SISE Web Auth And Guest Services — Timed 20 Questions

Question 1

When configuring an LWA portal, you notice that the HTTP traffic is not being redirected. What is a primary requirement for LWA that differs from CWA?

Accepted Answer

The NAD must have the 'ip http server' enabled.. For Local Web Authentication (LWA), the network access device (NAD) must have the 'ip http server' enabled to host the web login page locally. This differs from Centralized Web Authentication (CWA), where the NAD redirects to a central portal on Cisco ISE. LWA requires the NAD to serve the portal, hence the HTTP server must be active.

Answer

The endpoint must be statically assigned an IP.

Answer

A redirect ACL must be applied to the ISE interface.

Answer

The ISE node must be the default gateway.

Question 2

A sponsor wants to approve guest accounts via email. Where in ISE must the sponsor account be created and configured to allow this capability?

Accepted Answer

Guest Access > Configure > Sponsor Portals. The Sponsor Portal is where sponsors manage guest accounts, including approval workflows and email notifications.

Answer

Administration > Identity Management > Identities

Answer

Work Centers > Guest Access > Sponsor Groups

Answer

Policy > Policy Elements > Results

Question 3

You are implementing a Guest flow that requires the user to accept an Acceptable Use Policy (AUP). Where is the AUP text configured within the Cisco ISE portal settings?

Accepted Answer

Guest Access > Configure > Guest Portals > [Portal Name] > Portal Page Customization. The AUP text for a guest flow is configured per guest portal under Work Centers > Guest Access > Configure > Guest Portals > [Portal Name] > Portal Page Customization, where the AUP content and the 'Require AUP' toggle are defined. This ties the AUP to the specific portal that presents it, allowing different portals to display different policies.

Answer

Policy > Policy Elements > Results > Authorization Profiles

Answer

Work Centers > Guest Access > Settings > AUP

Answer

Administration > System > Settings > Guest

Question 4

A network administrator is configuring Central Web Authentication (CWA) and needs to ensure that the initial redirect is handled correctly by the switch. Which attribute must the Cisco ISE send to the network access device (NAD) to trigger the redirection?

Accepted Answer

cisco-av-pair = url-redirect=https://ise.example.com:8443/guestportal/gateway. For Central Web Authentication (CWA), ISE must return the cisco-av-pair AV pair 'url-redirect' containing the full HTTPS URL of the ISE guest/central portal gateway so the NAD (switch/WLC) can intercept the HTTP session and redirect the client. The value must include the portal path and port (e.g., :8443/guestportal/gateway) because the NAD uses this exact string in the HTTP 302 redirect it generates. Without this AV pair, the switch has no URL to send the client to and CWA cannot complete.

Answer

cisco-av-pair = redirect-url=http://ise.example.com

Answer

cisco-av-pair = redirect-to=https://ise.example.com

Answer

cisco-av-pair = url-redirect-acl=REDIRECT_ACL

Question 5

Which type of guest account is best suited for a visitor who needs access for exactly one business day and should have their account automatically deleted thereafter?

Accepted Answer

Daily Guest Account. A Daily Guest Account in Cisco ISE is a guest account type with a predefined lifetime of one day (24 hours), after which the account is automatically expired and deleted by the ISE guest account purge process. This matches the requirement for a visitor needing exactly one business day of access with automatic cleanup.

Answer

Self-Registered Guest

Answer

Hotspot Guest

Answer

Sponsored Guest

Question 6

A Guest user is stuck in a loop and cannot access the internet after authenticating. The NAD log shows the session is bouncing between the redirect state and authorized state. What is the most likely cause?

Accepted Answer

The Redirect ACL does not permit traffic to the ISE PSN IP.. A redirect loop between the redirect state and authorized state typically occurs when the Redirect ACL on the NAD does not permit traffic to the ISE PSN IP address, so the guest's browser cannot reach the portal to complete authentication. Without access to the PSN, the NAD keeps redirecting the client, and the session oscillates between states.

Answer

The guest user account is expired.

Answer

The switch is configured for redundant ISE nodes.

Answer

The CoA port is blocked by a firewall.

Question 7

When designing a guest network, you want to ensure that guests cannot reach each other. What is the most effective way to prevent this?

Accepted Answer

Apply a dACL that denies all traffic to the guest subnet.. Private VLANs (PVLANs) or client isolation on the wireless controller are the standard methods to prevent direct client-to-client communication at the link layer.

Answer

Enable MAC filtering on the ISE.

Answer

Configure a higher VLAN for the guests.

Answer

Configure a static route on the default gateway.

