SISE Web Auth And Guest Services Practice Test 3 — 15 Questions

Question 1

Which THREE of the following items are verified by ISE when a guest attempts to authenticate?

Accepted Answer

Account expiration date.. ISE checks the validity of the account (status), whether the account has expired, and if the specific credentials provided match the stored record.

Answer

The physical location of the NAD.

Answer

The user's browser version.

Question 2

Which TWO of the following settings are available for customizing the guest portal login page?

Accepted Answer

Inclusion of a mandatory AUP checkbox.. ISE portals allow for extensive customization of the UI, including the text displayed and the inclusion of specific fields like terms of use or registration forms.

Answer

Selection of the switch interface.

Answer

Direct editing of the Apache server config files.

Answer

Configuration of the RADIUS shared secret.

Question 3

Which TWO of the following are mandatory components for a CWA deployment?

Accepted Answer

A redirect ACL configured on the NAD.. CWA requires a properly configured redirect ACL on the NAD and a corresponding authorization profile in ISE that points the client to the portal.

Answer

A WLC with WPA3-Enterprise.

Answer

A local user database on the switch.

Answer

A static IP address for all guest clients.

Question 4

Which THREE of the following are valid actions an administrator can take in the Sponsor Portal?

Accepted Answer

Create a new guest account.. The Sponsor Portal provides tools for account creation, lifecycle management (extending/revoking), and viewing the status of guest accounts.

Answer

Change the global ISE logging level.

Answer

Modify the existing portal theme.

Question 5

Which TWO of the following are valid ways to provide access to a guest user?

Accepted Answer

Bypassing login via a Hotspot portal.. Guests can be authenticated via their own credentials (Guest Portal) or by simply accepting terms (Hotspot Portal).

Answer

Connecting via VPN tunnel only.

Answer

Using a static IP assigned by the administrator.

Answer

Authenticating via the CLI on the NAD.

Question 6

Which TWO of the following are common reasons for a Guest portal to display an 'Internal Server Error'?

Accepted Answer

The portal service on the PSN is unresponsive.. Internal Server Errors often relate to issues with the ISE node itself, such as database connectivity problems or the portal service being crashed/unresponsive.

Answer

The guest's device is blocked by a MAC filter.

Answer

The Guest user provided an invalid password.

Answer

The NAD is not configured for RADIUS.

Question 7

You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?

Accepted Answer

Set the Access Type to Permit Access and enable URL Redirect with the portal ID.. For CWA, the authorization profile must include a dACL or a filter-ID, and the Web Redirection component must be enabled with the specific Client Provisioning or Guest portal selected as the target.

Answer

Enable 'Authentication Bypass' in the authorization profile to allow the traffic to hit the redirect rule.

Answer

Configure the profile as a standard permit access profile with a dynamic VLAN assignment.

Answer

Set the Access Type to Web Auth and manually input the redirect IP address in the Custom Attributes field.

Question 8

A guest user successfully authenticates at the sponsor portal but cannot access the internet. You notice the session remains in the 'Pending' state. What is the most likely cause?

Accepted Answer

The sponsor has not approved the guest account request.. The 'Pending' state indicates that the sponsor or an administrator has not yet approved the account creation request, which is a common security feature in guest access flows.

Answer

The ISE node is not reachable via the DNS server specified in the guest VLAN.

Answer

The authorization policy is missing a 'permit access' rule for the guest account.

Answer

The guest password policy is incorrectly configured in the Guest Portal settings.

Question 9

You are troubleshooting a scenario where guest users are not being redirected when connecting to an open SSID. The WLC reports that the client is stuck in the 'Webauth' state but the portal never loads. Which component should you verify first?

Accepted Answer

Check if the client can resolve the ISE FQDN via DNS.. If the client is in the Webauth state on the WLC but the portal doesn't load, the issue is typically that the DNS resolution of the ISE FQDN is failing for the client or the WLC is not passing the redirect URL correctly.

Answer

Increase the idle timeout on the WLC's WLAN configuration.

Answer

Verify the WLC's 'Web Auth Redirect' configuration and ensure the 'Virtual Gateway' address is reachable.

Answer

Re-import the Guest Portal certificate on the WLC.

Question 10

You want to customize the guest portal so that it displays the company logo and specific terms of use. Where is this configuration performed within the Cisco ISE GUI?

Accepted Answer

Work Centers > Guest Access > Portals & Components. Portal customization is managed under the Guest Access menu, specifically within the Portal Builder of the selected portal type.

Answer

Administration > System > Settings > Portal Configuration

Answer

Policy > Policy Elements > Results > Authorization > Authorization Profiles

Answer

Operations > Troubleshoot > Diagnostic Tools

Question 11

What is the purpose of the 'Guest Type' configuration in Cisco ISE?

Accepted Answer

To define the attributes of the guest account such as duration and permissions.. Guest types define the lifecycle of a guest account, including time-to-live, max devices, and session duration.

Answer

To define the graphical user interface layout of the guest portal.

Answer

To assign a specific sponsor to a guest.

Answer

To set the IP address pool for the guest VLAN.

Question 12

When using Local Web Authentication (LWA) on a WLC, which entity performs the actual credentials check against Cisco ISE?

Accepted Answer

The Wireless LAN Controller (WLC).. In LWA, the WLC acts as the RADIUS client that sends the user-provided credentials to Cisco ISE for authentication.

Answer

The Access Point (AP) in FlexConnect mode.

Answer

The Cisco ISE node directly.

Answer

The client browser via HTTPS POST.

Question 13

A network administrator needs to implement self-registered guest access where the guest must provide an email address for validation. Which feature in the Guest Portal settings allows for this?

Accepted Answer

Registration Form settings.. The 'Self-Registration' page settings in the Guest Portal configuration allow enabling fields such as 'Email Address' and configuring the 'Email Validation' mechanism.

Answer

Authentication Policy rules.

Answer

Guest Type settings.

Answer

Device Registration settings.

Answer

Sponsor Group settings.

Question 14

Which THREE of the following are required components to successfully implement Central Web Authentication (CWA) with a Cisco WLC?

Accepted Answer

A URL Redirect ACL defined on the WLC.. CWA requires a specific authorization profile that includes redirection, an authentication rule that bypasses MAB or uses it as a trigger, and the appropriate URL redirect ACLs.

Answer

A static IP address assigned to all guest clients.

Answer

A redirection policy in the WLC's WLAN configuration.

Question 15

Which TWO of the following tasks are performed within the Sponsor Portal?

Accepted Answer

Creating new guest accounts.. The sponsor portal is used by internal users to manage the lifecycle of guest accounts, such as creating, approving, or extending them.

Answer

Mapping VLANs to specific guest SSIDs.

Answer

Configuring global portal branding.

Answer

Defining RADIUS shared secrets.