Scenario practice questions

An engineer is configuring Cisco ISE for guest access. The requirement is that guests must accept an acceptable use policy (AUP) before being granted network access. Which portal type should be used?

Trap 1: Sponsored guest portal

Requires a sponsor, not suitable for self-service AUP acceptance.

Trap 2: Hotspot guest portal

Provides open access without authentication.

Trap 3: BYOD portal

Used for device onboarding, not guest access.

A
Sponsored guest portal
Why wrong: Requires a sponsor, not suitable for self-service AUP acceptance.
B
Hotspot guest portal
Why wrong: Provides open access without authentication.
C
BYOD portal
Why wrong: Used for device onboarding, not guest access.
D
Self-registration guest portal
Allows guests to register and accept AUP.

Review the full routing breakdown →

Question 2hardmultiple choice

A network administrator is configuring IKEv2 on a Cisco router and wants to ensure that the router does not initiate connections but only responds to incoming IKEv2 requests. Which configuration command should be applied?

Trap 1: crypto ikev2 no initiate

Not a valid command in Cisco IOS.

Trap 2: crypto ikev2 limit max-incoming-sa 10

Limits number of incoming SAs, but does not prevent initiation.

Trap 3: crypto ikev2 limit max-negotiations 10

Limits simultaneous negotiations, but router can still initiate.

A
crypto ikev2 no initiate
Why wrong: Not a valid command in Cisco IOS.
B
crypto ikev2 passive
This command disables IKEv2 initiation, making the router respond-only.
C
crypto ikev2 limit max-incoming-sa 10
Why wrong: Limits number of incoming SAs, but does not prevent initiation.
D
crypto ikev2 limit max-negotiations 10
Why wrong: Limits simultaneous negotiations, but router can still initiate.

Study the full AAA explanation →

Question 3easymultiple choice

Refer to the exhibit. A user attempts to SSH to the router. The RADIUS server is unreachable. What will happen?

Exhibit

Refer to the exhibit.
```
! RADIUS server configuration
radius server MY_RADIUS
 address ipv4 192.168.10.10 auth-port 1812 acct-port 1813
 key cisco123
!
aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
```

Trap 1: The user will be denied access because RADIUS is unreachable

The 'local' keyword provides a fallback to local authentication.

Trap 2: The router will try TACACS+ as a fallback

No TACACS+ server is configured; only RADIUS and local.

Trap 3: The user will be authenticated using RADIUS after a timeout

The router will not wait indefinitely; it will fall back to local immediately.

A
The user will be denied access because RADIUS is unreachable
Why wrong: The 'local' keyword provides a fallback to local authentication.
B
The router will try TACACS+ as a fallback
Why wrong: No TACACS+ server is configured; only RADIUS and local.
C
The user will be authenticated using the local database
When RADIUS is unreachable, the router uses local authentication.
D
The user will be authenticated using RADIUS after a timeout
Why wrong: The router will not wait indefinitely; it will fall back to local immediately.

Read the full wireless explanation →

Question 4easymultiple choice

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

Trap 1: Profiling policy

Profiling policy is used to identify device attributes, not to grant access.

Trap 2: Authentication policy

Authentication policy only determines how users are authenticated, not the resulting access.

Trap 3: Policy set

Policy set is a container that groups authentication and authorization policies; it does not directly enforce access.

A
Profiling policy
Why wrong: Profiling policy is used to identify device attributes, not to grant access.
B
Authentication policy
Why wrong: Authentication policy only determines how users are authenticated, not the resulting access.
C
Authorization policy
Authorization policy defines what access is granted after authentication.
D
Policy set
Why wrong: Policy set is a container that groups authentication and authorization policies; it does not directly enforce access.

Question 5mediummulti select

An administrator is configuring 802.1X on a switch port for both an IP phone and a PC. Which two commands should be configured to support this scenario? (Choose two)

Trap 1: dot1x pae authenticator

May be needed but less specific to the scenario.

Trap 2: authentication violation restrict

Violation action, not required for basic setup.

Trap 3: authentication host-mode multi-auth

Allows multiple devices per domain, not ideal for phone+PC.

A
authentication host-mode multi-domain
Allows one voice and one data device.
B
dot1x pae authenticator
Why wrong: May be needed but less specific to the scenario.
C
authentication violation restrict
Why wrong: Violation action, not required for basic setup.
D
authentication port-control auto
Enables 802.1X authentication.
E
authentication host-mode multi-auth
Why wrong: Allows multiple devices per domain, not ideal for phone+PC.

Question 6easymultiple choice

Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?

Exhibit

Refer to the exhibit.

```
! Cisco Secure Endpoint Policy Snippet
! File Reputation Settings
file-reputation cloud-lookup enable
file-reputation local-cache enable
file-reputation timeout 5
! Exploit Prevention Settings
exploit-prevention enable
exploit-prevention level aggressive
! Malware Protection Settings
malware-protection enable
malware-protection scan-on-execution enable
malware-protection scan-on-write enable
```

Trap 1: The file will be held until the endpoint comes online and a cloud…

The policy does not hold files; timeout is 5 seconds.

Trap 2: The file will be quarantined due to the aggressive exploit…

Exploit Prevention does not affect file reputation.

Trap 3: The file will be blocked immediately by scan-on-write.

