322 questions total · 5pages · All types, answers revealed
Where are the TACACS+ accounting logs stored and viewed in the ISE management console?
Livelogs capture the full accounting data.
Why this answer
Accounting logs for TACACS+ are found under Operations > TACACS Livelogs.
Which component in ISE defines the 'result' of an authorization rule?
The profile contains the specific attributes (VLAN, SGT, dACL) applied to the session.
Why this answer
The Authorization Profile is the outcome object that is returned to the NAD to dictate session parameters.
Which THREE conditions must be met for a successful ISE node upgrade?
Synchronization must be healthy before starting.
Why this answer
Upgrades require a healthy cluster state, enough disk space for the upgrade bundle, and verified database consistency.
You are troubleshooting a TACACS+ issue where a user can log in but cannot execute any commands. The policy set hits the correct rule. What is the most likely reason?
If 'Deny' is selected without specific permit rules, all commands are blocked by default.
Why this answer
If the user is logged in, authentication works, but if no commands are permitted, the associated Command Set is either empty, set to 'Deny' for all, or misconfigured.
A user is assigned a Command Set that permits all commands, but they are still receiving 'Access Denied' when running 'reload'. What is the most likely reason?
Command authorization is checked against both ISE and the local device parser.
Why this answer
The switch's local privilege levels may prevent the user from executing high-impact commands like 'reload' even if the TACACS+ command set permits it.
If a user's certificate expires, how can the user renew it using the ISE BYOD flow?
ISE detects the expired certificate or lack of authentication and redirects the user to the portal to renew.
Why this answer
The user can reconnect to the network, trigger the MAB/Redirect process, and the portal will provide an option to re-enroll or renew the certificate.
Which portal is intended for guest users to manage their own registered devices, such as adding or removing their personal laptops?
This is the correct portal for device management.
Why this answer
The 'My Devices' portal is explicitly designed for guests or employees to manage their own registered devices for network access.
Which THREE of the following are common reasons why an endpoint would be listed as 'Unknown' in Cisco ISE?
A device must interact with the network to be profiled.
Why this answer
'Unknown' means the device hasn't been classified; this happens if no policies match, if probes are disabled, or if insufficient attributes are collected.
Which component in Cisco ISE defines the TACACS+ privilege levels and attributes sent to the network device?
Shell profiles define the session parameters.
Why this answer
Shell Profiles are the components that define the TACACS+ attributes, including privilege level, used by the network device.
Which THREE of the following are valid actions an administrator can take in the Sponsor Portal?
Core sponsor capability.
Why this answer
The Sponsor Portal provides tools for account creation, lifecycle management (extending/revoking), and viewing the status of guest accounts.
You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?
This is the correct navigation path for adding nodes to an ISE deployment.
Why this answer
You must register the secondary node from the Primary PAN GUI, providing the secondary node's credentials and IP.
Which probe is required to collect the 'User-Agent' string from a web browser to assist in profiling a device as a workstation?
The HTTP probe captures the User-Agent header from browser requests.
Why this answer
The HTTP probe is specifically designed to extract information from HTTP/HTTPS traffic, including the User-Agent string.
What is the purpose of the 'Posture Discovery' phase?
Discovery determines the policy applicability.
Why this answer
Discovery is the initial communication where the agent identifies the ISE PSN and checks if a posture policy exists.
Which THREE actions are required when configuring a BYOD flow that involves an external MDM integration?
This is the required path for MDM integration.
Why this answer
Integrating MDM requires establishing the server connection, defining the authorization policy to check compliance, and ensuring the device is correctly registered in the ISE endpoint database.
Which TWO of the following are benefits of using Network Device Groups (NDG)? (Choose two)
Scaling policies is easier.
Why this answer
NDGs simplify policy management and allow for device-specific policy targeting.
When configuring a Profiling Policy, what happens if an endpoint matches multiple policies?
ISE evaluates conditions and applies the most granular match.
Why this answer
Cisco ISE matches profiling policies based on a 'most specific match' logic or order, but typically the most specific policy (highest logic depth) takes precedence.
An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?
This ensures the SGT value is passed via the RADIUS attribute 217 to the network device.
Why this answer
Before SGTs can be used, the TrustSec matrix must be defined and the ISE must be configured to send SGT information in RADIUS Access-Accept messages.
Which of the following describes the function of the 'Profiling Priority' setting?
Priority governs the selection of the winning policy.
Why this answer
When multiple profiling policies match, the one with the highest priority (lowest number) is applied.
Which of the following is a valid condition for an ISE Authorization Policy?
Device-Type is a valid attribute for policy conditions.
Why this answer
ISE conditions can be based on device type, user group, location, or protocol.
Which THREE of the following items can be included in an ISE 'Common Task' for authorization?
dACLs are a standard common task.
