These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.
Start Scenario PracticeWhen troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?
Explanation: ISE Live Logs (A) are the primary real-time troubleshooting tool because they show the posture policy evaluation, the exact posture condition that failed, and the authorization result for the session as it happens. ISE Posture Reports (B) aggregate posture compliance data and show which posture policies and conditions are failing across endpoints, which helps confirm the specific compliance check that caused the failure. The AnyConnect DART bundle (E) collects the client-side posture logs, including the Posture Agent (cscan/ISEPosture) and compliance module logs, which reveal why the endpoint's posture assessment failed on the client. Cisco IOS syslog (C) only records router/switch events and does not contain posture policy evaluation details, and AnyConnect VPN Gateway logs (D) cover tunnel establishment and connection events rather than the posture compliance decision made by ISE.
Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?
Explanation: The Monitoring and Troubleshooting (MnT) persona in Cisco ISE is responsible for collecting and storing operational data, so option B (Reporting and analytics) is correct because MnT nodes host the reporting and analytics services that let administrators run operational reports, live logs, and dashboards on authentication, authorization, and accounting events. Option D (Log aggregation from all nodes) is also correct because all Policy Services Nodes (PSNs) and other ISE nodes forward their syslog and session data to the MnT node, which aggregates and stores it in the MnT database for troubleshooting and audit purposes. Option A (Policy distribution) is not an MnT function; policy configuration and distribution are handled by the Policy Administration Node (PAN), which pushes policies to PSNs. Option C (RADIUS authentication) is performed by Policy Services Nodes, which handle RADIUS and TACACS+ authentication, authorization, and accounting, not the MnT persona. Option E (Endpoint profiling probe) is a function of the PSN, where profiling probes (e.g., RADIUS, SNMP, DHCP, NetFlow) collect endpoint attributes, not the MnT node.
When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?
Explanation: TACACS+ Livelogs in Cisco ISE is the dedicated real-time log view that shows TACACS+ authentication and authorization request details, including the policy set and rule that matched. When troubleshooting TACACS+ authentication issues, this is the correct log to monitor because it captures the full request/response exchange and the policy evaluation result. RADIUS Livelogs, by contrast, only show RADIUS traffic and would not display TACACS+ request details.
When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?
Explanation: The Certificate Provisioning report under Operations > Reports > Endpoints and Users is the dedicated location where ISE logs the outcome of CA interactions during BYOD onboarding, including certificate enrollment requests, successes, and failures. When devices register successfully but certificate issuance fails, this report captures the SCEP/PKCS or EST exchange between ISE and the CA, showing error codes returned by the CA.
You are troubleshooting a PSN that is not receiving configuration updates. Which log file on the PSN would provide the most insight into the configuration sync process?
Explanation: The config-dist.log file on a PSN records the configuration distribution process, including synchronization attempts, successes, and failures with the Primary PAN. When a PSN is not receiving configuration updates, this log provides the most direct insight into why the sync is failing (e.g., connectivity, certificate, or replication issues). It is the go-to log for troubleshooting configuration replication.
+10 more scenario questions available
Practice all Troubleshooting Scenario QuestionsThese questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure. These appear throughout the SISE and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the SISE. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free SISE scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Troubleshooting Scenario Questions session with instant scoring and detailed explanations.
Start Scenario Practice →