Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) SISE Questions 151–225 | Page 3/4

151

Multi-Selectmedium

Which TWO of the following are valid ways to provide access to a guest user?

Select 2 answers

A.Bypassing login via a Hotspot portal.

B.Authentication via the Guest Portal using username/password.

C.Connecting via VPN tunnel only.

D.Using a static IP assigned by the administrator.

E.Authenticating via the CLI on the NAD.

AnswersA, B

A Hotspot portal grants network access without authenticating the guest against an identity provider, so no credentials are validated. This satisfies the stem's requirement for a valid guest access method by using a sponsored or self-registered portal that authorises the device, rather than requiring a Microsoft Entra ID account.

Why this answer

Option A is correct because a Hotspot portal is a standard Cisco ISE guest-access method that lets visitors self-register or click through a web page and be granted network access without requiring pre-created credentials, effectively bypassing a traditional login. Option B is correct because the Guest Portal (Sponsored or Self-Registered guest flow) authenticates guest users with a username and password stored in the ISE internal guest identity store, which is the canonical way to provide credentialed guest access. Option C is not a valid guest-access method here because a VPN tunnel is a remote-access technology, not a guest onboarding/authentication mechanism in this context.

Option D is not correct because assigning a static IP only provides addressing, not authentication or authorization for a guest. Option E is not correct because authenticating via the CLI on the NAD is an administrative/device-management action, not a supported way to grant a guest user network access.

Exam trap

SISE often tests the distinction between authentication methods and access provisioning, causing candidates to confuse network configuration (like static IP or VPN) with guest access mechanisms.

Full explanation →

152

MCQhard

A network engineer is deploying TACACS+ device administration with Cisco ISE for a large number of Cisco IOS routers. The engineer wants to centralize the authorization of commands so that users in different groups have different command privileges. The engineer has already configured authentication and authorization policy sets in ISE. Which additional configuration is required on the Cisco IOS routers to ensure that command authorization is enforced by ISE?

A.Configure 'aaa accounting commands 15 default start-stop group tacacs+' on each router.

B.Configure 'aaa authorization exec default group tacacs+ if-authenticated' on each router.

C.Configure 'tacacs-server directed-request' on each router.

D.Configure 'aaa authorization commands 15 default group tacacs+ if-authenticated' on each router.

AnswerD

This command enables command authorization for privilege level 15 commands, sending authorization requests to TACACS+ servers. The 'if-authenticated' keyword allows the command if the user has been authenticated, even if the TACACS+ server is unreachable, providing a fallback. Without this command, command authorization is not enforced, and users may execute commands based on their privilege level alone.

Why this answer

To enforce command authorization via TACACS+, the router must be configured with an AAA authorization method list for commands. The command 'aaa authorization commands 15 default group tacacs+ if-authenticated' sends authorization requests for privilege level 15 commands to ISE. The 'if-authenticated' fallback ensures that if the TACACS+ server is unreachable, commands are still allowed for authenticated users.

Without this, command authorization is not performed, and users can execute any command permitted by their privilege level.

Exam trap

The trap here is confusing EXEC authorization with command authorization; EXEC authorization only controls session establishment and privilege level assignment, not per-command enforcement.

Full explanation →

153

MCQeasy

A network engineer is configuring a Cisco router to use TACACS+ for device administration with Cisco ISE. The engineer wants to ensure that if the TACACS+ server is unreachable, the router falls back to local authentication. Which command should be configured on the router?

A.aaa authentication login default group tacacs+ local

B.aaa authentication login default local group tacacs+

C.aaa authentication login default group tacacs+ none

D.aaa authentication login default group tacacs+ enable

AnswerA

This command configures the router to use TACACS+ first and then fall back to the local user database if the TACACS+ servers are unreachable. The 'local' keyword at the end ensures that local authentication is attempted only if the TACACS+ method fails or times out. This provides a failover mechanism.

Why this answer

The correct command is 'aaa authentication login default group tacacs+ local', which attempts TACACS+ authentication first and falls back to the local user database if TACACS+ is unavailable. The order of methods is critical: TACACS+ before local. Using 'none' would disable authentication, 'local' first would bypass TACACS+, and 'enable' would use the enable password instead of local users.