Scan-on-write triggers a scan, but if cloud is unavailable, unknown files are allowed.

A
The file will be held until the endpoint comes online and a cloud lookup completes.
Why wrong: The policy does not hold files; timeout is 5 seconds.
B
The file will be quarantined due to the aggressive exploit prevention level.
Why wrong: Exploit Prevention does not affect file reputation.
C
The file will be allowed because local cache will store an unknown disposition.
Local cache stores unknown disposition; file is allowed until cloud lookup can be performed later.
D
The file will be blocked immediately by scan-on-write.
Why wrong: Scan-on-write triggers a scan, but if cloud is unavailable, unknown files are allowed.

Question 7hardmultiple choice

During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?

Trap 1: Increase the connection timeout

Increasing timeout may worsen the impact by holding more table entries.

Trap 2: Implement an access-list to allow only known source IPs

Unknown sources would be legitimate users, so this is impractical.

Trap 3: Configure a static route to null0 for the server's IP

Null routing drops all traffic to that IP, including legitimate.

A
Increase the connection timeout
Why wrong: Increasing timeout may worsen the impact by holding more table entries.
B
Implement an access-list to allow only known source IPs
Why wrong: Unknown sources would be legitimate users, so this is impractical.
C
Configure a static route to null0 for the server's IP
Why wrong: Null routing drops all traffic to that IP, including legitimate.
D
Enable TCP Intercept with a low threshold
TCP Intercept mitigates SYN floods by intercepting and verifying connections.

Read the full DNS explanation →

Question 8hardmultiple choice

A network administrator is configuring Cisco Umbrella for web security. They want to ensure that all DNS requests from branch offices are sent to Umbrella for policy enforcement, but they have limited control over the branch routers. What is the most effective deployment method?

Trap 1: Set up a transparent proxy on the branch routers

Proxy configuration is more involved and not DNS-specific.

Trap 2: Configure Umbrella as DNS forwarder on the branch routers

Requires control over routers, which the administrator does not have.

Trap 3: Use PAC files on the clients to redirect web traffic

PAC files are for HTTP proxy, not DNS-level enforcement.

A
Deploy the Umbrella roaming client on endpoints
Endpoints send DNS directly to Umbrella, no network changes needed.
B
Set up a transparent proxy on the branch routers
Why wrong: Proxy configuration is more involved and not DNS-specific.
C
Configure Umbrella as DNS forwarder on the branch routers
Why wrong: Requires control over routers, which the administrator does not have.
D
Use PAC files on the clients to redirect web traffic
Why wrong: PAC files are for HTTP proxy, not DNS-level enforcement.

Question 9hardmultiple choice

An engineer is troubleshooting why AMP for Endpoints is not detecting a specific malicious file. The file hash is available and other endpoints detected it. What is the most likely cause for the detection failure on this endpoint?

Trap 1: The AMP connector is not configured with a proxy when needed.

Proxy misconfiguration affects cloud connectivity, but the file might have been detected by other endpoints with similar connectivity.

Trap 2: The AMP signature database on that endpoint is outdated.

Signature updates are automatic; if other endpoints detect, the database is likely current.

Trap 3: The AMP policy is set to 'Block' instead of 'Detect'.

Policy mode affects actions, not the ability to detect; detection still occurs.

A
The AMP connector is not configured with a proxy when needed.
Why wrong: Proxy misconfiguration affects cloud connectivity, but the file might have been detected by other endpoints with similar connectivity.
B
The endpoint's AMP connector has local analysis disabled, preventing hash matching.
Local analysis allows matching known bad hashes without cloud lookup; if disabled, detection may rely solely on cloud.
C
The AMP signature database on that endpoint is outdated.
Why wrong: Signature updates are automatic; if other endpoints detect, the database is likely current.
D
The AMP policy is set to 'Block' instead of 'Detect'.
Why wrong: Policy mode affects actions, not the ability to detect; detection still occurs.

Question 10hardmultiple choice

A company uses Cisco Threat Response (CTR) to investigate a potential breach. The analyst sees an observable (SHA256) with a score of 90 in the threat grid. However, the AMP connector on the endpoint shows 'Allow' for that file. What could cause this discrepancy?

Trap 1: The 'File Blocking' setting is set to 'Off' for the policy,…

File blocking is controlled via file reputation rules, not a separate toggle.

Trap 2: The AMP policy has file reputation disabled, so all files are…

If file reputation is disabled, there would be no scoring, but CTR still shows a score.

Trap 3: The file was blocked but the AMP console shows 'Allow' due to…

The console reflects the action taken; if blocked, it would show 'Block'.

A
The 'File Blocking' setting is set to 'Off' for the policy, ignoring cloud scores.
Why wrong: File blocking is controlled via file reputation rules, not a separate toggle.
B
The AMP policy has file reputation disabled, so all files are allowed.
Why wrong: If file reputation is disabled, there would be no scoring, but CTR still shows a score.
C
The AMP policy uses 'Local Analysis' and the local analysis determined the file was safe.
Local analysis can override cloud reputation if configured and the file passes local heuristics.
D
The file was blocked but the AMP console shows 'Allow' due to delayed event ingestion.
Why wrong: The console reflects the action taken; if blocked, it would show 'Block'.