SISE Web Auth And Guest Services — Timed 15 Questions

Question 1

When configuring an LWA portal, you notice that the HTTP traffic is not being redirected. What is a primary requirement for LWA that differs from CWA?

Accepted Answer

The NAD must have the 'ip http server' enabled.. For Local Web Authentication (LWA), the network access device (NAD) must have the 'ip http server' enabled to host the web login page locally. This differs from Centralized Web Authentication (CWA), where the NAD redirects to a central portal on Cisco ISE. LWA requires the NAD to serve the portal, hence the HTTP server must be active.

Answer

The endpoint must be statically assigned an IP.

Answer

A redirect ACL must be applied to the ISE interface.

Answer

The ISE node must be the default gateway.

Question 2

A sponsor wants to approve guest accounts via email. Where in ISE must the sponsor account be created and configured to allow this capability?

Accepted Answer

Guest Access > Configure > Sponsor Portals. The Sponsor Portal is where sponsors manage guest accounts, including approval workflows and email notifications.

Answer

Administration > Identity Management > Identities

Answer

Work Centers > Guest Access > Sponsor Groups

Answer

Policy > Policy Elements > Results

Question 3

You are implementing a Guest flow that requires the user to accept an Acceptable Use Policy (AUP). Where is the AUP text configured within the Cisco ISE portal settings?

Accepted Answer

Guest Access > Configure > Guest Portals > [Portal Name] > Portal Page Customization. The AUP text for a guest flow is configured per guest portal under Work Centers > Guest Access > Configure > Guest Portals > [Portal Name] > Portal Page Customization, where the AUP content and the 'Require AUP' toggle are defined. This ties the AUP to the specific portal that presents it, allowing different portals to display different policies.

Answer

Policy > Policy Elements > Results > Authorization Profiles

Answer

Work Centers > Guest Access > Settings > AUP

Answer

Administration > System > Settings > Guest

Question 4

A network administrator is configuring Central Web Authentication (CWA) and needs to ensure that the initial redirect is handled correctly by the switch. Which attribute must the Cisco ISE send to the network access device (NAD) to trigger the redirection?

Accepted Answer

cisco-av-pair = url-redirect=https://ise.example.com:8443/guestportal/gateway. For Central Web Authentication (CWA), ISE must return the cisco-av-pair AV pair 'url-redirect' containing the full HTTPS URL of the ISE guest/central portal gateway so the NAD (switch/WLC) can intercept the HTTP session and redirect the client. The value must include the portal path and port (e.g., :8443/guestportal/gateway) because the NAD uses this exact string in the HTTP 302 redirect it generates. Without this AV pair, the switch has no URL to send the client to and CWA cannot complete.

Answer

cisco-av-pair = redirect-url=http://ise.example.com

Answer

cisco-av-pair = redirect-to=https://ise.example.com

Answer

cisco-av-pair = url-redirect-acl=REDIRECT_ACL

Question 5

Which type of guest account is best suited for a visitor who needs access for exactly one business day and should have their account automatically deleted thereafter?

Accepted Answer

Daily Guest Account. A Daily Guest Account in Cisco ISE is a guest account type with a predefined lifetime of one day (24 hours), after which the account is automatically expired and deleted by the ISE guest account purge process. This matches the requirement for a visitor needing exactly one business day of access with automatic cleanup.

Answer

Self-Registered Guest

Answer

Hotspot Guest

Answer

Sponsored Guest

Question 6

A Guest user is stuck in a loop and cannot access the internet after authenticating. The NAD log shows the session is bouncing between the redirect state and authorized state. What is the most likely cause?

Accepted Answer

The Redirect ACL does not permit traffic to the ISE PSN IP.. A redirect loop between the redirect state and authorized state typically occurs when the Redirect ACL on the NAD does not permit traffic to the ISE PSN IP address, so the guest's browser cannot reach the portal to complete authentication. Without access to the PSN, the NAD keeps redirecting the client, and the session oscillates between states.

Answer

The guest user account is expired.

Answer

The switch is configured for redundant ISE nodes.

Answer

The CoA port is blocked by a firewall.

Question 7

When designing a guest network, you want to ensure that guests cannot reach each other. What is the most effective way to prevent this?

Accepted Answer

Apply a dACL that denies all traffic to the guest subnet.. Private VLANs (PVLANs) or client isolation on the wireless controller are the standard methods to prevent direct client-to-client communication at the link layer.

Answer

Enable MAC filtering on the ISE.

Answer

Configure a higher VLAN for the guests.

Answer

Configure a static route on the default gateway.

Question 8

Which TWO of the following are mandatory components for a CWA deployment?

