Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.
Start Scenario PracticeWhich THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?
Explanation: Cisco TrustSec Security Group policy enforcement relies on three core building blocks. Option A, SGT (Security Group Tag), is correct because TrustSec classifies traffic by assigning a 16-bit SGT to a source identity, and that tag is what the fabric carries and enforces against. Option C, the enforcement device (e.g., Catalyst switch), is correct because TrustSec enforcement happens at the network device that receives the tagged packet and applies the policy, such as a Catalyst switch acting as an enforcement point. Option D, SGACL (Security Group Access Control List), is correct because SGACLs define the actual permissions between source and destination SGTs and are downloaded to enforcement devices to permit or deny traffic. Option B, TACACS+ command set, is not a TrustSec enforcement component; TACACS+ is used for device administration AAA and command authorization, not for SGT-based traffic policy. Option E, RADIUS shared secret, is also not a TrustSec enforcement component; a shared secret is an authentication credential used between a client and a RADIUS server, not a policy enforcement element.
Which THREE of the following are standard probes available in Cisco ISE to gather device information?
Explanation: In Cisco ISE, standard probes used for endpoint profiling and gathering device information include HTTP, SNMP Query, and DHCP. Option B (HTTP) is correct because ISE uses HTTP probes to inspect User-Agent strings and other HTTP header data from web requests, which helps identify device type and operating system. Option D (SNMP Query) is correct because ISE sends SNMP queries to network devices to collect system information such as sysDescr, sysObjectID, and interface details for profiling. Option E (DHCP) is correct because ISE can use DHCP probes to capture DHCP requests and options (for example, option 55 parameter request list, hostname, and vendor class) to fingerprint endpoints. Options A (SMTP) and C (FTP) are not standard ISE probes for device information gathering; SMTP and FTP are application protocols unrelated to ISE profiling probes.
Which TWO of the following tasks are performed within the Sponsor Portal?
Explanation: The Sponsor Portal in Cisco ISE is a web interface used by designated sponsors to manage guest lifecycle tasks, so option D (Creating new guest accounts) is correct because sponsors can create guest accounts directly, specifying duration, login credentials, and other guest details. Option E (Approving guest access requests) is also correct because sponsors receive and act on pending guest access requests, approving or denying them so guests can authenticate. Option A (Mapping VLANs to specific guest SSIDs) is incorrect because VLAN-to-SSID mapping is configured on the wireless LAN controller or in the network access policy, not in the Sponsor Portal. Option B (Configuring global portal branding) is incorrect because portal branding and customization are configured in the Guest Portal settings within ISE administration, not by sponsors in the Sponsor Portal. Option C (Defining RADIUS shared secrets) is incorrect because RADIUS shared secrets are configured on network devices and in ISE's network device definitions, not in the Sponsor Portal.
Which TWO of the following are true about Shell Profiles? (Choose two)
Explanation: Shell Profiles in Cisco ISE (TACACS+) are policy elements that define the authorization attributes returned to a network device after successful authentication. Option B is correct because Shell Profiles can include custom attributes (such as Cisco AV pairs) tailored to specific vendors, allowing device-specific authorization behavior. Option D is correct because Shell Profiles define the initial privilege level (for example, privilege level 15) assigned to the user's session upon login. Option A is incorrect because accounting is a separate TACACS+ function that logs user activity and is not replaced by Shell Profiles. Option C is incorrect because the command set is defined by Command Sets, not Shell Profiles, although both are authorization policy elements. Option E is incorrect because Shell Profiles are used with TACACS+ authorization, not exclusively with RADIUS authentication.
When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?
Explanation: ISE Live Logs (A) are the primary real-time troubleshooting tool because they show the posture policy evaluation, the exact posture condition that failed, and the authorization result for the session as it happens. ISE Posture Reports (B) aggregate posture compliance data and show which posture policies and conditions are failing across endpoints, which helps confirm the specific compliance check that caused the failure. The AnyConnect DART bundle (E) collects the client-side posture logs, including the Posture Agent (cscan/ISEPosture) and compliance module logs, which reveal why the endpoint's posture assessment failed on the client. Cisco IOS syslog (C) only records router/switch events and does not contain posture policy evaluation details, and AnyConnect VPN Gateway logs (D) cover tunnel establishment and connection events rather than the posture compliance decision made by ISE.
+15 more scenario questions available
Practice all Select Two (Multi-Select) QuestionsMulti-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination. These appear throughout the SISE and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the SISE. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free SISE scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Select Two (Multi-Select) Questions session with instant scoring and detailed explanations.
Start Scenario Practice →