Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) SISE Questions 76–150 | Page 2/4

MCQmedium

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

A.Initiate registration from the Primary PAN under Administration > System > Deployment

B.Configure the Secondary node as an standalone node and merge databases

C.Run the join command from the secondary node's CLI

D.Create a cluster via the ISE CLI setup wizard

AnswerA

Registration must be initiated from the Primary PAN, which generates a one-time registration key; the secondary node then uses that key to join. Starting from the secondary node is not supported, so this sequence satisfies the deployment's requirement that the Primary PAN authorises the new node.

Why this answer

In Cisco ISE, the Primary PAN is the authoritative node that maintains the deployment database and controls node registration. To add a secondary node, you log into the Primary PAN, navigate to Administration > System > Deployment, and use the 'Register an ISE node' action to initiate the join. The secondary node must already be installed and reachable, but the registration workflow is always driven from the Primary PAN, not the joining node.

Exam trap

SISE often tests the misconception that a secondary node initiates its own join via CLI or setup wizard, when in fact all node registration is initiated from the Primary PAN's Deployment page.

How to eliminate wrong answers

Option B is wrong because ISE nodes cannot be configured as standalone and then have databases merged — there is no database merge feature; nodes must be registered into the deployment from the Primary PAN. Option C is wrong because there is no CLI 'join' command on the secondary node for deployment registration; the CLI is used for initial setup, not for joining an existing deployment. Option D is wrong because the setup wizard configures a standalone node's basic parameters (hostname, IP, DNS, NTP, passwords) but does not create or join a cluster — cluster membership is established only via the Primary PAN's Deployment page.

Full explanation →

MCQmedium

Which probe is required to collect the 'User-Agent' string from a web browser to assist in profiling a device as a workstation?

A.HTTP

B.RADIUS

C.DHCP

D.DNS

AnswerA

HTTP probes capture the browser's User-Agent header directly during web requests, satisfying the stem's requirement to profile the device as a workstation. RADIUS and SNMP cannot read HTTP headers, and NetFlow records only metadata. HTTP is therefore the only listed probe that exposes the User-Agent string.

Why this answer

The HTTP probe in ISE collects attributes from HTTP traffic, including the User-Agent string sent by web browsers. This string (e.g., 'Mozilla/5.0 ... Windows NT 10.0 ...') is a key fingerprint used to profile a device as a workstation.

Without the HTTP probe, ISE would not see the User-Agent and would have to rely on other probes like DHCP or RADIUS, which do not carry that information.

Exam trap

The trap is confusing which probe collects which attribute — candidates may incorrectly select DHCP or RADIUS for User-Agent, when only the HTTP probe can see HTTP headers.

How to eliminate wrong answers

Option B is wrong because the RADIUS probe collects authentication attributes (username, MAC, NAS port, etc.) but does not inspect HTTP headers like User-Agent. Option C is wrong because the DHCP probe collects DHCP options (hostname, vendor class, parameter request list) but not the browser's User-Agent string. Option D is wrong because the DNS probe collects DNS query and response data (e.g., reverse lookups, domain names) but does not see HTTP headers.

Full explanation →

MCQeasy

What is the purpose of the 'Posture Discovery' phase?

A.To verify the user credentials

B.To remediate non-compliant endpoints

C.To identify if posture is required for the session

D.To determine if the endpoint is compliant

AnswerC

Posture Discovery determines whether the endpoint requires posture assessment at all, based on operating system, agent presence and matching policy conditions. It precedes any compliance check, so its specific role is deciding if posture applies to the session rather than evaluating or remediating the endpoint.

Why this answer

Posture Discovery is the phase where ISE determines whether posture assessment is required for the session at all. It evaluates the authorization policy and posture policy to decide if the endpoint should be posture-checked, and if so, which posture policy applies. It does not itself verify compliance or remediate — it only decides whether posture is in scope.

Exam trap

SISE often tests the distinction between 'is posture required?' (Discovery) and 'is the endpoint compliant?' (Assessment), so candidates who pick 'determine if the endpoint is compliant' confuse the two phases.

How to eliminate wrong answers

Option A is wrong because verifying user credentials is the authentication phase (802.1X/MAB with an identity store), not posture discovery. Option B is wrong because remediation happens after a posture assessment finds the endpoint non-compliant, which is a later phase. Option D is wrong because determining compliance is the posture assessment/evaluation phase, which occurs after discovery confirms posture is required.

Full explanation →

Multi-Selectmedium

Which TWO of the following are benefits of using Network Device Groups (NDG)? (Choose two)

Select 2 answers

A.Eliminates the need for shared secrets

B.Automatically updates the device config

C.Simplifies policy management by grouping devices

D.Allows granular policy targeting based on location or role

E.Replaces the need for TACACS+ command sets

AnswersC, D

Grouping network devices into Network Device Groups lets a single policy apply to many devices at once, removing the need to configure each device individually. This directly delivers the simplified policy management benefit named in the option.

Why this answer

Option C is correct because Network Device Groups (NDGs) in Cisco ISE let you organize network access devices into logical collections so that authorization policies and policy sets can be applied to the group as a whole rather than to each device individually, greatly simplifying policy management. Option D is correct because NDGs can be defined by attributes such as location, device type, or role, allowing authorization rules and policy conditions to target specific groups of devices with granular precision. Options A, B, and E are incorrect: NDGs do not eliminate shared secrets (RADIUS/TACACS+ shared secrets are still configured per device), they do not automatically push or update device configurations (that is the role of configuration management tools, not NDGs), and they do not replace TACACS+ command sets, which are still required to control the specific commands an administrator may execute on a device.

Exam trap

SISE often tests the misconception that NDGs are functional configuration objects — candidates assume they push configs or replace secrets, when they are purely a logical grouping mechanism for policy targeting.

Full explanation →

Multi-Selecthard

Which THREE of the following items can be included in an ISE 'Common Task' for authorization?

Select 3 answers

A.Password complexity policy

B.dACL assignment

C.SGT assignment

D.RADIUS session timeout

E.VLAN assignment

AnswersB, C, E

A dACL assignment is a valid Common Task because ISE can push downloadable ACLs to network access devices during authorization. The dACL defines permit and deny entries applied to the switch or wireless controller port, satisfying the stem's requirement that the item be selectable within a Common Task for enforcing authorisation policy.

Why this answer

In Cisco ISE, an authorization policy's Common Tasks are the standard result types that can be returned to a network device after a successful authentication, and they include dACL assignment (B), SGT assignment (C), and VLAN assignment (E). Option B is correct because ISE can push a downloadable ACL (dACL) name to the switch or WLC, which the NAD then applies to the session to filter traffic. Option C is correct because ISE can return a Security Group Tag (SGT) via the RADIUS Cisco-AVPair attribute (cts:security-group-tag), enabling TrustSec enforcement on the network device.

Option E is correct because ISE can return a VLAN ID or VLAN name in the RADIUS Tunnel attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) to place the endpoint into a specific VLAN. Option A is not part of a Common Task because password complexity is configured in authentication/identity policies or the identity store, not returned as an authorization result. Option D is not a Common Task because RADIUS session timeout is a session attribute (Session-Timeout) typically set in authorization profiles or global settings, not one of the standard Common Task result categories.

Exam trap

SISE often tests the boundary between authentication policy elements (password complexity, identity sources) and authorization result elements (dACL, SGT, VLAN); candidates mistakenly include authentication-side items in the Common Task selection.

Full explanation →

MCQeasy

Which component in ISE is responsible for mapping an authenticated user to a specific set of permissions and command restrictions in a TACACS+ environment?

A.TACACS+ Authorization Policy

B.TACACS+ Authentication Policy

C.Policy Set

D.Network Device Group

AnswerA

TACACS+ separates authentication from authorization, and the authorization policy is what maps an authenticated identity to per-command permissions and restrictions. It satisfies the stem's requirement to translate a verified user into a specific permission set and command restrictions.

Why this answer

In ISE TACACS+, the Authorization Policy is the component that evaluates the authenticated identity and device attributes and returns the authorization result, including the shell profile and command set that define permissions and command restrictions. Authentication only verifies identity; authorization is what maps the user to a specific permission set.

Exam trap

The trap is conflating authentication with authorization: candidates pick the Authentication Policy because the user was 'authenticated,' but permissions and command restrictions are always an authorization function.

How to eliminate wrong answers

Option B is wrong because the TACACS+ Authentication Policy only validates credentials (via AD, internal users, etc.) and does not assign permissions or command restrictions. Option C is wrong because a Policy Set is the container that groups authentication and authorization policies for matching conditions, not the component that maps users to permissions. Option D is wrong because a Network Device Group is a classification construct used in policy conditions to group devices, not a mechanism for assigning user permissions.

Full explanation →

MCQeasy

When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?

A.Cisco IOS-style extended access-list format

B.SGACL tag format

C.JSON format

D.XML format

AnswerA

TrustSec dACLs require Cisco IOS-style extended access-list syntax, not standard IP ACLs or vendor-neutral formats. This satisfies the stem's mandatory format constraint, as the SISE exam expects entries such as "permit ip any any" with protocol, source, and destination fields.

Why this answer

When you create a downloadable ACL in Cisco ISE, the ACE entries must be written in Cisco IOS-style extended ACL syntax (e.g., 'permit tcp any host 10.1.1.5 eq 443'). ISE does not translate from other formats — it passes the ACE text verbatim to the NAD inside the RADIUS cisco-av-pair attribute, so the syntax must match what the switch's IOS parser expects.

Exam trap

The trap here is confusing dACL syntax with SGACL or API payload formats — candidates who have worked with TrustSec or ISE REST APIs may incorrectly select SGACL tag or JSON format.

How to eliminate wrong answers

Option B is wrong because SGACL tag format is used for TrustSec Security Group ACLs (which reference SGT values, not IP/port tuples) and is a completely different enforcement mechanism from dACLs. Option C is wrong because JSON is a data-interchange format used by ISE's REST APIs and pxGrid, not the format for ACL entries pushed to a switch. Option D is wrong because XML is used for some ISE configuration exports and API payloads, but not for dACL ACE syntax delivered to network devices.

Full explanation →

MCQhard

Which specific ISE process is responsible for managing the communication between the PAN and PSNs?

A.ISE Messaging Service

B.Application Server

C.Radius Core

D.Monitoring Service

AnswerA

The ISE Messaging Service handles inter-node communication, carrying configuration and operational data between the PAN and PSNs. This satisfies the stem's constraint of identifying the specific process managing PAN-to-PSN communication, rather than a broader service such as the database or API gateway.

Why this answer

The ISE Messaging Service is the internal process that handles communication between the Policy Administration Node (PAN) and the Policy Service Nodes (PSNs). It uses a messaging bus to propagate policy configuration, session data, and administrative changes across the deployment.

Exam trap

SISE often tests whether candidates confuse the Messaging Service (PAN-PSN communication) with the Application Server (UI/API) or Radius Core (protocol processing), so knowing the specific role of each ISE process is essential.

How to eliminate wrong answers

Option B is wrong because the Application Server hosts the web UI and REST APIs, not the PAN-to-PSN messaging channel. Option C is wrong because Radius Core handles RADIUS protocol processing for authentication and authorization, not inter-node communication. Option D is wrong because the Monitoring Service collects and stores logging and reporting data, not the messaging between PAN and PSN.

Full explanation →

Multi-Selecthard

Which THREE of the following items are considered 'results' in an ISE authorization policy? (Choose three)

Select 3 answers

A.Authorization Profile

B.Shared Secret

C.Command Set

D.Shell Profile

E.Network Device Group

AnswersA, C, D

An Authorization Profile is a result, not a condition: it defines what ISE returns after a rule matches, such as VLAN, dACL, SGT or posture settings. It sits in the results section of the authorization policy.

Why this answer

In an ISE authorization policy, the results are the enforcement artifacts that ISE returns to the network access device (NAD) once a matching authorization rule is hit. Option A (Authorization Profile) is correct because it is the primary result object, bundling attributes such as VLAN, dACL, SGT, and reauthentication timers that are pushed to the NAD via RADIUS. Option C (Command Set) is correct because it is a result that defines the set of TACACS+ commands (permit/deny) an authenticated administrator is allowed to run on a device.

Option D (Shell Profile) is correct because it is a TACACS+ result that specifies the privilege level and shell attributes (e.g., default privilege, auto-command) assigned to an admin session. Option B (Shared Secret) is not a result; it is a credential used to secure RADIUS/TACACS+ communication between ISE and the NAD, configured under Network Devices. Option E (Network Device Group) is not a result; it is a condition/attribute used to classify and match NADs within policy rules, not an enforcement outcome.

Exam trap

SISE often tests the distinction between policy conditions (NDGs, identity groups) and policy results (Authorization Profiles, Shell Profiles, Command Sets), so candidates who pick NDG or Shared Secret confuse the input side with the output side of the rule.

Full explanation →

MCQeasy

A network administrator is configuring Cisco ISE profiling for a new branch office. The administrator wants to ensure that endpoints are profiled based on information collected from DHCP packets. Which probe must be enabled on the Policy Service node to collect DHCP attributes?

A.DHCP probe

B.SNMP probe

C.HTTP probe

D.RADIUS probe

AnswerA

The DHCP probe captures DHCP packets to extract attributes such as hostname, vendor class identifier, and requested parameters. These attributes are used by the profiling engine to classify endpoints. Enabling the DHCP probe on the Policy Service node is necessary to collect DHCP-based profiling data, making it the correct choice for this scenario.

