Courseiva

Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) (SISE) — Questions 1–75

262 questions total · 4 pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 4

Page 2
1
Multi-Selecthard

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

Select 3 answers
A.The user must manually 'Install' the configuration profile
B.The device must be connected via VPN
C.HTTPS access to the ISE portal
D.The profile must be signed by a trusted certificate
E.The device must be jailbroken
AnswersA, C, D

Native Supplicant Provisioning delivers the profile via the ISE portal, but iOS requires explicit user consent before the configuration profile installs. The user must tap Install and authenticate, so manual installation is a necessary step for the supplicant to receive its certificate and Wi-Fi settings.

Why this answer

Option A is correct because Native Supplicant Provisioning (NSP) on iOS requires the user to manually tap 'Install' to accept and install the generated .mobileconfig profile — iOS does not allow silent installation of Wi-Fi/802.1X profiles pushed by ISE. Option C is correct because the iOS device must reach the ISE Guest/Sponsor/ BYOD portal over HTTPS (TCP 443) to authenticate, download the provisioning profile, and complete the onboarding flow. Option D is correct because the configuration profile delivered during NSP must be signed by a certificate that the iOS device trusts (e.g., a publicly trusted CA or an internal CA whose root is already installed), otherwise iOS rejects the profile as unsigned/untrusted.

Option B is not required — NSP operates over the existing Wi-Fi/HTTPS path to the ISE portal, not a VPN tunnel. Option E is not required — NSP is a supported, Apple-sanctioned workflow on non-jailbroken iOS devices.

Exam trap

SISE often tests the requirements for NSP, and candidates may incorrectly assume VPN or jailbreaking is needed, or overlook the need for a trusted certificate.

Full explanation →
2
MCQhard

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

A.The NAD is missing the 'aaa server radius dynamic-author' configuration.
B.The Guest user group is missing from the Policy Set.
C.The Redirect ACL is applied to the wrong interface.
D.The portal URL is incorrect.
AnswerA

Dynamic authorisation (CoA) lets the NAD accept change-of-authorisation packets from the RADIUS server. Without 'aaa server radius dynamic-author', the switch cannot process the CoA that moves the session from redirected to authenticated after portal login.

Why this answer

In a CWA (Central Web Authentication) flow, after the user authenticates on the portal, ISE must send a Change of Authorization (CoA) to the NAD to move the session from redirected to authenticated. This requires the NAD to be configured with the 'aaa server radius dynamic-author' command so it can accept CoA requests from ISE. Without it, the NAD ignores the CoA and the session remains in the redirected state.

Exam trap

SISE often tests the CWA post-authentication CoA requirement, and candidates frequently blame the portal or policy set instead of the NAD's missing dynamic-author configuration, which is the actual cause of a stuck redirected session.

How to eliminate wrong answers

Option B is wrong because a missing Guest user group in the Policy Set would cause authentication to fail entirely, not a successful authentication with a stuck redirected state. Option C is wrong because a misapplied Redirect ACL would prevent the initial redirect to the portal, not the post-authentication transition. Option D is wrong because an incorrect portal URL would prevent the user from reaching the portal at all, not cause a post-authentication state transition failure.

Full explanation →
3
MCQeasy

What is the primary benefit of using a Policy Set compared to the legacy 'Rule-Based' approach in ISE?

A.Improved logical organization and modularity
B.Requires fewer licenses
C.Eliminates the need for external identity sources
D.Faster performance
AnswerA

Policy Sets group multiple authentication and authorisation policy objects into a single reusable container, so a change applies everywhere the set is referenced. This delivers the modularity and logical organisation that the legacy rule-based model, with its flat per-rule structure, cannot.

Why this answer

The primary benefit of a Policy Set over the legacy rule-based approach is improved logical organization and modularity. Policy Sets let you group authentication and authorization rules by use case (e.g., wired 802.1X, wireless guest, VPN) with their own conditions, making large deployments easier to manage and troubleshoot.

Exam trap

SISE often tests whether candidates understand that Policy Sets are an organizational and modularity improvement, not a licensing, identity-source, or performance feature.

How to eliminate wrong answers

Option B is wrong because Policy Sets do not change licensing requirements; licensing is based on node counts and features, not on policy structure. Option C is wrong because Policy Sets do not eliminate the need for external identity sources; they still rely on AD, LDAP, or other stores for authentication. Option D is wrong because Policy Sets do not inherently improve performance; they are an organizational construct, and performance depends on PSN sizing and deployment design.

Full explanation →
4
MCQmedium

When defining a Shell Profile for a TACACS+ administrator, which setting ensures the user is placed into privilege level 15 immediately upon login?

A.Set 'Attribute' to 'priv-lvl=15' in custom attributes
B.Set the 'Auto-Command' to 'enable 15'
C.Configure the 'Privilege Level' field to 15
D.Enable 'Maximum Privilege' in the command set
AnswerC

Setting the Privilege Level field to 15 in the Shell Profile assigns the maximum TACACS+ privilege directly at authorisation, so the administrator lands in enable mode on login without issuing an enable command. This satisfies the stem's requirement for immediate privilege level 15 placement.

Why this answer

In Cisco ISE's TACACS+ shell profile, the 'Privilege Level' field is the explicit setting that assigns the user's initial privilege level upon login. Setting it to 15 places the administrator directly into privileged EXEC mode without requiring an 'enable' command.

Exam trap

SISE often tests whether candidates know that privilege level is set in the Shell Profile's Privilege Level field, not via custom AV pairs or auto-commands — candidates overcomplicate it by trying to hand-craft priv-lvl attributes.

How to eliminate wrong answers

Option A is wrong because while priv-lvl is the underlying TACACS+ AV pair, ISE exposes it through the dedicated Privilege Level field in the shell profile — manually crafting custom attributes is unnecessary and error-prone. Option B is wrong because Auto-Command runs a command after login (e.g., 'show version') but does not itself elevate privilege; using 'enable 15' as an auto-command is a workaround, not the intended configuration. Option D is wrong because 'Maximum Privilege' is not a valid ISE shell profile setting — privilege is controlled by the Privilege Level field and the command set, not a 'maximum' toggle.

Full explanation →
5
Multi-Selecthard

Which THREE of the following are steps required to configure Cisco ISE for TACACS+ command authorization?

Select 3 answers
A.Define a Shell Profile
B.Configure an SGT
C.Create a Device Administration Policy
D.Define a Command Set
E.Enable MAB
AnswersA, C, D

A Shell Profile supplies the privilege-level and default command-set attributes returned in the TACACS+ authorisation response, binding the user to the correct privilege level and command restrictions. It is the mandatory companion object that pairs with the Command Set in the authorisation policy rule.

Why this answer

Option A (Define a Shell Profile) is correct because the Shell Profile in Cisco ISE specifies the TACACS+ privilege level and the default command set (permit/deny) applied to the administrative session, which is required for command authorization to function. Option C (Create a Device Administration Policy) is correct because the Device Administration authorization policy set maps the matched identity/group conditions to the Shell Profile and Command Set, thereby enforcing TACACS+ command authorization on network devices. Option D (Define a Command Set) is correct because a Command Set is the reusable list of permitted or denied CLI commands (with optional arguments) that ISE references when evaluating each command sent by the device.

Option B (Configure an SGT) is not required, as Security Group Tags are used for TrustSec segmentation, not TACACS+ command authorization. Option E (Enable MAB) is not required, since MAC Authentication Bypass is a network access authentication method for endpoints, not a step in configuring device administration command authorization.

Exam trap

SISE often tests the confusion between TACACS+ device administration components (Shell Profile, Command Set, Device Administration Policy) and unrelated ISE features like SGT or MAB; candidates pick SGT because it appears in other ISE questions.

Full explanation →
6
MCQmedium

When setting up a custom endpoint identity group for printers, what is the best practice for assigning devices to that group?

A.Manually add every printer MAC address to the group.
B.Use a Profiling Policy to automatically assign the device to the 'Printers' Identity Group.
C.Import a CSV file periodically.
D.Use an Authorization Policy to bypass profiling.
AnswerB

A Profiling Policy applies matching rules to discovered endpoints and places them into the correct identity group automatically, removing manual assignment errors. This satisfies the best-practise requirement for scalable, consistent printer onboarding in Cisco ISE.

Why this answer

The best practice for assigning devices to a custom endpoint identity group is to use a Profiling Policy. Profiling policies automatically classify endpoints based on collected attributes (e.g., DHCP, HTTP, SNMP) and assign them to the appropriate identity group. This ensures dynamic and scalable management, reducing manual effort and errors.

Exam trap

The trap here is thinking that manual or CSV-based methods are acceptable for large-scale deployments. Candidates might choose manual addition because it seems straightforward, but the best practice is automation through profiling policies.

How to eliminate wrong answers

Option A is wrong because manually adding every printer MAC address is not scalable and prone to error, especially in large networks. Option C is wrong because importing a CSV file periodically is a manual process that does not automatically adapt to changes and can become outdated. Option D is wrong because using an Authorization Policy to bypass profiling does not assign devices to the group; it simply skips profiling, which defeats the purpose of classification.

Full explanation →
7
Multi-Selecteasy

Which TWO of the following are valid device attributes that can be used to identify a device for BYOD onboarding?

Select 2 answers
A.Device-Type
B.Operating-System
C.VLAN-ID
D.RADIUS-Session-ID
E.Port-Number
AnswersA, B

Device-Type is a profiled attribute derived from endpoint fingerprinting, such as distinguishing a phone from a laptop. BYOD onboarding policies can match on it to apply the correct registration flow and authorisation result for that class of device.

Why this answer

Device-Type (A) is a valid device attribute for BYOD onboarding because onboarding policies in solutions like Cisco ISE use the endpoint's device category (e.g., smartphone, tablet, laptop) to match authorization rules and assign the appropriate access. Operating-System (B) is also valid because the endpoint's OS (e.g., Windows, macOS, iOS, Android) is a recognized attribute used in BYOD device-identification and policy conditions. VLAN-ID (C) is not a device attribute; it is a network segmentation value assigned to a switch port or SSID, not a property of the endpoint itself.

RADIUS-Session-ID (D) is a per-session identifier generated during RADIUS authentication, not a persistent device attribute. Port-Number (E) identifies the switch port or network interface the device connects through, which is a network location attribute rather than a device attribute.

Exam trap

SISE often tests the distinction between endpoint/device identity attributes (Device-Type, Operating-System) and network access attributes (VLAN-ID, Port-Number, RADIUS-Session-ID), causing candidates to select network-layer values as device identifiers.

Full explanation →
8
MCQhard

When designing an ISE deployment across WAN links, what is the primary recommendation regarding MnT nodes?

A.Distributed MnTs across all WAN sites
B.Always place MnT in the cloud
C.Disable logging for remote sites
D.Keep the MnT node in the same high-speed network as the PAN
AnswerD

MnT nodes write session and accounting data continuously to the PAN, so placing them on the same high-speed network avoids WAN latency and bandwidth saturation. This satisfies the deployment's performance constraint, since replication and logging traffic across slow WAN links degrades PAN responsiveness and reporting accuracy.

Why this answer

Cisco recommends keeping the MnT (Monitoring and Troubleshooting) node in the same high-speed network as the PAN (Policy Administration Node) because MnT stores and processes large volumes of logging and session data, and it frequently communicates with the PAN for policy and configuration synchronization. Placing MnT across a WAN link introduces latency and potential replication issues.

Exam trap

SISE often tests the placement of ISE personas — candidates may assume MnT can be distributed like PSNs, but the trap is forgetting that MnT must be co-located with PAN for performance and replication.

How to eliminate wrong answers

Option A is wrong because distributing MnT nodes across all WAN sites is not supported in a single ISE deployment; MnT is a centralized role, and multiple MnT nodes must be in the same LAN as the PAN for proper operation. Option B is wrong because ISE does not support deploying MnT in the cloud as a standalone role; ISE nodes must be on-premises or in a supported cloud environment with proper connectivity. Option C is wrong because disabling logging for remote sites would eliminate visibility and violate compliance requirements, and it does not address MnT placement.

Full explanation →
9
MCQmedium

You need to allow users to remediate a non-compliant status manually. Which feature allows them to 'retry' the posture check after they have fixed the issue?

A.A remediation link that triggers a command
B.Re-scan button in the AnyConnect agent UI
C.A periodic re-scan timer in the posture policy
D.Re-authentication via the 802.1X supplicant
AnswerB

The Re-scan button in the AnyConnect agent UI lets users trigger an on-demand posture reassessment after remediating their device, without waiting for the next periodic check. This directly satisfies the stem's requirement to manually retry the posture check, immediately updating compliance status against the ISE policy.

Why this answer

The Re-scan button in the AnyConnect agent UI allows users to manually trigger a posture re-assessment after they have remediated the issue. This button is available in the AnyConnect posture module interface, enabling users to retry the posture check without waiting for a periodic scan or re-authenticating. It is the feature designed for manual remediation retry.

Exam trap

SISE often tests the difference between manual and automatic remediation — candidates may pick periodic re-scan or re-authentication, but the question specifically asks for a feature that allows users to manually retry, which is the Re-scan button in AnyConnect.

How to eliminate wrong answers

Option A is wrong because a remediation link that triggers a command is an automated action, not a user-initiated retry — it does not allow the user to manually re-scan. Option C is wrong because a periodic re-scan timer automatically re-scans at set intervals, but it does not give the user manual control to retry immediately. Option D is wrong because re-authentication via the 802.1X supplicant would restart the entire network access process, not just the posture check, and is not a manual retry feature.

Full explanation →
10
MCQmedium

Which attribute in a Shell Profile is used to control whether a user can perform 'enable' commands?