Exam trap

The trap here is reversing the order of authentication methods, such as putting 'local' before 'tacacs+', which would not provide the desired fallback behavior.

Full explanation →

154

Multi-Selecteasy

Which TWO of the following are true about Monitor Mode?

Select 2 answers

A.It requires user intervention

B.It logs posture results for analysis

C.It blocks traffic for non-compliant devices

D.It automatically fixes compliance issues

E.It allows network access for non-compliant endpoints

AnswersB, E

Monitor Mode evaluates endpoints against posture conditions but only records the outcome, writing compliance and non-compliance results to ISE reports. This satisfies the scenario's need for visibility without enforcement, letting administrators analyse posture data before enabling closed-mode blocking.

Why this answer

Option B is correct because Monitor Mode in posture assessment (e.g., Cisco ISE or similar NAC solutions) records and logs the posture results of endpoints without enforcing any action, allowing administrators to analyze compliance data before enabling enforcement. Option E is correct because, in Monitor Mode, non-compliant endpoints are still granted network access since no enforcement policy is applied; the mode is purely observational. Option A is incorrect because Monitor Mode operates automatically once configured, requiring no per-session user intervention.

Option C is incorrect because blocking traffic for non-compliant devices is characteristic of Enforcement Mode, not Monitor Mode. Option D is incorrect because automatically fixing compliance issues (remediation) is a separate function, often part of remediation or enforcement workflows, not Monitor Mode itself.

Exam trap

The trap is confusing Monitor Mode with Enforcement Mode; candidates often think Monitor Mode blocks non-compliant devices, but it only logs and allows.

Full explanation →

155

Multi-Selectmedium

Which TWO of the following are valid ways to restrict access based on posture status in ISE?

Select 2 answers

A.Change the Identity Source Sequence

B.Create an Authorization Policy rule using Posture status

C.Assign a dACL that denies traffic if non-compliant

D.Use a Shell Profile

E.Create an Authentication Policy rule using Posture status

AnswersB, C

An authorization policy rule can evaluate the posture condition directly, so non-compliant endpoints match a rule that returns a restricted result. This enforces posture-based access at the policy decision point, satisfying the stem's requirement to restrict access according to posture status.

Why this answer

Option B is correct because ISE enforces posture-based access decisions in the Authorization Policy: you create an authorization rule whose conditions include the posture status attribute (e.g., PostureStatus = Compliant or NonCompliant), so endpoints are granted different authorizations depending on their posture result. Option C is correct because a downloadable ACL (dACL) applied in the authorization result can restrict traffic for non-compliant endpoints, for example by denying most traffic while permitting remediation or quarantine access, which is a valid way to enforce posture-based access restriction. Option A is not correct because the Identity Source Sequence only determines which identity stores are queried during authentication and has nothing to do with posture status.

Option D is not correct because a Shell Profile defines CLI/session attributes for TACACS+ device administration, not posture-based network access control. Option E is not correct because the Authentication Policy runs before posture assessment and evaluates identity/authentication conditions, not posture status, which is only known after posture evaluation and is used in the Authorization Policy.

Exam trap

SISE often tests the distinction between authentication and authorization policies, and candidates may incorrectly assume posture status can be used in an Authentication Policy rule or confuse identity source sequences with posture enforcement.

Full explanation →

156

MCQhard

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

A.Verify the dACL configuration

B.Verify the RADIUS shared secret

C.Verify the EAP protocol version

D.Verify SXP connection status and configuration on both peers

AnswerD

SXP is the protocol that carries SGT mappings to non-Cisco or legacy peers, so if tags are not propagating, the SXP session itself is the fault domain. Checking connection status and configuration on both peers confirms whether the session is up and correctly bound.

Why this answer

SXP (SGT Exchange Protocol) propagates SGTs between devices that cannot natively carry them (e.g., non-Cisco or older switches). If an SGT is not being embedded in SXP, the first thing to verify is the SXP connection status and configuration on both peers — the connection must be established and the correct SGTs permitted. This is the direct troubleshooting step for SXP propagation failures.