Why this answer
Common Tasks include VLAN, Voice Domain, and dACL/SGACL assignment.
Which component in ISE is responsible for mapping an authenticated user to a specific set of permissions and command restrictions in a TACACS+ environment?
This policy determines the shell profile and command set assigned to the user.
Why this answer
The TACACS+ Authorization Policy is the component that ties identity, context, and profile/command set together.
When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?
dACLs must follow standard IOS extended ACL syntax.
Why this answer
dACLs on ISE must be defined using standard IOS-style access-list syntax, and they are pushed to the NAD during the authorization phase.
Which specific ISE process is responsible for managing the communication between the PAN and PSNs?
Messaging service manages inter-node coordination.
Why this answer
The 'ISE Messaging Service' (based on RabbitMQ) is the backbone for communication and state synchronization between nodes.
Which THREE of the following are valid types of Posture Conditions?
Checks for service running status.
Why this answer
ISE supports multiple condition types including File, Registry, and Service checks.
Which THREE of the following items are considered 'results' in an ISE authorization policy? (Choose three)
Used for RADIUS authorization.
You are configuring a DHCP probe on a Cisco ISE node to identify endpoints. Which specific configuration step is required to ensure the ISE node receives DHCP traffic when the client and server are on a different subnet?
IP helper-address is required to forward DHCP requests to the ISE node.
Why this answer
IP Helper-address must be configured on the default gateway to forward DHCP broadcasts to the ISE node acting as a probe.
You want to customize the guest portal so that it displays the company logo and specific terms of use. Where is this configuration performed within the Cisco ISE GUI?
This is the correct location to edit the Guest Portal and its associated customization settings.
Why this answer
Portal customization is managed under the Guest Access menu, specifically within the Portal Builder of the selected portal type.
If a user is redirected to the Guest portal but receives a '404 Page Not Found' error, what is the most likely configuration issue?
This causes the 404 error.
Why this answer
If the portal FQDN is not resolvable or the portal service on the PSN is not active, the user will reach a non-existent page.
You have a policy set where authentication succeeds, but the user is hitting the 'Default' authorization rule instead of the expected rule. What should you check first?
Authorization rules are processed top-down; the first match wins.
Why this answer
The order of rules in the Authorization Policy is critical; if a rule appears below a more general rule that also matches, the more general one wins.
Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?
This section allows you to enable and define CWA redirects.
Why this answer
The 'Web Redirection' checkbox under the Authorization Profile allows configuring the Centralized Web Authentication (CWA) URL.
When a user's device is stolen, which action should be taken in the 'My Devices' portal?
Removing the device from the registered list effectively revokes its access rights.
Why this answer
The user or administrator can 'Deregister' or 'Blacklist' the device to revoke its certificate and access.
You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?
The proxy acts as a broker between the endpoint and the CA.
Why this answer
The SCEP proxy allows the endpoint to request a certificate from an internal CA through the ISE node, keeping the CA hidden from the internal network.
Which protocol is used by the AnyConnect agent to communicate posture information to the ISE Policy Service Node (PSN)?
The Cisco ISE posture agent communicates with the PSN over TCP port 8905.
A user is failing to receive the expected dACL. The ISE logs show the correct authorization rule was matched, but the dACL is not applied. What is the most likely cause?
If the dACL name is not correctly mapped in the profile as a RADIUS attribute, the switch will not know which ACL to apply.
Which of the following is an example of an 'Exception' policy in ISE?
Top-level rules act as exceptions for specific users or devices.
Why this answer
Exception rules are used to handle specific, high-priority cases before the main policy rules are evaluated.
Which TWO of the following are common reasons for a Guest portal to display an 'Internal Server Error'?
Common node-specific issue.
Why this answer
Internal Server Errors often relate to issues with the ISE node itself, such as database connectivity problems or the portal service being crashed/unresponsive.
In a high-availability deployment, you have a Primary PAN/MnT and a Secondary PAN/MnT. If the Primary PAN fails, what is the impact on the Monitoring (MnT) services?
In a distributed deployment, the secondary node continues to collect and process logs.
Why this answer
MnT services are independent of the PAN role; if the Primary MnT fails, the Secondary MnT assumes the role, but PAN failure does not automatically crash MnT unless they share the same physical node.
You are configuring a BYOD flow for iOS devices and notice that the native supplicant provisioning process is failing during the installation of the mobile configuration profile. Where should you check the logs in ISE to determine if the issue is related to the SCEP proxy communication?
The SCEP debug logs are the primary location for troubleshooting certificate issuance issues during the BYOD flow.
Why this answer
The SCEP proxy logs are specifically located under the 'SCEP' category within the Operations > Troubleshooting > Debug Wizard or by monitoring the 'scep.log' file.
How can you verify that ISE is receiving TACACS+ requests from a specific switch?
Livelogs provide real-time visibility.