Why this answer

The DHCP probe is specifically designed to capture DHCP packets and extract attributes like hostname, vendor class, and requested parameters. These attributes are then used by the profiling engine to classify endpoints. For profiling based on DHCP information, enabling the DHCP probe on the Policy Service node is required.

Exam trap

The trap here is confusing the RADIUS probe with the DHCP probe; while both collect endpoint attributes, only the DHCP probe captures DHCP options used for profiling.

Full explanation →

MCQmedium

You are configuring a DHCP probe on a Cisco ISE node to identify endpoints. Which specific configuration step is required to ensure the ISE node receives DHCP traffic when the client and server are on a different subnet?

A.Configure a DHCP relay agent on the ISE node itself.

B.Enable DHCP Server mode on the Cisco ISE Profiling service.

C.Configure an IP helper-address on the Layer 3 device for the client VLAN pointing to the ISE node.

D.Enable DHCP Snooping on the ISE node interface.

AnswerC

DHCP broadcasts stay within the client subnet, so the Layer 3 device must relay them. An IP helper-address on the client VLAN forwards those requests to the ISE node, letting the probe receive traffic from endpoints on a different subnet.

Why this answer

To ensure the ISE node receives DHCP traffic when the client and DHCP server are on different subnets, you must configure an IP helper-address on the Layer 3 device (e.g., router or switch) for the client VLAN, pointing to the ISE node. This relays DHCP packets to ISE, allowing the DHCP probe to collect profiling data. Thus, option C is correct.

Exam trap

The trap is thinking ISE can relay DHCP or that DHCP snooping can forward packets, when actually an IP helper-address on the network device is required.

How to eliminate wrong answers

Option A is wrong because ISE cannot act as a DHCP relay agent; it only listens for DHCP traffic. Option B is wrong because enabling DHCP Server mode on ISE is not required and would conflict with existing DHCP servers. Option D is wrong because DHCP Snooping is a switch feature that filters DHCP traffic, not a relay mechanism, and ISE does not support it on its interface.

Full explanation →

MCQmedium

You want to customize the guest portal so that it displays the company logo and specific terms of use. Where is this configuration performed within the Cisco ISE GUI?

A.Administration > System > Settings > Portal Configuration

B.Policy > Policy Elements > Results > Authorization > Authorization Profiles

C.Work Centers > Guest Access > Portals & Components

D.Operations > Troubleshoot > Diagnostic Tools

AnswerC

Guest portal branding and terms of use are configured under Work Centers > Guest Access > Portals & Components, where each portal's logo, acceptable-use text and language settings are edited. This satisfies the requirement to customise the guest portal's appearance and terms.

Why this answer

The guest portal customization—including uploading a company logo and defining specific terms of use—is performed in the Work Centers > Guest Access > Portals & Components section of the Cisco ISE GUI. This area provides a centralized location for creating and editing all guest-facing portals (e.g., Hotspot, Self-Registered, Sponsored) and their associated components like logos, banners, and acceptance policies. The other options are unrelated to portal branding or terms of use configuration.

Exam trap

SISE often tests the distinction between portal customization (Work Centers > Guest Access > Portals & Components) and authorization policy configuration (Policy > Policy Elements > Results > Authorization > Authorization Profiles), causing candidates to confuse where branding and terms of use are set versus where network access results are defined.

How to eliminate wrong answers

Option A is wrong because Administration > System > Settings > Portal Configuration does not exist as a path for guest portal customization; system settings under Administration typically cover global ISE operational parameters, not guest portal branding. Option B is wrong because Policy > Policy Elements > Results > Authorization > Authorization Profiles is used to define authorization results (e.g., VLAN, DACL, SGT) that are applied after authentication, not to customize the visual appearance or terms of use of a guest portal. Option D is wrong because Operations > Troubleshoot > Diagnostic Tools is for troubleshooting and diagnostics (e.g., running diagnostic tests, evaluating policies), not for configuring portal content.

Full explanation →

MCQhard

If a user is redirected to the Guest portal but receives a '404 Page Not Found' error, what is the most likely configuration issue?

A.The NAD is blocking the traffic.

B.The Guest Portal is not enabled on the PSN.

C.The redirect URL is pointing to a non-existent portal path or the PSN is not reachable.

D.The user's account is expired.

AnswerC

A 404 arises when the redirect targets a portal path that does not exist, or the Policy Service Node cannot serve the Guest portal. This satisfies the stem's symptom of a failed redirect to the Guest portal.

Why this answer

A '404 Page Not Found' on the guest portal almost always means the redirect URL the NAD was given points to a path that does not exist on the PSN, or the PSN hosting the portal is unreachable from the client. ISE constructs the redirect URL from the portal configuration and the PSN's hostname/FQDN, so a mismatch in the portal name, a stale DNS entry, or an unreachable PSN produces a 404 rather than a login page.

Exam trap

SISE often tests whether candidates can distinguish HTTP-layer errors (404) from network-layer failures (timeouts) — a 404 means the web server was reached but the path was wrong, not that traffic was blocked.

How to eliminate wrong answers

Option A is wrong because a NAD blocking traffic would typically cause a timeout or connection reset, not an HTTP 404 returned by a web server. Option B is wrong because a disabled portal usually results in a different error or no redirect at all — the client would not reach a web server capable of returning 404. Option D is wrong because an expired account produces an authentication failure message on the portal, not a page-not-found error, since the portal page itself would still load.

Full explanation →

MCQmedium

You have a policy set where authentication succeeds, but the user is hitting the 'Default' authorization rule instead of the expected rule. What should you check first?

A.The RADIUS dictionary version

B.The Identity Store order

C.The Policy Set name

D.The Authorization rule order

AnswerD

Authorization rules are evaluated top-down, so a rule placed above the expected one matches first and terminates processing. Checking the rule order in the policy set confirms whether the Default rule is being reached because a preceding rule already matched.

Why this answer

Authorization rules are evaluated top-down within a policy set, and the first rule whose conditions match is applied. If authentication succeeds but the user falls through to the 'Default' rule, it means no earlier rule matched the user's attributes, or the expected rule is positioned below a broader rule that already matched. Checking the authorization rule order first confirms whether a catch-all or higher-priority rule is intercepting the session before the intended rule is evaluated.

Exam trap

SISE often tests the misconception that authorization rules are matched by specificity or by the 'best' match, when in fact ISE evaluates them strictly top-down and stops at the first match.

How to eliminate wrong answers

Option A is wrong because the RADIUS dictionary version only affects how vendor-specific attributes (VSAs) are parsed and displayed, not which authorization rule matches. Option B is wrong because Identity Store order affects authentication source sequencing, not authorization rule evaluation. Option C is wrong because the Policy Set name is just a label; renaming it does not change which authorization rule fires.

Full explanation →

MCQmedium

Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?

A.RADIUS Attributes -> Tunnel-Private-Group-ID

B.Advanced Attributes -> ACL

C.VLAN/dACL Filters

D.Common Tasks -> Web Redirection

AnswerD

The Common Tasks section of an Authorization Profile contains the Web Redirection setting, where you supply the redirect URL and its ACL. Selecting it satisfies the requirement to specify a WebAuth redirect destination for the posture-assessed endpoint.

Why this answer

The Web Redirection option is located under Common Tasks in an Authorization Profile, where you select the redirect type (Centralized Web Auth, Hotspot, Client Provisioning, MDM, etc.) and specify the ACL and redirect URL. This is the standard mechanism for sending endpoints to a WebAuth portal for guest or BYOD flows.

Exam trap

SISE often tests whether candidates can locate the Web Redirection setting under Common Tasks rather than confusing it with VLAN, dACL, or advanced RADIUS attribute options.

How to eliminate wrong answers

Option A is wrong because RADIUS Attributes -> Tunnel-Private-Group-ID is used to assign a VLAN via RADIUS tunnel attributes, not to redirect to a web portal. Option B is wrong because Advanced Attributes -> ACL attaches an access list to the authorization result but does not define a WebAuth redirect URL. Option C is wrong because VLAN/dACL Filters are used for VLAN and downloadable ACL assignments, not for web redirection.

Full explanation →

MCQhard

A security team wants to ensure that endpoints connecting via VPN are compliant with the latest antivirus definitions. They configure a posture policy that checks for the antivirus definition date to be within the last 7 days. However, some endpoints with up-to-date antivirus are still marked Non-Compliant. The administrator suspects that the posture condition is not evaluating correctly. Which component should be checked to verify that the antivirus definition date is being read correctly by the AnyConnect Posture module?

A.The endpoint's operating system language settings, which can affect how the antivirus definition date is formatted and read.

B.The posture condition's file check configuration, which specifies the path to the antivirus definition file and the date format.

C.The AnyConnect Posture module's version, because older versions may not support reading date-based conditions.

D.The ISE Policy Service Node's certificate used for posture communication, as an expired certificate would cause inaccurate results.

AnswerB

Antivirus definition dates are often checked using file conditions that examine the last modified date or a specific file's version. If the file path or date format is incorrect, the condition may fail even when definitions are current. Verifying the file check configuration ensures the agent reads the correct file and interprets the date properly. This is the most likely cause given the symptoms.

Why this answer

When posture conditions check for antivirus definition dates, they often rely on file conditions that examine file metadata such as last modified date or version. If the specified file path or the expected date format does not match the actual file, the condition will incorrectly fail. Reviewing the file check configuration ensures the agent reads the correct data and applies the correct logic.

Exam trap

The trap here is blaming communication or version issues when the problem is specific to how a file-based condition interprets date information, which is a common misconfiguration.

Full explanation →

MCQeasy

When a user's device is stolen, which action should be taken in the 'My Devices' portal?

A.Deregister or Blacklist the device

B.Perform a factory reset on the device remotely

C.Delete the user's account

D.Change the user's AD password

AnswerA

Deregistering or blacklisting the stolen device in the My Devices portal immediately revokes its trust with Microsoft Entra ID, preventing further access to corporate resources. This satisfies the stem's stolen-device constraint by severing the device identity record, so any cached credentials or tokens tied to that registration can no longer authenticate.

Why this answer

In the 'My Devices' portal, the appropriate action when a device is stolen is to deregister or blacklist the device. Deregistration removes the device from the user's profile, while blacklisting prevents it from reconnecting to the network. This mitigates risk by ensuring the stolen device cannot access corporate resources.

Exam trap

SISE often tests the confusion between self-service portal actions and administrative actions, leading candidates to choose remote wipe or account deletion when the question specifically asks about the 'My Devices' portal.

How to eliminate wrong answers

Option B is wrong because the 'My Devices' portal does not have the capability to perform a remote factory reset; that would require a mobile device management (MDM) solution. Option C is wrong because deleting the user's account is an administrative action that affects the user's access entirely, not just the stolen device, and is not performed in the 'My Devices' portal. Option D is wrong because changing the user's AD password does not directly address the stolen device's access and is not an action available in the 'My Devices' portal.

Full explanation →

MCQhard

You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?

A.To sign certificates for the endpoints

B.To encrypt the SCEP traffic between ISE and the endpoint

C.To store the Private Keys of the issued certificates

D.To allow devices to request certificates from the CA via the ISE node

AnswerD

The SCEP proxy relays certificate requests from BYOD endpoints to the CA, since endpoints cannot reach the CA directly. ISE acts as intermediary, forwarding the request and returning the issued certificate. This satisfies the stem's constraint of enrolling BYOD devices without direct CA connectivity.

Why this answer

The SCEP proxy in ISE acts as an intermediary between the endpoint and the Certificate Authority (CA). Instead of the endpoint contacting the CA directly, it sends its SCEP request to ISE, which forwards it to the CA, obtains the certificate, and returns it to the endpoint. This allows ISE to enforce BYOD policies, apply authorization, and avoid exposing the CA directly to endpoints.

Exam trap

SISE often tests whether candidates think ISE signs certificates or stores private keys — the exam expects you to know ISE is only a proxy and never handles private keys or performs signing.

How to eliminate wrong answers

Option A is wrong because ISE does not sign certificates — the CA (e.g., Microsoft AD CS, EJBCA) performs the actual signing; ISE only proxies the request. Option B is wrong because while SCEP traffic can be encrypted (typically via HTTPS), the primary role of the SCEP proxy is not encryption but brokering the request. Option C is wrong because ISE never stores the endpoint's private key — the private key is generated on the endpoint and never leaves it; only the public key is sent in the CSR.

Full explanation →

MCQmedium

Which protocol is used by the AnyConnect agent to communicate posture information to the ISE Policy Service Node (PSN)?

A.RADIUS

B.HTTP/HTTPS (TCP 8905)

C.DNS

D.SNMP

AnswerB

AnyConnect sends posture data to the ISE PSN over HTTP/HTTPS on TCP 8905, satisfying the requirement for a dedicated posture transport channel. Unlike RADIUS, which carries authentication and authorisation, this separate TCP session handles endpoint posture assessment traffic exclusively, allowing the agent to report compliance details directly to the PSN.

Why this answer

The AnyConnect (now Secure Client) posture module communicates with the ISE Policy Service Node over HTTPS on TCP port 8905, using the ISE posture agent protocol. RADIUS is used only for the initial 802.1X/MAB authentication and authorization, not for ongoing posture data exchange. The posture agent sends posture assessment results (AVC, AS, etc.) to the PSN via this HTTPS channel, and the PSN returns the compliance decision.

Exam trap

SISE often tests the port/protocol pairing for posture — candidates assume RADIUS carries posture data because it carries auth, but posture uses HTTPS/8905, a distinct channel.