Exam trap

SISE often tests the confusion between SGT propagation mechanisms (SXP, inline tagging) and enforcement mechanisms (dACL, SGACL); candidates pick dACL or RADIUS options that are unrelated to SXP propagation.

How to eliminate wrong answers

Option A is wrong because dACL configuration affects enforcement of SGT-based policy, not the SXP propagation of SGTs itself. Option B is wrong because the RADIUS shared secret is used for authentication between the NAD and ISE, not for SXP peer communication. Option C is wrong because the EAP protocol version relates to 802.1X authentication, not SXP SGT propagation.

Full explanation →

157

MCQeasy

What is the purpose of an Authorization Profile's 'Common Tasks'?

A.To group devices together

B.To configure standard RADIUS attributes easily

C.To define user permissions for ISE UI

D.To store identity sources

AnswerB

Common Tasks provides predefined shortcuts that populate standard RADIUS attributes, such as VLAN or ACL assignments, into the authorization profile without manual entry. This simplifies and standardises attribute configuration, ensuring consistent access policy enforcement during authentication.

Why this answer

The 'Common Tasks' section within an Authorization Profile in Cisco ISE provides a simplified interface for configuring frequently used RADIUS attributes, such as VLAN assignment, dACL, and reauthentication timers. These tasks map to standard RADIUS attributes (e.g., Tunnel-Type, Tunnel-Private-Group-ID, Cisco-AVPair) without requiring manual attribute entry. This streamlines policy creation for common network access scenarios.

Exam trap

SISE often tests the confusion between Authorization Profiles and other ISE components like Network Device Groups or Admin RBAC roles, leading candidates to incorrectly associate 'Common Tasks' with device grouping or UI permissions.

How to eliminate wrong answers

Option A is wrong because grouping devices is done through Network Device Groups (NDGs) or endpoint identity groups, not Authorization Profiles. Option C is wrong because user permissions for ISE UI are defined by RBAC policies and admin roles, not Authorization Profiles. Option D is wrong because identity sources are configured separately (e.g., Active Directory, LDAP) and referenced in authentication policies, not stored in Authorization Profiles.

Full explanation →

158

MCQeasy

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

A.Policy > Policy Sets > [Set Name] > Authorization Policy

B.Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings

C.Operations > Troubleshoot > BYOD Settings

D.Administration > Device Portal Management

AnswerB

The BYOD checkbox lives under the specific portal's own settings, reached via Work Centers > Guest Access > Portals & Components, then the named portal, then Portal Settings. This path satisfies the stem's requirement to enable BYOD for one specific registration portal rather than globally.

Why this answer

The BYOD checkbox for a specific device registration portal is enabled under Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. This is where the portal configuration includes the option to enable BYOD device registration. The path is specific to the Guest Access work center in ISE.

Exam trap

SISE often tests whether candidates know the exact menu path for portal settings, confusing it with policy sets or administration menus, when the correct location is under Work Centers > Guest Access > Portals & Components.

How to eliminate wrong answers

Option A is wrong because Policy > Policy Sets > Authorization Policy is where authorization rules are defined, not where portal BYOD settings are configured. Option C is wrong because Operations > Troubleshoot > BYOD Settings is not a valid menu path for enabling BYOD on a portal; troubleshooting is for diagnostics. Option D is wrong because Administration > Device Portal Management is not the correct path in current ISE versions; the portal settings are under Work Centers > Guest Access.

Full explanation →

159

MCQmedium

You have created a custom profiler condition that is not matching endpoints correctly. Where should you check the live authentication and profiling logs to verify if the attribute is being received by ISE?

A.Administration > System > Logging

B.Operations > RADIUS Livelogs

C.Policy > Profiling > Profiling Policies

D.Context Visibility > Endpoints

AnswerB

RADIUS Livelogs capture live authentication and authorisation exchanges, showing the actual attributes received from the network access device. Inspecting them confirms whether the profiler condition's attribute arrives and with what value, exposing mismatches that prevent correct endpoint matching.