Why this answer
Monitoring the TACACS Livelogs will show the live requests as they arrive at the ISE nodes.
Which of the following is a posture requirement setting that defines how often the agent performs a re-scan?
This setting defines the frequency of posture re-assessment.
Why this answer
The 'Periodic Scanning' setting in the posture policy defines the interval for re-scanning.
What is the purpose of the 'PAN' role in a deployment?
PAN manages all policies and configuration.
Why this answer
The Policy Administration Node (PAN) provides the centralized management interface for all policy definitions and deployment configuration.
Which TWO of the following authentication protocols are supported by ISE for 802.1X?
EAP-TLS is the preferred method for certificate-based auth.
Why this answer
PEAP and EAP-TLS are the most common protocols used with ISE.
You are integrating an MDM server with ISE for BYOD. The requirement is that ISE must check the compliance status of the device before granting full network access. Which feature must be enabled in the MDM configuration within ISE?
This setting allows ISE to query the MDM for the compliance status of the registered device.
Why this answer
The 'Device Compliance' checkbox must be enabled in the MDM server configuration to trigger the API calls for status checks.
Which THREE of the following are required to successfully implement SXP (SGT Exchange Protocol)?
The mapping provides the data that SXP propagates.
Why this answer
SXP requires the connection between the speaker/listener, the CTS feature enabled, and SGT-to-IP mapping.
You need to create a custom profiling condition to identify printers based on their MAC OUI. Which menu path should you use to define this condition?
This is the correct path for creating, editing, and managing custom conditions.
Why this answer
Custom conditions are managed within the Policy > Profiling > Profiling Conditions section.
You are configuring a policy to allow 'Read-Only' access for junior admins. You have created a Command Set that allows 'show' commands. What else is required to implement 'Read-Only' access correctly?
This combines the restriction level with the allowed commands.
Why this answer
A Shell Profile with a low privilege level (e.g., 1) is required in conjunction with a command set that restricts commands to 'show' only.
When decommissioning an ISE node, what is the correct order of steps?
Removing from deployment ensures a clean deregistration.
Why this answer
You must first remove the node from the deployment list in the Primary PAN, then you can safely wipe/decommission the physical/virtual appliance.
During BYOD onboarding, the client is unable to download the Network Setup Assistant (NSA). You verify the portal settings and observe that the 'Client Provisioning' resource is correctly assigned to the policy. What is the most likely cause if the device fails to reach the download page?
If the ACL blocks the traffic, the client cannot communicate with the ISE provisioning service.
Why this answer
The redirect ACL must permit traffic to the Cisco ISE server on ports 8443 or 8905 to ensure the client can reach the provisioning services.
You are creating a File Requirement for posture assessment. What is the required behavior if you want to confirm that a specific file exists on the client machine?
The 'Exists' check is the standard method for verifying file presence as a compliance condition.
Why this answer
In a File Requirement, setting the condition to 'Exists' allows the agent to verify the presence of a specific file path on the local drive.
What is the function of the 'PassiveID' feature in a distributed ISE deployment?
PassiveID listens to sources like WMI or Syslog for identity mapping.
Why this answer
PassiveID allows ISE to collect user-to-IP mapping information from external sources without active polling, which is critical for identity-based access control.
Which type of guest account is best suited for a visitor who needs access for exactly one business day and should have their account automatically deleted thereafter?
This provides the specific time-bound access requested.
Why this answer
An 'Expiring' account is designed to be time-bound, and ISE automatically removes it upon expiration based on the defined policies.
What is the purpose of the 'Guest Type' configuration in Cisco ISE?
Guest Types allow you to set policies for how long an account lasts and what access the guest is granted.
Why this answer
Guest types define the lifecycle of a guest account, including time-to-live, max devices, and session duration.
When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?
This ensures the version is 10.5.0 or higher.
Why this answer
The 'Greater Than or Equal' operator is necessary to ensure the version meets or exceeds the security requirement.
Which THREE of the following are characteristics of the TACACS+ protocol? (Choose three)
Standard port for TACACS+.
When setting up a self-registration portal, you want to require that the guest's email address is validated before granting access. Which feature should you enable?
This setting enables the email verification workflow.
Why this answer
Email verification requires the user to click a link sent to their email to activate the account. This is configured in the self-registration portal settings.
Which protocol is used by ISE to communicate with the MDM server for device status checks?
REST API is the standard mechanism for ISE to interact with external MDM platforms.
Why this answer
ISE uses REST APIs to communicate with most modern MDM solutions like AirWatch or Intune.
You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?
The Web Redirection settings must be configured to point to the specific portal, which triggers the WLC to send a redirect URL to the client.
Why this answer
For CWA, the authorization profile must include a dACL or a filter-ID, and the Web Redirection component must be enabled with the specific Client Provisioning or Guest portal selected as the target.