How to eliminate wrong answers

Option A is wrong because RADIUS carries authentication, authorization, and accounting attributes — it does not transport posture assessment payloads from the endpoint agent to ISE. Option C is wrong because DNS is only used for name resolution of the PSN FQDN, not for posture data transport. Option D is wrong because SNMP is a network management protocol for polling devices and traps, not for endpoint posture reporting.

Full explanation →

MCQhard

A user is failing to receive the expected dACL. The ISE logs show the correct authorization rule was matched, but the dACL is not applied. What is the most likely cause?

A.The dACL is not assigned to the correct interface on the switch

B.The Authorization Profile lacks the correct cisco-av-pair attribute

C.The user is in the wrong AD group

D.The device is in the wrong network device group

AnswerB

The matched rule supplies an authorisation profile, but the dACL only reaches the switch if the profile carries the cisco-av-pair attribute (ip:inacl) containing the ACL name. Without that attribute, RADIUS returns no downloadable ACL, so the switch enforces none.

Why this answer

The most likely cause is that the Authorization Profile in ISE lacks the correct cisco-av-pair attribute that defines the dACL name to be returned to the switch. Even if the authorization rule matches, the switch cannot apply a dACL if the RADIUS response does not include the dACL attribute (typically cisco-av-pair with 'ip:inacl#'). The ISE logs show the rule matched, but the dACL is not applied because the profile is missing the attribute.

Exam trap

SISE often tests the difference between rule matching and attribute return — candidates may blame AD groups or NDGs, but if the rule matched, the issue is in the Authorization Profile's returned attributes, specifically the cisco-av-pair for the dACL.

How to eliminate wrong answers

Option A is wrong because dACLs are applied dynamically via RADIUS, not statically assigned to interfaces; the switch applies the dACL based on the RADIUS response, so interface assignment is not the issue. Option C is wrong because if the user were in the wrong AD group, the authorization rule would not have matched; the logs show the correct rule matched, so AD group membership is not the cause. Option D is wrong because if the device were in the wrong network device group, the authorization rule would not have matched; again, the logs confirm the correct rule matched, so NDG is not the issue.

Full explanation →

MCQmedium

Which of the following is an example of an 'Exception' policy in ISE?

A.A Policy Set condition

B.An Identity Source Sequence

C.A rule placed at the top of the Authorization Policy

D.The Default policy set

AnswerC

An exception policy is an authorisation rule positioned above the standard rule set so it is evaluated first. Placing it at the top lets specific identities bypass the normal conditions, which is exactly the exception behaviour the question asks for.

Why this answer

In Cisco ISE, an 'Exception' policy is an authorization rule placed at the top of the Authorization Policy set that matches specific conditions and applies a result before the normal rule flow. It is used to override standard authorization for special cases (e.g., a specific user, endpoint, or device) without disturbing the main policy logic. Placing it at the top ensures it is evaluated first.

Exam trap

SISE often tests the confusion between policy set conditions, identity source sequences, and authorization rules; candidates pick 'Policy Set condition' because it sounds like a policy construct, missing that an exception is specifically a top-of-list authorization rule.

How to eliminate wrong answers

Option A is wrong because a Policy Set condition determines which policy set a request is matched to, not an exception within authorization. Option B is wrong because an Identity Source Sequence defines the order in which identity stores are queried during authentication, not an authorization exception. Option D is wrong because the Default policy set is the fallback policy set used when no other policy set matches — it is not itself an exception rule.

Full explanation →

MCQmedium

You are configuring a BYOD flow for iOS devices and notice that the native supplicant provisioning process is failing during the installation of the mobile configuration profile. Where should you check the logs in ISE to determine if the issue is related to the SCEP proxy communication?

A.Policy > Policy Elements > Results > Certificate Profiles

B.Administration > System > Licensing

C.Operations > RADIUS Livelog

D.Operations > Troubleshoot > Debug Wizard > scep

AnswerD

The Debug Wizard's scep option enables targeted SCEP proxy debugging, capturing certificate enrolment exchanges between ISE and the CA. This isolates whether profile installation failed due to SCEP communication rather than supplicant or MDM issues.

Why this answer

The Debug Wizard under Operations > Troubleshoot allows you to enable targeted debug logging for specific ISE services, including the SCEP proxy (scep). When native supplicant provisioning fails during mobile configuration profile installation, the SCEP proxy is responsible for forwarding certificate requests to the CA; enabling the scep debug lets you see the actual SCEP enrollment exchange and pinpoint failures. This is the correct place to check SCEP proxy communication logs.

Exam trap

SISE often tests the confusion between configuration menus (where you set up certificate profiles) and troubleshooting menus (where you view logs), causing candidates to pick Policy > Policy Elements instead of the Debug Wizard.

How to eliminate wrong answers

Option A is wrong because Policy > Policy Elements > Results > Certificate Profiles is where you configure certificate templates and RA/CA settings, not where you view runtime logs. Option B is wrong because Administration > System > Licensing only shows license consumption and has nothing to do with SCEP troubleshooting. Option C is wrong because Operations > RADIUS Livelog shows live RADIUS authentication/authorization events, not SCEP proxy or certificate enrollment traffic.

Full explanation →

MCQmedium

How can you verify that ISE is receiving TACACS+ requests from a specific switch?

A.View the Network Device list

B.Check the TACACS Livelogs

C.Run a packet capture on the switch

D.Check the System Summary

AnswerB

TACACS Livelogs display real-time authentication, authorisation and accounting exchanges, showing each request's source device and outcome. Filtering by the switch's IP confirms whether ISE is receiving its TACACS+ traffic, directly satisfying the requirement to verify connectivity from that specific switch.

Why this answer

Cisco ISE provides TACACS+ Livelogs under Operations > TACACS > Live Logs, which show real-time TACACS+ authentication and authorization requests received from network devices. This is the direct way to verify that ISE is receiving TACACS+ requests from a specific switch, including the device name, user, and result.

Exam trap

The trap is choosing configuration views (Network Device list) or packet captures instead of the operational Live Logs that directly show received TACACS+ requests.

How to eliminate wrong answers

Option A is wrong because the Network Device list only shows configured NADs, not whether requests are actually arriving from them. Option C is wrong because a packet capture on the switch shows outbound packets but does not confirm ISE received or processed them. Option D is wrong because the System Summary shows ISE health and performance metrics, not per-request TACACS+ activity.

Full explanation →

MCQhard

A network administrator is configuring a Cisco ISE TACACS+ Command Set to allow users to execute 'show running-config' but deny all other 'show' commands. Which command set configuration in ISE achieves this?

A.Deny: show *; Permit: show running-config

B.Permit: show running-config; Permit: show *

C.Permit: show running-config; Deny: show *

D.Permit: show *; Deny: show running-config

AnswerC

This configuration explicitly permits the exact command 'show running-config' and then denies all other commands starting with 'show'. In ISE Command Sets, the order of entries matters; the permit for the specific command must come before the deny for the broader pattern. This ensures that only 'show running-config' is allowed among show commands.

Why this answer

In ISE Command Sets, entries are evaluated top-down, and the first match is applied. To permit a specific command and deny all others in a category, you must place the permit for the specific command before the deny for the broader pattern. The correct configuration permits 'show running-config' and then denies 'show *', ensuring only that specific command is allowed.

The reverse order would deny the specific command as well.

Exam trap

The trap here is misunderstanding the order of evaluation in Command Sets; the first matching entry wins, so a broad deny before a specific permit will block the permitted command.

Full explanation →

100

MCQeasy

Which of the following is a posture requirement setting that defines how often the agent performs a re-scan?

A.Periodic Scanning Interval

B.Re-assessment Frequency

C.Scan Timeout

D.Policy Update Interval

AnswerA

Periodic Scanning Interval is the posture requirement that governs re-scan frequency, defining the elapsed time between successive agent posture assessments. It directly satisfies the stem's constraint of specifying how often the agent re-scans, rather than what conditions must pass or how remediation behaves.

Why this answer

The Periodic Scanning Interval is the specific posture requirement setting in Cisco ISE that controls how frequently the endpoint agent (e.g., Cisco AnyConnect ISE Posture module) performs a posture re-scan. It defines the time interval between automatic posture reassessments, ensuring that endpoints remain compliant with security policies throughout the session. This setting is configured within the posture policy under 'Periodic Reassessment' and directly answers the question of how often the agent re-scans.

Exam trap

SISE often tests the distinction between posture reassessment timing and other posture-related timers, such as scan timeout or policy update interval, causing candidates to confuse the purpose of each setting.

How to eliminate wrong answers

Option B is wrong because 'Re-assessment Frequency' is not a recognized setting name in Cisco ISE posture policies; it is a generic term that may describe the concept but does not match the actual configuration parameter. Option C is wrong because 'Scan Timeout' defines the maximum time allowed for a posture scan to complete before it is considered failed, not the interval between scans. Option D is wrong because 'Policy Update Interval' controls how often the agent downloads updated posture policies from ISE, not how often it performs a re-scan of the endpoint's compliance status.

Full explanation →

101

MCQmedium

What is the purpose of the 'PAN' role in a deployment?

A.Log aggregation and reports

B.Centralized policy management

C.Authentication of endpoints

D.Database backups

AnswerB

The PAN role provides centralised policy management, acting as the single point where administrators define and push policy to managed firewalls and enforcement nodes. This satisfies the deployment requirement for consistent, centrally administered policy rather than per-device configuration.

Why this answer

The Policy Administration Node (PAN) in Cisco ISE is the central controller that hosts the policy repository, manages all configuration, and distributes policies to Policy Service Nodes (PSNs). It provides centralized policy management for the entire distributed deployment.

Exam trap

SISE often tests the confusion between ISE personas — candidates mistakenly assign authentication or logging duties to the PAN when those belong to PSNs and MnT nodes respectively.

How to eliminate wrong answers

Option A is wrong because log aggregation and reporting are handled by the Monitoring and Troubleshooting Node (MnT), not the PAN. Option C is wrong because endpoint authentication is performed by PSNs, which handle RADIUS/TACACS+ requests; the PAN does not authenticate endpoints. Option D is wrong because database backups are an administrative function that can be performed on the PAN but are not its primary role — the PAN's core purpose is policy administration and distribution.

Full explanation →

102

Multi-Selecteasy

Which TWO of the following authentication protocols are supported by ISE for 802.1X?

Select 2 answers

A.SNMPv2

B.EAP-TLS

C.ICMP

D.PEAP

E.FTP

AnswersB, D

EAP-TLS is certificate-based, using mutual X.509 authentication between supplicant and server, so it satisfies ISE's 802.1X requirement without relying on password credentials. ISE terminates the EAP-TLS tunnel and validates client certificates against its certificate authentication profile, making it a natively supported 802.1X method.

Why this answer

EAP-TLS (Option B) is correct because Cisco ISE supports it as an 802.1X authentication method in which both the supplicant and the server authenticate using X.509 digital certificates, providing mutual certificate-based authentication over EAP. PEAP (Option D) is also correct because ISE supports Protected EAP, which establishes a TLS tunnel between the supplicant and the ISE server and then carries an inner authentication method such as MS-CHAPv2 or EAP-GTC. SNMPv2 (Option A) is a network management protocol used for monitoring and configuring devices, not an 802.1X authentication protocol.

ICMP (Option C) is a control/diagnostic protocol (e.g., ping) and plays no role in 802.1X authentication. FTP (Option E) is a file transfer protocol and is unrelated to 802.1X authentication.

Exam trap

SISE often tests whether candidates can distinguish EAP authentication methods (EAP-TLS, PEAP) from unrelated protocols like SNMP, ICMP, and FTP that appear as distractors.

Full explanation →

103

MCQmedium

When decommissioning an ISE node, what is the correct order of steps?

A.Change node to standalone, then remove

B.Shut down the node, then remove from deployment

C.Re-image the node, then remove from deployment

D.Remove from deployment, then shut down

AnswerD

Removing the node from the deployment first ensures ISE stops advertising it and no policy sets or session traffic route to it, preventing authentication failures. Shutting down afterwards avoids orphaned entries and replication issues, satisfying the stem's requirement for the correct decommissioning order.

Why this answer

The correct decommissioning sequence is to first remove the node from the ISE deployment via the PAN (Deregister), then shut it down. Removing the node from the deployment first ensures the PAN stops replicating configuration to it and other nodes stop forwarding logs or authentication requests to it, preventing orphaned references and replication errors.

Exam trap

SISE often tests the principle that ISE is a coordinated cluster — the trap is candidates treating a node as an isolated appliance and shutting it down first, ignoring that the PAN must be informed to avoid replication and logging errors.

How to eliminate wrong answers

Option A is wrong because changing a node to standalone mode is not a decommissioning step — it would actually detach the node from the deployment in an unsupported way and leave stale entries in the PAN. Option B is wrong because shutting down the node first leaves it registered in the deployment, causing the PAN to log replication failures and PSNs to attempt communication with a dead node. Option C is wrong because re-imaging destroys the node's configuration and certificates before it is cleanly removed from the deployment, which can leave the PAN with an unrecoverable stale node entry.

Full explanation →

104

MCQmedium

You are creating a File Requirement for posture assessment. What is the required behavior if you want to confirm that a specific file exists on the client machine?

A.Set the Check type to 'Exists' and provide the full file path.

B.Set the Check type to 'Status' and provide the service name.

C.Set the Check type to 'Registry' and provide the key path.

