SISE Web Auth And Guest Services Practice Test 2 — 15 Questions

Question 1

In a CWA flow, what is the significance of the 'cisco-av-pair = url-redirect-acl' attribute?

Accepted Answer

It specifies the name of the ACL on the NAD that defines traffic to be intercepted.. This attribute tells the NAD which ACL to use to determine which packets should be redirected and which should be allowed to proceed without redirection (e.g., DNS, DHCP, and traffic to ISE).

Answer

It defines the URL to which the user is redirected.

Answer

It triggers the CoA process.

Answer

It defines the guest group permissions.

Question 2

Where do you customize the visual look and feel of the guest portal, such as logos and background colors?

Accepted Answer

Work Centers > Guest Access > Configure > Guest Portals. The 'Portal Page Customization' section within the specific portal configuration allows for uploading custom logos and changing themes.

Answer

Administration > System > Settings

Answer

Policy > Policy Elements > Results

Answer

Administration > Identity Management > Identities

Question 3

A Guest user is stuck in a loop and cannot access the internet after authenticating. The NAD log shows the session is bouncing between the redirect state and authorized state. What is the most likely cause?

Accepted Answer

The Redirect ACL does not permit traffic to the ISE PSN IP.. If the Redirect ACL is not properly configured to exclude the ISE PSN IP, the traffic to the ISE portal might get redirected again, causing a loop.

Answer

The guest user account is expired.

Answer

The switch is configured for redundant ISE nodes.

Answer

The CoA port is blocked by a firewall.

Question 4

A user is authenticating via the Sponsored Guest portal. After the sponsor approves the guest, the user still cannot access the network. What is the most common reason for this if the RADIUS flow is correct?

Accepted Answer

The NAD is not processing the CoA request sent by ISE.. If the session is not updated, the switch doesn't know the status has changed. A CoA is required to re-evaluate the session after approval.

Answer

The guest password has expired.

Answer

The guest account is not in the correct group.

Answer

The browser cache is preventing the redirect.

Question 5

When setting up a self-registration portal, you want to require that the guest's email address is validated before granting access. Which feature should you enable?

Accepted Answer

Self-Registration Account Activation. Email verification requires the user to click a link sent to their email to activate the account. This is configured in the self-registration portal settings.

Answer

Enable Guest MAC Caching

Answer

Enable Captcha

Answer

Require Sponsor Approval

Question 6

You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?

Accepted Answer

It sets the guest account status to 'Pending' until approved.. It forces the guest account status to be 'pending' until a sponsor manually updates it to 'approved', preventing network access until that happens.

Answer

It automatically emails the sponsor.

Answer

It sends a RADIUS request to the sponsor's device.

Answer

It allows the guest to bypass the login screen.

Question 7

Which protocol does the Cisco ISE use to inform the NAD that a guest user's session state has changed (e.g., from 'redirect' to 'authenticated')?

Accepted Answer

RADIUS CoA. Change of Authorization (CoA) is the mechanism used by RADIUS to update an active session.

Answer

HTTP

Answer

SNMP

Answer

TACACS+

Question 8

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

Accepted Answer

Called-Station-ID. The 'Called-Station-ID' attribute, which typically contains the SSID or the Switch Port ID, allows ISE to identify where the connection attempt originated.

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 9

In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?

Accepted Answer

To define attributes like account lifetime and access policies for guest accounts.. Guest types allow you to define common parameters like account duration, password requirements, and access permissions that can be applied to guest accounts.

Answer

To manage the list of sponsors.

Answer

To define the portal look and feel.

Answer

To configure the RADIUS server settings.

Question 10

If a user is redirected to the Guest portal but receives a '404 Page Not Found' error, what is the most likely configuration issue?

Accepted Answer

The redirect URL is pointing to a non-existent portal path or the PSN is not reachable.. If the portal FQDN is not resolvable or the portal service on the PSN is not active, the user will reach a non-existent page.

Answer

The NAD is blocking the traffic.

Answer

The Guest Portal is not enabled on the PSN.

Answer

The user's account is expired.

Question 11

Which portal is intended for guest users to manage their own registered devices, such as adding or removing their personal laptops?

Accepted Answer

My Devices Portal. The 'My Devices' portal is explicitly designed for guests or employees to manage their own registered devices for network access.

Answer

Hotspot Portal

Answer

Sponsor Portal

Answer

Guest Portal

Question 12

You are reviewing the ISE logs and see that the Guest Portal authentication is failing. Where should you look to find the exact reason for the failure?

Accepted Answer

Operations > RADIUS Livelogs. The 'Live Logs' in ISE provide real-time visibility into authentication attempts, including the specific failure reason (e.g., 'invalid credentials', 'user account expired').

Answer

Monitoring > Reports > Guest

Answer

Policy > Policy Sets

Answer

Administration > System > Logging

Question 13

What is the purpose of the 'Guest Flow' setting in the Authorization Profile?

Accepted Answer

It tells the ISE to trigger the Guest Portal.. The Guest Flow setting determines how the guest session is handled by the ISE, specifically linking the authorization profile to the appropriate portal type.

Answer

It defines the session timeout.

Answer

It enables MAC caching.

Answer

It defines the Guest Group.

Question 14

If you want a guest user to be automatically redirected to a specific webpage (e.g., company news) after a successful login, where is this configured?

Accepted Answer

In the Guest Portal Settings under 'Post-Login' page.. The 'Post-Login' landing page configuration in the Guest Portal allows you to define the URL to which the user is redirected after a successful authentication.

Answer

In the Authorization Profile.

Answer

In the Guest Type configuration.

Answer

In the Redirect ACL on the NAD.

Question 15

Which THREE of the following are steps involved in the guest portal sponsor approval process?

Accepted Answer

The sponsor logs into the sponsor portal to review and approve the request.. The workflow involves the guest requesting access, the sponsor receiving an email notification, and the sponsor logging into the portal to approve or deny the request.

Answer

The ISE automatically approves the account after 10 minutes.

Answer

The guest must physically visit the sponsor's office.