Why this answer

RADIUS Livelogs under Operations is the real-time troubleshooting view in ISE that shows authentication and authorization requests as they arrive, including the RADIUS attributes (Cisco AV pairs, Calling-Station-ID, etc.) that the NAD sends. When a custom profiler condition fails to match, you need to confirm whether the attribute the condition depends on is actually being received from the network device. RADIUS Livelogs displays the raw attribute payload of each Access-Request, so you can verify attribute presence, spelling, and value before blaming the profiling policy.

Exam trap

SISE often tests the distinction between where you configure a feature (policy, settings) versus where you observe live protocol data — candidates pick the policy page when the question is really asking for the real-time troubleshooting tool.

How to eliminate wrong answers

Option A is wrong because Administration > System > Logging only configures logging targets, severity levels, and local log settings — it does not display live authentication or attribute data. Option C is wrong because Policy > Profiling > Profiling Policies is where you define the conditions and rules themselves, not where you observe whether attributes are arriving from the NAD. Option D is wrong because Context Visibility > Endpoints shows the resulting endpoint inventory and profile assignments after processing, not the raw incoming RADIUS attributes needed to debug a non-matching condition.

Full explanation →

160

MCQeasy

A security team is deploying Cisco ISE BYOD for employee devices. They want to ensure that only devices that have completed the BYOD onboarding process and possess a valid certificate are allowed on the corporate SSID. Which ISE policy element should they configure to enforce this requirement?

A.An authorization policy that permits access only when the endpoint presents a valid certificate and is registered in the BYOD identity group.

B.A guest portal configuration that requires users to register their devices before accessing the network.

C.A client provisioning policy that matches the corporate SSID and requires certificate enrollment.

D.A posture policy that checks for the presence of the BYOD certificate on the endpoint.

AnswerA

The authorization policy is where ISE decides whether to grant, deny, or restrict network access. By requiring a valid certificate and membership in the BYOD identity group, the policy ensures that only devices that completed onboarding and hold a certificate are allowed on the corporate SSID. This directly enforces the stated requirement.

Why this answer

Authorization policies in Cisco ISE determine the level of network access granted to an endpoint. To allow only devices that have completed BYOD onboarding and possess a valid certificate, the policy must evaluate certificate validity and BYOD registration status. This is the correct enforcement point, as client provisioning and posture serve different roles in the BYOD lifecycle.

Exam trap

The trap here is assuming that client provisioning or posture policies enforce ongoing access control, when authorization is the policy set that grants or denies network access.

Full explanation →

161

Multi-Selecteasy

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

Select 2 answers

A.Policy distribution

B.Reporting and analytics

C.RADIUS authentication

D.Log aggregation from all nodes

E.Endpoint profiling probe

AnswersB, D

Reporting and analytics is a core Monitoring and Troubleshooting function, letting the persona aggregate and visualise authentication, authorisation and posture data across the deployment. This satisfies the stem's requirement for an MnT duty, distinct from configuration or policy-definition tasks owned by other personas.

Why this answer

The Monitoring and Troubleshooting (MnT) persona in Cisco ISE is responsible for collecting and storing operational data, so option B (Reporting and analytics) is correct because MnT nodes host the reporting and analytics services that let administrators run operational reports, live logs, and dashboards on authentication, authorization, and accounting events. Option D (Log aggregation from all nodes) is also correct because all Policy Services Nodes (PSNs) and other ISE nodes forward their syslog and session data to the MnT node, which aggregates and stores it in the MnT database for troubleshooting and audit purposes. Option A (Policy distribution) is not an MnT function; policy configuration and distribution are handled by the Policy Administration Node (PAN), which pushes policies to PSNs.

Option C (RADIUS authentication) is performed by Policy Services Nodes, which handle RADIUS and TACACS+ authentication, authorization, and accounting, not the MnT persona. Option E (Endpoint profiling probe) is a function of the PSN, where profiling probes (e.g., RADIUS, SNMP, DHCP, NetFlow) collect endpoint attributes, not the MnT node.

Exam trap

SISE often tests persona responsibilities, and candidates confuse MnT functions (reporting, log aggregation) with PAN functions (policy distribution) or PSN functions (RADIUS authentication, profiling), leading to incorrect selections.