D.Set the Check type to 'Version' and provide the file size.

E.Set the Check type to 'Content' and provide the file hash.

AnswerA

Setting the Check type to 'Exists' makes the posture condition evaluate file presence rather than content, version or hash. Supplying the full path lets the client agent locate the exact file, satisfying the requirement to confirm existence.

Why this answer

In Cisco ISE posture policy, a File Requirement is used to check for the presence, version, or content of a file on the endpoint. To simply confirm that a specific file exists, the Check type must be set to 'Exists' and the full file path (e.g., C:\Program Files\App\app.exe) must be provided. ISE then uses the AnyConnect/Stealthwatch posture agent to verify the file's presence and returns Compliant or Non-Compliant.

Exam trap

SISE often tests the mapping between posture Check types and their required inputs — candidates confuse 'Exists' (file path) with 'Version' (file version) or 'Status' (service name), picking the wrong check type for the stated goal.

How to eliminate wrong answers

Option B is wrong because 'Status' check type is used to verify whether a Windows service is running, started, or stopped — it requires a service name, not a file path. Option C is wrong because 'Registry' check type inspects a registry key or value, not a file on disk. Option D is wrong because 'Version' checks the file version number (or file version attributes), not file size, and it is used when a specific version is required.

Option E is wrong because 'Content' check type validates file contents against a hash or string, which is overkill for simply confirming existence.

Full explanation →

105

MCQmedium

What is the function of the 'PassiveID' feature in a distributed ISE deployment?

A.It enables redundant authentication

B.It replaces the need for PSNs

C.It caches RADIUS requests

D.It provides user identity mapping without active probing

AnswerD

PassiveID derives user identity from existing authentication traffic, such as RADIUS accounting or AD logins, without sending probes to endpoints. This satisfies scenarios where active probing is undesirable, mapping users to sessions passively while avoiding the network disruption and endpoint agent requirements active methods impose.

Why this answer

PassiveID in Cisco ISE is a service that listens to and analyzes existing network traffic (such as RADIUS accounting, DHCP, and SNMP) to build a user identity mapping without actively probing endpoints. It passively collects user and device information from sources like Active Directory logs, syslog, and NetFlow, associating IP addresses with usernames. This is especially useful for devices that cannot run an active supplicant or for guest/BYOD scenarios where active probing is not feasible.

Thus, it provides identity mapping without generating additional network traffic or requiring active probes.

Exam trap

SISE often tests the distinction between passive and active identity collection methods, and candidates may confuse PassiveID with authentication or caching features, leading them to select options that imply active involvement or redundancy.

How to eliminate wrong answers

Option A is wrong because PassiveID does not provide redundant authentication; redundancy in ISE is achieved through PSN failover and load balancing, not PassiveID. Option B is wrong because PassiveID does not replace Policy Service Nodes (PSNs); PSNs are required for policy evaluation and enforcement, while PassiveID only supplements identity information. Option C is wrong because PassiveID does not cache RADIUS requests; RADIUS caching is not a function of PassiveID, and caching is typically handled by the RADIUS server itself or through session management.

Full explanation →

106

MCQeasy

What is the purpose of the 'Guest Type' configuration in Cisco ISE?

A.To define the graphical user interface layout of the guest portal.

B.To assign a specific sponsor to a guest.

C.To set the IP address pool for the guest VLAN.

D.To define the attributes of the guest account such as duration and permissions.

AnswerD

Guest Type defines the account attributes applied to guest users, including access duration and permissions, determining how long the account remains valid and what it may reach. This governs sponsor-created guest access within Cisco ISE.

Why this answer

The 'Guest Type' configuration in Cisco ISE defines the attributes of a guest account, such as the duration of access, the maximum number of devices, and the permissions or roles assigned to the guest. It is a template that determines the guest's access privileges and account lifecycle. This allows administrators to create different guest types (e.g., contractor, visitor) with tailored settings.

Exam trap

The trap is confusing Guest Type with portal customization or sponsor assignment; candidates must remember that Guest Type defines account attributes like duration and permissions, not UI or sponsor settings.

How to eliminate wrong answers

Option A is wrong because the graphical user interface layout of the guest portal is controlled by portal customization settings, not by Guest Type. Option B is wrong because assigning a sponsor to a guest is done through sponsor groups and guest sponsor policies, not through Guest Type. Option C is wrong because the IP address pool for the guest VLAN is configured in the network device (switch/controller) or in authorization profiles, not in the Guest Type definition.

Full explanation →

107

MCQhard

When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?

A.Matches

B.Greater Than or Equal

C.Equals

D.Contains

AnswerB

Greater Than or Equal compares the detected application version numerically against the threshold, so any build at or above 10.5.0 satisfies the condition. This directly meets the stem's "at least" constraint, whereas Greater Than alone would wrongly exclude version 10.5.0 itself.

Why this answer

The 'Greater Than or Equal' operator is the only one that evaluates a version comparison numerically, allowing the condition to match any version at or above 10.5.0 (e.g., 10.5.1, 10.6.0, 11.0.0). This is required when the goal is a minimum version threshold rather than an exact match.

Exam trap

SISE often tests operator selection for version checks, and the trap is choosing 'Equals' or 'Matches' when the requirement is a minimum version threshold, which would incorrectly fail newer versions.

How to eliminate wrong answers

Option A is wrong because 'Matches' is used for pattern/regex matching of strings, not for numeric version comparison, so it cannot enforce a minimum version. Option C is wrong because 'Equals' only matches the exact version 10.5.0 and would fail for 10.5.1 or 10.6.0, which also satisfy the 'at least' requirement. Option D is wrong because 'Contains' performs substring matching and would incorrectly match versions like 110.5.0 or 10.5.0-beta, and it does not understand version semantics.

Full explanation →

108

Multi-Selecthard

Which THREE of the following are characteristics of the TACACS+ protocol? (Choose three)

Select 3 answers

A.Uses TCP port 49

B.Encrypts the entire packet body

C.Only encrypts the password field

D.Uses UDP port 1812

E.Separates authentication, authorization, and accounting

AnswersA, B, E

TACACS+ establishes its connection over TCP port 49, satisfying the stem's requirement for a defining transport characteristic. Unlike RADIUS, which uses UDP ports 1812 and 1813, TACACS+ relies on TCP to provide reliable, connection-oriented delivery, separating authentication, authorisation and accounting into distinct functions.

Why this answer

Option A is correct because TACACS+ operates over TCP and uses well-known port 49 for its communications between the client (NAS) and the TACACS+ server. Option B is correct because TACACS+ encrypts the entire body of the packet, not just credentials, providing confidentiality for all payload data exchanged. Option E is correct because TACACS+ is designed to separate the AAA functions—authentication, authorization, and accounting—into distinct processes, allowing each to be handled independently.

Option C is not correct because encrypting only the password field is characteristic of RADIUS, not TACACS+. Option D is not correct because UDP port 1812 is used by RADIUS authentication, whereas TACACS+ uses TCP port 49.

Exam trap

The trap is mixing up RADIUS and TACACS+ characteristics — candidates often remember 'TACACS+ encrypts everything' but then incorrectly assign UDP 1812 or password-only encryption to it under time pressure.

Full explanation →

109

MCQmedium

When setting up a self-registration portal, you want to require that the guest's email address is validated before granting access. Which feature should you enable?

A.Enable Guest MAC Caching

B.Self-Registration Account Activation

C.Enable Captcha

D.Require Sponsor Approval

AnswerB

Self-Registration Account Activation sends a verification email containing an activation link; the guest account remains inactive until the link is clicked, so the email address is validated before access is granted. Without it, sponsors approve accounts without proving email ownership.

Why this answer

Self-Registration Account Activation is the ISE guest portal feature that requires the guest to validate their email address by clicking an activation link before the account becomes active. When enabled, ISE sends a confirmation email and holds the account in a pending state until the link is clicked. This directly satisfies the requirement to validate the guest's email before granting access.

Exam trap

SISE often tests the distinction between email validation (Self-Registration Account Activation) and sponsor approval, so candidates who see 'email' and pick 'Require Sponsor Approval' fall into the trap of confusing two different approval workflows.

How to eliminate wrong answers

Option A is wrong because Guest MAC Caching allows returning devices to bypass the portal, which is unrelated to email validation. Option C is wrong because Captcha prevents automated bot registrations but does not validate the email address. Option D is wrong because Sponsor Approval requires a sponsor to manually approve the guest, which is a different workflow from email self-validation.

Full explanation →

110

MCQmedium

Which protocol is used by ISE to communicate with the MDM server for device status checks?

A.SNMP

B.REST API

C.RADIUS

D.LDAP

AnswerB

ISE queries the MDM server over its REST API, sending device identifiers and receiving compliance attributes such as jailbroken or managed status. This is the actual transport for MDM status checks, distinguishing it from RADIUS, TACACS+ or SNMP, which serve other ISE functions.

Why this answer

ISE communicates with MDM servers using REST API calls to query device status and compliance information. This allows ISE to integrate with MDM solutions for device registration and compliance checks.

Exam trap

The trap is confusing the protocol used for MDM integration with other protocols like RADIUS or LDAP; the exam expects you to know that ISE uses REST API for MDM communication.

How to eliminate wrong answers

Option A is wrong because SNMP is used for network monitoring, not MDM integration. Option C is wrong because RADIUS is used for authentication, authorization, and accounting, not for querying MDM servers. Option D is wrong because LDAP is used for directory services, not MDM integration.

Full explanation →

111

MCQmedium

You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?

A.Set the Access Type to Permit Access and enable URL Redirect with the portal ID.

B.Enable 'Authentication Bypass' in the authorization profile to allow the traffic to hit the redirect rule.

C.Configure the profile as a standard permit access profile with a dynamic VLAN assignment.

D.Set the Access Type to Web Auth and manually input the redirect IP address in the Custom Attributes field.

AnswerA

The Web Redirection settings must be configured to point to the specific portal, which triggers the WLC to send a redirect URL to the client.

Why this answer

Central Web Authentication requires the authorization profile to permit access and simultaneously return a URL redirect AV pair pointing to the ISE guest/central portal. In ISE, the authorization profile's 'Access Type = ACCESS_ACCEPT' plus the 'Web Redirection (CWA)' setting with the correct portal ID is what tells the WLC/switch to redirect the client's HTTP traffic to the ISE portal. Without the URL redirect attribute, the client is simply permitted and never sees the portal.

Exam trap

SISE often tests the misconception that any 'Permit Access' profile enables CWA — candidates forget that the mandatory piece is the URL redirect AV pair with the correct portal ID, not just the access type.

How to eliminate wrong answers

Option B is wrong because Authentication Bypass skips authentication entirely and does not generate the redirect AV pair, so the client would be granted access without being sent to the portal. Option C is wrong because a standard permit profile with dynamic VLAN assignment only authorizes and segments the client; it contains no URL redirect attribute, so no CWA redirection occurs. Option D is wrong because 'Web Auth' is not a valid Access Type in an ISE authorization profile, and manually entering a redirect IP in Custom Attributes does not produce the structured Cisco AV pair (url-redirect / url-redirect-acl) that the NAD requires.

Full explanation →

112

MCQeasy

What is the benefit of using multiple TACACS+ Policy Sets?

A.To increase the speed of authentication

B.To reduce the need for shared secrets

C.To increase the number of users allowed

D.To segment policies by device type or user group

AnswerD

Multiple TACACS+ policy sets let administrators apply distinct rule sets matched by device type or user group, rather than one monolithic policy. This segmentation satisfies the requirement to tailor authorisation per device category or user population.

Why this answer

Multiple TACACS+ Policy Sets allow you to segment policies by device type or user group, so different sets of rules can be applied to different network devices or administrative roles. This provides granular control over command authorization and accounting for diverse device populations.

Exam trap

SISE often tests the purpose of multiple TACACS+ Policy Sets, so candidates who pick 'increase speed' or 'reduce shared secrets' confuse organizational segmentation with performance or security mechanics.

How to eliminate wrong answers

Option A is wrong because multiple policy sets do not increase authentication speed — they add organizational structure, not performance. Option B is wrong because shared secrets are configured per network device, not per policy set, so policy sets do not reduce the need for them. Option C is wrong because the number of users allowed is determined by licensing and the identity store, not by the number of policy sets.

Full explanation →

113

MCQeasy

A network engineer is setting up a guest portal that allows guests to self-register. The company requires that guests provide a valid email address to receive their account credentials. Which portal configuration setting must be enabled to enforce this requirement?

A.Enable guest account expiration

B.Require sponsor approval before guest access

C.Require guest to provide a valid email address

D.Require guest to enter a username and password

AnswerC

Enabling this setting in the Guest Portal configuration forces the guest to enter a valid email address during self-registration. ISE then uses that email to send the account credentials and notifications. This directly meets the company's requirement.

Why this answer

To require guests to provide a valid email address during self-registration, the 'Require guest to provide a valid email address' setting must be enabled in the Guest Portal configuration. This ensures ISE collects the email and uses it to send credentials. Other settings address different aspects of the guest flow.

Exam trap

The trap here is confusing the email requirement with sponsor approval or account expiration, which are separate features not related to enforcing email collection.

Full explanation →

114

MCQmedium

You are configuring a custom profiling policy and notice that the 'Certainty Factor' is too low for the device to be assigned to the correct group. What is the purpose of the Certainty Factor in ISE?

A.To determine the priority of the profiling policy.

B.To force the device to re-authenticate.

