SISE Web Auth And Guest Services Practice Test 3 — 15 Questions

Question 1

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

Accepted Answer

Called-Station-ID. Called-Station-ID is the RADIUS attribute that carries the identifier of the network access point (e.g., the SSID or the MAC address of the wireless controller/AP) that the guest is connecting to. In a guest flow, this attribute is used to determine the physical location of the request because it identifies the specific access device. Cisco ISE uses Called-Station-ID in authorization policies to apply location-based restrictions or to track where a guest session originates.

Answer

Framed-IP-Address

Answer

Calling-Station-ID

Answer

NAS-IP-Address

Question 2

In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?

Accepted Answer

To define attributes like account lifetime and access policies for guest accounts.. Guest Types in ISE define the template for guest accounts, including account lifetime (duration), maximum simultaneous logins, and the access policies (authorization profiles) that apply to that type of guest. They allow administrators to create different classes of guests (e.g., short-term visitor vs. long-term contractor) with distinct attributes.

Answer

To manage the list of sponsors.

Answer

To define the portal look and feel.

Answer

To configure the RADIUS server settings.

Question 3

If a user is redirected to the Guest portal but receives a '404 Page Not Found' error, what is the most likely configuration issue?

Accepted Answer

The redirect URL is pointing to a non-existent portal path or the PSN is not reachable.. A '404 Page Not Found' on the guest portal almost always means the redirect URL the NAD was given points to a path that does not exist on the PSN, or the PSN hosting the portal is unreachable from the client. ISE constructs the redirect URL from the portal configuration and the PSN's hostname/FQDN, so a mismatch in the portal name, a stale DNS entry, or an unreachable PSN produces a 404 rather than a login page.

Answer

The NAD is blocking the traffic.

Answer

The Guest Portal is not enabled on the PSN.

Answer

The user's account is expired.

Question 4

Which portal is intended for guest users to manage their own registered devices, such as adding or removing their personal laptops?

Accepted Answer

My Devices Portal. The My Devices Portal is specifically designed for end users (including guests) to self-register, add, and remove their personal devices, such as laptops and smartphones, without sponsor intervention. It provides a self-service interface for device management tied to the user's account.

Answer

Hotspot Portal

Answer

Sponsor Portal

Answer

Guest Portal

Question 5

You are reviewing the ISE logs and see that the Guest Portal authentication is failing. Where should you look to find the exact reason for the failure?

Accepted Answer

Operations > RADIUS Livelogs. Operations > RADIUS Livelogs provides real-time, detailed RADIUS authentication and authorization logs, including the exact failure reason for guest portal authentication attempts. It shows the full RADIUS request/response exchange, the policy set matched, and any error codes. This is the primary place to diagnose why a guest authentication is failing.

Answer

Monitoring > Reports > Guest

Answer

Policy > Policy Sets

Answer

Administration > System > Logging

Question 6

What is the purpose of the 'Guest Flow' setting in the Authorization Profile?

Accepted Answer

It tells the ISE to trigger the Guest Portal.. The 'Guest Flow' setting in an ISE Authorization Profile tells ISE to redirect the endpoint to the Guest Portal for registration or sponsorship, rather than granting normal network access. It is the mechanism that triggers the guest onboarding workflow when a user or device is not yet known to ISE. This is distinct from session timeout, MAC caching, or group definition, which are separate authorization attributes.

Answer

It defines the session timeout.

Answer

It enables MAC caching.

Answer

It defines the Guest Group.

Question 7

If you want a guest user to be automatically redirected to a specific webpage (e.g., company news) after a successful login, where is this configured?

Accepted Answer

In the Guest Portal Settings under 'Post-Login' page.. The post-login redirect URL for guest users is configured in the Guest Portal Settings under the 'Post-Login' page, where administrators specify the URL to which guests are redirected after successful authentication. This is a portal-level setting, not an authorization or NAD-level configuration, because the redirect is part of the web portal experience rather than the network enforcement.

Answer

In the Authorization Profile.

Answer

In the Guest Type configuration.

Answer

In the Redirect ACL on the NAD.

Question 8

Which THREE of the following are steps involved in the guest portal sponsor approval process?

Accepted Answer

The sponsor logs into the sponsor portal to review and approve the request.. In the Cisco ISE guest sponsor approval workflow, the process begins when the guest registers for an account on the self-registration portal (B), which creates a pending guest account that requires sponsor action. The sponsor then logs into the sponsor portal to review and approve the request (A), which is the core approval step that activates the guest account. The sponsor also receives an automated email notification about the pending account (D), alerting them that a guest is awaiting approval so they can act on it. Option C is incorrect because ISE does not automatically approve accounts after 10 minutes; approval requires explicit sponsor action (or a configured automatic approval policy, not a fixed timer). Option E is incorrect because the entire sponsor approval process is performed through the portals and email notifications, with no requirement for the guest to physically visit the sponsor's office.

Answer

The ISE automatically approves the account after 10 minutes.

Answer

The guest must physically visit the sponsor's office.

Question 9

Which THREE of the following items are verified by ISE when a guest attempts to authenticate?

Accepted Answer

Account expiration date.. When a guest authenticates against ISE, the guest portal validates the submitted username and password against the internal guest account store, so option D (Password credentials) is verified. ISE also checks the guest account's lifecycle attributes, including the expiration date set when the account was created or sponsored, making option A (Account expiration date) correct. Additionally, ISE evaluates the account's status field — Approved, Pending, Suspended, or Disabled — to decide whether the guest is permitted to log in, which is option E (Account status). Option B is not verified during authentication because the NAD's physical location is not an attribute ISE checks for guest login, and option C is incorrect because the browser version is not part of ISE's guest authentication validation.