A.Custom Attributes
B.Privilege Level
C.Auto-Command
D.Command Authorization
AnswerB

Privilege Level in the Shell Profile defines the maximum TACACS+ privilege level assigned to the user after authentication, which determines whether enable commands are permitted. Setting it to 15 allows enable; lower values restrict it, directly satisfying the stem's control requirement.

Why this answer

In an ISE Shell Profile, the Privilege Level attribute determines the privilege level assigned to the user on the network device after TACACS+ authorization. On Cisco IOS, privilege level 15 is required to run 'enable' and enter privileged EXEC mode, so this attribute directly controls whether a user can perform enable commands.

Exam trap

The trap is assuming Command Authorization alone governs enable access; candidates forget that privilege level (priv-lvl) is the gatekeeper for entering privileged EXEC mode.

How to eliminate wrong answers

Option A is wrong because Custom Attributes are arbitrary key-value pairs used for policy conditions or RADIUS returns, not a built-in control for enable capability. Option C is wrong because Auto-Command specifies a command that runs automatically upon login (for example, 'show version'), not the privilege level that governs enable access. Option D is wrong because Command Authorization is the mechanism that checks individual commands against a Command Set; it does not itself set the privilege level that determines enable access.

Full explanation →
11
MCQmedium

You are implementing TACACS+ device administration for a group of routers. You need to assign specific privilege levels to different users. Where in the ISE policy set is this privilege assignment configured?

A.In the Shell Profile assigned to the Authorization Policy.
B.In the Network Device Group settings.
C.In the Command Set configuration.
D.In the Network Device definition.
AnswerA

Privilege levels for TACACS+ device administration are delivered through the Shell Profile referenced by the Authorization Policy result. The profile contains the actual privilege and command-set values, so assigning it within the authorisation rule is what maps users to their router privilege levels.

Why this answer

Privilege level assignment in ISE TACACS+ is configured in the Shell Profile, which is then referenced by the Authorization Policy. The shell profile contains the Privilege Level field (and other AV pairs) that ISE returns to the network device to set the user's EXEC privilege after authentication.

Exam trap

SISE often tests the confusion between Shell Profile (privilege level and shell attributes) and Command Set (per-command authorization) — candidates mix up which object controls privilege versus which controls allowed commands.

How to eliminate wrong answers

Option B is wrong because Network Device Group settings categorize devices (location, type) for policy matching — they don't assign user privilege levels. Option C is wrong because the Command Set defines which commands are permitted or denied, not the user's privilege level. Option D is wrong because the Network Device definition holds the device's IP, shared secret, and TACACS+ settings — it has nothing to do with per-user privilege assignment.

Full explanation →
12
MCQeasy

Which Cisco ISE construct is used to combine authentication and authorization policies into a single logical container?

A.Identity Source Sequence
B.Policy Elements
C.Policy Set
D.Authorization Profile
AnswerC

A Policy Set binds authentication and authorisation rules into one logical container, letting ISE evaluate identity and authorisation policy together per connection. It satisfies the stem's requirement for a single construct combining both policy types, unlike standalone authentication or authorisation policy objects.

Why this answer

A Policy Set in Cisco ISE is the top-level container that binds together authentication and authorization policies for a specific set of conditions (e.g., matching a device type, protocol, or network device). It allows you to define a single logical unit where the authentication policy (who can authenticate) and authorization policy (what they are allowed to do) are evaluated in sequence. This structure simplifies management by grouping related rules, and ISE evaluates policy sets in a top-down order based on their rank.

The correct answer is Policy Set because it is explicitly designed to combine these two policy types into one container.

Exam trap

SISE often tests the confusion between Policy Sets and Policy Elements, where candidates mistakenly think Policy Elements combine authentication and authorization, when in fact Policy Sets are the logical containers that do so.

How to eliminate wrong answers

Option A is wrong because an Identity Source Sequence is a list of identity stores (e.g., AD, LDAP) that ISE queries in order during authentication, but it does not contain authorization policies. Option B is wrong because Policy Elements are reusable building blocks (e.g., conditions, authorization profiles, allowed protocols) that are referenced within policies, not a container that combines authentication and authorization. Option D is wrong because an Authorization Profile is a set of attributes (e.g., VLAN, DACL) applied to a session after successful authorization, but it is only one component within an authorization policy and does not include authentication logic.

Full explanation →
13
MCQmedium

In the BYOD flow, what occurs immediately after the user provides credentials in the portal?

A.The device is automatically moved to the production VLAN
B.The user is disconnected from the network
C.The device is provisioned with a certificate
D.The device is registered in the Active Directory
AnswerC

After portal authentication, Microsoft Entra ID issues a device certificate to the BYOD endpoint, satisfying the stem's requirement for the step immediately following credential submission. This certificate then serves as the identity credential for subsequent EAP-TLS authentication, removing the need to re-prompt the user for credentials during network onboarding.

Why this answer

In the BYOD flow, after the user authenticates to the device registration portal, ISE provisions the device with a certificate (typically an X.509 client certificate from the internal CA) so the device can be trusted for future 802.1X/EAP-TLS authentications. This certificate-based trust is the core of the BYOD onboarding process.

Exam trap

The trap is that candidates think the device is immediately placed on the production VLAN after login, but the actual next step is certificate provisioning — the VLAN move only happens after the full onboarding and posture cycle completes.

How to eliminate wrong answers

Option A is wrong because moving the device to the production VLAN happens after successful onboarding and posture compliance, not immediately after credential entry. Option B is wrong because the user is not disconnected at this point — the session continues through the onboarding workflow. Option D is wrong because registering the device in Active Directory is not part of the ISE BYOD flow; ISE registers the device in its own endpoint database and issues a certificate, not an AD computer object.

Full explanation →
14
Multi-Selectmedium

Which TWO of the following are benefits of integrating MDM with Cisco ISE for BYOD?

Select 2 answers
A.Ability to trigger remote wipe or lock commands
B.Faster SSID connection speed
C.Automated device compliance status checks
D.Automatic creation of Active Directory accounts
E.Increased bandwidth for BYOD users
AnswersA, C

MDM integration lets ISE instruct the MDM server to issue remote wipe or lock commands when a BYOD device is lost, stolen or non-compliant. This satisfies the benefit requirement by enforcing remediation directly on the endpoint through the MDM API.

Why this answer

Option A (Ability to trigger remote wipe or lock commands) is correct because integrating an MDM with Cisco ISE allows ISE to invoke MDM APIs to issue remote wipe or lock actions on noncompliant or lost/stolen BYOD endpoints, typically via the MDM's REST API during posture or remediation workflows. Option C (Automated device compliance status checks) is correct because the ISE-MDM integration uses the MDM's API to poll or receive device compliance attributes (e.g., jailbroken/rooted status, OS version, PIN enforcement, encryption), which ISE then uses in authorization policies to grant, restrict, or quarantine network access. Option B is incorrect because SSID connection speed is determined by wireless RF conditions, PHY rates, and 802.11 negotiation, not by MDM-ISE integration.

Option D is incorrect because ISE-MDM integration does not create Active Directory accounts; AD account provisioning is handled by separate identity management or directory tools. Option E is incorrect because bandwidth allocation is governed by QoS, WLAN policies, and network capacity, not by MDM-ISE integration.

Exam trap

SISE often tests the distinction between MDM integration benefits and general network performance improvements, causing candidates to select options like faster SSID connection or increased bandwidth, which are unrelated to MDM.

Full explanation →
15
Multi-Selecteasy

Which TWO of the following are types of Identity Sources in ISE?

Select 2 answers
A.Policy Set
B.Authorization Profile
C.Internal Users
D.Command Set
E.Active Directory
AnswersC, E

Internal Users is a valid identity source in Cisco ISE, holding locally defined accounts for authentication when external directories are unavailable or unsuitable. It satisfies the question by naming a native ISE repository, distinct from external sources such as Active Directory or LDAP.

Why this answer

In Cisco ISE, an Identity Source is a repository that ISE queries to authenticate and retrieve attributes about a user or endpoint, and both Internal Users (C) and Active Directory (E) are valid Identity Source types. Internal Users (C) is correct because ISE's built-in internal user database can serve as an identity store for local authentication, including users, passwords, and identity group assignments. Active Directory (E) is correct because ISE can join an AD domain and use it as an external identity source via the ISE AD connector for authentication and group/attribute retrieval.

The other options are not identity sources: Policy Set (A) is a container that binds conditions to authentication/authorization policies, Authorization Profile (B) is a set of attributes (such as VLAN, dACL, or SGT) applied in an authorization rule result, and Command Set (D) is a TACACS+ construct that defines which CLI commands a user is permitted to run.

Exam trap

SISE often tests whether candidates can distinguish identity sources (where credentials are validated) from policy elements and results (what happens after authentication), so options like Authorization Profile and Command Set are placed to lure candidates who confuse policy constructs with identity stores.

Full explanation →
16
MCQmedium

A user reports that their BYOD device is not being recognized as 'Compliant' even though the MDM shows it is compliant. Which ISE component is responsible for retrieving this status?

A.The ISE MDM Server connector
B.The ISE Policy Information Point (PIP)
C.The ISE Monitoring node
D.The ISE RADIUS service
AnswerA

The ISE MDM Server connector polls the external MDM to obtain device compliance and jailbreak status, then feeds it into authorisation. Without this connector, ISE cannot learn the MDM's verdict, so the device never matches a Compliant condition despite the MDM reporting compliance.

Why this answer

The ISE MDM Server connector is the component that communicates directly with external MDM systems (such as Intune, AirWatch, or MobileIron) to retrieve device compliance status. It uses the MDM API to poll or receive push notifications about device posture, then feeds that data into ISE's authorization policies. Without this connector, ISE would have no way to know whether a BYOD device meets compliance requirements, even if the MDM itself reports it as compliant.

Exam trap

SISE often tests the distinction between components that retrieve external data (MDM connector) versus those that store it (PIP) or enforce it (RADIUS), so candidates must remember that the connector is the active retrieval agent.

How to eliminate wrong answers

Option B is wrong because the Policy Information Point (PIP) is an internal ISE database that stores attributes retrieved by other components—it does not itself communicate with external MDMs. Option C is wrong because the Monitoring node handles logging, reporting, and troubleshooting, not external data retrieval. Option D is wrong because the RADIUS service processes authentication and authorization requests but does not fetch MDM compliance data; it relies on the MDM connector to supply that information.

Full explanation →
17
MCQmedium

In a distributed environment, if the Primary PAN goes offline, what happens to the Secondary PAN?

A.It disconnects from the PSNs
B.It remains in Secondary mode until manually promoted
C.It stops accepting configuration changes
D.It automatically assumes the Primary role
AnswerB

The Secondary PAN stays passive because Cisco ISE does not provide automatic failover; promotion to Primary requires an administrator to run the `application configure ise` promotion command or use the CLI. This satisfies the stem's constraint: no automatic role transition occurs when the Primary PAN goes offline.

Why this answer

In a Cisco ISE distributed deployment, the Secondary PAN does not automatically take over the Primary role. The Secondary PAN remains in a standby state and must be manually promoted via the ISE CLI (application configure ise) or GUI before it can serve as the active Primary PAN. This design prevents split-brain scenarios where two nodes simultaneously believe they are Primary.

Exam trap

SISE often tests the misconception that ISE PAN nodes support automatic failover like a firewall cluster — candidates assume the Secondary PAN auto-promotes, but ISE requires manual promotion.

How to eliminate wrong answers

Option A is wrong because the Secondary PAN does not manage PSN connections directly — PSNs register with the Primary PAN and continue operating independently if the Primary goes offline. Option C is wrong because configuration changes are already only accepted on the Primary PAN, so the Secondary stopping config changes is not a consequence of Primary failure. Option D is wrong because ISE does not support automatic PAN failover; promotion is always a manual administrative action.

Full explanation →
18
MCQeasy

What is the default persona of a newly installed Cisco ISE appliance before any configuration changes?

A.PSN
B.Standalone
C.Monitoring node
D.Primary PAN
AnswerB

A freshly installed Cisco ISE appliance defaults to the Standalone persona, operating independently with no distributed deployment roles assigned. Until an administrator promotes it to Primary PAN, Secondary PAN or PSN, it functions self-contained, which is why Standalone is the correct default.

Why this answer

A newly installed Cisco ISE appliance defaults to the Standalone persona, meaning it performs all roles (Policy Administration Node, Policy Service Node, and Monitoring Node) on a single node. This is the out-of-box state before any distributed deployment configuration is applied. Administrators must explicitly promote or register nodes to change personas.

Exam trap

SISE often tests the default persona of a fresh ISE appliance — candidates incorrectly assume it is a PSN or Primary PAN, but it is Standalone until explicitly changed.

How to eliminate wrong answers

Option A is wrong because PSN (Policy Service Node) is a distributed persona that a node assumes only after being registered to a Primary PAN — it is not the default. Option C is wrong because a Monitoring node is a dedicated persona for logging and reporting, configured only in distributed deployments. Option D is wrong because Primary PAN is a role assigned during distributed setup; a fresh appliance is not automatically a Primary PAN.

Full explanation →
19
MCQmedium

You need to ensure that the AnyConnect posture agent is updated automatically. Where is this configured?

A.Posture Policy > Settings
B.Posture Requirements
C.Remediation Actions
D.Client Provisioning Policy
AnswerD

The Client Provisioning Policy defines which AnyConnect modules and posture components are pushed to endpoints, including automatic updates of the posture agent. Configuring it there satisfies the requirement for automatic agent updates without manual user intervention.

