SISE Web Auth And Guest Services — Timed 15 Questions

Question 1

A sponsor wants to approve guest accounts via email. Where in ISE must the sponsor account be created and configured to allow this capability?

Accepted Answer

Guest Access > Configure > Sponsor Portals. The Sponsor Portal is where sponsors manage guest accounts, including approval workflows and email notifications.

Answer

Administration > Identity Management > Identities

Answer

Work Centers > Guest Access > Sponsor Groups

Answer

Policy > Policy Elements > Results

Question 2

When designing a guest network, you want to ensure that guests cannot reach each other. What is the most effective way to prevent this?

Accepted Answer

Apply a dACL that denies all traffic to the guest subnet.. Private VLANs (PVLANs) or client isolation on the wireless controller are the standard methods to prevent direct client-to-client communication at the link layer.

Answer

Enable MAC filtering on the ISE.

Answer

Configure a higher VLAN for the guests.

Answer

Configure a static route on the default gateway.

Question 3

Which TWO of the following can be used to identify a guest device for MAC caching?

Accepted Answer

The Guest Portal ID.. MAC caching relies on the device's MAC address and sometimes the specific portal being accessed to differentiate sessions and cache the device status.

Answer

The user's email address.

Answer

The switch's hostname.

Answer

The user's IP address.

Question 4

Which THREE of the following are mandatory fields for configuring a new Guest Portal in ISE?

Accepted Answer

Portal Name.. Creating a portal requires a unique name, a defined portal type (Hotspot, Guest, etc.), and the selection of the Policy Service Node (PSN) that will host the portal.

Answer

Default Sponsor email.

Answer

Primary DNS server IP.

Question 5

Which THREE of the following items are included in a typical RADIUS Authorization Profile for a CWA redirect?

Accepted Answer

cisco-av-pair = url-redirect-acl.. A redirect-capable profile must include the redirection URL, the redirect ACL name, and the specific class or group attributes to identify the user's role.

Answer

The RADIUS shared secret.

Answer

The 'Framed-IP-Address'.

Question 6

When configuring an LWA portal, you notice that the HTTP traffic is not being redirected. What is a primary requirement for LWA that differs from CWA?

Accepted Answer

The NAD must have the 'ip http server' enabled.. LWA requires the NAD to act as the web server for the captive portal, meaning the switch handles the HTTP request interception directly, unlike CWA where the endpoint is redirected to ISE.

Answer

The endpoint must be statically assigned an IP.

Answer

A redirect ACL must be applied to the ISE interface.

Answer

The ISE node must be the default gateway.

Question 7

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Accepted Answer

The Network Access Device (NAD). The switch (NAD) performs the redirection based on the 'url-redirect' attribute provided by ISE in the RADIUS access-accept.

Answer

The Cisco ISE Policy Service Node (PSN)

Answer

The endpoint's default browser

Answer

The Guest Portal application

Question 8

A guest user reports they receive a certificate warning when redirected to the ISE Guest portal. What is the most common cause of this issue?

Accepted Answer

The ISE server certificate is self-signed or not trusted by the client device.. Guest portals use HTTPS. If the ISE certificate is not signed by a trusted CA, the browser will display a warning.

Answer

The ISE portal is configured for HTTP instead of HTTPS.

Answer

The DNS server is not resolving the ISE FQDN.

Answer

The switch is not configured for SSL interception.

Question 9

You are implementing a Guest flow that requires the user to accept an Acceptable Use Policy (AUP). Where is the AUP text configured within the Cisco ISE portal settings?

Accepted Answer

Guest Access > Configure > Guest Portals > [Portal Name] > Portal Page Customization. The AUP is defined within the Guest Portal's 'Page Customization' settings under the 'Acceptable Use Policy' section.

Answer

Policy > Policy Elements > Results > Authorization Profiles

Answer

Work Centers > Guest Access > Settings > AUP

Answer

Administration > System > Settings > Guest

Question 10

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

Accepted Answer

The NAD is missing the 'aaa server radius dynamic-author' configuration.. After successful portal authentication, ISE sends a RADIUS CoA to the NAD. If the NAD is not configured to accept CoA, the session remains in the initial state.

Answer

The Guest user group is missing from the Policy Set.

Answer

The Redirect ACL is applied to the wrong interface.

Answer

The portal URL is incorrect.

Question 11

You are troubleshooting a Guest flow where the client hits the portal but cannot authenticate. You notice the MAC address is not being cached properly. Which setting in the Guest Portal configuration is responsible for enabling MAC caching?

Accepted Answer

Enable MAC Caching. MAC Caching allows ISE to remember the device after the first authentication, preventing repeated portal logins. This is enabled under the Guest Portal settings for MAC Caching.

Answer

Enable Auto-Login

Answer

Enable Guest Flow Bypass

Answer

Enable Device Registration

Question 12

A network administrator is configuring Central Web Authentication (CWA) and needs to ensure that the initial redirect is handled correctly by the switch. Which attribute must the Cisco ISE send to the network access device (NAD) to trigger the redirection?

Accepted Answer

cisco-av-pair = url-redirect=https://ise.example.com:8443/guestportal/gateway. The Cisco-AV-Pair 'url-redirect' is the standard attribute used in a RADIUS Accept message to inform the switch to redirect web traffic to the ISE guest portal.

Answer

cisco-av-pair = redirect-url=http://ise.example.com

Answer

cisco-av-pair = redirect-to=https://ise.example.com

Answer

cisco-av-pair = url-redirect-acl=REDIRECT_ACL

Question 13

Which type of guest account is best suited for a visitor who needs access for exactly one business day and should have their account automatically deleted thereafter?

Accepted Answer

Daily Guest Account. An 'Expiring' account is designed to be time-bound, and ISE automatically removes it upon expiration based on the defined policies.

Answer

Self-Registered Guest

Answer

Hotspot Guest

Answer