Answer

The physical location of the NAD.

Answer

The user's browser version.

Question 10

Which TWO of the following settings are available for customizing the guest portal login page?

Accepted Answer

Inclusion of a mandatory AUP checkbox.. Option B is correct because guest portal configurations in ClearPass (and similar NAC solutions) allow administrators to enable a mandatory Acceptable Use Policy checkbox that users must acknowledge before authenticating, which is a standard customization on the login page. Option E is correct because the login form's header and footer text are editable fields within the guest portal customization settings, letting administrators add branding, instructions, or legal notices. Option A is not a guest portal login page setting; switch interface selection relates to network infrastructure configuration, not portal appearance. Option C is incorrect because direct editing of Apache server config files is not a supported or exposed customization method in the portal UI and would be an unsupported modification. Option D is incorrect because the RADIUS shared secret is an authentication service configuration parameter, not a login page customization option.

Answer

Selection of the switch interface.

Answer

Direct editing of the Apache server config files.

Answer

Configuration of the RADIUS shared secret.

Question 11

Which THREE of the following are valid actions an administrator can take in the Sponsor Portal?

Accepted Answer

Create a new guest account.. The Sponsor Portal in Cisco ISE is designed for sponsor users to manage guest accounts, so option B (Create a new guest account) is correct because sponsors can provision new guest users directly from the portal. Option D (Delete an existing guest account) is correct because sponsors are permitted to remove guest accounts they manage, revoking access. Option E (Extend the expiration time of a guest account) is correct because sponsors can modify guest account settings, including extending the account's validity period. Option A (Change the global ISE logging level) is not a Sponsor Portal function; logging levels are configured in the ISE GUI under Administration > System > Logging. Option C (Modify the existing portal theme) is also not a Sponsor Portal action; portal customization is performed by administrators in the ISE GUI under Guest Access > Portals & Components.

Answer

Change the global ISE logging level.

Answer

Modify the existing portal theme.

Question 12

Which TWO of the following are valid ways to provide access to a guest user?

Accepted Answer

Bypassing login via a Hotspot portal.. Option A is correct because a Hotspot portal is a standard Cisco ISE guest-access method that lets visitors self-register or click through a web page and be granted network access without requiring pre-created credentials, effectively bypassing a traditional login. Option B is correct because the Guest Portal (Sponsored or Self-Registered guest flow) authenticates guest users with a username and password stored in the ISE internal guest identity store, which is the canonical way to provide credentialed guest access. Option C is not a valid guest-access method here because a VPN tunnel is a remote-access technology, not a guest onboarding/authentication mechanism in this context. Option D is not correct because assigning a static IP only provides addressing, not authentication or authorization for a guest. Option E is not correct because authenticating via the CLI on the NAD is an administrative/device-management action, not a supported way to grant a guest user network access.

Answer

Connecting via VPN tunnel only.

Answer

Using a static IP assigned by the administrator.

Answer

Authenticating via the CLI on the NAD.

Question 13

You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?

Accepted Answer

Set the Access Type to Permit Access and enable URL Redirect with the portal ID.. Central Web Authentication requires the authorization profile to permit access and simultaneously return a URL redirect AV pair pointing to the ISE guest/central portal. In ISE, the authorization profile's 'Access Type = ACCESS_ACCEPT' plus the 'Web Redirection (CWA)' setting with the correct portal ID is what tells the WLC/switch to redirect the client's HTTP traffic to the ISE portal. Without the URL redirect attribute, the client is simply permitted and never sees the portal.

Answer

Enable 'Authentication Bypass' in the authorization profile to allow the traffic to hit the redirect rule.

Answer

Configure the profile as a standard permit access profile with a dynamic VLAN assignment.

Answer

Set the Access Type to Web Auth and manually input the redirect IP address in the Custom Attributes field.

Question 14

You want to customize the guest portal so that it displays the company logo and specific terms of use. Where is this configuration performed within the Cisco ISE GUI?

Accepted Answer

Work Centers > Guest Access > Portals & Components. The guest portal customization—including uploading a company logo and defining specific terms of use—is performed in the Work Centers > Guest Access > Portals & Components section of the Cisco ISE GUI. This area provides a centralized location for creating and editing all guest-facing portals (e.g., Hotspot, Self-Registered, Sponsored) and their associated components like logos, banners, and acceptance policies. The other options are unrelated to portal branding or terms of use configuration.

Answer

Administration > System > Settings > Portal Configuration

Answer

Policy > Policy Elements > Results > Authorization > Authorization Profiles

Answer

Operations > Troubleshoot > Diagnostic Tools

Question 15

What is the purpose of the 'Guest Type' configuration in Cisco ISE?

Accepted Answer

To define the attributes of the guest account such as duration and permissions.. The 'Guest Type' configuration in Cisco ISE defines the attributes of a guest account, such as the duration of access, the maximum number of devices, and the permissions or roles assigned to the guest. It is a template that determines the guest's access privileges and account lifecycle. This allows administrators to create different guest types (e.g., contractor, visitor) with tailored settings.

Answer

To define the graphical user interface layout of the guest portal.

Answer

To assign a specific sponsor to a guest.

Answer

To set the IP address pool for the guest VLAN.