20+ practice questions focused on Policy Enforcement — one of the most tested topics on the Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Policy Enforcement PracticeWhen configuring a RADIUS authorization policy for a dot1x deployment, which TWO attributes are commonly used to assign a dynamic VLAN?
Explanation: Option C (Tunnel-Type equals VLAN) is correct because RFC 2868 defines Tunnel-Type as the attribute that specifies the tunneling protocol to use, and setting it to the value VLAN (13) tells the NAS to place the supplicant into a VLAN. Option D (Tunnel-Medium-Type equals 802) is correct because it specifies the tunnel medium as 802 (value 6), which is required alongside Tunnel-Type and Tunnel-Private-Group-ID to form the standard RADIUS VLAN assignment tuple used for dynamic VLANs in dot1x. Option A (Service-Type equals Framed) is not used for VLAN assignment; it indicates the type of service being requested and is not part of the tunnel attributes. Option B (Framed-IP-Address) assigns an IP address to the user, not a VLAN. Option E (Cisco-AV-Pair) is a vendor-specific attribute that can carry VLAN information on Cisco gear, but it is not the commonly standardized attribute pair for dynamic VLAN assignment and is not marked correct here.
When configuring dACLs for enforcement on Cisco IOS switches, which TWO of the following are true regarding the behavior of the dACL downloaded from Cisco ISE?
Explanation: Option C is correct because Cisco ISE delivers the downloadable ACL to the switch inside the RADIUS Access-Accept as the cisco-av-pair VSA (vendor-specific attribute, vendor ID 9, attribute 1), with the value formatted as 'ip:inacl#<number>=...' (or 'ip:outacl#...'), which the switch parses into a named dACL. Option E is correct because a dACL is bound to the individual authenticated session (the endpoint's authorization result) and is applied dynamically to that session's port/interface, so different users on the same switch can receive different ACLs. Option A is incorrect because the dACL is applied in addition to, not as a replacement for, any static ACL already configured on the interface. Option B is incorrect because the dACL is held in RAM and applied dynamically for the session; it is not written to NVRAM as a persistent configuration. Option D is incorrect because the dACL is not applied globally to the switch or to all interfaces — it is scoped to the specific authenticated session.
You are implementing Cisco TrustSec and need to restrict traffic between two different SGTs on a Cisco Catalyst switch. Which policy component enforces this communication restriction?
Explanation: SGACLs (Security Group ACLs) are the policy components in Cisco TrustSec that enforce traffic restrictions between different Security Group Tags (SGTs). They define permit/deny rules based on source and destination SGTs and are downloaded to the network device to filter traffic. SGACLs are applied in the egress direction on the switch port.
An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?
Explanation: For SGT-based enforcement to work end-to-end, ISE must propagate the SGT to the network device as part of the authorization result, which requires enabling SGT propagation (inline tagging) on the relevant policy set/authorization profile. Without propagation, the switch never learns the SGT and cannot apply SGACLs between SGT 10 and SGT 20.
A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?
Explanation: In Cisco ISE, the Authorization Profile is the component that contains the actual network access attributes returned to the NAD, such as VLAN assignment (e.g., 'VLAN 100' or the IETF RADIUS attribute Tunnel-Private-Group-ID). The Authorization Policy rule matches conditions (like AD group membership) and then references an Authorization Profile to apply the VLAN. Therefore, the AD group-to-VLAN mapping is configured in the Authorization Profile.
+15 more Policy Enforcement questions available
Practice all Policy Enforcement questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Policy Enforcement. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Policy Enforcement questions on the SISE frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Policy Enforcement is tested as part of the Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) blueprint. Practicing with targeted Policy Enforcement questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SISE practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Policy Enforcement is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Policy Enforcement practice session with instant scoring and detailed explanations.
Start Policy Enforcement Practice →