Why this answer

The Client Provisioning Policy in Cisco ISE determines which software (such as the AnyConnect posture agent) is provisioned to endpoints and how it is updated. To ensure the AnyConnect posture agent is updated automatically, you configure the Client Provisioning Policy to point to the latest AnyConnect package and enable automatic upgrades. This policy controls the provisioning and update behavior.

Exam trap

SISE often tests where agent updates are configured — candidates may pick Posture Policy or Remediation Actions, but the correct location is Client Provisioning Policy, which handles software provisioning and upgrades.

How to eliminate wrong answers

Option A is wrong because Posture Policy > Settings contains general posture settings like remediation timers and grace periods, not agent update configuration. Option B is wrong because Posture Requirements define compliance conditions, not agent provisioning or updates. Option C is wrong because Remediation Actions define what happens when an endpoint is non-compliant, not how the agent is updated.

Full explanation →
20
MCQeasy

What is the effect of setting a Posture Requirement to 'Optional'?

A.The agent only checks when requested by the user
B.The agent will not perform the check at all
C.The user can choose to bypass the check without being blocked
D.The device is automatically granted access
AnswerC

Setting a Posture Requirement to 'Optional' means the endpoint is not blocked when the check fails or is skipped; the user may proceed without remediation. It differs from 'Mandatory', which enforces compliance before granting access.

Why this answer

Setting a posture requirement to 'Optional' means the check is still evaluated and reported, but the user is not blocked if it fails — they can choose to continue without remediation. This is used for monitoring or gradual rollout rather than enforcement.

Exam trap

SISE often tests the difference between Optional and Disabled posture requirements, and candidates incorrectly assume Optional means the check is skipped or that access is automatically granted.

How to eliminate wrong answers

Option A is wrong because 'Optional' does not make the check user-triggered; the agent still performs the check automatically, it just does not enforce it. Option B is wrong because 'Optional' does not disable the check — that would be a 'Disabled' or 'Not Used' setting, and the check still runs and reports compliance status. Option D is wrong because 'Optional' does not automatically grant access; the device still goes through authorization, and the result simply does not block the user, which is different from being auto-authorized.

Full explanation →
21
MCQmedium

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

A.By creating a Network Device Group
B.By using IP address ranges in the policy
C.By tagging them with SGTs
D.By using the Device Name in the condition
AnswerA

A Network Device Group lets you tag devices by location, and authorisation policy conditions can then match on that group. This satisfies the requirement that different devices trigger different policies based on where they sit, since the group is the attribute evaluated in the policy rule.

Why this answer

Creating a Network Device Group (NDG) is the best way to group network devices by location so that authorization policies can differentiate them. NDGs can be hierarchical (e.g., Location#Branch) and are referenced directly in policy conditions, making location-based policy enforcement clean and scalable.

Exam trap

SISE often tests the purpose of Network Device Groups versus SGTs or IP-based conditions, and candidates incorrectly choose SGTs or IP ranges for grouping network devices by location.

How to eliminate wrong answers

Option B is wrong because using IP address ranges in policy conditions is brittle and hard to maintain as subnets change, and it does not scale well across many sites. Option C is wrong because SGTs (Security Group Tags) are used for group-based access control of endpoints and users, not for grouping network devices by location for policy conditions. Option D is wrong because using the Device Name in a condition requires listing individual devices, which does not scale and is not a grouping mechanism.

Full explanation →
22
MCQmedium

A user is authenticating using EAP-TLS. Where is the certificate validation policy configured in ISE?

A.Identity Source Sequence
B.Authorization Profile
C.Policy Set Condition
D.Allowed Protocols
AnswerD

Certificate validation for EAP-TLS is governed by the Allowed Protocols configuration, where the specific EAP method's options define which certificate authorities and checks ISE accepts. Enabling EAP-TLS there determines how the client certificate is validated during authentication.

Why this answer

In ISE, the certificate validation policy for EAP-TLS is configured under Allowed Protocols. This is where you enable EAP-TLS and configure whether to validate the client certificate against a specific CA, check certificate revocation, and set other TLS-specific options. The Allowed Protocols service is the central place for EAP method configuration.

Exam trap

SISE often tests the confusion between where authentication methods are configured (Allowed Protocols) and where authorization attributes are defined (Authorization Profile), tricking candidates into picking the wrong service.

How to eliminate wrong answers

Option A is wrong because Identity Source Sequence defines the order of identity stores for authentication, not certificate validation. Option B is wrong because Authorization Profile defines the attributes returned to the NAD after authorization, not certificate validation. Option C is wrong because Policy Set Conditions determine which policy set matches the request, not how certificates are validated.

Full explanation →
23
Multi-Selectmedium

Which THREE of the following are required components to successfully implement Central Web Authentication (CWA) with a Cisco WLC?

Select 3 answers
A.A static IP address assigned to all guest clients.
B.A URL Redirect ACL defined on the WLC.
C.An Authorization Profile with 'Web Redirection' enabled.
D.An ISE Authorization Policy rule that returns the redirection profile.
E.A redirection policy in the WLC's WLAN configuration.
AnswersB, C, D

CWA intercepts the client's initial HTTP request and redirects it to the centralised web portal for authentication. The URL redirect ACL on the WLC defines which traffic is intercepted and redirected, while permitting the portal and DNS traffic to pass, so it is a mandatory component.

Why this answer

Central Web Authentication (CWA) on a Cisco WLC requires the WLC to redirect unauthenticated clients to ISE's guest portal, which is accomplished by defining a URL Redirect ACL on the WLC (option B) that matches HTTP/HTTPS traffic and permits DNS and the ISE portal; this ACL is referenced in the WLAN's Layer 3 security configuration so the WLC knows which traffic to intercept. On the ISE side, an Authorization Profile with 'Web Redirection' enabled (option C) supplies the redirect URL and the name of the redirect ACL that must match the WLC's ACL, and an ISE Authorization Policy rule that returns that redirection profile (option D) is what actually triggers the redirect for the MAB-authenticated endpoint before full 802.1X/guest authentication completes. Options A and E are not required: CWA relies on DHCP-assigned addresses rather than static IPs on guest clients, and the redirection is driven by the ISE authorization result plus the WLC redirect ACL, not by a separate 'redirection policy' in the WLAN configuration.

Exam trap

SISE often tests the specific components of CWA — candidates may include WLAN-level redirection policies or static IPs, but the correct trio is URL Redirect ACL, Authorization Profile with Web Redirection, and an ISE Authorization Policy rule returning that profile.

Full explanation →
24
Multi-Selecthard

A network engineer is deploying Cisco ISE to enforce Security Group Tags (SGTs) in a wired environment. The engineer wants to ensure that the SGT is assigned to the endpoint during authorization and that the switch enforces the SGT-based policy. Which two actions are required to enable SGT enforcement on the switch? (Choose two.)

Select 2 answers
A.Enable SXP on the switch to propagate SGTs to other devices.
B.Configure the authorization profile in ISE to include the 'cisco-av-pair' attribute with the SGT value.
C.Configure the switch to send the Calling-Station-ID in the RADIUS request.
D.Enable SGACL enforcement on the switch by configuring the 'cts role-based enforcement' command.
E.Configure the switch to use MACsec for SGT propagation.
AnswersB, D

When ISE authorizes an endpoint, it can assign an SGT by sending the 'cisco-av-pair' RADIUS attribute with the value 'cts:security-group-tag=xxx'. This attribute is used by the switch to tag the endpoint's traffic with the specified SGT. Without this, the endpoint will not receive an SGT, and enforcement cannot occur. This is a required step for dynamic SGT assignment.

Why this answer

To enforce SGT-based policies on a switch, two key actions are required: the switch must have role-based enforcement enabled using the 'cts role-based enforcement' command, and ISE must assign an SGT to the endpoint via the 'cisco-av-pair' attribute in the authorization profile. These steps ensure that the switch tags traffic with an SGT and enforces SGACLs accordingly.

Exam trap

The trap here is confusing SGT propagation methods like SXP or MACsec with the actual enforcement mechanism, which requires both role-based enforcement on the switch and SGT assignment from ISE.

Full explanation →
25
MCQhard

You are implementing 'Device Administration' (TACACS+) and want to restrict an admin to 'show' commands only. How do you construct this policy?

A.Use the 'Admin' group in the authentication policy
B.Create a shell profile with privilege level 1
C.Create a command set with 'show' and assign to an authorization policy rule
D.Configure a dACL on the device
AnswerC

A command set listing 'show' is bound to an authorization policy rule, so TACACS+ permits only matching commands and denies the rest. This satisfies the stem's constraint of restricting the administrator to show commands exclusively.

Why this answer

To restrict a TACACS+ admin to 'show' commands only, you create a Command Set that defines the permitted commands (e.g., 'show') and then assign that Command Set to an Authorization Policy rule that matches the admin's identity or group. The Command Set is the ISE object that specifies which commands are allowed or denied, and the Authorization Policy rule applies it to the session.

Exam trap

SISE often tests the difference between Shell Profiles (which set session attributes like privilege level) and Command Sets (which control specific commands) — candidates may choose Shell Profile thinking it restricts commands, but only Command Sets provide command-level granularity.

How to eliminate wrong answers

Option A is wrong because the 'Admin' group in the authentication policy only determines how the admin authenticates (e.g., against AD) and does not control command authorization. Option B is wrong because a shell profile with privilege level 1 grants a broad set of commands (typically all show commands plus some others) but does not provide granular command-level restriction to only 'show' — and it does not allow specifying individual commands. Option D is wrong because a dACL is used for network access control (filtering traffic), not for TACACS+ command authorization on a device.

Full explanation →
26
Multi-Selecthard

Which TWO of the following represent ways to verify the posture status of an endpoint?

Select 2 answers
A.Check the DHCP server logs
B.View the status in the AnyConnect agent UI
C.Review the switch port configuration
D.Analyze the AAA traffic dump
E.Check the Posture Assessment Report on ISE
AnswersB, E

The AnyConnect agent UI displays the endpoint's current posture state, including which checks passed or failed, giving local verification on the device itself. This satisfies the stem's requirement for a valid method of confirming posture status without querying ISE server-side reporting.

Why this answer

Option B is correct because the Cisco AnyConnect (Secure Client) agent UI displays the endpoint's posture status directly, showing whether the system has passed or failed the posture policy checks performed by the agent in conjunction with ISE. Option E is correct because ISE's Posture Assessment Report provides a centralized view of posture results, including compliance details for each endpoint that has undergone posture evaluation. Option A is incorrect because DHCP server logs only record IP address lease assignments and contain no posture or compliance information.

Option C is incorrect because switch port configuration defines Layer 2 settings such as VLANs, trunking, and port security, not endpoint posture state. Option D is incorrect because an AAA traffic dump captures RADIUS authentication and authorization exchanges but does not present a usable posture status verification view.

Exam trap

SISE often tests the distinction between direct posture verification methods (agent UI, ISE reports) and indirect network data (DHCP logs, switch configs, AAA dumps), so candidates may incorrectly choose options that seem related to network access but do not directly show posture compliance.

Full explanation →
27
MCQmedium

In an ISE Authorization Policy, what happens if no rules match a request?

A.The request is sent to the primary PAN
B.The request hits the Default rule in the Policy Set
C.The request is automatically permitted
D.The NAD closes the port
AnswerB

A Policy Set always ends with a non-editable Default rule, which matches any request that no preceding rule matched. It therefore guarantees a deterministic result rather than an undefined one, satisfying the stem's requirement that every request receives a decision even when no configured rule applies.

Why this answer

If no rules match a request in an ISE Authorization Policy, the request hits the Default rule in the Policy Set. The Default rule is a catch-all that typically has a result of 'DenyAccess' unless explicitly configured otherwise. This ensures that unmatched requests are handled consistently, often denying access by default.

Exam trap

The trap is thinking that unmatched requests are automatically permitted or that they are sent to another node. The correct behavior is to hit the Default rule, which typically denies access. Candidates might forget the existence of the Default rule.

How to eliminate wrong answers

Option A is wrong because sending the request to the primary PAN is not a standard authorization policy behavior; the PAN is for administration, not policy evaluation. Option C is wrong because automatically permitting would be a security risk; the default is usually deny. Option D is wrong because the NAD closing the port is a result of a deny action, but it's not the immediate next step; the policy evaluation first hits the Default rule, which may then result in a deny that causes the NAD to close the port.

Full explanation →
28
MCQhard

A TACACS+ command authorization policy is failing to restrict specific configuration changes on a Cisco IOS device. Which field in the TACACS+ Profile must be correctly configured to ensure the command list is evaluated?

A.Command Sets
B.Device Administration Policy
C.Policy Set Condition
D.Shell Profile
AnswerA

The Command Set holds the permitted or denied command list that TACACS+ evaluates during authorisation. If it is unconfigured or wrongly attached to the profile, ISE cannot match commands, so configuration changes are not restricted.

Why this answer

In a TACACS+ Profile in Cisco ISE, the Command Sets field is where you define the list of commands (permit/deny) that will be evaluated for command authorization. If the command list is not correctly configured in the Command Sets, the device will not receive the proper authorization response, and the policy will fail to restrict commands. Therefore, Command Sets is the field that must be correctly configured.

Exam trap

SISE often tests the specific field within a TACACS+ Profile that contains the command list — candidates may confuse Command Sets with Shell Profile or Device Administration Policy, but only Command Sets holds the actual command authorization rules.

How to eliminate wrong answers

Option B is wrong because Device Administration Policy is a broader policy that references the TACACS+ Profile, but it does not contain the command list itself. Option C is wrong because Policy Set Condition determines which policy set applies to the request, not the command authorization list. Option D is wrong because Shell Profile defines the shell attributes (e.g., privilege level, timeout) for the user session, not the command authorization list.