C.To indicate the confidence level that the device is correctly profiled.

D.To limit the number of devices in an endpoint group.

AnswerC

The Certainty Factor is a numeric score expressing how confident the profiling conditions are that a device matches an endpoint profile. A low value means the collected attributes are inconclusive, so ISE withholds assignment to the correct group until confidence rises.

Why this answer

The Certainty Factor in ISE is a numerical value (0-100) that represents how confident the profiling engine is that a device belongs to a particular profile. It is calculated based on the number and weight of matched conditions in the profiling policy. A higher certainty factor increases the likelihood that the device will be assigned to the correct group, while a low certainty factor indicates that the collected attributes do not strongly match any profile.

Exam trap

SISE often tests the misconception that Certainty Factor determines policy priority or is used to force reauthentication, when in fact it solely indicates confidence in the profiling result.

How to eliminate wrong answers

Option A is wrong because priority of profiling policies is determined by the order of policies in the policy list, not by the Certainty Factor. Option B is wrong because forcing re-authentication is done through CoA (Change of Authorization) or reauthentication timers, not via Certainty Factor. Option D is wrong because limiting the number of devices in an endpoint group is not a function of the Certainty Factor; endpoint group membership is not limited by this value.

Full explanation →

115

MCQmedium

When configuring an SNMP Query probe, why is it recommended to use SNMPv3 instead of SNMPv1/v2c?

A.SNMPv3 is the only version supported by ISE.

B.SNMPv3 is faster.

C.SNMPv3 provides authentication and encryption for the query.

D.SNMPv3 eliminates the need for a community string.

AnswerC

SNMPv3 adds user-based authentication (SHA/MD5) and payload encryption (AES/DES) via the USM and VACM modules, which SNMPv1 and v2c lack entirely. This satisfies the stem's security requirement, preventing credential interception and spoofed responses during queries.

Why this answer

SNMPv3 is recommended over SNMPv1/v2c for SNMP Query probes because it provides authentication and encryption, ensuring that the queries and responses are secure. SNMPv1/v2c use plaintext community strings, which are vulnerable to eavesdropping and unauthorized access. SNMPv3 also supports stronger security models like USM (User-based Security Model).

Exam trap

SISE often tests the misconception that SNMPv3 eliminates community strings entirely or is the only supported version, when in fact it replaces them with user-based credentials and ISE supports multiple versions.

How to eliminate wrong answers

Option A is wrong because ISE supports SNMPv1, v2c, and v3; SNMPv3 is not the only version supported. Option B is wrong because SNMPv3 is not inherently faster; in fact, the added security overhead can make it slightly slower. Option D is wrong because SNMPv3 does not eliminate the need for a community string; it replaces community strings with user-based credentials (username, authentication password, privacy password), but it still requires configuration of those credentials.

Full explanation →

116

MCQmedium

What is the function of the 'RADIUS Accounting' probe in the profiling process?

A.To encrypt the session.

B.To collect device attributes contained in RADIUS accounting packets.

C.To act as a RADIUS server.

D.To authenticate the device.

AnswerB

The RADIUS Accounting probe parses accounting packets sent by network devices, extracting attributes such as endpoint identifiers and device details. These attributes feed the profiling engine, satisfying the need to identify and classify endpoints from RADIUS accounting data.

Why this answer

It collects session information from the RADIUS traffic, providing start/stop and attribute data useful for device identification.

Full explanation →

117

Multi-Selecthard

Which THREE of the following items are required for the EAP-TLS authentication process to succeed?

Select 3 answers

A.User password stored in the endpoint registry

B.Client certificate installed on the device

C.ISE server certificate installed on the PSN

D.Trust anchor (Root CA) installed on both client and server

E.Active Directory GPO to force login

AnswersB, C, D

EAP-TLS mandates mutual authentication, so the supplicant must present its own X.509 certificate to prove device identity to ISE. Without this client certificate, the TLS handshake cannot complete, since ISE requires the endpoint to authenticate itself rather than relying on credentials.

Why this answer

EAP-TLS is a mutual certificate-based authentication method, so the client must present its own identity certificate: option B (client certificate installed on the device) is required for the supplicant to authenticate to the network. The authentication server must also prove its identity, so option C (ISE server certificate installed on the PSN) is required for the Policy Service Node to present a valid server certificate during the TLS handshake. Both sides must validate the other's certificate chain, so option D (trust anchor/Root CA installed on both client and server) is required to build and verify the certificate path.

Option A is incorrect because EAP-TLS does not use a user password in the registry; authentication is based on certificates, not stored credentials. Option E is incorrect because an Active Directory GPO forcing login is not a prerequisite for the EAP-TLS handshake itself, even if AD may be used for authorization or identity mapping.

Exam trap

SISE often tests the misconception that EAP-TLS requires a password or that Active Directory configuration alone is sufficient, when in fact it is purely certificate-based and requires a trust anchor on both sides.

Full explanation →

118

Multi-Selecthard

A security engineer is configuring a Cisco ISE profiling policy to identify and authorize endpoints. The engineer wants to use the SNMP Query probe to gather attributes from network devices. Which two statements are true regarding the SNMP Query probe in Cisco ISE? (Choose two.)

Select 2 answers

A.The SNMP Query probe can collect attributes such as CDP neighbors and ARP tables from network devices.

B.The SNMP Query probe automatically discovers all network devices and adds them to ISE without manual configuration.

C.The SNMP Query probe requires the network device to have SNMP read-write access enabled for ISE to retrieve data.

D.The SNMP Query probe can be used to profile endpoints that are not directly connected to a Cisco switch, such as wireless clients.

E.The SNMP Query probe can only retrieve attributes from Cisco devices that are running IOS XE.

AnswersA, D

The SNMP Query probe in Cisco ISE can query network devices using SNMP to retrieve information like CDP neighbor details, ARP tables, MAC address tables, and other MIB objects. This data helps profile endpoints by associating them with switch ports and VLANs. It is especially useful when device sensor or other probes are not available. The probe uses SNMP read-only community strings or SNMPv3 credentials configured in ISE to poll the devices.

Why this answer

The SNMP Query probe in Cisco ISE is a powerful profiling method that polls network devices using SNMP read-only credentials to gather endpoint attributes. It can retrieve data such as CDP neighbors, ARP tables, and MAC address tables from switches, and can also query wireless controllers to profile wireless clients. It requires manual configuration of network devices in ISE, including IP addresses and SNMP credentials.

It does not require read-write access, nor does it automatically discover devices. It is not limited to Cisco IOS XE devices, as it can work with any SNMP-enabled device.

Exam trap

The trap here is assuming that the SNMP Query probe requires read-write access or only works with Cisco IOS XE devices, when in fact it only needs read-only access and supports a wide range of SNMP-enabled devices.

Full explanation →

119

MCQmedium

Which component of the Cisco ISE Profiling architecture is responsible for comparing collected attributes against defined profiling policies?

A.Monitoring Node (MnT)

B.Feed Service

C.Administration Node (PAN)

D.Policy Service Node (PSN) Profiler Service

AnswerD

The PSN Profiler Service evaluates endpoint attributes collected by probes against the profiling policies, then assigns the matching endpoint profile. This satisfies the stem's requirement for the comparison component, since probes only gather raw data and the PAN neither collects nor matches attributes locally.

Why this answer

The Policy Service Node (PSN) Profiler Service is responsible for collecting endpoint attributes and comparing them against profiling policies to determine the device profile. The PSN hosts the profiler service, which includes the profiling engine that evaluates conditions and assigns certainty factors. The PAN (Administration Node) manages the configuration and policies, but the actual profiling decision is made by the PSN.

Exam trap

SISE often tests the confusion between the PAN's role in policy management and the PSN's role in policy execution, leading candidates to incorrectly select the PAN for profiling decisions.

How to eliminate wrong answers

Option A is wrong because the Monitoring Node (MnT) is responsible for logging, reporting, and troubleshooting, not for comparing attributes against policies. Option B is wrong because the Feed Service is a component that downloads updated profiling policies from Cisco, but it does not perform the comparison. Option C is wrong because the Administration Node (PAN) is the management interface for configuration and policy creation, but it does not execute the profiling logic; that is done by the PSN.

Full explanation →

120

MCQmedium

You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?

A.In the Authorization Policy rule conditions

B.In the Results section of the Authentication Policy

C.In the RADIUS dictionary under Policy Elements

D.In the Policy Set general authentication settings

AnswerA

Authorization policy rules evaluate conditions after authentication and are where endpoint identity group membership is matched to grant or deny access. Defining the internal endpoint group here enforces the stem's requirement that only matching devices receive authorisation.

Why this answer

In Cisco ISE, policy sets are composed of authentication and authorization policies. The authorization policy is where you define conditions based on attributes like Endpoint Identity Groups to determine the level of access granted. Therefore, to ensure only devices matching a specific internal endpoint group are granted access, you must define this requirement in the Authorization Policy rule conditions.

This allows ISE to evaluate the endpoint's group membership and enforce the appropriate authorization result.

Exam trap

SISE often tests the distinction between authentication and authorization policies, and candidates may incorrectly assume that endpoint group conditions belong in the authentication policy or general settings, when they are actually evaluated in the authorization policy.

How to eliminate wrong answers

Option B is wrong because the Results section of the Authentication Policy only determines the authentication result (e.g., Pass/Fail) and does not evaluate endpoint group membership for authorization. Option C is wrong because the RADIUS dictionary under Policy Elements is used to define or view RADIUS attributes, not to enforce access based on endpoint groups. Option D is wrong because the Policy Set general authentication settings configure which authentication protocols and identity stores are used, not the conditions for granting access based on endpoint groups.

Full explanation →

121

MCQhard

When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?

A.Authentication Policy

B.Policy Set

C.Result

D.Authorization Policy

AnswerD

The Authorization Policy column in ISE live logs names the authorisation policy rule that matched the request, showing exactly which condition set granted or denied access. This pinpoints the rule responsible for the failed authorisation, unlike identity or endpoint columns.

Why this answer

The Authorization Policy column in the ISE live logs shows the exact authorization rule that was evaluated and matched for a given session. When a user or endpoint attempts access, ISE processes the request through the authentication policy, then the authorization policy, and the live log records which specific rule within the authorization policy was hit. This allows administrators to quickly identify which condition (e.g., AD group, posture status, device type) triggered the result, such as PermitAccess or DenyAccess.

Exam trap

SISE often tests the distinction between authentication and authorization columns in live logs, and candidates frequently confuse the Authentication Policy column (which shows the authentication rule) with the Authorization Policy column (which shows the authorization rule).

How to eliminate wrong answers

Option A is wrong because the Authentication Policy column indicates the authentication rule that matched (e.g., which identity source or protocol was used), not the authorization rule. Option B is wrong because the Policy Set column shows the overall policy set that was selected based on the initial conditions (like device type or location), but it does not identify the specific authorization rule within that set. Option C is wrong because the Result column displays the final outcome of the authorization (e.g., PermitAccess, DenyAccess), not the rule that produced it.

Full explanation →

122

MCQmedium

A user is authenticated, but their authorization profile returns the wrong VLAN. Which troubleshooting tool in ISE is best suited to verify the attributes sent to the NAD?

A.Monitoring -> Alarms

B.Live Logs

C.Policy Simulation

D.TCP Dump

AnswerB

Live Logs capture the RADIUS authentication and authorization exchange in real time, letting you inspect the actual attributes returned to the network access device. This directly satisfies the stem's requirement to verify which VLAN and other authorization attributes ISE sent, confirming whether the wrong profile or policy caused the mismatch.

Why this answer

Live Logs in ISE provides real-time detailed authentication and authorization logs, including the exact attributes returned to the NAD in the authorization profile. It shows the RADIUS response attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID (VLAN), making it the best tool to verify what was sent to the switch.

Exam trap

SISE often tests the confusion between Policy Simulation (pre-deployment testing) and Live Logs (real-time session inspection), tricking candidates into picking simulation when they need to verify actual attributes sent to the NAD.

How to eliminate wrong answers

Option A is wrong because Monitoring -> Alarms shows system alerts and health events, not per-session authorization attributes. Option C is wrong because Policy Simulation is used to test policy logic before deployment, not to inspect live session attributes. Option D is wrong because TCP Dump captures raw packets but does not decode and present the authorization attributes in a readable, session-centric way like Live Logs.

Full explanation →

123

MCQeasy

What is the primary benefit of using native supplicant provisioning in ISE?

A.It provides complete control over the device's file system

B.It encrypts the entire hard drive

C.It leverages the built-in OS capabilities for connectivity

D.It removes the need for RADIUS authentication

AnswerC

Native supplicant provisioning uses the operating system's built-in 802.1X supplicant rather than installing Cisco AnyConnect or another client, so endpoints connect using existing OS capabilities. This satisfies the requirement to avoid additional software on managed devices.

Why this answer

Native supplicant provisioning in Cisco ISE leverages the built-in 802.1X supplicant already present in the operating system (e.g., Windows Wired AutoConfig, macOS native supplicant) to establish network connectivity, rather than deploying a third-party supplicant like Cisco AnyConnect NAM. This reduces deployment complexity and cost while still enabling ISE to push configuration profiles and certificates to the endpoint.

Exam trap

The trap is assuming native supplicant provisioning eliminates RADIUS or provides deep device control; it only changes which 802.1X client is used, while authentication still flows through ISE/RADIUS.

