Web Authentication (CWA) guest solution using Cisco ISE. The guest VLAN must redirect unauthenticated users to the guest portal. Which two components are required for the initial redirection to occur? (Choose two.)

Accepted Answer

An authorization profile that returns the cisco-av-pair url-redirect and url-redirect-acl attributes. For CWA redirection to work, ISE must return an authorization profile containing the cisco-av-pair attributes url-redirect and url-redirect-acl. The switch must also have an ACL configured with the exact name specified in url-redirect-acl. These two elements together enable the switch to intercept the client's HTTP traffic and redirect it to the guest portal while blocking other traffic. Without either component, the redirection fails.

Answer

MAC Authentication Bypass (MAB) enabled on the switch port

Answer

A certificate installed on the guest endpoint for HTTPS redirection

Answer

A downloadable ACL (dACL) pushed from ISE to the switch

Question 3

A network engineer is setting up a guest portal in Cisco ISE. The portal will be used by visitors to register and gain internet access. The engineer wants to ensure that the portal is accessible over HTTPS and that the certificate presented is trusted by the guests' browsers. Which certificate store should the engineer use to import the public certificate for the guest portal?

Accepted Answer

Portal Certificates store. Cisco ISE organizes certificates into specific stores based on their purpose. The Portal Certificates store is used exclusively for certificates that secure ISE web portals. To avoid browser warnings, the engineer must import a publicly signed certificate, including its private key, into this store and then bind it to the guest portal. The other stores serve different functions such as node communication or trust validation.

Answer

Trusted Certificates store

Answer

System Certificates store

Answer

Local Certificates store

Question 4

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Accepted Answer

The Network Access Device (NAD). The Network Access Device (NAD) is responsible for redirecting the guest user's browser in a Central Web Authentication (CWA) flow. When the endpoint connects, the NAD (e.g., a wireless controller or switch) intercepts the HTTP traffic and redirects the user to the ISE guest portal for authentication.

Answer

The Cisco ISE Policy Service Node (PSN)

Answer

The endpoint's default browser

Answer

The Guest Portal application

Question 5

A guest user reports they receive a certificate warning when redirected to the ISE Guest portal. What is the most common cause of this issue?

Accepted Answer

The ISE server certificate is self-signed or not trusted by the client device.. The most common cause of certificate warnings on the ISE Guest portal is that the ISE server is using a self-signed certificate or a certificate not trusted by the client's browser trust store. Browsers will display a warning when the certificate chain cannot be validated against a trusted CA. Replacing the default self-signed certificate with a CA-signed certificate whose SAN matches the portal FQDN resolves the warning.

Answer

The ISE portal is configured for HTTP instead of HTTPS.

Answer

The DNS server is not resolving the ISE FQDN.

Answer

The switch is not configured for SSL interception.

Question 6

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

Accepted Answer

The NAD is missing the 'aaa server radius dynamic-author' configuration.. In a CWA (Central Web Authentication) flow, after the user authenticates on the portal, ISE must send a Change of Authorization (CoA) to the NAD to move the session from redirected to authenticated. This requires the NAD to be configured with the 'aaa server radius dynamic-author' command so it can accept CoA requests from ISE. Without it, the NAD ignores the CoA and the session remains in the redirected state.

Answer

The Guest user group is missing from the Policy Set.

Answer

The Redirect ACL is applied to the wrong interface.

Answer

The portal URL is incorrect.

Question 7

You are troubleshooting a Guest flow where the client hits the portal but cannot authenticate. You notice the MAC address is not being cached properly. Which setting in the Guest Portal configuration is responsible for enabling MAC caching?

Accepted Answer

Enable MAC Caching. MAC caching in the ISE Guest Portal configuration allows the client's MAC address to be remembered after successful authentication, so subsequent connections bypass the portal and are authenticated automatically. If MAC caching is not enabled, the MAC address is not cached, and the client is forced to re-authenticate through the portal each time, which matches the reported symptom. Enabling MAC Caching in the Guest Portal settings resolves this.

Answer

Enable Auto-Login

Answer

Enable Guest Flow Bypass

Answer

Enable Device Registration

Question 8

You need to allow guest users to access specific internal resources (like a printer) while they are connected to the Guest network. How do you configure this in ISE?

Accepted Answer

Assign a downloadable ACL (dACL) in the Authorization Profile.. A downloadable ACL (dACL) is a Cisco AV pair that ISE sends to the switch in the RADIUS Access-Accept. The switch then applies this ACL to the client's port to filter traffic. This allows granular control, such as permitting access only to a specific printer IP while denying other internal resources. The dACL is defined in the Authorization Profile, which is referenced in the authorization policy rule for guest users.