Full explanation →
29
MCQhard

You are troubleshooting a scenario where an admin cannot execute a specific command despite the Command Set having 'Permit' for that command. What is a common reason?

A.The ISE Policy Set has 'Deny' as the default
B.The user is in the wrong AD group
C.The TACACS+ shared secret is incorrect
D.The command is blocked by the switch's local configuration
AnswerD

Cisco ISE authorises commands through the Command Set, but the switch's local configuration, such as a privilege level or parser view restriction, can still deny execution. Authorisation succeeds while the device itself blocks the command, so the admin cannot run it despite the Permit result.

Why this answer

A common reason a permitted command still fails is that the switch's local configuration blocks it. For example, local command authorization, privilege-level restrictions, or AAA command authorization configured locally on the device can deny a command even when ISE's Command Set permits it. The device's local policy takes precedence or acts as an additional gate.

Exam trap

The trap is assuming ISE is the sole authority; candidates forget that the network device's local configuration can independently block a command even when ISE permits it.

How to eliminate wrong answers

Option A is wrong because a default 'Deny' in the Policy Set would affect all commands not explicitly permitted, not a single command that is already permitted in the Command Set. Option B is wrong because AD group membership affects which authorization rule matches, but if the Command Set is already applied and permits the command, the AD group is not the direct cause. Option C is wrong because an incorrect TACACS+ shared secret would break authentication entirely, not selectively block one command.

Full explanation →
30
MCQmedium

A network administrator is deploying a guest wireless network using Cisco ISE. They want guests to authenticate through a web portal, but they do not want guests to have to create their own accounts. Instead, they want employees to pre-create guest accounts and provide credentials to visitors. Which ISE feature should the administrator configure to enable this workflow?

A.Sponsor portal
B.Hotspot portal
C.Device registration portal
D.Self-registration guest portal
AnswerA

The sponsor portal allows authorized employees (sponsors) to create and manage guest accounts in advance. Sponsors can generate credentials and provide them to visitors. This matches the requirement of employees pre-creating guest accounts. Thus, configuring the sponsor portal is the correct solution.

Why this answer

The sponsor portal is specifically designed for sponsors to create and manage guest accounts. It enables employees to pre-create accounts and provide credentials to guests, which matches the requirement. Other portal types like self-registration or hotspot do not involve sponsors in account creation.

Therefore, the sponsor portal is the correct configuration.

Exam trap

The trap here is confusing the sponsor portal with the self-registration portal, which allows guests to create their own accounts.

Full explanation →
31
MCQmedium

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

A.It stores the device credentials
B.It defines which users can access the device
C.It defines the privilege level for the session
D.It defines the list of allowed commands
AnswerC

The Shell Profile maps the authenticated TACACS+ user to a specific privilege level (0–15) applied to the shell session, satisfying the stem's requirement to define authorisation for device administration. Without it, the session defaults to the lowest privilege, so it directly controls the level granted.

Why this answer

The Shell Profile in TACACS+ defines the privilege level for the session. When a user authenticates via TACACS+, the Shell Profile is used to specify the privilege level (e.g., privilege 15) that the user will have on the device. This determines what commands the user can execute.

The Shell Profile is part of the authorization process and is often configured on the TACACS+ server.

Exam trap

SISE often tests the role of Shell Profile in TACACS+ authorization. Candidates may confuse it with command authorization or user authentication, but it specifically sets the privilege level for the session.

How to eliminate wrong answers

Option A is wrong because the Shell Profile does not store device credentials; credentials are stored in the authentication database. Option B is wrong because the Shell Profile does not define which users can access the device; that is determined by authentication and authorization policies. Option D is wrong because the Shell Profile does not define the list of allowed commands; command authorization is handled separately, often via command sets.

Full explanation →
32
MCQhard

When configuring a load balancer for a group of PSNs, what is the best practice for handling RADIUS traffic?

A.SSL-offloading
B.Source-IP affinity (persistence)
C.Active-passive failover only
D.Round-robin without persistence
AnswerB

Source-IP affinity pins each client's RADIUS session to one PSN for its duration, preserving session state across the load balancer. RADIUS is stateful, so persistence prevents authentication failures caused by requests landing on different PSNs.

Why this answer

RADIUS is a UDP-based protocol where the NAS and PSN maintain session state across the Access-Request/Access-Challenge/Access-Accept exchange. If a load balancer distributes successive packets from the same client to different PSNs, the challenge/response state is lost and authentication fails. Source-IP affinity (persistence) ensures all RADIUS packets from a given NAS or endpoint land on the same PSN for the duration of the session.

Exam trap

SISE often tests whether candidates understand that RADIUS is stateful per transaction, tempting them to choose round-robin or SSL offloading options that sound like standard load-balancing best practices but break authentication.

How to eliminate wrong answers

Option A is wrong because SSL offloading applies to TLS-wrapped protocols (HTTPS, LDAPS) and is irrelevant to RADIUS, which is not TLS-encrypted at the transport layer (RadSec is a separate case). Option C is wrong because active-passive failover only addresses availability, not the per-session state consistency required for RADIUS; it also wastes capacity and does not solve multi-PSN load distribution. Option D is wrong because round-robin without persistence actively breaks RADIUS by scattering packets across PSNs, causing authentication failures mid-exchange.

Full explanation →
33
Multi-Selectmedium

Which TWO of the following are common troubleshooting steps for a failed BYOD portal redirection?

Select 2 answers
A.Restart the Active Directory domain controller
B.Check the Authorization Policy for the correct URL-Redirect attribute
C.Verify the redirect ACL permits access to ISE
D.Re-configure the DHCP server
E.Change the switch model
AnswersB, C

The Authorization Policy's URL-Redirect attribute determines where the BYOD portal sends unregistered devices after authentication. If it points to a stale or incorrect portal address, redirection fails silently. Verifying this attribute directly satisfies the stem's requirement to troubleshoot failed redirection, since the policy governs the redirect target itself.

Why this answer

Option B is correct because in Cisco ISE BYOD flows the Authorization Policy must return the correct URL-Redirect attribute (e.g., the Cisco AV pair url-redirect pointing to the guest/BYOD portal) so the endpoint is redirected to the portal instead of being denied or passed through. Option C is correct because the redirect ACL applied to the authorization result must permit the client's traffic to reach ISE (TCP 8443 for the portal, and DNS resolution), otherwise the HTTP redirect cannot complete and the portal never loads. Restarting the Active Directory domain controller (A) is unrelated to portal redirection and would not fix a redirect attribute or ACL problem.

Re-configuring the DHCP server (D) is unnecessary unless IP addressing is broken, which is not the described symptom. Changing the switch model (E) is irrelevant since redirection depends on policy and ACL configuration, not hardware model.

Exam trap

SISE often tests the misconception that BYOD redirection failures are caused by backend infrastructure (AD, DHCP, hardware) rather than the two configuration touchpoints that actually control redirection: the Authorization Policy's URL-Redirect attribute and the redirect ACL on the NAD.

Full explanation →
34
MCQmedium

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

A.Registry Condition
B.Application Condition
C.File Condition
D.Patch Condition
AnswerD

A patch condition checks for a specific installed update by its KB number, directly satisfying the requirement to verify that exact Windows patch. Unlike OS-version or file conditions, it queries the update inventory, so only endpoints with that KB installed match the policy.

Why this answer

A Patch Condition in ISE posture is specifically designed to check for the presence of a particular Windows patch by its KB number (or a range of KBs). It queries the endpoint's update history and compares it against the configured KB values, returning compliant or non-compliant. This is the only condition type that directly targets patch-level granularity.

Exam trap

SISE often tests whether candidates know that patch verification is a dedicated condition type (Patch Condition) rather than being achieved through registry or file checks, which are common but indirect workarounds.

How to eliminate wrong answers

Option A is wrong because a Registry Condition checks for the existence or value of a specific registry key, which is useful for many things but not a direct KB check. Option B is wrong because an Application Condition checks whether a specific application is installed and its version, not OS patches. Option C is wrong because a File Condition checks for the presence, date, or version of a file on disk, which is unrelated to patch installation.

Full explanation →
35
MCQmedium

Which of the following is a requirement for a successful BYOD certificate provisioning flow?

A.The client must have the Root CA certificate installed in its trusted store
B.The client must use a specific third-party supplicant
C.The client must be joined to the Active Directory domain
D.The device must be managed by the same MDM as the enterprise devices
AnswerA

The client must trust the issuing CA before it will accept the provisioned certificate; without the Root CA in its trusted store, the device rejects the certificate chain and provisioning fails. This satisfies the stem's requirement for a successful BYOD certificate provisioning flow.

Why this answer

For BYOD certificate provisioning (e.g., via the native supplicant or Cisco Network Setup Assistant), the client must trust the ISE certificate chain, which requires the Root CA certificate to be installed in the client's trusted store. Without that trust anchor, the TLS handshake during enrollment fails and the certificate cannot be provisioned. This is a fundamental PKI requirement for any certificate-based onboarding flow.

Exam trap

SISE often tests the misconception that BYOD certificate provisioning requires domain join or MDM management, when in fact the only hard requirement is that the client trusts the issuing CA's root certificate.

How to eliminate wrong answers

Option B is wrong because ISE BYOD provisioning supports native supplicants (Windows, macOS, iOS, Android) and does not require a specific third-party supplicant. Option C is wrong because BYOD devices are typically personal and not domain-joined; AD membership is not a prerequisite for certificate provisioning. Option D is wrong because BYOD devices are by definition not managed by the enterprise MDM; the flow is designed for unmanaged devices, so MDM management is not required.

Full explanation →
36
MCQmedium

A guest user reports they receive a certificate warning when redirected to the ISE Guest portal. What is the most common cause of this issue?

A.The ISE portal is configured for HTTP instead of HTTPS.
B.The DNS server is not resolving the ISE FQDN.
C.The ISE server certificate is self-signed or not trusted by the client device.
D.The switch is not configured for SSL interception.
AnswerC

Guest portal redirection presents the ISE server certificate to the client browser. If that certificate is self-signed or issued by a CA the client does not trust, the TLS handshake triggers a warning. Replacing it with a CA-signed certificate trusted by client devices resolves the warning.

Why this answer

The most common cause of certificate warnings on the ISE Guest portal is that the ISE server is using a self-signed certificate or a certificate not trusted by the client's browser trust store. Browsers will display a warning when the certificate chain cannot be validated against a trusted CA. Replacing the default self-signed certificate with a CA-signed certificate whose SAN matches the portal FQDN resolves the warning.

Exam trap

SISE often tests the difference between certificate trust issues and DNS/HTTP misconfigurations — candidates may pick DNS or HTTP options, but a certificate warning specifically points to a TLS trust problem, not connectivity.

How to eliminate wrong answers

Option A is wrong because if the portal were configured for HTTP instead of HTTPS, the user would not receive a certificate warning at all — there would be no TLS handshake. Option B is wrong because a DNS resolution failure would result in a 'page cannot be reached' or timeout error, not a certificate warning; the browser would never reach the TLS stage. Option D is wrong because SSL interception is not a switch function in this context, and even if it were, it would not be the typical cause of a guest portal certificate warning; the issue is server certificate trust.

Full explanation →
37
Multi-Selectmedium

Which THREE of the following are true regarding the Cisco ISE Profiler Feed Service?

Select 3 answers
A.It automatically assigns devices to groups.
B.It can be configured to update automatically on a schedule.
C.It downloads updated profiling policies from Cisco.
D.It is mandatory for all deployments.
E.It requires internet access for the PAN node.
AnswersB, C, E

Feed updates can be scheduled, letting the PAN poll Cisco's servers at defined intervals rather than manually triggering each download. This automatic scheduling satisfies the stem by confirming the feed supports recurring, unattended policy refreshes.

Why this answer

Option B is correct because the Profiler Feed Service can be scheduled to poll Cisco's update servers automatically at a configured interval (for example, daily or weekly) so that endpoint profile policies stay current without manual intervention. Option C is correct because the service's core function is to download updated profiling policies and Cisco-provided endpoint profile definitions from Cisco's feed servers to the ISE deployment. Option E is correct because the Policy Administration Node (PAN) is the node that contacts the external Cisco feed servers, so it requires outbound internet access (HTTPS/443) to retrieve those updates.

Option A is not correct because the feed service only supplies profile/policy updates; actual assignment of endpoints to identity groups is performed by ISE's profiling engine and authorization policies, not by the feed itself. Option D is not correct because the Profiler Feed Service is optional — ISE can profile endpoints using built-in and custom policies without ever enabling the feed service.

Exam trap

SISE often tests the misconception that the Profiler Feed Service automatically assigns endpoints to groups or is required for profiling to work, when in fact it only downloads policy updates and is optional.

Full explanation →
38
MCQmedium

You are troubleshooting a Guest flow where the client hits the portal but cannot authenticate. You notice the MAC address is not being cached properly. Which setting in the Guest Portal configuration is responsible for enabling MAC caching?

A.Enable Auto-Login
B.Enable Guest Flow Bypass
C.Enable MAC Caching
D.Enable Device Registration
AnswerC

Enabling MAC Caching lets the guest portal cache the endpoint's MAC address after successful authentication, so returning clients bypass the portal. This directly satisfies the stem's requirement: the MAC address is not being cached, causing repeated authentication failures. The setting is the specific control governing that caching behaviour.