How to eliminate wrong answers

Option A is wrong because native supplicant provisioning does not grant control over the device's file system; it configures network authentication settings via the OS supplicant. Option B is wrong because encrypting the entire hard drive is a function of full disk encryption (BitLocker/FileVault), not supplicant provisioning. Option D is wrong because native supplicant provisioning still relies on RADIUS authentication through ISE — it changes the supplicant, not the authentication protocol.

Full explanation →

124

MCQhard

If a user is authenticated via TACACS+ but no authorization policy matches, what is the default behavior?

A.The user is granted read-only access

B.The user is prompted to re-authenticate

C.The user is granted full access

D.The user is rejected

AnswerD

TACACS+ applies a default-deny model: if authentication succeeds but no authorization policy rule matches the request, ISE returns a deny, so the user is rejected rather than granted access. There is no implicit permit fallback in the policy set.

Why this answer

In TACACS+, authorization is a separate process from authentication. If a user authenticates successfully but no authorization policy matches, the default behavior is to reject the user — access is denied. This is because TACACS+ authorization must explicitly permit commands or services; absence of a matching rule results in a deny.

Exam trap

The trap is assuming a fallback like read-only or full access — candidates forget that TACACS+ authorization is default-deny when no policy matches.

How to eliminate wrong answers

Option A is wrong because TACACS+ does not default to read-only access; there is no implicit read-only fallback. Option B is wrong because re-authentication is not triggered by a missing authorization policy — the user is already authenticated. Option C is wrong because granting full access would be a security risk and is not the default; TACACS+ follows a default-deny model for authorization.

Full explanation →

125

MCQhard

You need to profile IoT devices that only support mDNS. Which probe should you enable?

A.mDNS probe

B.DHCP probe

C.SNMP Query probe

D.HTTP probe

AnswerA

The mDNS probe resolves multicast DNS queries on UDP port 5353, which is the only discovery protocol these IoT devices support. Enabling it lets Cisco Identity Services Engine profile them by parsing their mDNS service advertisements, satisfying the stem's constraint that devices support mDNS exclusively.

Why this answer

For IoT devices that only support mDNS (Multicast DNS, used by Bonjour, Chromecast, AirPrint, and similar services), the mDNS probe is the correct choice because it captures mDNS traffic and extracts service and device attributes for profiling. Enabling the mDNS probe allows ISE to identify devices that don't participate in DHCP fingerprinting or RADIUS-based profiling.

Exam trap

SISE often tests whether candidates know which probe maps to which protocol — the trap is selecting a general-purpose probe (DHCP, HTTP) when the device only speaks a specific protocol like mDNS.

How to eliminate wrong answers

Option B is wrong because the DHCP probe requires the device to request an IP via DHCP and send identifiable options — mDNS-only IoT devices may use static IPs or minimal DHCP requests. Option C is wrong because SNMP Query polls network devices for MAC/ARP tables, which doesn't capture mDNS service advertisements. Option D is wrong because the HTTP probe inspects HTTP User-Agent strings, which mDNS-only devices typically don't generate.

Full explanation →

126

Multi-Selecthard

Which TWO methods can be used to verify that a TACACS+ request from a network device is reaching the Cisco ISE PSN?

Select 2 answers

A.Checking the Network Device Group membership list.

B.Reviewing the Operations > TACACS Livelogs in the ISE GUI.

C.Viewing the Policy Set order of precedence.

D.Executing a packet capture (TCP dump) on the ISE PSN interface.

E.Checking the switch console logs for AAA server status.

AnswersB, D

TACACS Livelogs under Operations display TACACS+ authentication and authorisation requests in real time as the PSN processes them. Seeing the device's request appear confirms it reached the PSN, satisfying the stem's verification requirement without needing CLI access.

Why this answer

Option B is correct because the Operations > TACACS Livelogs page in the ISE GUI shows TACACS+ authentication and authorization requests as they arrive at the PSN, confirming the request reached ISE. Option D is correct because running a packet capture (tcpdump) on the PSN interface lets you see the inbound TCP port 49 traffic from the network device, directly proving the TACACS+ request arrived. Option A is wrong because Network Device Group membership only defines device classification, not whether a request reached the PSN.

Option C is wrong because Policy Set order of precedence controls rule evaluation, not request arrival. Option E is wrong because switch console AAA server status shows local client-side state, not whether the request reached the ISE PSN.

Exam trap

SISE often tests the distinction between configuration-level artifacts (device groups, policy sets) and runtime evidence (Livelogs, packet captures) — candidates pick configuration screens thinking they prove traffic flow.

Full explanation →

127

Multi-Selectmedium

Which TWO of the following are prerequisites for the AnyConnect posture agent to function?

Select 2 answers

A.Administrative rights on the server

B.Connectivity to the ISE PSN

C.A pre-installed VPN tunnel

D.A supported operating system

E.A static IP address on the endpoint

AnswersB, D

Posture assessment requires the agent to reach an ISE Policy Service Node to submit posture data and receive the access decision. Without PSN connectivity, the agent cannot complete posture evaluation, so the endpoint fails authorisation. This prerequisite directly satisfies the scenario's requirement for the AnyConnect posture agent to function.

Why this answer

Option B is correct because the AnyConnect posture agent must reach an ISE Policy Services Node (PSN) to send posture assessment data and receive the posture decision (via the posture discovery and posture-report flow over HTTPS/port 8443), so connectivity to the ISE PSN is a prerequisite. Option D is correct because the posture agent is only supported on specific operating systems (for example, supported versions of Windows, macOS, and Linux) and will not function on an unsupported OS. Option A is not required because administrative rights on the server are not needed for the endpoint posture agent to operate.

Option C is not required because the posture agent does not depend on a pre-installed VPN tunnel; posture can be evaluated before or independently of tunnel establishment. Option E is not required because the endpoint can use DHCP and does not need a static IP address for posture to work.

Exam trap

The trap is confusing agent prerequisites with ISE server requirements, leading candidates to select administrative rights or VPN tunnel.

Full explanation →

128

MCQhard

You are troubleshooting a certificate provisioning failure where the error is 'Internal CA Error'. What is the most likely cause?

A.The ISE node is not configured as a subordinate CA correctly

B.The user password has expired

C.The client certificate is too small

D.The network switch is blocking port 443

AnswerA

The 'Internal CA Error' arises when ISE's internal certificate authority cannot issue the endpoint certificate, typically because the node's subordinate CA configuration, including the CA certificate chain, is incorrect or incomplete. This satisfies the stem's certificate provisioning failure scenario.

Why this answer

The 'Internal CA Error' in Cisco ISE certificate provisioning typically indicates that the ISE node's internal Certificate Authority (CA) is not properly configured as a subordinate CA to the enterprise PKI, or the CA certificate chain is incomplete/misconfigured. ISE uses its internal CA to issue certificates for BYOD, posture, and admin services, and if the subordinate CA relationship is broken, provisioning fails with this error. The correct fix is to verify the subordinate CA configuration and certificate chain.

Exam trap

SISE often tests whether candidates can distinguish between certificate provisioning errors caused by CA misconfiguration versus authentication or connectivity errors, causing them to pick a password or port-related answer when the error explicitly mentions 'Internal CA'.

How to eliminate wrong answers

Option B is wrong because an expired user password would produce an authentication failure (e.g., 'Authentication failed' or 'User password expired'), not an 'Internal CA Error' related to certificate provisioning. Option C is wrong because certificate key size (e.g., 1024 vs 2048 bits) would produce a key-strength or algorithm error, not an internal CA error. Option D is wrong because a switch blocking port 443 would cause a connectivity/timeout error (e.g., 'Unable to reach server'), not an internal CA error generated by ISE's CA subsystem.

Full explanation →

129

Multi-Selecthard

Which TWO of the following are necessary to successfully profile devices using the SNMP Query probe?

Select 2 answers

A.SNMP Write community string configured on the device.

B.LLDP-MED enabled on the endpoint.

C.Read access to the MIBs on the target device.

D.SNMP community string or credentials defined in ISE.

E.A static IP address on the target device.

AnswersC, D

The SNMP Query probe reads object identifiers from the device's management information base to gather profiling attributes. Read access to those MIBs is therefore required; without it queries return errors and no endpoint data is collected.

Why this answer

Option C is correct because the SNMP Query probe in Cisco ISE reads information from the device's Management Information Base (MIB) objects to identify attributes such as sysDescr, sysObjectID, and interface details, so read access to those MIBs on the target device is required for profiling to succeed. Option D is correct because ISE must be configured with the matching SNMP community string (for SNMPv1/v2c) or SNMPv3 credentials (username, authentication, and privacy settings) that the target device accepts, otherwise the query will be rejected and no profiling data will be returned. Option A is not needed because SNMP Query profiling only performs read operations (GET/GET-NEXT/GET-BULK); write access is never used.

Option B is not needed because LLDP-MED is an entirely separate profiling method (used by the LLDP-MED probe via CDP/LLDP neighbor data), not part of SNMP Query. Option E is not needed because SNMP Query can target any reachable device by IP address, whether statically assigned or obtained via DHCP.

Exam trap

SISE often tests the misconception that SNMP write access or LLDP-MED is required for SNMP Query profiling, when in fact only read access and credentials are needed.

Full explanation →

130

MCQmedium

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

A.Authentication Policy

B.Identity Source Sequence

C.Authorization Policy Condition

D.Authorization Profile

AnswerC

Authorization policy conditions in Cisco ISE restrict MAB by matching endpoint attributes such as MAC OUI, satisfying the requirement that only approved vendors connect. Unlike authentication policies, which select identity stores, authorization conditions evaluate attributes after authentication to enforce granular permit or deny decisions per endpoint.

Why this answer

In Cisco ISE, MAB (MAC Authentication Bypass) authorization decisions are made by the Authorization Policy, and the specific conditions that match attributes like MAC address, OUI, or endpoint identity group are configured as conditions within an Authorization Policy rule. To restrict access to specific MAC OUI addresses, you create a condition (e.g., using the 'MACAddress' or 'EndPointMacAddress' attribute with an OUI prefix match) inside the Authorization Policy rule, which then determines the resulting Authorization Profile.

Exam trap

SISE often tests the confusion between Authentication Policy (how identity is verified) and Authorization Policy (what access is granted), tricking candidates into placing MAC OUI restrictions in the wrong policy.

How to eliminate wrong answers

Option A is wrong because the Authentication Policy determines how the identity is validated (e.g., MAB vs 802.1X vs CWA) — it does not evaluate MAC OUI restrictions for authorization. Option B is wrong because an Identity Source Sequence defines the ordered list of identity stores ISE queries during authentication; it has no role in matching MAC OUI patterns for authorization. Option D is wrong because an Authorization Profile defines the result (VLAN, dACL, SGT, URL redirect) applied when a rule matches — it does not contain the matching condition itself.

Full explanation →

131

MCQeasy

Which menu path in Cisco ISE is used to define a new Network Device Group?

A.Operations > TACACS Livelogs

B.Administration > Identity Management

C.Policy > Policy Elements > Results

D.Administration > Network Resources > Network Device Groups

AnswerD

Administration > Network Resources > Network Device Groups is the exact path where Cisco ISE stores device group definitions, satisfying the requirement to define a new Network Device Group. Groups created here feed into authorisation policy conditions and device registration, so the hierarchy is available immediately for policy evaluation.

Why this answer

The correct menu path to define a new Network Device Group in Cisco ISE is Administration > Network Resources > Network Device Groups. This is where you create and manage groups that can be used to logically group network devices for policy conditions and authorization rules.

Exam trap

SISE often tests menu path memorization; candidates may confuse the Network Device Groups location with Identity Management or Policy Elements, leading to incorrect answers.

How to eliminate wrong answers

Option A is wrong because Operations > TACACS Livelogs is used to view live TACACS+ authentication and authorization logs, not to configure device groups. Option B is wrong because Administration > Identity Management is where you configure identity sources such as Active Directory, LDAP, or internal users, not network device groups. Option C is wrong because Policy > Policy Elements > Results is where you define authorization results (e.g., dACLs, VLANs, SGTs) that are referenced in policies, not network device groups.

Full explanation →

132

MCQhard

A guest user connects to the network and is redirected to the ISE Guest Portal. After entering valid credentials, the user is authenticated, but the browser remains on the 'Redirecting' page and never reaches the intended URL. The NAD logs show repeated MAC authentication bypass (MAB) attempts with the guest endpoint's MAC address, and the authorization result is 'Redirect'. What is the most likely cause of this issue?

A.The guest endpoint is not being reauthenticated after successful web authentication because the NAD is not receiving the Change of Authorization (CoA) from ISE.

B.The guest portal is configured to use a self-signed certificate, causing the browser to block the redirect.

C.The Authorization Profile for the guest flow is missing the 'Web Redirection' attribute, so the NAD does not know where to redirect the user after authentication.

D.The guest user's credentials are being rejected by the external identity store, causing ISE to reapply the redirect policy.

AnswerA

After web authentication, ISE must send a CoA to the NAD to change the session authorization from Redirect to Permit. If the CoA fails (e.g., due to incorrect CoA configuration, unreachable NAD, or shared secret mismatch), the NAD continues to apply the Redirect policy, causing the loop. The repeated MAB attempts indicate the session is stuck in the redirect state.

Why this answer

The most likely cause is that ISE cannot send a successful Change of Authorization to the NAD after web authentication. The NAD remains in the Redirect state, causing the browser to loop. This can happen if CoA is not enabled on the NAD, the CoA shared secret is incorrect, or the NAD is unreachable.