Question 8

Which TWO of the following are mandatory components for a CWA deployment?

Accepted Answer

A redirect ACL configured on the NAD.. Option C is correct because Cisco Central Web Authentication (CWA) requires the NAD (switch or WLC) to have a redirect ACL that intercepts the client's initial HTTP/HTTPS traffic and redirects it to the ISE guest portal before authorization completes. Option E is correct because CWA fundamentally depends on a guest portal configured in ISE, which is where the client authenticates via web credentials and triggers the posture/authorization flow. Option A is not required, since CWA works with standard 802.1X/MAC authentication and does not mandate WPA3-Enterprise on the WLC. Option B is not required, as user credentials are validated by ISE, not a local switch database. Option D is not required, because guest clients typically receive addresses via DHCP rather than needing static IPs.

Answer

A WLC with WPA3-Enterprise.

Answer

A local user database on the switch.

Answer

A static IP address for all guest clients.

Question 9

Which TWO of the following can be used to identify a guest device for MAC caching?

Accepted Answer

The Guest Portal ID.. MAC caching relies on the device's MAC address and sometimes the specific portal being accessed to differentiate sessions and cache the device status.

Answer

The user's email address.

Answer

The switch's hostname.

Answer

The user's IP address.

Question 10

Which THREE of the following are mandatory fields for configuring a new Guest Portal in ISE?

Accepted Answer

Portal Name.. Creating a portal requires a unique name, a defined portal type (Hotspot, Guest, etc.), and the selection of the Policy Service Node (PSN) that will host the portal.

Answer

Default Sponsor email.

Answer

Primary DNS server IP.

Question 11

Which TWO of the following are common reasons for a Guest portal to display an 'Internal Server Error'?

Accepted Answer

The portal service on the PSN is unresponsive.. Option D is correct because the Guest portal is hosted by the Policy Service Node (PSN) in Cisco ISE, so if the portal service (the ISE Guest/Sponsor portal web service) is unresponsive or stopped, the portal cannot render its pages and returns an HTTP 500 Internal Server Error. Option E is correct because the Guest portal relies on the ISE database (the internal database or an external database such as Oracle/Microsoft SQL for guest accounts) to look up and validate guest credentials; if that database is unreachable, the portal's backend query fails and the server returns an Internal Server Error. Option A is not correct because a MAC filter block typically results in the device being denied network access or redirected, not an HTTP 500 from the portal itself. Option B is not correct because an invalid password is a normal authentication failure that produces a credential-rejection message, not a server-side 500 error. Option C is not correct because a NAD not configured for RADIUS causes authentication/authorization failures or no response, not an Internal Server Error on the Guest portal.

Answer

The guest's device is blocked by a MAC filter.

Answer

The Guest user provided an invalid password.

Answer

The NAD is not configured for RADIUS.

Question 12

Which THREE of the following items are included in a typical RADIUS Authorization Profile for a CWA redirect?

Accepted Answer

cisco-av-pair = url-redirect-acl.. A redirect-capable profile must include the redirection URL, the redirect ACL name, and the specific class or group attributes to identify the user's role.

Answer

The RADIUS shared secret.

Answer

The 'Framed-IP-Address'.

Question 13

A guest user successfully authenticates at the sponsor portal but cannot access the internet. You notice the session remains in the 'Pending' state. What is the most likely cause?

Accepted Answer

The sponsor has not approved the guest account request.. The most likely cause is that the sponsor has not approved the guest account request. In ISE, when sponsor approval is required, the guest account remains in 'Pending' state until a sponsor approves it. The session state reflects this pending status, and the guest cannot access the internet until approval occurs.

Answer

The ISE node is not reachable via the DNS server specified in the guest VLAN.

Answer

The authorization policy is missing a 'permit access' rule for the guest account.

Answer

The guest password policy is incorrectly configured in the Guest Portal settings.

Question 14

You are troubleshooting a scenario where guest users are not being redirected when connecting to an open SSID. The WLC reports that the client is stuck in the 'Webauth' state but the portal never loads. Which component should you verify first?

Accepted Answer

Check if the client can resolve the ISE FQDN via DNS.. When a client is stuck in 'Webauth' state and the portal never loads, the most likely cause is that the client cannot resolve the ISE FQDN to an IP address, so the redirect fails. Verifying DNS resolution is the first troubleshooting step because the WLC redirects the client to the ISE portal by FQDN, and without DNS the client cannot reach the portal.

Answer

Increase the idle timeout on the WLC's WLAN configuration.