Why this answer

MAC caching in the ISE Guest Portal configuration allows the client's MAC address to be remembered after successful authentication, so subsequent connections bypass the portal and are authenticated automatically. If MAC caching is not enabled, the MAC address is not cached, and the client is forced to re-authenticate through the portal each time, which matches the reported symptom. Enabling MAC Caching in the Guest Portal settings resolves this.

Exam trap

SISE often tests the distinction between MAC caching, Auto-Login, and Device Registration — candidates may confuse these features, but only MAC Caching directly addresses caching the MAC address for guest re-authentication.

How to eliminate wrong answers

Option A is wrong because Auto-Login allows a previously authenticated user to be logged in automatically based on a cookie or credential, but it does not cache the MAC address; it's a different mechanism. Option B is wrong because Guest Flow Bypass is not a standard ISE Guest Portal setting for MAC caching; it may refer to bypassing the guest flow entirely, which is not the issue. Option D is wrong because Device Registration is for registering devices for BYOD or posture, not for caching MAC addresses for guest re-authentication.

Full explanation →
39
MCQmedium

A network administrator needs to implement self-registered guest access where the guest must provide an email address for validation. Which feature in the Guest Portal settings allows for this?

A.Registration Form settings.
B.Authentication Policy rules.
C.Guest Type settings.
D.Device Registration settings.
E.Sponsor Group settings.
AnswerA

Registration Form settings let you enable self-registration and require specific fields, such as email address, before a guest is validated. This directly satisfies the stem's constraint that guests self-register and supply an email address for validation, rather than relying on sponsor-created or pre-populated accounts.

Why this answer

The Registration Form settings in the ISE Guest Portal configuration control the fields presented to self-registering guests, including the option to require an email address for validation. Enabling the email field with validation forces guests to enter a valid email before the account is created and credentials are delivered. This is the specific portal-level feature that governs what data guests must supply during self-registration.

Exam trap

SISE often tests the distinction between portal presentation settings (Registration Form fields) and portal authorization settings (Guest Type, Sponsor Group), causing candidates to pick Guest Type when the question is really about what data the guest must supply.

How to eliminate wrong answers

Option B is wrong because Authentication Policy rules determine how credentials are validated (e.g., against the guest identity store), not what fields appear on the registration form. Option C is wrong because Guest Type settings define account duration, sponsor requirements, and login behavior, but not the registration form fields themselves. Option D is wrong because Device Registration settings apply to BYOD device onboarding portals, not guest self-registration email validation.

Option E is wrong because Sponsor Group settings control which sponsors can approve guests and their permissions, not the guest-facing registration form.

Full explanation →
40
MCQmedium

A network engineer is deploying Cisco ISE in a distributed architecture. The engineer needs to ensure that the deployment can scale to handle a large number of concurrent authentication requests. Which factor primarily determines the number of PSNs required?

A.The number of endpoints in the network.
B.The number of concurrent authentication requests and the required throughput.
C.The number of administrators who will manage the ISE deployment.
D.The number of network access devices (NADs) in the network.
AnswerB

The number of PSNs is primarily determined by the expected concurrent authentication load and the required throughput. Each PSN has performance limits, and adding PSNs distributes the load. Factors include the rate of authentications per second, the complexity of policies, and the use of features like profiling and posture.

Why this answer

The number of PSNs is driven by the concurrent authentication load and required throughput. Each PSN has capacity limits, so deploying additional PSNs distributes the load and ensures scalability. Other factors like endpoint count and NAD count are secondary to the actual transaction rate and performance needs.

Exam trap

The trap here is assuming that endpoint count alone dictates PSN count, ignoring the actual authentication rate and performance characteristics.

Full explanation →
41
MCQeasy

Which port does Cisco ISE use by default for TACACS+ communication with network devices?

A.TCP 8443
B.UDP 1812
C.UDP 1645
D.TCP 49
AnswerD

TACACS+ uses TCP port 49 for communication between Cisco ISE and network devices. Unlike RADIUS, which uses UDP ports 1812 and 1813, TACACS+ separates authentication, authorisation and accounting over a single TCP connection, making port 49 the default for device administration.

Why this answer

TACACS+ uses TCP port 49 by default for all communication between the network access device and the AAA server such as Cisco ISE. This is a well-known, IANA-registered port specifically assigned to the TACACS+ protocol. ISE listens on TCP 49 for TACACS+ requests from NADs.

Exam trap

The trap is mixing up TACACS+ (TCP 49) with RADIUS ports (UDP 1812/1813 or legacy 1645/1646) — candidates often default to RADIUS ports because RADIUS is more commonly discussed.

How to eliminate wrong answers

Option A is wrong because TCP 8443 is used by ISE for administrative HTTPS/portal access, not TACACS+. Option B is wrong because UDP 1812 is the RADIUS authentication port (and 1813 is accounting), not TACACS+. Option C is wrong because UDP 1645 is the legacy RADIUS authentication port retained for backward compatibility, not TACACS+.

Full explanation →
42
MCQmedium

You are configuring a Posture policy in Cisco ISE and need to ensure that endpoints running an outdated version of Windows are directed to a specific remediation portal. Which component must you configure to define the conditions that trigger this remediation?

A.Posture Requirements
B.Client Provisioning Policies
C.Remediation Actions
D.Posture Policies
AnswerA

Posture Requirements define the specific checks, such as OS version, that an endpoint must satisfy. Configuring a requirement for the minimum Windows version makes non-compliant endpoints fail the check and be directed to the remediation portal, satisfying the stated condition.

Why this answer

Posture Requirements in Cisco ISE define the specific conditions that an endpoint must meet to be considered compliant, such as a particular Windows version or patch level. When an endpoint fails to meet a requirement, ISE can trigger a remediation action. The requirement itself contains the condition (e.g., 'Windows version must be at least 10.0.19041') that, when not met, leads to remediation.

Therefore, Posture Requirements is the component that defines the conditions triggering remediation.

Exam trap

The trap is confusing Posture Requirements (the condition) with Remediation Actions (the action) — candidates often pick Remediation Actions because the question mentions 'remediation portal', but the portal is the action, not the condition.

How to eliminate wrong answers

Option B is wrong because Client Provisioning Policies determine which software (like AnyConnect or a remediation client) is provisioned to an endpoint, not the conditions that trigger remediation. Option C is wrong because Remediation Actions define what action to take (e.g., link to a portal, run a script) but do not define the condition that triggers them — they are the 'then' part, not the 'if' part. Option D is wrong because Posture Policies are the higher-level policies that bind posture requirements to endpoint identity groups and define the overall compliance flow, but the specific condition that triggers remediation is defined within the Posture Requirement itself.

Full explanation →
43
MCQeasy

In the context of TACACS+, what is the purpose of the 'Network Device Group'?

A.To enable remote logging
B.To organize devices for policy assignment
C.To set the shared secret for all devices in the group
D.To update the device firmware
AnswerB

Network Device Groups classify TACACS+ clients into logical groupings, such as by location or device type. This grouping lets administrators bind command sets and authorisation policies to whole categories of devices rather than configuring each one individually, satisfying scalable policy assignment.

Why this answer

In TACACS+, a Network Device Group (NDG) is used to logically group network devices (e.g., by location, type, or function) so that policies, command sets, and authorization rules can be applied to the group rather than individual devices. This simplifies management and enables scalable policy assignment.

Exam trap

SISE often tests the purpose of NDGs; candidates may confuse them with device configuration settings like shared secrets or logging, but NDGs are purely for logical grouping and policy application.

How to eliminate wrong answers

Option A is wrong because remote logging is typically configured via syslog or TACACS+ accounting, not through NDGs; NDGs do not enable logging. Option C is wrong because the shared secret is configured per device or globally in TACACS+ server settings, not through NDGs; NDGs are for policy organization. Option D is wrong because firmware updates are not a function of TACACS+ or NDGs; they are handled by device management systems.

Full explanation →
44
MCQeasy

Which ISE menu path is used to create a new Authorization Profile?

A.Policy -> Policy Sets -> Add
B.Policy -> Policy Elements -> Conditions
C.Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles
D.Administration -> Identity Management -> Groups
AnswerC

Authorization Profiles are result objects, so they live under Policy Elements alongside other reusable results. The path Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles is where a new profile is created for later reference in authorization policy rules.

Why this answer

In Cisco ISE, Authorization Profiles define the actual permissions or attributes (e.g., VLAN, dACL, SGT) that are applied to a session after a successful authorization policy match. They are created and managed under Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. This is the only path among the options that leads to the Authorization Profiles configuration page.

Exam trap

SISE often tests the distinction between policy elements that define conditions versus those that define results, and candidates frequently confuse the Authorization Profiles path with Policy Sets or Conditions.

How to eliminate wrong answers

Option A is wrong because Policy -> Policy Sets -> Add is used to create a new policy set (a collection of authentication and authorization rules), not an authorization profile. Option B is wrong because Policy -> Policy Elements -> Conditions is where you define conditions (e.g., AD group membership, time-of-day) that are used in policy rules, not the results that are applied. Option D is wrong because Administration -> Identity Management -> Groups is for managing identity groups (e.g., user identity groups or endpoint identity groups), which are used in conditions but are not authorization profiles.

Full explanation →
45
MCQhard

During an 802.1X process, the NAD sends an Access-Request with a specific Calling-Station-ID. If ISE does not find this in its Endpoint DB, what is the default behavior for the 'Unknown' status?

A.Always deny
B.Always permit
C.Automatically add to database
D.Process based on Authorization Policy match
AnswerD

Endpoints absent from the Identity Services Engine Endpoint DB receive the Unknown status, which does not block authentication. ISE instead evaluates the request against the matching Authorization Policy rules, applying the resulting authorisation profile to permit or restrict access.

Why this answer

When ISE receives an Access-Request with a Calling-Station-ID (MAC address) that is not present in the Endpoint Database, the endpoint is assigned the 'Unknown' identity group by default. ISE does not automatically deny or permit — it simply proceeds to evaluate the Authorization Policy, where the 'Unknown' group can be matched by a specific rule (e.g., redirect to guest portal, apply a restrictive dACL, or deny). The outcome is entirely determined by which authorization rule matches.

Exam trap

SISE often tests the misconception that ISE has a hardcoded default action (deny or permit) for unknown endpoints, when in reality the behavior is entirely driven by the Authorization Policy match.

How to eliminate wrong answers

Option A is wrong because ISE has no built-in 'always deny' behavior for unknown endpoints — denial only happens if an authorization rule explicitly matches the Unknown group and returns a DenyAccess result. Option B is wrong because 'always permit' would be a severe security default and is not how ISE behaves; permitting requires an explicit authorization rule. Option C is wrong because ISE does not automatically add unknown endpoints to the Endpoint Database during authentication — endpoints are added via profiling probes, manual entry, or the guest/MAC registration flows, not as a side effect of an unknown Calling-Station-ID.

Full explanation →
46
MCQhard

A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?

A.Modify the guest portal settings
B.Change the authentication sequence
C.Reorder the policy sets
D.Adjust the Policy Set conditions
AnswerD

Policy Set conditions determine which policy set a request matches, evaluated before authentication rules inside it. Refining those conditions so guest attributes, such as the guest user's identity source or group, match the Guest policy set routes the traffic correctly.

Why this answer

Policy Set conditions are the top-level matching criteria that determine which policy set a request is evaluated against. If guest traffic is landing in the wrong policy set, the fix is to adjust the conditions (e.g., SSID, NAS-IP-Address, device type, or RADIUS attributes) so the guest session matches the 'Guest' policy set. Reordering only changes evaluation order among policy sets that already match — it does not change which conditions cause a match.

Exam trap

SISE often tests the confusion between policy set selection (conditions) and policy set ordering (reordering), tricking candidates into picking 'reorder' when the real issue is that the conditions themselves don't match the traffic.

How to eliminate wrong answers

Option A is wrong because guest portal settings control the web authentication experience (redirect URL, acceptable use policy, login page), not which policy set the RADIUS request is matched against. Option B is wrong because the authentication sequence defines the order of identity stores (AD, LDAP, internal users) within a policy set, not which policy set is selected. Option C is wrong because reordering policy sets only affects the evaluation order of already-matching sets; it cannot force a non-matching request into the Guest set.

Full explanation →
47
Multi-Selecthard

Which THREE of the following are steps involved in the guest portal sponsor approval process?

Select 3 answers
A.The sponsor logs into the sponsor portal to review and approve the request.
B.The guest registers for an account on the self-registration portal.
C.The ISE automatically approves the account after 10 minutes.
D.The sponsor receives an automated email notification about the pending account.
E.The guest must physically visit the sponsor's office.
AnswersA, B, D

The sponsor authenticates to the sponsor portal and approves or denies the pending guest account there. This review action is the decision point of the workflow, converting the pending registration into an active account, and is distinct from the notification that merely prompts it.

Why this answer

In the Cisco ISE guest sponsor approval workflow, the process begins when the guest registers for an account on the self-registration portal (B), which creates a pending guest account that requires sponsor action. The sponsor then logs into the sponsor portal to review and approve the request (A), which is the core approval step that activates the guest account. The sponsor also receives an automated email notification about the pending account (D), alerting them that a guest is awaiting approval so they can act on it.

Option C is incorrect because ISE does not automatically approve accounts after 10 minutes; approval requires explicit sponsor action (or a configured automatic approval policy, not a fixed timer). Option E is incorrect because the entire sponsor approval process is performed through the portals and email notifications, with no requirement for the guest to physically visit the sponsor's office.

Exam trap

SISE often tests the sequence and actors in the sponsor approval flow — candidates add plausible but non-existent steps like auto-approval timers or in-person visits.

