SISE Hard Difficulty Questions

Explanation: RADIUS is a UDP-based protocol where the NAS and PSN maintain session state across the Access-Request/Access-Challenge/Access-Accept exchange. If a load balancer distributes successive packets from the same client to different PSNs, the challenge/response state is lost and authentication fails. Source-IP affinity (persistence) ensures all RADIUS packets from a given NAS or endpoint land on the same PSN for the duration of the session.

Explanation: A dACL is an ordered list of ACEs evaluated top-down, and IOS ACLs have an implicit 'deny ip any any' at the end. To deny a specific subnet while permitting all other traffic, you place the deny ACE for 10.1.1.0/24 first, then explicitly permit everything else with 'permit ip any any' as the final line. Without that explicit permit, the implicit deny would block all remaining traffic.

Explanation: Cisco TrustSec Security Group policy enforcement relies on three core building blocks. Option A, SGT (Security Group Tag), is correct because TrustSec classifies traffic by assigning a 16-bit SGT to a source identity, and that tag is what the fabric carries and enforces against. Option C, the enforcement device (e.g., Catalyst switch), is correct because TrustSec enforcement happens at the network device that receives the tagged packet and applies the policy, such as a Catalyst switch acting as an enforcement point. Option D, SGACL (Security Group Access Control List), is correct because SGACLs define the actual permissions between source and destination SGTs and are downloaded to enforcement devices to permit or deny traffic. Option B, TACACS+ command set, is not a TrustSec enforcement component; TACACS+ is used for device administration AAA and command authorization, not for SGT-based traffic policy. Option E, RADIUS shared secret, is also not a TrustSec enforcement component; a shared secret is an authentication credential used between a client and a RADIUS server, not a policy enforcement element.

Explanation: The Sponsor Portal in Cisco ISE is a web interface used by designated sponsors to manage guest lifecycle tasks, so option D (Creating new guest accounts) is correct because sponsors can create guest accounts directly, specifying duration, login credentials, and other guest details. Option E (Approving guest access requests) is also correct because sponsors receive and act on pending guest access requests, approving or denying them so guests can authenticate. Option A (Mapping VLANs to specific guest SSIDs) is incorrect because VLAN-to-SSID mapping is configured on the wireless LAN controller or in the network access policy, not in the Sponsor Portal. Option B (Configuring global portal branding) is incorrect because portal branding and customization are configured in the Guest Portal settings within ISE administration, not by sponsors in the Sponsor Portal. Option C (Defining RADIUS shared secrets) is incorrect because RADIUS shared secrets are configured on network devices and in ISE's network device definitions, not in the Sponsor Portal.

Explanation: In Cisco ISE, an Authorization Profile can return a downloadable ACL (dACL) name (option A), which the NAD (e.g., a WLC or switch) downloads and applies to the client's session to filter permitted traffic, directly restricting network access. VLAN assignment (option C) is also commonly used in an Authorization Profile to place the client into a specific VLAN, thereby limiting which network segment and resources it can reach. SGT propagation (B) is about carrying a Security Group Tag for TrustSec policy enforcement, not itself a restriction setting in the profile. Authentication protocol (D) is negotiated during authentication, not an authorization-profile restriction. Identity Source (E) is used during authentication/policy evaluation to look up the user, not to restrict the client's access.