Full explanation →

162

MCQhard

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

A.The FQDN of the Load Balancer VIP

B.The local gateway address

C.The IP address of the ISE Admin Node

D.A single static IP of the Primary PSN

AnswerA

Pointing the posture agent at the load balancer's FQDN lets it resolve to the VIP, which distributes assessment traffic across available PSNs. This satisfies the high-availability constraint, since a single PSN address would fail if that node became unavailable.

Why this answer

The posture agent should point to the FQDN of the Load Balancer VIP to ensure it always reaches a PSN for assessment. In a high-availability environment, using a load balancer VIP provides a single, resilient endpoint that distributes requests across multiple PSNs. This avoids single points of failure and ensures that if one PSN goes down, the agent can still reach another PSN via the VIP.

Exam trap

SISE often tests the confusion between using a load balancer VIP and a specific PSN IP. Candidates may choose a static PSN IP for simplicity, but that defeats high availability.

How to eliminate wrong answers

Option B is wrong because the local gateway address is not a PSN and does not provide posture assessment services. Option C is wrong because the ISE Admin Node (PAN) is not used for posture assessment; PSNs handle posture. Option D is wrong because a single static IP of the Primary PSN does not provide high availability; if that PSN fails, the agent cannot reach another PSN.

Full explanation →

163

MCQmedium

You are troubleshooting an issue where IP phones are not being profiled. The SNMP read community string on the switch does not match the one configured in ISE. What is the expected behavior?

A.The endpoint will be profiled based on the MAC OUI only.

B.The SNMP trap probe will still work.

C.The SNMP Query probe will fail to collect CDP/LLDP data from the switch.

D.ISE will automatically update the community string on the switch.

AnswerC

The SNMP Query probe authenticates to the switch using the configured read community string. A mismatch causes the switch to reject the request, so the probe cannot retrieve CDP or LLDP neighbour data and profiling fails.

Why this answer

The SNMP Query probe in ISE polls the switch via SNMP to retrieve CDP/LLDP neighbor data for profiling. If the SNMP read community string configured in ISE does not match the switch, the SNMP query fails and ISE cannot collect that CDP/LLDP data, so profiling is degraded or fails. This is the expected behavior described in option C.

Exam trap

SISE often tests the distinction between SNMP Query and SNMP Trap probes; candidates assume a community string mismatch affects traps, but traps are outbound from the switch and do not depend on ISE's read community string.

How to eliminate wrong answers

Option A is wrong because MAC OUI alone provides only vendor-level profiling, not the rich CDP/LLDP data the SNMP Query probe is meant to collect — and the question asks about the expected behavior of the mismatch, which is query failure. Option B is wrong because SNMP traps are a separate mechanism (SNMP Trap probe) and are not affected by the read community string mismatch in the same way; the question specifically concerns the SNMP Query probe. Option D is wrong because ISE never automatically updates the switch's SNMP community string — that is a manual network device configuration.

Full explanation →

164

MCQmedium

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

A.The Cisco ISE Policy Service Node (PSN)

B.The Network Access Device (NAD)

C.The endpoint's default browser

D.The Guest Portal application

AnswerB

The Network Access Device intercepts the guest's initial HTTP request and issues the redirect to the Cisco ISE CWA portal. Redirection happens at the NAD, not the client or policy server, because the NAD controls the traffic path before authorisation completes.

Why this answer

The Network Access Device (NAD) is responsible for redirecting the guest user's browser in a Central Web Authentication (CWA) flow. When the endpoint connects, the NAD (e.g., a wireless controller or switch) intercepts the HTTP traffic and redirects the user to the ISE guest portal for authentication.

Exam trap

The trap is thinking that ISE (PSN or portal) performs the redirection. While ISE provides the redirect URL, the actual HTTP redirect is enforced by the NAD. Candidates might confuse the role of the PSN in policy decision with the enforcement point.