Full explanation →
48
MCQhard

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

A.System Summary Dashboard
B.Endpoint Context Visibility
C.TACACS+ Livelogs
D.RADIUS Livelogs
AnswerC

TACACS+ Livelogs capture per-request authentication detail, including the matched policy set and authorisation result, which the stem requires. Unlike passive log files, Livelogs stream live request attributes and rule evaluations, so you can pinpoint exactly why a device's TACACS+ authentication attempt succeeded or failed.

Why this answer

TACACS+ Livelogs in Cisco ISE is the dedicated real-time log view that shows TACACS+ authentication and authorization request details, including the policy set and rule that matched. When troubleshooting TACACS+ authentication issues, this is the correct log to monitor because it captures the full request/response exchange and the policy evaluation result. RADIUS Livelogs, by contrast, only show RADIUS traffic and would not display TACACS+ request details.

Exam trap

SISE often tests whether candidates know that TACACS+ and RADIUS have separate Livelogs — picking RADIUS Livelogs for a TACACS+ issue is the classic wrong answer.

How to eliminate wrong answers

Option A is wrong because the System Summary Dashboard provides high-level health and performance metrics, not per-request TACACS+ authentication details or policy match results. Option B is wrong because Endpoint Context Visibility shows endpoint attributes and profiling data, not TACACS+ authentication request logs. Option D is wrong because RADIUS Livelogs only capture RADIUS authentication/authorization exchanges — TACACS+ requests are a separate protocol and will not appear there.

Full explanation →
49
MCQhard

A company has deployed Cisco ISE BYOD with native supplicant provisioning. Employees are reporting that their Windows 10 devices fail to complete the onboarding process. The administrator reviews the ISE logs and sees that the devices are successfully authenticated and authorized for the BYOD onboarding portal, but the supplicant provisioning wizard fails to run. The administrator suspects that the issue is related to the supplicant provisioning settings. Which of the following should the administrator verify first to resolve this issue?

A.The Windows 10 devices have the latest version of the Cisco AnyConnect Network Access Manager installed
B.The supplicant provisioning profile in ISE is configured to use the correct Windows supplicant and the provisioning wizard is enabled
C.The certificate authority (CA) in ISE is configured to issue certificates with a validity period of at least one year
D.The client provisioning policy is configured to use a guest portal instead of a BYOD portal
AnswerB

For native supplicant provisioning on Windows, ISE must be configured with a supplicant provisioning profile that specifies the Windows native supplicant and includes the provisioning wizard. If the profile is misconfigured or the wizard is disabled, the provisioning will fail even if authentication succeeds. The administrator should verify that the supplicant profile is correctly set to use the Windows supplicant and that the wizard is enabled for the device type.

Why this answer

For native supplicant provisioning to work on Windows 10, ISE must have a supplicant provisioning profile that correctly identifies the Windows native supplicant and enables the provisioning wizard. If the profile is misconfigured or the wizard is not enabled, the device will fail to run the wizard even after successful authentication. The administrator should verify the supplicant profile settings, including the supplicant type and the provisioning wizard configuration.

Other options, such as requiring AnyConnect or checking certificate validity, are not relevant to the wizard execution failure.

Exam trap

The trap here is assuming that third-party supplicant software like AnyConnect is required, when native supplicant provisioning uses the built-in Windows supplicant.

Full explanation →
50
Multi-Selectmedium

Which TWO of the following are valid components of a TACACS+ Authorization Policy in Cisco ISE? (Choose two)

Select 2 answers
A.User Password
B.RADIUS attribute list
C.Shell Profile
D.Device Shared Secret
E.Command Set
AnswersC, E

A TACACS+ authorization policy rule binds identity and group conditions to a Shell Profile, which defines the privilege level and session attributes returned to the network device. Shell Profile is therefore a valid policy component, satisfying the stem's requirement for authorised elements.

Why this answer

In Cisco ISE, a TACACS+ Authorization Policy is built from authorization results that define what an authenticated user is permitted to do on a network device, and the two valid components here are the Shell Profile (C) and the Command Set (E). The Shell Profile (C) is correct because it defines the privilege level and shell attributes (such as default privilege, maximum privilege, and auto-command) that ISE returns in the TACACS+ authorization response to control the user's CLI session. The Command Set (E) is correct because it specifies the set of commands (permit/deny with optional arguments) that the user is authorized to execute, and it is referenced by the Shell Profile or applied directly in the authorization result.

User Password (A) is not a TACACS+ authorization component; it is authentication data handled during the authentication phase. RADIUS attribute list (B) is incorrect because RADIUS attributes belong to RADIUS-based authorization, not TACACS+ authorization policy components. Device Shared Secret (D) is incorrect because it is a credential used to secure communication between the network device and ISE, not a component of the authorization policy itself.

Exam trap

SISE often tests whether candidates can distinguish authentication components (passwords, shared secrets) from authorization result components (shell profile, command set) — candidates pick credentials thinking they're part of the authorization policy.

Full explanation →
51
MCQeasy

What is the purpose of the 'Redirect ACL' on the network access device?

A.To encrypt the traffic between the client and the switch
B.To limit the bandwidth for BYOD users
C.To force the client to use a specific DNS server
D.To permit access to the ISE portal while blocking all other traffic
AnswerD

The Redirect ACL on the switch or WLC permits client traffic to the ISE portal and DNS while denying everything else, forcing the endpoint into the captive portal for authentication or remediation before broader access is granted.

Why this answer

The Redirect ACL on the NAD (switch/WLC) is a pre-auth ACL that permits only the traffic required to reach the ISE portal (DNS, DHCP, HTTP/HTTPS to ISE) and denies everything else, forcing the client into the guest/BYOD/posture flow. Once the client is authorized, ISE sends a CoA that replaces the redirect ACL with the appropriate authorization ACL (e.g., full access or limited access). This is the mechanism that makes centralized web authentication and BYOD onboarding work.

Exam trap

SISE often tests the misconception that the Redirect ACL is a security enforcement ACL for post-auth traffic, when in fact it is a pre-auth traffic-steering mechanism whose only job is to funnel the client to the ISE portal.

How to eliminate wrong answers

Option A is wrong because the Redirect ACL does not encrypt traffic; encryption on the access layer is handled by MACsec (802.1AE) or by the EAP TLS tunnel, not by an ACL. Option B is wrong because bandwidth limiting is enforced by QoS policies (rate limiting, policing) on the NAD, not by an ACL. Option C is wrong because forcing a specific DNS server is done via DHCP option 6 or DNS snooping/redirection, not by the Redirect ACL — the ACL merely permits DNS traffic to whatever server the client is configured to use.

Full explanation →
52
Multi-Selectmedium

Which TWO of the following are valid components of an ISE Authorization Policy rule?

Select 2 answers
A.Results
B.Device Groups
C.Authentication protocols
D.Identity Source
E.Conditions
AnswersA, E

Results specify the authorization profile or permissions returned when a rule's conditions match, such as a VLAN, dACL or SGT. They form the second core component of an ISE authorization policy rule, determining what access the matched session receives.

Why this answer

In Cisco ISE, an Authorization Policy rule is built from two main parts: Conditions and Results. Option E (Conditions) is correct because the rule's conditions define the matching criteria — such as identity group, AD group, device type, or posture status — that determine whether the rule applies to a session. Option A (Results) is correct because the results define what authorization profile or permissions (e.g., VLAN, dACL, SGT, or downloadable ACL) are applied when the conditions match.

Option D (Identity Source) is not a component of the authorization rule itself; identity sources are referenced in authentication policy rules to validate credentials. Option B (Device Groups) is used in network device definitions and policy sets, not as a direct authorization rule component. Option C (Authentication protocols) are configured in authentication policy rules, not in authorization policy rules.

Exam trap

The trap is confusing components of authentication policies with those of authorization policies. Candidates might think identity sources or authentication protocols are part of authorization rules, but they are not; authorization rules only have conditions and results.

Full explanation →
53
MCQmedium

If a user is successfully registered but cannot connect after the BYOD flow, which status should you check in the 'Endpoints' menu?

A.User ID
B.Registration Status
C.Last Access Date
D.Device Type
AnswerB

Registration Status shows whether the endpoint completed onboarding and holds a valid certificate, satisfying the stem's constraint of a registered user who cannot connect. A failed or pending status reveals the certificate was never issued, explaining the connection failure.

Why this answer

The 'Registration Status' field in the Endpoints menu directly indicates whether a device completed the BYOD onboarding/registration process successfully. If a user is registered but cannot connect, checking Registration Status confirms whether the endpoint actually finished the registration handshake or is stuck in a pending/failed state. This is the authoritative field for diagnosing post-registration connectivity issues in the BYOD flow.

Exam trap

The trap here is confusing user-level identity fields (User ID) with endpoint-level onboarding state (Registration Status), causing candidates to pick the field that seems most 'identifying' rather than the one that reflects BYOD completion.

How to eliminate wrong answers

Option A is wrong because User ID only identifies the account owner and does not reflect whether the device itself completed registration or is authorized to connect. Option C is wrong because Last Access Date is a historical audit field showing the last successful connection, not the current registration or authorization state. Option D is wrong because Device Type is merely descriptive metadata about the endpoint hardware/OS and has no bearing on whether registration or connectivity succeeded.

Full explanation →
54
MCQmedium

Which probe is most effective for identifying the specific operating system and browser type of an endpoint connecting via a web portal?

A.HTTP probe
B.DHCP probe
C.MAC OUI probe
D.DNS probe
AnswerA

The HTTP probe inspects the User-Agent string within HTTP traffic, revealing the endpoint's operating system and browser type. This satisfies the stem's web-portal scenario, where HTTP is the only traffic available, unlike NetFlow or DHCP probes.

Why this answer

The HTTP probe is the most effective for identifying OS and browser type because it collects User-Agent strings and other HTTP headers sent by the endpoint's browser during web portal authentication. These headers contain detailed information about the operating system, browser name, and version, which ISE uses to match profiling policies. No other probe provides this level of browser-specific detail.

Exam trap

SISE often tests whether candidates confuse the DHCP probe (which identifies OS via DHCP fingerprinting) with the HTTP probe (which identifies browser and OS via User-Agent) — the question specifically asks for browser type, which only HTTP provides.

How to eliminate wrong answers

Option B is wrong because the DHCP probe collects DHCP fingerprint data (option 55 parameter request list, hostname, etc.), which can identify the OS but not the browser. Option C is wrong because the MAC OUI probe only identifies the hardware manufacturer from the first three bytes of the MAC address — it cannot determine OS or browser. Option D is wrong because the DNS probe captures DNS queries and can infer some application behavior, but it does not reveal browser type or OS version.

Full explanation →
55
MCQeasy

When deploying the AnyConnect Posture agent, which specific file must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment?

A.AnyConnect Diagnostic and Reporting Tool
B.AnyConnect ISE Posture Agent profile
C.AnyConnect Compliance Module
D.AnyConnect VPN package
AnswerC

The AnyConnect Compliance Module supplies the posture plugins that ISE pushes to endpoints, enabling the agent to perform posture assessment. Uploading it to Client Provisioning satisfies the stem's requirement, since the AnyConnect package alone cannot evaluate endpoint compliance conditions.

Why this answer

The AnyConnect Compliance Module is the specific file that must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment. It contains the posture policies and checks that the AnyConnect ISE Posture Agent uses to evaluate endpoint compliance. Without this module, the agent cannot perform posture checks, so it is essential for posture assessment.

Exam trap

SISE often tests the confusion between the AnyConnect Compliance Module and the AnyConnect ISE Posture Agent profile, as both are related to posture but serve different purposes: the profile configures the agent, while the Compliance Module provides the actual posture checks.

How to eliminate wrong answers

Option A is wrong because the AnyConnect Diagnostic and Reporting Tool (DART) is used for troubleshooting and collecting logs, not for posture assessment. Option B is wrong because the AnyConnect ISE Posture Agent profile is a configuration profile that defines how the agent behaves, but it does not contain the actual posture checks; the Compliance Module is required for that. Option D is wrong because the AnyConnect VPN package provides VPN functionality, not posture assessment; it is used for remote access, not compliance checking.

Full explanation →
56
MCQmedium

You are configuring a BYOD flow where users must register their devices via the self-service portal. Which ISE component is responsible for triggering the redirection to the BYOD portal after an initial MAC Authentication Bypass (MAB) success?

A.Policy Set with a global redirect object
B.Authentication Policy with a portal trigger
C.RADIUS server-side redirect attribute
D.Authorization Profile with a redirect ACL and URL redirect
AnswerD

The Authorization Profile carries the redirect ACL and URL redirect attributes returned in the RADIUS Access-Accept after MAB succeeds. These attributes instruct the switch to intercept the session and send the user's browser to the BYOD self-service portal for registration.

Why this answer

The Authorization Profile with a redirect ACL and URL redirect is responsible for triggering the redirection to the BYOD portal after an initial MAB success. When a device authenticates via MAB, ISE evaluates the authorization policy and returns an Authorization Profile that includes a redirect ACL and a URL redirect to the BYOD portal. The NAS then applies the redirect ACL and sends the user's HTTP traffic to the portal.

Exam trap

SISE often tests the specific ISE component that triggers redirection. Candidates may think redirection is configured in the authentication policy or via a global object, but it is actually an Authorization Profile with redirect attributes.

How to eliminate wrong answers

Option A is wrong because a Policy Set with a global redirect object is not a specific ISE component; redirection is achieved via Authorization Profiles. Option B is wrong because an Authentication Policy with a portal trigger is not how redirection is implemented; authentication policies determine authentication methods, not redirection. Option C is wrong because a RADIUS server-side redirect attribute is not a standard ISE term; redirection is done via Authorization Profile attributes like Cisco-AVPair.