Accepted Answer

A redirect ACL configured on the NAD.. Option C is correct because Cisco Central Web Authentication (CWA) requires the NAD (switch or WLC) to have a redirect ACL that intercepts the client's initial HTTP/HTTPS traffic and redirects it to the ISE guest portal before authorization completes. Option E is correct because CWA fundamentally depends on a guest portal configured in ISE, which is where the client authenticates via web credentials and triggers the posture/authorization flow. Option A is not required, since CWA works with standard 802.1X/MAC authentication and does not mandate WPA3-Enterprise on the WLC. Option B is not required, as user credentials are validated by ISE, not a local switch database. Option D is not required, because guest clients typically receive addresses via DHCP rather than needing static IPs.

Answer

A WLC with WPA3-Enterprise.

Answer

A local user database on the switch.

Answer

A static IP address for all guest clients.

Question 9

Which TWO of the following can be used to identify a guest device for MAC caching?

Accepted Answer

The Guest Portal ID.. MAC caching relies on the device's MAC address and sometimes the specific portal being accessed to differentiate sessions and cache the device status.

Answer

The user's email address.

Answer

The switch's hostname.

Answer

The user's IP address.

Question 10

Which THREE of the following are mandatory fields for configuring a new Guest Portal in ISE?

Accepted Answer

Portal Name.. Creating a portal requires a unique name, a defined portal type (Hotspot, Guest, etc.), and the selection of the Policy Service Node (PSN) that will host the portal.

Answer

Default Sponsor email.

Answer

Primary DNS server IP.

Question 11

Which TWO of the following are common reasons for a Guest portal to display an 'Internal Server Error'?

Accepted Answer

The portal service on the PSN is unresponsive.. Option D is correct because the Guest portal is hosted by the Policy Service Node (PSN) in Cisco ISE, so if the portal service (the ISE Guest/Sponsor portal web service) is unresponsive or stopped, the portal cannot render its pages and returns an HTTP 500 Internal Server Error. Option E is correct because the Guest portal relies on the ISE database (the internal database or an external database such as Oracle/Microsoft SQL for guest accounts) to look up and validate guest credentials; if that database is unreachable, the portal's backend query fails and the server returns an Internal Server Error. Option A is not correct because a MAC filter block typically results in the device being denied network access or redirected, not an HTTP 500 from the portal itself. Option B is not correct because an invalid password is a normal authentication failure that produces a credential-rejection message, not a server-side 500 error. Option C is not correct because a NAD not configured for RADIUS causes authentication/authorization failures or no response, not an Internal Server Error on the Guest portal.

Answer

The guest's device is blocked by a MAC filter.

Answer

The Guest user provided an invalid password.

Answer

The NAD is not configured for RADIUS.

Question 12

Which THREE of the following items are included in a typical RADIUS Authorization Profile for a CWA redirect?

Accepted Answer

cisco-av-pair = url-redirect-acl.. A redirect-capable profile must include the redirection URL, the redirect ACL name, and the specific class or group attributes to identify the user's role.

Answer

The RADIUS shared secret.

Answer

The 'Framed-IP-Address'.

Question 13

A guest user successfully authenticates at the sponsor portal but cannot access the internet. You notice the session remains in the 'Pending' state. What is the most likely cause?

Accepted Answer

The sponsor has not approved the guest account request.. The most likely cause is that the sponsor has not approved the guest account request. In ISE, when sponsor approval is required, the guest account remains in 'Pending' state until a sponsor approves it. The session state reflects this pending status, and the guest cannot access the internet until approval occurs.

Answer

The ISE node is not reachable via the DNS server specified in the guest VLAN.

Answer

The authorization policy is missing a 'permit access' rule for the guest account.

Answer

The guest password policy is incorrectly configured in the Guest Portal settings.

Question 14

You are troubleshooting a scenario where guest users are not being redirected when connecting to an open SSID. The WLC reports that the client is stuck in the 'Webauth' state but the portal never loads. Which component should you verify first?

Accepted Answer

Check if the client can resolve the ISE FQDN via DNS.. When a client is stuck in 'Webauth' state and the portal never loads, the most likely cause is that the client cannot resolve the ISE FQDN to an IP address, so the redirect fails. Verifying DNS resolution is the first troubleshooting step because the WLC redirects the client to the ISE portal by FQDN, and without DNS the client cannot reach the portal.

Answer

Increase the idle timeout on the WLC's WLAN configuration.

Answer

Verify the WLC's 'Web Auth Redirect' configuration and ensure the 'Virtual Gateway' address is reachable.

Answer

Re-import the Guest Portal certificate on the WLC.

Question 15

When using Local Web Authentication (LWA) on a WLC, which entity performs the actual credentials check against Cisco ISE?

Accepted Answer

The Wireless LAN Controller (WLC).. In Local Web Authentication, the WLC itself hosts the login page and performs the credential check against the configured authentication server, which in this scenario is Cisco ISE. The WLC acts as the RADIUS client and sends the user's credentials to ISE via RADIUS Access-Request; ISE validates them and returns Access-Accept/Reject. The AP and the client browser are not the authenticating entities.

Answer

The Access Point (AP) in FlexConnect mode.

Answer

The Cisco ISE node directly.

Answer

The client browser via HTTPS POST.