Answer

Enable Guest VLAN assignment.

Answer

Modify the Redirect ACL on the switch.

Answer

Configure a port-based ACL on the switch interface.

Question 9

Which guest portal type should you select if you want to allow users to connect to the network without any authentication, simply by clicking an 'Accept' button?

Accepted Answer

Hotspot Portal. The Hotspot Portal is specifically designed for unauthenticated guest access where users simply click an 'Accept' button (or similar) to acknowledge the acceptable use policy and gain network access. It requires no credentials, sponsorship, or self-registration, making it the correct choice for click-through access.

Answer

Sponsored Guest Portal

Answer

Guest Portal

Answer

Self-Registered Guest Portal

Question 10

In a CWA flow, what is the significance of the 'cisco-av-pair = url-redirect-acl' attribute?

Accepted Answer

It specifies the name of the ACL on the NAD that defines traffic to be intercepted.. In a Central Web Authentication (CWA) flow, the 'cisco-av-pair = url-redirect-acl' attribute tells the network access device (NAD) which ACL to apply to intercept and redirect the user's HTTP traffic to the ISE portal. The ACL itself is defined locally on the NAD and typically permits DNS and the redirect, while denying other traffic until authentication completes. The attribute does not contain the redirect URL — that is carried by a separate 'url-redirect' attribute.

Answer

It defines the URL to which the user is redirected.

Answer

It triggers the CoA process.

Answer

It defines the guest group permissions.

Question 11

Where do you customize the visual look and feel of the guest portal, such as logos and background colors?

Accepted Answer

Work Centers > Guest Access > Configure > Guest Portals. Guest portal branding — logos, background images, colors, and text — is customized under Work Centers > Guest Access > Configure > Guest Portals. Within a specific portal's configuration you can edit the Portal Page Customization settings, upload a logo, and adjust the color scheme and language. This is the dedicated location for all guest-facing portal appearance changes.

Answer

Administration > System > Settings

Answer

Policy > Policy Elements > Results

Answer

Administration > Identity Management > Identities

Question 12

A user is authenticating via the Sponsored Guest portal. After the sponsor approves the guest, the user still cannot access the network. What is the most common reason for this if the RADIUS flow is correct?

Accepted Answer

The NAD is not processing the CoA request sent by ISE.. After a sponsor approves a guest, ISE must push a Change of Authorization (CoA) to the NAD to move the session from the restricted guest VLAN/ACL to the authorized state. If the NAD does not support, is not configured for, or rejects the CoA (RFC 5176), the guest remains in the limited-access state even though ISE shows the account as approved. This is the most common cause when the RADIUS authentication flow itself is working correctly.

Answer

The guest password has expired.

Answer

The guest account is not in the correct group.

Answer

The browser cache is preventing the redirect.

Question 13

When setting up a self-registration portal, you want to require that the guest's email address is validated before granting access. Which feature should you enable?

Accepted Answer

Self-Registration Account Activation. Self-Registration Account Activation is the ISE guest portal feature that requires the guest to validate their email address by clicking an activation link before the account becomes active. When enabled, ISE sends a confirmation email and holds the account in a pending state until the link is clicked. This directly satisfies the requirement to validate the guest's email before granting access.

Answer

Enable Guest MAC Caching

Answer

Enable Captcha

Answer

Require Sponsor Approval

Question 14

You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?

Accepted Answer

It sets the guest account status to 'Pending' until approved.. The 'Sponsor Approval' setting in a Guest Portal configuration sets the guest account status to 'Pending' until a sponsor approves the request. This means the guest cannot access the network until the sponsor explicitly grants approval, typically via the Sponsor Portal. The setting enforces a workflow where guest access is gated by sponsor action.

Answer

It automatically emails the sponsor.

Answer

It sends a RADIUS request to the sponsor's device.

Answer

It allows the guest to bypass the login screen.

Question 15

Which protocol does the Cisco ISE use to inform the NAD that a guest user's session state has changed (e.g., from 'redirect' to 'authenticated')?

Accepted Answer

RADIUS CoA. Cisco ISE uses RADIUS Change of Authorization (CoA) to dynamically change the authorization state of an active session on a Network Access Device (NAD). When a guest user's session state changes (e.g., from redirect to authenticated), ISE sends a RADIUS CoA request (Disconnect or CoA-Request) to the NAD, which then reauthenticates or changes the session's authorization. This is the standard mechanism for dynamic session control.

Answer

HTTP

Answer

SNMP

Answer

TACACS+