Full explanation →
57
MCQhard

A user is complaining that they are stuck in a posture remediation loop despite having the latest antivirus software installed. You verify that the AV check is correctly configured. What is the most likely cause for this behavior?

A.The ISE server is in maintenance mode.
B.The AnyConnect Compliance Module is outdated on the endpoint.
C.The Posture Policy is disabled.
D.The Authorization policy uses the wrong group.
E.The Remediation action requires a reboot that hasn't occurred.
AnswerB

The Compliance Module supplies the posture condition definitions and remediation logic AnyConnect uses. An outdated module cannot correctly evaluate the installed antivirus, so ISE keeps returning the same failed condition and the endpoint loops through remediation despite compliant AV.

Why this answer

The AnyConnect Compliance Module (also called the Posture Module) is responsible for performing posture checks on the endpoint, including antivirus, firewall, and OS patch verification. If the module is outdated, it may not correctly report the AV status to ISE, causing the endpoint to appear non-compliant and triggering a remediation loop even though the AV software is current.

Exam trap

SISE often tests posture troubleshooting — candidates assume the AV software itself is the problem, but the actual issue is frequently the AnyConnect Compliance Module being outdated and unable to correctly report AV status.

How to eliminate wrong answers

Option A is wrong because if the ISE server were in maintenance mode, posture checks would fail entirely for all users, not just one user in a remediation loop. Option C is wrong because a disabled Posture Policy would result in no posture check being performed at all, not a remediation loop. Option D is wrong because a wrong group in the Authorization policy would result in incorrect access permissions, not a posture remediation loop.

Option E is wrong because while a pending reboot can cause posture failures, the question specifies the AV check is correctly configured and the AV is up to date — the most likely cause is the compliance module itself being outdated, which is a known issue.

Full explanation →
58
MCQmedium

If you want a guest user to be automatically redirected to a specific webpage (e.g., company news) after a successful login, where is this configured?

A.In the Authorization Profile.
B.In the Guest Type configuration.
C.In the Redirect ACL on the NAD.
D.In the Guest Portal Settings under 'Post-Login' page.
AnswerD

The Guest Portal's Post-Login page holds the redirect URL applied after successful authentication, so guests land on the specified company news page. Configuring it there ties the redirect to the portal flow itself, rather than to authorisation policy or endpoint posture settings.

Why this answer

The post-login redirect URL for guest users is configured in the Guest Portal Settings under the 'Post-Login' page, where administrators specify the URL to which guests are redirected after successful authentication. This is a portal-level setting, not an authorization or NAD-level configuration, because the redirect is part of the web portal experience rather than the network enforcement.

Exam trap

The trap is conflating the NAD's pre-login redirect ACL (which forces users to the portal) with the portal's post-login redirect setting (which sends users to a landing page after authentication).

How to eliminate wrong answers

Option A is wrong because the Authorization Profile controls network-level attributes like VLAN, dACL, and SGT — it does not control web portal redirect behavior. Option B is wrong because Guest Type configuration defines account parameters (sponsor, duration, login options), not the post-login landing page. Option C is wrong because the Redirect ACL on the NAD controls which traffic is intercepted for redirection to the portal, not where the user lands after login.

Full explanation →
59
MCQmedium

A network engineer is troubleshooting a TACACS+ authentication failure on a Cisco switch. The switch is configured to use Cisco ISE as its TACACS+ server. The engineer runs 'debug tacacs' on the switch and sees that the request is sent but no response is received. Which action should the engineer take first to resolve the issue?

A.Ensure that the switch is configured to use RADIUS for authentication.
B.Verify that the shared secret on the switch matches the one configured in ISE for the switch.
C.Restart the ISE services to clear any temporary glitches.
D.Check if the switch's IP address is in the ISE Identity Group.
AnswerB

If the shared secret does not match, ISE will not respond to TACACS+ requests, and the switch will not receive a response. This is a common cause of TACACS+ failures. The engineer should first check the shared secret on both the switch and ISE. If they differ, the switch's request will be silently dropped by ISE, leading to the observed behavior.

Why this answer

When a TACACS+ request is sent but no response is received, a common cause is a shared secret mismatch. ISE will not respond if the shared secret does not match the one configured on the network device. The engineer should verify the shared secret on both the switch and ISE.

Other steps, such as checking Identity Groups or restarting services, are not relevant to this specific symptom.

Exam trap

The trap here is assuming that ISE will send an error response for a shared secret mismatch; instead, it silently drops the packet, leading to no response.

Full explanation →
60
MCQmedium

When adding a secondary PAN, what is the consequence if the time synchronization (NTP) differs significantly between nodes?

A.The node will operate in read-only mode
B.The node will join but logs will be out of order
C.Only TACACS+ services will be impacted
D.The registration process will fail
AnswerD

Secondary PAN registration relies on certificate-based authentication, which fails when node clocks differ significantly. Valid certificates appear expired or not-yet-valid outside the tolerance window, so the time synchronisation mismatch causes the registration process itself to fail.

Why this answer

When adding a secondary PAN to a Cisco ISE deployment, time synchronization is critical for certificate validation and secure communication. If NTP differs significantly between nodes, the secondary PAN will fail to register because the certificate exchange and authentication processes require synchronized clocks. This is a common requirement in distributed systems to prevent replay attacks and ensure log integrity.

Exam trap

SISE often tests the misconception that NTP issues only affect logging or minor services, when in fact they can cause complete registration failure due to certificate validation.

How to eliminate wrong answers

Option A is wrong because read-only mode is not a consequence of NTP mismatch; it's typically a result of licensing or role configuration. Option B is wrong because while logs might be out of order, the more immediate and severe consequence is registration failure. Option C is wrong because TACACS+ services are not the only impacted service; the entire node registration fails, affecting all ISE personas.

Full explanation →
61
MCQmedium

Which guest portal type should you select if you want to allow users to connect to the network without any authentication, simply by clicking an 'Accept' button?

A.Sponsored Guest Portal
B.Guest Portal
C.Self-Registered Guest Portal
D.Hotspot Portal
AnswerD

The Hotspot Portal satisfies the no-authentication constraint by presenting a click-through Accept button, granting network access without credentials. Unlike the Sponsored-Guest or Self-Registered portals, which require sponsor approval or credential creation, the Hotspot flow performs no identity lookup against Microsoft Entra ID, so unauthenticated visitors gain access immediately.

Why this answer

The Hotspot Portal is specifically designed for unauthenticated guest access where users simply click an 'Accept' button (or similar) to acknowledge the acceptable use policy and gain network access. It requires no credentials, sponsorship, or self-registration, making it the correct choice for click-through access.

Exam trap

SISE often tests the differences between Hotspot, Self-Registered, and Sponsored portals, so candidates who confuse 'click-through' with 'self-registration' will pick the wrong portal type.

How to eliminate wrong answers

Option A is wrong because a Sponsored Guest Portal requires a sponsor to create credentials for the guest, which involves authentication. Option B is wrong because the generic 'Guest Portal' typically refers to a portal that requires login credentials (self-registered or sponsored). Option C is wrong because a Self-Registered Guest Portal requires the user to fill out a registration form and create an account, which is more than just clicking 'Accept'.

Full explanation →
62
MCQmedium

A network engineer is adding a Cisco Catalyst 9300 switch to Cisco ISE for TACACS+ device administration. The switch will use a shared secret of 'C1sco123'. The engineer wants to ensure that ISE can authenticate and authorize administrative sessions from this device. Where should the shared secret be configured in ISE?

A.In the Network Device definition under Administration > Network Resources > Network Devices.
B.In the TACACS+ Profile under Work Centers > Device Administration > Policy Elements > TACACS Profiles.
C.In the TACACS+ Command Set under Work Centers > Device Administration > Policy Elements > Command Sets.
D.In the External RADIUS Server configuration under Administration > External RADIUS Servers.
AnswerA

The shared secret for a TACACS+ network device is configured directly in the Network Device object in ISE. This secret is used to encrypt the entire TACACS+ packet payload and must match the key configured on the switch with the 'tacacs server' command. Without this, ISE will not process authentication requests from the device.

Why this answer

The shared secret for TACACS+ is a device-specific credential configured in the Network Device object in ISE. It must match the key on the switch. Command Sets and TACACS+ Profiles define authorization results, not authentication credentials.

External RADIUS Servers are for outbound proxying. Therefore, the Network Device definition is the correct place to configure the shared secret.

Exam trap

The trap here is confusing the shared secret, which is configured in the Network Device definition, with authorization policy elements like Command Sets or TACACS+ Profiles.

Full explanation →
63
MCQmedium

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

A.Device Profiling
B.RADIUS Accounting
C.Active Directory Identity Store
D.Policy Sets
AnswerA

Device profiling fingerprints the connecting endpoint, using attributes such as DHCP, HTTP user-agent and MAC OUI to identify whether it is an iPhone, Windows or other device type. This satisfies the stem's requirement to identify device type so the appropriate configuration is applied.

Why this answer

Device Profiling is the ISE component that identifies the device type (e.g., iPhone vs. Windows) by collecting attributes via probes such as DHCP, RADIUS, SNMP, and NMAP, then matching them against profiling policies. This identification drives the appropriate BYOD configuration and authorization.

Exam trap

SISE often tests which component performs device identification, and candidates confuse profiling with authorization constructs like policy sets or identity stores.

How to eliminate wrong answers

Option B is wrong because RADIUS Accounting provides session start/stop and traffic data, not device type identification — it does not classify endpoints. Option C is wrong because Active Directory is an identity store for user authentication, not a device classification engine. Option D is wrong because Policy Sets are containers that group authentication and authorization rules; they consume profiling data but do not themselves identify device types.

Full explanation →
64
MCQhard

A user is authenticating via the Sponsored Guest portal. After the sponsor approves the guest, the user still cannot access the network. What is the most common reason for this if the RADIUS flow is correct?

A.The NAD is not processing the CoA request sent by ISE.
B.The guest password has expired.
C.The guest account is not in the correct group.
D.The browser cache is preventing the redirect.
AnswerA

The CoA is necessary to change the authorization state from 'pending' to 'authorized'.

Why this answer

After a sponsor approves a guest, ISE must push a Change of Authorization (CoA) to the NAD to move the session from the restricted guest VLAN/ACL to the authorized state. If the NAD does not support, is not configured for, or rejects the CoA (RFC 5176), the guest remains in the limited-access state even though ISE shows the account as approved. This is the most common cause when the RADIUS authentication flow itself is working correctly.

Exam trap

SISE often tests the assumption that sponsor approval alone grants access, ignoring the CoA dependency — candidates forget that ISE must actively signal the NAD to change the session.

How to eliminate wrong answers

Option B is wrong because an expired password would cause authentication to fail outright, not a post-approval access issue. Option C is wrong because group membership is typically validated at authentication time; if the group were wrong, the initial login would fail or the sponsor flow would not complete. Option D is wrong because browser cache affects the redirect experience, not the enforcement of network access after approval.

Full explanation →
65
MCQmedium

Which of the following is a best practice when configuring TACACS+ for network administration?

A.Enable command authorization
B.Use RADIUS for command authorization
C.Use a single shared secret for all devices
D.Disable accounting for performance
AnswerA

Command authorization makes the TACACS+ server verify each command against the admin's assigned command set before the device executes it, enforcing least privilege. This satisfies the stem's best-practise requirement by restricting administrators to only the commands their role permits.

Why this answer

Enabling command authorization is a best practice for TACACS+ because it allows the TACACS+ server to authorize each command a user attempts to execute, providing granular control over what administrators can do on network devices. This enforces the principle of least privilege and is a core strength of TACACS+ over RADIUS.

Exam trap

The trap is thinking RADIUS can perform command authorization; candidates may choose RADIUS because it is also an AAA protocol, but only TACACS+ supports per-command authorization.

How to eliminate wrong answers

Option B is wrong because RADIUS does not support command authorization; it is primarily used for authentication and accounting, and its authorization capabilities are limited to attributes like VLAN or ACL, not per-command control. Option C is wrong because using a single shared secret for all devices is a security risk; best practice is to use unique shared secrets per device to limit the impact of a compromised secret. Option D is wrong because disabling accounting for performance is not a best practice; accounting is essential for auditing and compliance, and its performance impact is minimal.

Full explanation →
66
MCQmedium

A user reports that a device was incorrectly identified as a 'Cisco IP Phone' when it is actually a 'Cisco Access Point'. Which troubleshooting step should you take first?

A.Check the endpoint attributes in Context Visibility to see why it matched that policy.
B.Re-register the device.
C.Delete all profiling policies.
D.Restart the ISE node.
AnswerA

Context Visibility shows the endpoint's profiled attributes and the matching policy, revealing which probe or condition classified it as a Cisco IP Phone. Inspecting this first identifies the misclassification source before editing profiles or policies.

Why this answer

The first troubleshooting step is to check the endpoint's attributes in Context Visibility, which shows the collected profiling attributes, the matched profiling policies, and the confidence scores that led to the 'Cisco IP Phone' classification. This reveals whether the misclassification is due to incorrect attributes (e.g., a stale MAC OUI match) or an overly broad profiling policy, allowing targeted correction.

Exam trap

The trap is jumping to disruptive fixes (re-register, restart, delete policies) instead of using ISE's built-in diagnostic tool (Context Visibility) to identify the root cause of the misclassification.

How to eliminate wrong answers

Option B is wrong because re-registering the device does not address the root cause of misclassification and may disrupt the endpoint's current session. Option C is wrong because deleting all profiling policies is a destructive action that would break profiling for every endpoint, not just the misidentified one. Option D is wrong because restarting the ISE node is a disruptive, non-targeted action that does not diagnose or fix the profiling logic.