Verifying CoA configuration and connectivity is essential.

Exam trap

The trap here is focusing on certificate or credential issues when the symptom of repeated MAB attempts and persistent redirect after successful authentication points to a CoA failure.

Full explanation →

133

MCQeasy

Where do you customize the visual look and feel of the guest portal, such as logos and background colors?

A.Administration > System > Settings

B.Work Centers > Guest Access > Configure > Guest Portals

C.Policy > Policy Elements > Results

D.Administration > Identity Management > Identities

AnswerB

Guest portal branding—logos, background colours and custom text—is configured under Work Centers > Guest Access > Configure > Guest Portals, where each portal's visual settings are edited. This path satisfies the stem's requirement to customise the portal's look and feel.

Why this answer

Guest portal branding — logos, background images, colors, and text — is customized under Work Centers > Guest Access > Configure > Guest Portals. Within a specific portal's configuration you can edit the Portal Page Customization settings, upload a logo, and adjust the color scheme and language. This is the dedicated location for all guest-facing portal appearance changes.

Exam trap

SISE often tests the difference between global system settings and per-portal configuration — candidates pick Administration > System > Settings because 'branding' sounds global, but portal appearance is always portal-specific.

How to eliminate wrong answers

Option A is wrong because Administration > System > Settings covers global system parameters like FIPS mode, SMTP, and profiler feed settings, not portal branding. Option C is wrong because Policy > Policy Elements > Results defines authorization results such as dACLs, VLANs, and SGTs, which have nothing to do with portal appearance. Option D is wrong because Administration > Identity Management > Identities is where you manage internal user accounts and identity sources, not guest portal look and feel.

Full explanation →

134

Multi-Selecthard

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

Select 3 answers

A.SGT (Security Group Tag)

B.TACACS+ command set

C.Enforcement device (e.g., Catalyst switch)

D.SGACL (Security Group Access Control List)

E.RADIUS shared secret

AnswersA, C, D

The Security Group Tag is a metadata value inserted into the packet, classifying the source's role or group. TrustSec policy matches on this tag rather than IP addresses, enabling scalable, topology-independent segmentation across the network fabric.

Why this answer

Cisco TrustSec Security Group policy enforcement relies on three core building blocks. Option A, SGT (Security Group Tag), is correct because TrustSec classifies traffic by assigning a 16-bit SGT to a source identity, and that tag is what the fabric carries and enforces against. Option C, the enforcement device (e.g., Catalyst switch), is correct because TrustSec enforcement happens at the network device that receives the tagged packet and applies the policy, such as a Catalyst switch acting as an enforcement point.

Option D, SGACL (Security Group Access Control List), is correct because SGACLs define the actual permissions between source and destination SGTs and are downloaded to enforcement devices to permit or deny traffic. Option B, TACACS+ command set, is not a TrustSec enforcement component; TACACS+ is used for device administration AAA and command authorization, not for SGT-based traffic policy. Option E, RADIUS shared secret, is also not a TrustSec enforcement component; a shared secret is an authentication credential used between a client and a RADIUS server, not a policy enforcement element.

Exam trap

SISE often tests the confusion between TrustSec components (SGT, SGACL, enforcement device) and unrelated AAA constructs like TACACS+ command sets or RADIUS shared secrets.

Full explanation →

135

MCQmedium

You need to ensure that only specific ISE nodes perform the NMAP scan probe. Where is this configured?

A.Administration > System > Settings > Profiling Feed

B.Policy > Profiling > Profiling Policies

C.Administration > System > Deployment > [Node Name] > Profiling Configuration

D.Policy > Policy Elements > Results

AnswerC

Profiling configuration is set per node under Administration > System > Deployment, selecting the node and enabling the NMAP scan probe there. This node-level setting ensures only the chosen ISE nodes run the scan, satisfying the requirement to restrict probe execution.

Why this answer

NMAP scan probe enablement is configured per-PSN under Administration > System > Deployment > [Node Name] > Profiling Configuration. This is where you enable or disable individual probes (NMAP, DHCP, RADIUS, SNMP, NetFlow, etc.) on a specific ISE node, allowing you to restrict scanning to dedicated PSNs rather than every node in the deployment.

Exam trap

SISE often tests the distinction between global profiling settings (feeds, policies) and per-node probe configuration, catching candidates who assume probe enablement is a global policy setting.

How to eliminate wrong answers

Option A is wrong because Administration > System > Settings > Profiling Feed controls the download of Cisco-provided OUI and profile feed updates, not per-node probe enablement. Option B is wrong because Policy > Profiling > Profiling Policies defines the matching conditions and policies that assign endpoints to identity groups — it does not control which node runs the NMAP probe. Option D is wrong because Policy > Policy Elements > Results contains reusable authorization results such as authorization profiles and downloadable ACLs, which are unrelated to probe configuration.

Full explanation →

136

Multi-Selectmedium

Which TWO of the following are true regarding TACACS+ command sets? (Choose two)

Select 2 answers

A.They support explicit 'permit' and 'deny' rules

B.They only support exact command matching

C.They are used to define the privilege level of the session

D.They are defined in the Identity store

E.They can use regular expressions for command matching

AnswersA, E

TACACS+ command sets are ordered lists of permit and deny entries applied per command or command argument, letting administrators allow specific privileged commands while blocking others. This explicit allow/deny structure is what enables granular authorisation on Cisco devices.

Why this answer

Option A is correct because TACACS+ command sets are built from explicit permit and deny statements that authorize or block specific commands (or command arguments) for a user or group after authentication and authorization succeed. Option E is correct because TACACS+ command sets support regular expression matching, allowing patterns such as 'show.*' to match multiple related commands rather than requiring each command to be listed individually. Option B is wrong because TACACS+ command matching is not limited to exact matches; it also supports regular expressions and partial/argument-based matching.

Option C is wrong because the privilege level of a session is set by the TACACS+ authorization response (for example, the 'priv-lvl' attribute), not by the command set itself. Option D is wrong because command sets are defined in the TACACS+ server's policy configuration (such as the device/group configuration on Cisco ISE or a TACACS+ daemon), not in the identity store that holds user credentials.

Exam trap

SISE often tests the misconception that TACACS+ command sets only support exact command matching, confusing them with simpler authorization methods, when in fact they support regular expressions and explicit permit/deny rules.

Full explanation →

137

MCQeasy

You are configuring a Network Device Group in Cisco ISE to organize devices by geographical location. Which menu path should you navigate to in order to create a new Network Device Group?

A.Operations > Network Devices > Device Groups

B.Administration > Network Resources > Network Device Groups

C.Administration > System > Settings > Device Groups

D.Policy > Policy Elements > Network Device Groups

AnswerB

Network Device Groups are created under Administration > Network Resources > Network Device Groups, where hierarchical groups such as location or device type are defined and assigned. This menu path satisfies the stem's requirement to organise devices by geographical location.

Why this answer

Network Device Groups (NDGs) in Cisco ISE are created under Administration > Network Resources > Network Device Groups. This location houses the hierarchical grouping structure (e.g., Device Type, Location) used to organize network access devices for policy conditions. Navigating here lets you create new group hierarchies such as Location#All Locations#SanJose that can then be referenced in authorization policy rules.

Exam trap

SISE often tests the exact menu path for Network Device Groups, and candidates confuse it with Policy > Policy Elements or Administration > System > Settings.

How to eliminate wrong answers

Option A is wrong because Operations > Network Devices does not exist as a menu path in ISE; Operations contains Livelogs, Troubleshoot, and Dashboard views, not device configuration. Option C is wrong because Administration > System > Settings contains global system settings like SMTP, logging, and certificates, not device group definitions. Option D is wrong because Policy > Policy Elements contains reusable policy objects like authorization profiles and conditions, but Network Device Groups are defined under Administration > Network Resources, not Policy Elements.

Full explanation →

138

Multi-Selecthard

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

Select 3 answers

A.SMTP

B.HTTPS

C.FTP

D.RADIUS

E.SCEP

AnswersB, D, E

HTTPS secures browser-based onboarding and certificate enrolment traffic, satisfying the BYOD requirement that unmanaged personal devices authenticate over untrusted networks. Its TLS encryption protects credentials and device posture data in transit, and it underpins the web portals used for registration, compliance checks and remediation throughout the device lifecycle.

Why this answer

HTTPS (B) is critical because BYOD enrollment, policy delivery, and MDM/UEM management traffic must be encrypted and authenticated over TLS, typically on TCP 443, protecting device and user data in transit. RADIUS (D) is essential for authenticating BYOD devices and users to the network, commonly via 802.1X/EAP, enabling access control and dynamic VLAN or role assignment. SCEP (E) is the Simple Certificate Enrollment Protocol used to automate certificate issuance to BYOD devices, which underpins identity, Wi-Fi/EAP-TLS authentication, and VPN trust in the lifecycle.

SMTP (A) is only for sending email and FTP (C) is a legacy cleartext file-transfer protocol; neither provides the authentication, encryption, or certificate provisioning functions required for BYOD onboarding and management.

Exam trap

SISE often tests which protocols are essential to BYOD, and candidates may incorrectly include generic protocols like SMTP or FTP because they sound like standard network services, missing the security and certificate focus of BYOD.

Full explanation →

139

MCQhard

An administrator notices that TACACS+ authentication is failing for devices. The logs show 'RADIUS request received'. What is the most likely cause?

A.The NAD is configured for RADIUS authentication instead of TACACS+.

B.The TACACS+ service is disabled on the ISE Policy Service Node.

C.The ISE policy set is missing a TACACS+ rule.

D.The shared secret between ISE and the NAD is mismatched.

AnswerA

The log entry 'RADIUS request received' indicates the NAD is sending RADIUS, not TACACS+, so ISE cannot process it as TACACS+. Reconfiguring the NAD to use TACACS+ satisfies the stem's requirement for successful TACACS+ authentication.

Why this answer

The log message 'RADIUS request received' indicates that ISE is receiving RADIUS packets, not TACACS+ packets, from the network access device. This means the NAD is configured to use RADIUS for authentication instead of TACACS+. The fix is to reconfigure the NAD to use TACACS+ (or correct the AAA server group) so that TACACS+ requests are sent to ISE.

Exam trap

The trap is focusing on ISE-side TACACS+ configuration (service, policy, secret) when the log clearly shows RADIUS traffic — the root cause is the NAD using the wrong protocol.

How to eliminate wrong answers

Option B is wrong because if the TACACS+ service were disabled on the PSN, ISE would not receive TACACS+ requests, but the log would not show 'RADIUS request received' — it would show no TACACS+ activity or a service error. Option C is wrong because a missing TACACS+ policy set would still result in TACACS+ requests being received and logged, not RADIUS requests. Option D is wrong because a shared secret mismatch would cause TACACS+ authentication failures with decryption errors, not a RADIUS request log.

Full explanation →

140

MCQhard

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

A.The SGT is not in the ISE database

B.RADIUS shared secret is wrong

C.The switch is missing the 'cts role-based enforcement' command

D.The user is in the wrong AD group

AnswerC

Without the `cts role-based enforcement` command, the switch downloads SGT bindings but never installs SGACLs into hardware, so tagged traffic passes unfiltered. Enabling it activates role-based enforcement, satisfying the stem's requirement that the switch apply the correct filtering for the assigned SGT.

Why this answer

For SGACL enforcement to occur on a switch, the switch must have the 'cts role-based enforcement' command enabled globally (and often on the interface). Without this command, the switch may receive the SGT via RADIUS but will not enforce any SGACL filtering, resulting in the described failure. This is the most likely reason when the SGT is assigned but filtering does not happen.

Exam trap

SISE often tests the specific CLI command required for TrustSec enforcement — candidates may focus on ISE-side configuration or RADIUS issues, but the question asks for the most likely reason on the switch, which is the missing enforcement command.

How to eliminate wrong answers

Option A is wrong because if the SGT is not in the ISE database, the user would not be assigned an SGT at all — the question states the user is assigned an SGT. Option B is wrong because a wrong RADIUS shared secret would cause authentication to fail entirely, not just SGACL enforcement. Option D is wrong because being in the wrong AD group would result in a different SGT assignment, but the question says the user is assigned an SGT (presumably the correct one) and filtering still fails.

Full explanation →

141

Multi-Selecthard

Which THREE components are required to successfully deploy a Scalable Group Access (SGA) policy for SGT enforcement?

Select 3 answers

A.TACACS+ Command Authorization

B.DHCP Snooping

C.SGACL definition

D.TrustSec Matrix configuration

E.SGT mapping

AnswersC, D, E

SGACLs supply the actual permit or deny rules applied to traffic between source and destination SGTs. Without a defined SGACL, the TrustSec Matrix has no enforceable access control entries, so this component is mandatory for SGT-based enforcement in an SGA policy.

Why this answer

Option C (SGACL definition) is required because Scalable Group Access enforcement relies on Security Group ACLs that specify the permitted or denied traffic between source and destination SGTs; without an SGACL there is no policy to enforce. Option D (TrustSec Matrix configuration) is required because the TrustSec matrix binds source SGTs to destination SGTs and references the SGACLs, defining the actual enforcement policy that the network devices download. Option E (SGT mapping) is required because devices must know which SGT to assign to endpoints or users (via static IP-to-SGT, VLAN-to-SGT, or 802.1X/ISE authorization), otherwise traffic cannot be classified and the matrix/SGACL policy cannot be applied.