Answer

Verify the WLC's 'Web Auth Redirect' configuration and ensure the 'Virtual Gateway' address is reachable.

Answer

Re-import the Guest Portal certificate on the WLC.

Question 15

When using Local Web Authentication (LWA) on a WLC, which entity performs the actual credentials check against Cisco ISE?

Accepted Answer

The Wireless LAN Controller (WLC).. In Local Web Authentication, the WLC itself hosts the login page and performs the credential check against the configured authentication server, which in this scenario is Cisco ISE. The WLC acts as the RADIUS client and sends the user's credentials to ISE via RADIUS Access-Request; ISE validates them and returns Access-Accept/Reject. The AP and the client browser are not the authenticating entities.

Answer

The Access Point (AP) in FlexConnect mode.

Answer

The Cisco ISE node directly.

Answer

The client browser via HTTPS POST.

Question 16

Which THREE components are part of the 'Guest Access' workflow in Cisco ISE?

Accepted Answer

ISE Policy Sets.. In Cisco ISE, the Guest Access workflow is built around three core components: the Guest Portal (C), which is the web interface where guests self-register or log in and accept acceptable-use policies; the Sponsor Portal (E), which allows authorized sponsors to create, approve, and manage guest accounts and credentials; and ISE Policy Sets (A), which contain the authentication and authorization rules that determine how guest traffic is processed and which portals or access levels guests receive. These three elements together form the end-to-end guest onboarding and access-control flow. Device Sensor Service (B) is incorrect because it is used to collect endpoint profiling attributes from network devices, not to support guest access. Active Directory Join (D) is incorrect because it is an identity-source integration used for authenticating domain users, not a required component of the guest workflow.

Answer

Device Sensor Service.

Answer

Active Directory Join.

Question 17

A network administrator is deploying a Central Web Authentication (CWA) guest solution using Cisco ISE. The guest VLAN must redirect unauthenticated users to the guest portal. Which two components are required for the initial redirection to occur? (Choose two.)

Accepted Answer

An authorization profile that returns the cisco-av-pair url-redirect and url-redirect-acl attributes. For CWA redirection to work, ISE must return an authorization profile containing the cisco-av-pair attributes url-redirect and url-redirect-acl. The switch must also have an ACL configured with the exact name specified in url-redirect-acl. These two elements together enable the switch to intercept the client's HTTP traffic and redirect it to the guest portal while blocking other traffic. Without either component, the redirection fails.

Answer

MAC Authentication Bypass (MAB) enabled on the switch port

Answer

A certificate installed on the guest endpoint for HTTPS redirection

Answer

A downloadable ACL (dACL) pushed from ISE to the switch

Question 18

A network engineer is setting up a guest portal in Cisco ISE. The portal will be used by visitors to register and gain internet access. The engineer wants to ensure that the portal is accessible over HTTPS and that the certificate presented is trusted by the guests' browsers. Which certificate store should the engineer use to import the public certificate for the guest portal?

Accepted Answer

Portal Certificates store. Cisco ISE organizes certificates into specific stores based on their purpose. The Portal Certificates store is used exclusively for certificates that secure ISE web portals. To avoid browser warnings, the engineer must import a publicly signed certificate, including its private key, into this store and then bind it to the guest portal. The other stores serve different functions such as node communication or trust validation.

Answer

Trusted Certificates store

Answer

System Certificates store

Answer

Local Certificates store

Question 19

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Accepted Answer

The Network Access Device (NAD). The Network Access Device (NAD) is responsible for redirecting the guest user's browser in a Central Web Authentication (CWA) flow. When the endpoint connects, the NAD (e.g., a wireless controller or switch) intercepts the HTTP traffic and redirects the user to the ISE guest portal for authentication.

Answer

The Cisco ISE Policy Service Node (PSN)

Answer

The endpoint's default browser

Answer

The Guest Portal application

Question 20

A guest user reports they receive a certificate warning when redirected to the ISE Guest portal. What is the most common cause of this issue?

Accepted Answer

The ISE server certificate is self-signed or not trusted by the client device.. The most common cause of certificate warnings on the ISE Guest portal is that the ISE server is using a self-signed certificate or a certificate not trusted by the client's browser trust store. Browsers will display a warning when the certificate chain cannot be validated against a trusted CA. Replacing the default self-signed certificate with a CA-signed certificate whose SAN matches the portal FQDN resolves the warning.

Answer

The ISE portal is configured for HTTP instead of HTTPS.

Answer

The DNS server is not resolving the ISE FQDN.

Answer

The switch is not configured for SSL interception.