Full explanation →
67
MCQmedium

Where are the TACACS+ accounting logs stored and viewed in the ISE management console?

A.Operations > TACACS Livelogs
B.Monitoring > Reports > TACACS
C.Administration > System > Logging
D.Policy > Policy Elements
AnswerA

TACACS+ accounting records stream into the Operations > TACACS Livelogs viewer, which displays command authorisation and accounting events in real time. This satisfies the stem's requirement to locate where accounting logs are stored and viewed within the ISE management console, rather than under RADIUS or reporting sections.

Why this answer

TACACS+ accounting logs in Cisco ISE are viewed under Operations > TACACS Livelogs. This live log view shows real-time TACACS+ authentication, authorization, and accounting events, including command execution details, the user, the device, and the result. It is the primary troubleshooting and auditing interface for TACACS+ activity in the ISE GUI.

Exam trap

SISE often tests the exact menu path for TACACS+ accounting logs, and candidates confuse Operations > TACACS Livelogs with Monitoring > Reports or Administration > Logging.

How to eliminate wrong answers

Option B is wrong because Monitoring > Reports > TACACS is not the correct path for viewing live TACACS+ accounting events; reports are for aggregated/exported data, not real-time livelogs. Option C is wrong because Administration > System > Logging configures ISE's own system logging (syslog targets, log levels), not TACACS+ accounting records. Option D is wrong because Policy > Policy Elements contains reusable policy objects like authorization profiles and command sets, not log data.

Full explanation →
68
MCQeasy

Which component in ISE defines the 'result' of an authorization rule?

A.Policy Set
B.Identity Source
C.Authorization Policy
D.Authorization Profile
AnswerD

The authorization profile holds the actual enforcement attributes — VLAN, dACL, SGT, URL redirect — that ISE returns once a rule matches. The rule's conditions only select it; the profile supplies the result, satisfying the stem's requirement for the component defining the rule's outcome.

Why this answer

In ISE, an Authorization Profile defines the actual result of an authorization rule, such as VLAN assignment, DACL, SGT, or reauthentication timers. The authorization policy contains rules that reference authorization profiles as the 'then' action. Therefore, the component that defines the 'result' is the Authorization Profile.

Exam trap

SISE often tests the distinction between an Authorization Policy (the rule) and an Authorization Profile (the result); candidates may pick the policy when asked for the component that defines the result.

How to eliminate wrong answers

Option A is wrong because a Policy Set is a container that groups authentication and authorization policies based on conditions, but it does not define the result itself. Option B is wrong because an Identity Source (e.g., AD, LDAP) is used during authentication to verify user credentials, not to define authorization results. Option C is wrong because an Authorization Policy is the set of rules that evaluate conditions and then apply an authorization profile; it does not define the result directly—the profile does.

Full explanation →
69
MCQhard

A user is assigned a Command Set that permits all commands, but they are still receiving 'Access Denied' when running 'reload'. What is the most likely reason?

A.The Command Set is not applied in the Policy Set
B.The device is not authorized for the command
C.The user's privilege level on the device is insufficient
D.The TACACS+ server is unreachable
AnswerC

Command Sets authorise which commands are available, but the device's privilege level (privilege exec level) independently gates execution. A 'reload' requires privilege level 15, so a user at a lower level receives 'Access Denied' despite the Command Set permitting all commands.

Why this answer

Even if a Command Set permits all commands, the user must have a sufficient privilege level on the device to execute privileged commands like 'reload'. If the Shell Profile assigns a low privilege level (for example, priv-lvl 1), the device will reject 'reload' with 'Access Denied' regardless of the Command Set.

Exam trap

The trap is assuming a permissive Command Set is sufficient; candidates overlook that privilege level is enforced first and can block commands even when the command set allows them.

How to eliminate wrong answers

Option A is wrong because if the Command Set were not applied in the Policy Set, the user would typically get a default deny for all commands, not a selective denial of 'reload' while other commands work. Option B is wrong because device authorization is a broad concept; the specific symptom of 'reload' failing while other commands succeed points to privilege level, not device-level authorization. Option D is wrong because an unreachable TACACS+ server would cause authentication or authorization to fail entirely, not just a single command.

Full explanation →
70
MCQhard

A company uses Cisco ISE BYOD with certificate-based authentication. Employees report that their devices successfully onboard and receive a certificate, but after a few days, they are unable to connect to the corporate SSID. The administrator checks ISE and finds that the devices are failing authentication with the error 'Certificate revoked'. The administrator verifies that the certificates are still valid and not expired. Which ISE feature should the administrator check to resolve this issue?

A.Certificate Revocation List (CRL) distribution point and ISE's revocation check settings
B.Certificate Revocation List (CRL) settings in the certificate template
C.Certificate template's validity period and renewal settings
D.Online Certificate Status Protocol (OCSP) configuration in ISE
AnswerA

The error 'Certificate revoked' indicates that ISE is checking the certificate against a CRL and finding it listed as revoked, or the CRL is improperly configured. The administrator should verify the CRL distribution point in the certificate and ensure ISE can reach it and that the CRL is current. If the CRL incorrectly includes the certificate, or if ISE is using a stale CRL, it will reject valid certificates. Adjusting revocation check settings or updating the CRL resolves the issue.

Why this answer

The 'Certificate revoked' error means ISE's revocation check is determining the certificate is revoked. This typically occurs when the CRL distribution point is unreachable, the CRL is stale, or the certificate is incorrectly listed as revoked. The administrator should verify the CRL distribution point in the certificate and ISE's revocation settings.

Ensuring ISE can retrieve a current CRL and that the certificate is not actually revoked will resolve the authentication failures.

Exam trap

The trap here is focusing on certificate expiration or template settings, while the error explicitly indicates a revocation issue, pointing to CRL or OCSP configuration.

Full explanation →
71
MCQhard

If a user's certificate expires, how can the user renew it using the ISE BYOD flow?

A.The certificate renews automatically in the background
B.Re-install the Network Setup Assistant manually
C.Reconnect to the SSID and follow the re-enrollment prompt in the portal
D.Contact the administrator to manually push a new certificate
AnswerC

Reconnecting to the SSID triggers the BYOD flow, which detects the expired certificate and presents the re-enrollment prompt in the portal, satisfying the renewal requirement. The user then re-runs certificate provisioning to obtain a fresh certificate without manual administrator intervention.

Why this answer

When a user's certificate expires in an ISE BYOD flow, the user can renew it by reconnecting to the SSID and following the re-enrollment prompt in the portal. This triggers the BYOD onboarding process again, allowing the user to obtain a new certificate. The certificate does not renew automatically, nor does it require manual administrator intervention or re-installing the Network Setup Assistant.

Exam trap

SISE often tests the self-service nature of BYOD certificate renewal, and candidates may think automatic renewal or admin intervention is required.

How to eliminate wrong answers

Option A is wrong because certificates do not renew automatically in the background; they have a fixed validity period and require re-enrollment. Option B is wrong because re-installing the Network Setup Assistant is not the standard renewal method; the user should reconnect to the SSID to trigger the portal. Option D is wrong because contacting the administrator to manually push a new certificate is not the self-service BYOD flow; the user can renew it themselves via the portal.

Full explanation →
72
MCQeasy

Which portal is intended for guest users to manage their own registered devices, such as adding or removing their personal laptops?

A.My Devices Portal
B.Hotspot Portal
C.Sponsor Portal
D.Guest Portal
AnswerA

My Devices Portal lets guest users self-manage their registered devices, satisfying the stem's requirement that guests add or remove personal laptops themselves. It authenticates against Microsoft Entra ID and permits device registration, renaming, and removal without administrator involvement, unlike the Sponsor or Admin portals.

Why this answer

The My Devices Portal is specifically designed for end users (including guests) to self-register, add, and remove their personal devices, such as laptops and smartphones, without sponsor intervention. It provides a self-service interface for device management tied to the user's account.

Exam trap

SISE often tests the distinction between the Guest Portal (authentication entry), Sponsor Portal (sponsor-managed guest accounts), Hotspot Portal (click-through guest access), and My Devices Portal (self-service device registration), so candidates who pick the Guest Portal miss the self-service device management purpose.

How to eliminate wrong answers

Option B is wrong because the Hotspot Portal is used for guest access with a simple click-through or self-registration flow, not for managing registered devices. Option C is wrong because the Sponsor Portal is used by sponsors to create and manage guest accounts, not by guests to manage their own devices. Option D is wrong because the Guest Portal is the entry point for guest authentication and registration, not the self-service device management interface.

Full explanation →
73
Multi-Selectmedium

Which THREE of the following are common reasons why an endpoint would be listed as 'Unknown' in Cisco ISE?

Select 3 answers
A.The device is connected to a non-Cisco switch.
B.The endpoint is not using 802.1X.
C.The endpoint has not generated enough traffic to trigger a probe.
D.The necessary probes are disabled on the PSN.
E.No profiling policies match the collected attributes.
AnswersC, D, E

Insufficient traffic means no probe—SNMP, RADIUS, DHCP, or AD—has observed the endpoint, so profiling cannot assign an identity group. Cisco ISE requires collected attributes before classification; without them the endpoint remains Unknown, satisfying the stem's scenario of missing profiling data.

Why this answer

Option C is correct because Cisco ISE profiling relies on collecting attributes from network traffic and other sources; if an endpoint has not generated enough traffic, insufficient attributes are gathered and the endpoint remains in the Unknown state. Option D is correct because profiling probes (such as SNMP, DHCP, RADIUS, NetFlow, and HTTP) must be enabled on the Policy Services Node (PSN); if the required probes are disabled, ISE cannot collect the endpoint attributes needed to identify it. Option E is correct because even when attributes are collected, ISE must match them against configured profiling policies; if no profiling policy matches the collected attributes, the endpoint is classified as Unknown.

Option A is not necessarily correct because ISE can profile endpoints on non-Cisco switches using probes like DHCP, RADIUS, and NetFlow, so the switch vendor alone does not cause Unknown status. Option B is not necessarily correct because ISE can profile endpoints that do not use 802.1X through other probes such as DHCP, SNMP, and NetFlow, so lack of 802.1X alone does not make an endpoint Unknown.

Exam trap

SISE often tests whether candidates conflate authentication requirements with profiling requirements — 802.1X and Cisco-only infrastructure are authentication concerns, not profiling prerequisites, so they are classic distractors.

Full explanation →
74
MCQmedium

Which component in Cisco ISE defines the TACACS+ privilege levels and attributes sent to the network device?

A.Command Set
B.Network Device Group
C.Shell Profile
D.Authorization Policy
AnswerC

A TACACS+ shell profile defines what ISE returns when an administrator starts a shell session: default and maximum privilege levels, attributes such as idle timeout and auto-command, and custom attribute-value pairs for platforms that need them. The Device Administration authorization policy selects which shell profile applies to which users and devices, often alongside command sets that restrict individual commands.

Why this answer

The Shell Profile in Cisco ISE is the authorization component that defines the TACACS+ privilege level (e.g., Privilege 15) and shell attributes such as idle timeout and session timeout that are returned to the network device in the TACACS+ authorization response. It is referenced from the Authorization Policy result and determines the user's shell-level access on the device.

Exam trap

SISE often tests the confusion between Shell Profile (privilege level and shell attributes) and Command Set (per-command authorization), causing candidates to pick Command Set when the question asks about privilege levels.

How to eliminate wrong answers

Option A is wrong because a Command Set defines which individual CLI commands are permitted or denied (via command authorization), not the privilege level or shell attributes. Option B is wrong because a Network Device Group is used to logically group NADs for policy conditions and hit selection, not to define TACACS+ privilege attributes. Option D is wrong because the Authorization Policy is the rule that matches conditions and selects results (Shell Profile, Command Set, etc.), but it does not itself contain the privilege level or shell attributes.

Full explanation →
75
Multi-Selecthard

Which THREE of the following are valid actions an administrator can take in the Sponsor Portal?

Select 3 answers
A.Change the global ISE logging level.
B.Create a new guest account.
C.Modify the existing portal theme.
D.Delete an existing guest account.
E.Extend the expiration time of a guest account.
AnswersB, D, E

Creating a guest account provisions a new sponsored identity with defined start and end times, which the Sponsor Portal supports. This satisfies the stem's requirement for valid administrator actions, since account creation is the portal's primary sponsor workflow.

Why this answer

The Sponsor Portal in Cisco ISE is designed for sponsor users to manage guest accounts, so option B (Create a new guest account) is correct because sponsors can provision new guest users directly from the portal. Option D (Delete an existing guest account) is correct because sponsors are permitted to remove guest accounts they manage, revoking access. Option E (Extend the expiration time of a guest account) is correct because sponsors can modify guest account settings, including extending the account's validity period.

Option A (Change the global ISE logging level) is not a Sponsor Portal function; logging levels are configured in the ISE GUI under Administration > System > Logging. Option C (Modify the existing portal theme) is also not a Sponsor Portal action; portal customization is performed by administrators in the ISE GUI under Guest Access > Portals & Components.

Exam trap

SISE often tests the boundary between sponsor-level actions and administrator-level actions, and candidates incorrectly include administrative tasks like changing logging levels or portal themes as sponsor capabilities.

Full explanation →

Page 1 of 4

Page 2

All pages

1234

Practice SISE by domain

Target a specific domain to shore up weak areas.

Architecture And DeploymentBYODEndpoint ComplianceWeb Auth And Guest ServicesNetwork Access Device AdministrationProfilerPolicy Enforcement
See all domains with question counts →