What is the benefit of using multiple TACACS+ Policy Sets?
This allows for cleaner and more specific policy management.
Why this answer
Policy Sets allow for granular control and different rules for different types of devices or users.
You are configuring a custom profiling policy and notice that the 'Certainty Factor' is too low for the device to be assigned to the correct group. What is the purpose of the Certainty Factor in ISE?
It represents the cumulative score of matching profile conditions.
Why this answer
The Certainty Factor is a numerical value that increases as more matching conditions are met, ensuring a higher confidence in the device identity.
When configuring an SNMP Query probe, why is it recommended to use SNMPv3 instead of SNMPv1/v2c?
Security is the primary advantage.
Why this answer
SNMPv3 provides authentication and encryption, which are essential for security in enterprise networks.
What is the function of the 'RADIUS Accounting' probe in the profiling process?
RADIUS accounting provides valuable session data.
Why this answer
It collects session information from the RADIUS traffic, providing start/stop and attribute data useful for device identification.
Which THREE of the following items are required for the EAP-TLS authentication process to succeed?
The client must present its certificate to the server.
Why this answer
EAP-TLS requires the client to have a certificate, the server to have a certificate, and both to trust the CA chain.
Which component of the Cisco ISE Profiling architecture is responsible for comparing collected attributes against defined profiling policies?
The Profiler service on the PSN is responsible for the policy matching logic.
Why this answer
The Profiler service on the PSN acts as the policy engine that matches attributes to policies.
You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?
The authorization policy rule conditions allow you to match the request against the Internal Endpoint Group attribute.
Why this answer
The authorization policy within a policy set is where you define the conditions and the corresponding permissions based on attributes like the Internal Endpoint Group.
An administrator needs to ensure that only devices enrolled in their corporate MDM (AirWatch) can gain full network access. How should the ISE authorization policy be configured to verify MDM compliance for a BYOD endpoint?
These attributes allow ISE to evaluate the compliance status reported by the integrated MDM server.
Why this answer
The 'MDM Compliance' attribute is returned by the MDM server to ISE during the authorization process, which can then be checked in the authorization policy condition.
When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?
This field shows the specific rule within the policy set that was applied.
Why this answer
The 'Authorization Policy' column in the Live Logs displays the name of the rule that was triggered for a specific session.
A user is authenticated, but their authorization profile returns the wrong VLAN. Which troubleshooting tool in ISE is best suited to verify the attributes sent to the NAD?
The Live Logs provide a detailed breakdown of the RADIUS attributes returned to the NAD.
Why this answer
The 'Live Logs' detail view shows the RADIUS attributes returned to the NAD for every session.
What does the 'Fallthrough' option in an ISE Policy Set rule do?
Fallthrough enables evaluation of subsequent rules even if a match occurs.
Why this answer
Fallthrough allows the request to continue being evaluated against subsequent rules in the policy set if the current rule matches.
What is the primary benefit of using native supplicant provisioning in ISE?
Using the native supplicant prevents the need for additional, resource-heavy third-party agents.
Why this answer
Native supplicant provisioning simplifies user experience by automatically configuring WiFi settings without requiring third-party software.
If a user is authenticated via TACACS+ but no authorization policy matches, what is the default behavior?
Default behavior is to deny access.
Why this answer
The default ISE policy behavior for TACACS+ is to reject authorization if no rules match.
You need to profile IoT devices that only support mDNS. Which probe should you enable?
mDNS probe specifically handles service discovery traffic.
Why this answer
The mDNS probe allows ISE to listen for Bonjour/mDNS service advertisements, which is critical for IoT discovery.
Which TWO methods can be used to verify that a TACACS+ request from a network device is reaching the Cisco ISE PSN?
Live logs provide real-time visibility into incoming requests.
Why this answer
You can verify traffic using the Live Logs in the Operations menu or by performing a TCP dump on the PSN.
Which RADIUS attribute is commonly used to inform the Network Access Server (NAS) that a re-authentication is required after a successful BYOD provisioning?
This tells the switch to re-authenticate the user once the BYOD portal session is closed.
Why this answer
The 'Cisco-AV-Pair' containing 'url-redirect' is used initially, but 'Termination-Action: RADIUS-Request' is often used to force a re-authentication after the BYOD process.
Which TWO of the following are prerequisites for the AnyConnect posture agent to function?
Agent must talk to PSN.
Why this answer
The agent needs to reach the PSN and be supported by the endpoint OS.
You are troubleshooting a certificate provisioning failure where the error is 'Internal CA Error'. What is the most likely cause?
If ISE is meant to act as a CA, it must be properly tiered and trusted.
Why this answer
The most common cause for an Internal CA error is that the ISE node lacks the necessary permissions or the CA is misconfigured as a root/subordinate.
Practice SISE by domain
Target a specific domain to shore up weak areas.