Option A (TACACS+ Command Authorization) is not required for SGA/SGT enforcement; it controls CLI command privileges, not group-based traffic policy. Option B (DHCP Snooping) is not required for SGA/SGT enforcement; it is a Layer 2 security feature for DHCP and does not perform SGT classification or SGACL enforcement.

Exam trap

SISE often tests the confusion between classification (SGT mapping) and enforcement (SGACL + Matrix), causing candidates to select ancillary features like DHCP Snooping or TACACS+ that are not part of the core SGA policy triad.

Full explanation →

142

MCQeasy

A network administrator is adding a new Cisco IOS router to Cisco ISE for TACACS+ device administration. The administrator needs to ensure that ISE recognizes the router and accepts its TACACS+ requests. What must be configured in ISE for the router?

A.Add the router as a Network Device with its IP address and shared secret.

B.Create an Authorization Policy that permits all commands.

C.Add the router to an Identity Group.

D.Configure a RADIUS server on the router pointing to ISE.

AnswerA

In Cisco ISE, each network device that communicates with ISE must be defined as a Network Device. This includes specifying the device's IP address and a shared secret. The shared secret must match the one configured on the router. Without this, ISE will not recognize the device and will reject TACACS+ requests. This is a fundamental step for device administration.

Why this answer

For Cisco ISE to accept TACACS+ requests from a router, the router must be defined as a Network Device in ISE. This configuration includes the device's IP address and a shared secret that matches the one on the router. Without this, ISE will not process the requests.

Authorization policies and other settings are applied after the device is recognized.

Exam trap

The trap here is confusing user identity groups with network device groups; network devices must be added under Network Resources, not Identity Management.

Full explanation →

143

Multi-Selecthard

Which THREE of the following items are verified by ISE when a guest attempts to authenticate?

Select 3 answers

A.Account expiration date.

B.The physical location of the NAD.

C.The user's browser version.

D.Password credentials.

E.Account status (e.g., Approved, Pending, Disabled).

AnswersA, D, E

Microsoft Entra ID guest accounts carry an account expiration date, and ISE verifies it during guest authentication to deny access once that date passes. This satisfies the stem's requirement for a verified item, since expired guest credentials must be rejected before authorisation proceeds.

Why this answer

When a guest authenticates against ISE, the guest portal validates the submitted username and password against the internal guest account store, so option D (Password credentials) is verified. ISE also checks the guest account's lifecycle attributes, including the expiration date set when the account was created or sponsored, making option A (Account expiration date) correct. Additionally, ISE evaluates the account's status field — Approved, Pending, Suspended, or Disabled — to decide whether the guest is permitted to log in, which is option E (Account status).

Option B is not verified during authentication because the NAD's physical location is not an attribute ISE checks for guest login, and option C is incorrect because the browser version is not part of ISE's guest authentication validation.

Exam trap

The trap is confusing authentication with authorization. Candidates might think that any attribute used in policy decisions is part of authentication, but authentication strictly verifies identity, while authorization determines access.

Full explanation →

144

MCQmedium

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

A.In the Policy Set Authentication rule

B.In the Authorization Profile

C.In the Command Set Policy Element

D.In the User Identity Group

AnswerC

The Command Set Policy Element defines the permitted command list, which is then referenced by the command authorisation rule. This satisfies the stem's requirement of specifying exactly where allowed commands are declared, separating the command definitions from the rule that applies them.

Why this answer

In ISE TACACS+ command authorization, the specific set of commands a user is permitted (or denied) to run is defined inside a Command Set, which is a Policy Element. The Command Set is then referenced by an Authorization Policy rule, which applies it when the user's session matches the rule conditions. This separation lets you reuse the same command list across multiple rules and policy sets.

Exam trap

SISE often tests the distinction between the Command Set (which holds the command list) and the Authorization Profile (which holds the result attributes) — candidates frequently pick the Authorization Profile because it sounds like the place where authorization is defined.

How to eliminate wrong answers

Option A is wrong because the Authentication rule only determines how the user is authenticated (e.g., against AD or internal users) — it does not define command-level permissions. Option B is wrong because an Authorization Profile defines the result of authorization (such as shell profile, privilege level, or downloadable ACL) but does not itself contain the list of permitted commands. Option D is wrong because a User Identity Group is only a logical grouping of identities used in policy conditions; it does not hold command lists.

Full explanation →

145

MCQmedium

When configuring a Shell Profile, what is the purpose of the 'Common Tasks' section?

A.To define custom protocol commands

B.To simplify configuration of standard attributes

C.To configure device-specific command sets

D.To manage user group membership

AnswerB

Common Tasks presents tick-box shortcuts for frequently used Shell Profile attributes, such as default privilege level and auto-command, so administrators avoid manually entering each TACACS+ attribute-value pair. This simplifies configuration of standard attributes, exactly as the stem describes.

Why this answer

The Common Tasks section in a Cisco ISE Shell Profile provides pre-populated, standard shell attributes (such as default privilege level, idle timeout, and session timeout) that administrators can enable with a checkbox instead of manually entering each TACACS+ AV pair. It simplifies configuration of commonly used standard attributes.

Exam trap

SISE often tests the confusion between Shell Profile Common Tasks (standard shell attributes) and Command Sets (per-command authorization), causing candidates to pick command-related answers for a shell-attribute question.

How to eliminate wrong answers

Option A is wrong because custom protocol commands are defined in Command Sets, not in the Shell Profile's Common Tasks section. Option C is wrong because device-specific command sets are separate authorization objects referenced from the Authorization Policy, not configured inside the Shell Profile. Option D is wrong because user group membership is managed in Active Directory or ISE internal identity stores, not in the Shell Profile.

Full explanation →

146

MCQhard

A security administrator is troubleshooting why a particular endpoint is being profiled as a generic 'Windows Workstation' instead of the more specific 'Windows 10 Enterprise' policy. The administrator checks the Profiling Policies and sees that the 'Windows 10 Enterprise' policy has a minimum certainty factor of 20, while the endpoint's current certainty factor is 18. The administrator also notices that the endpoint has matching attributes for both policies. What is the most likely reason the endpoint is not matching the more specific policy?

A.The endpoint's MAC address is not in the OUI database.

B.The minimum certainty factor for the 'Windows 10 Enterprise' policy is higher than the endpoint's current certainty factor.

C.The endpoint has not been assigned to the correct Endpoint Identity Group.

D.The 'Windows 10 Enterprise' policy is disabled.

AnswerB

Each profiling policy has a minimum certainty factor that must be met or exceeded for the policy to be considered a match. If the endpoint's accumulated certainty factor is 18 and the policy requires 20, the policy will not be selected. Instead, a less specific policy with a lower threshold, such as 'Windows Workstation', may match, explaining the observed behavior.

Why this answer

Profiling policies use a minimum certainty factor to determine whether an endpoint qualifies for that policy. When multiple policies match, the one with the highest certainty factor that meets its minimum threshold is selected. Here, the endpoint's certainty factor of 18 is below the required 20 for the Windows 10 Enterprise policy, so ISE falls back to a less specific policy with a lower threshold.

Exam trap

The trap here is thinking that having matching attributes alone is sufficient, when in fact the accumulated certainty factor must also meet the policy's minimum threshold.

Full explanation →

147

Multi-Selecthard

A security architect is designing a Cisco ISE deployment for a large enterprise with 20,000 endpoints. The design must ensure that RADIUS authentication and authorization continue even if the Primary PAN and Secondary PAN both become unreachable. The architect is evaluating the roles and services that must be enabled on the PSNs to support this requirement. Which two statements correctly describe the behavior or configuration needed to meet this goal? (Choose two.)

Select 2 answers

A.The PassiveID service must be enabled on each PSN to ensure RADIUS requests are processed during a PAN outage.

B.PSNs cache the last known policy configuration and can continue to process RADIUS authentications and authorizations for a limited time when PAN connectivity is lost.

C.The Administration service must be enabled on at least one PSN to allow it to process RADIUS requests when the PANs are unavailable.

D.PSNs must be manually reconfigured to point to a temporary PAN before they can resume RADIUS processing after a PAN outage.

E.The Policy Service service must be enabled on each PSN to allow it to handle RADIUS authentication and authorization requests from network access devices.

AnswersB, E

Cisco ISE PSNs maintain a local cache of the policy configuration received from the PAN. If the PAN becomes unreachable, PSNs can continue to process RADIUS requests using this cached policy for a period of time. This behavior is critical for maintaining authentication and authorization availability during administrative outages, though some features that require live PAN communication may be limited.

Why this answer

To maintain RADIUS authentication and authorization during a PAN outage, PSNs must have the Policy Service enabled and must be able to rely on their cached policy configuration. The Policy Service is the persona that processes RADIUS requests, and the cache allows continued operation when the PAN is unreachable. Together, these two statements correctly describe the required configuration and behavior for high availability of AAA services.

Exam trap

The trap here is confusing the Administration service with the Policy Service, or assuming PassiveID plays a role in RADIUS processing during a PAN outage.

Full explanation →

148

Multi-Selecthard

A network security engineer is configuring profiling policies in Cisco ISE to identify and classify endpoints. The engineer wants to ensure that the profiling policies correctly match endpoints based on multiple conditions. Which two statements are true regarding profiling policy conditions and certainty factors? (Choose two.)

Select 2 answers

A.The minimum certainty factor of a profiling policy must be equal to the sum of all condition certainty factors.

B.When multiple profiling policies match, ISE selects the policy with the highest cumulative certainty factor that meets its minimum threshold.

C.A profiling policy can contain multiple conditions, and each condition can have a different certainty factor.

D.Profiling policies can only use a single condition; multiple conditions require separate policies.

E.Certainty factors are only applied to the first matching condition in a policy.

AnswersB, C

Cisco ISE evaluates all profiling policies and calculates a cumulative certainty factor for each based on matched conditions. If a policy's cumulative certainty factor meets or exceeds its minimum threshold, it becomes a candidate. Among all candidates, ISE selects the policy with the highest cumulative certainty factor. This ensures the most specific match is chosen, assuming it meets its threshold.

Why this answer

Profiling policies in Cisco ISE can include multiple conditions, each with its own certainty factor, and the cumulative certainty factor is compared against the policy's minimum threshold. When several policies match, the one with the highest cumulative certainty factor that meets its threshold is selected. These mechanisms allow granular and accurate endpoint classification.

Exam trap

The trap here is assuming that the minimum certainty factor must equal the sum of all condition certainty factors, when it is actually a threshold that can be lower to allow partial matches.

Full explanation →

149

MCQmedium

A security administrator is configuring a policy set in Cisco ISE to enforce different authorization policies based on the endpoint's posture status. The administrator wants to ensure that non-compliant endpoints are placed in a remediation VLAN. Which condition should be used in the authorization policy to match endpoints that have failed posture assessment?

A.PostureStatus EQUALS NonCompliant

B.ComplianceStatus EQUALS Failed

C.EndPointPolicy EQUALS NonCompliant

D.PostureReport EQUALS NonCompliant

AnswerA

In Cisco ISE, the posture status is represented by the 'PostureStatus' attribute, which can have values such as Compliant, NonCompliant, Unknown, or NotApplicable. To match endpoints that have failed posture assessment, the condition should check if PostureStatus equals NonCompliant. This attribute is populated after posture assessment and can be used in authorization policies to assign remediation VLANs or restricted access.

Why this answer

The PostureStatus attribute in Cisco ISE reflects the result of posture assessment. It can be Compliant, NonCompliant, Unknown, or NotApplicable. To direct non-compliant endpoints to a remediation VLAN, the authorization policy must check for PostureStatus EQUALS NonCompliant.

This ensures that only endpoints that have failed the posture check receive the remediation treatment.

Exam trap

The trap here is confusing the attribute name and its values, such as using 'ComplianceStatus' or 'Failed' instead of the correct 'PostureStatus' and 'NonCompliant'.

Full explanation →

150

MCQhard

You want to implement a 'Change of Authorization' (CoA) after a user changes their location. How is the CoA triggered by ISE?

A.ISE sends a RADIUS CoA message to the NAD

B.The NAD sends a re-authentication request

C.It requires a manual port bounce

D.The user must log out and back in

AnswerA

ISE initiates CoA by sending a RADIUS Change of Authorization packet, defined in RFC 5176, to the network access device. The NAD then reauthenticates or reauthorises the session, applying the new location-based policy without requiring the user to reconnect.

Why this answer

ISE triggers a Change of Authorization (CoA) by sending a RADIUS Disconnect-Request (code 40) or CoA-Request (code 43) packet directly to the Network Access Device (NAD) that currently has the user's session. This allows ISE to dynamically modify the user's authorization (e.g., VLAN, ACL, SGT) without requiring re-authentication. The NAD must support CoA (RFC 5176) and have the ISE node configured as a CoA client.

This is the standard mechanism for enforcing policy changes mid-session.

Exam trap

SISE often tests the direction of CoA messages: candidates may mistakenly think the NAD initiates the change or that re-authentication is required, but ISE is the initiator sending RADIUS CoA to the NAD.

How to eliminate wrong answers

Option B is wrong because the NAD does not initiate a re-authentication request; re-authentication is typically triggered by ISE via CoA or by session timeout, not by the NAD itself. Option C is wrong because a manual port bounce is a disruptive, manual workaround that is not part of ISE's CoA process; CoA is automatic and does not require physical intervention. Option D is wrong because requiring the user to log out and back in is a manual re-authentication that defeats the purpose of CoA, which is to apply changes without user disruption.

Full explanation →

Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) (SISE) — Questions 76–150