How to eliminate wrong answers

Option A is wrong because the Policy Service Node (PSN) makes policy decisions and provides the redirect URL, but it does not perform the actual redirection; the NAD enforces the redirect. Option C is wrong because the endpoint's default browser is the user agent that receives the redirect, but it does not initiate the redirection; it simply follows the HTTP redirect sent by the NAD. Option D is wrong because the Guest Portal application is hosted on ISE and presents the login page, but it does not redirect the browser; the NAD redirects the browser to the portal.

Full explanation →

165

MCQeasy

Which of the following is NOT a valid probe type in Cisco ISE?

A.SNMP Query

B.ICMP

C.DHCP

D.RADIUS

AnswerB

Cisco ISE supports RADIUS, TACACS+, and REST probes for testing external identity or policy services. ICMP is a network-layer reachability protocol, not an application probe type, so it cannot be configured as a probe in ISE.

Why this answer

Cisco ISE supports several active probe types for endpoint profiling: DHCP, RADIUS, SNMP Query, SNMP Trap, NetFlow, DNS, HTTP, and NMAP, among others. ICMP is not one of the configurable probe types in ISE's profiling configuration — while ISE may send pings internally for reachability, ICMP is not exposed as a profiling probe. Therefore ICMP is the option that is NOT a valid probe type.

Exam trap

The trap here is confusing general network diagnostic protocols (like ICMP/ping) with ISE's specific profiling probe types — candidates assume any protocol ISE 'uses' must be a probe.

How to eliminate wrong answers

Option A is wrong because SNMP Query is a legitimate ISE probe that polls network devices for ARP, MAC, and CDP/LLDP tables. Option C is wrong because the DHCP probe is one of the most commonly used ISE probes, capturing DHCP fingerprint data via SPAN or the NAD. Option D is wrong because the RADIUS probe collects attributes from RADIUS accounting and authentication packets to help profile endpoints.

Full explanation →

166

MCQeasy

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

A.To gather compliance data without restricting network access

B.To automatically remediate endpoints

C.To bypass the posture check entirely

D.To block all traffic until the agent is installed

AnswerA

Monitor Mode collects endpoint compliance data while leaving network access unrestricted, satisfying the stem's requirement for visibility without enforcement. Unlike enforcement mode, which applies remediation or restricts access based on posture results, Monitor Mode only audits and reports, letting administrators assess posture compliance before rolling out enforcement.

Why this answer

In Cisco ISE Posture policies, Monitor Mode is used to assess endpoint compliance without restricting network access. The endpoint is allowed on the network, but posture data is collected and logged. This allows administrators to see compliance status without impacting users, making option A correct.

Exam trap

The trap is assuming Monitor Mode means no posture check occurs, when it actually performs the check but does not enforce the result.

How to eliminate wrong answers

Option B is wrong because automatic remediation is not performed in Monitor Mode; remediation requires enforcement. Option C is wrong because Monitor Mode does not bypass the posture check; it still performs the check but does not enforce. Option D is wrong because blocking all traffic is enforcement, not monitoring.

Full explanation →

167

Multi-Selecthard

Which THREE features are configured at the node level in the ISE Administration console?

Select 3 answers

A.Global policy rules

B.Logging categories

C.External ID store configuration

D.Profiling probes

E.Network interface settings

AnswersB, D, E

Logging categories are configured per node under Administration > System > Logging, letting each ISE node emit its own debug or audit levels independently. This satisfies the stem's node-level constraint, since logging settings apply to the individual appliance rather than globally across the deployment.

Why this answer

In the Cisco ISE Administration console, node-level configuration is scoped to a specific ISE node rather than the whole deployment. Logging categories (B) are configured per node under Administration > System > Logging > Logging Categories, allowing each node's logging levels and targets to be tuned independently. Profiling probes (D) are enabled and configured per node under Administration > System > Profiling Configuration, since probes such as SNMP, RADIUS, DHCP, and NetFlow run on individual PSNs.

Network interface settings (E) are also node-specific, configured under Administration > System > Settings > Network Interfaces, because each node has its own NIC, IP address, and VLAN configuration. Global policy rules (A) and external ID store configuration (C) are deployment-wide settings managed at the system level, not per node, so they are not correct answers.

Exam trap

SISE often tests the distinction between node-level and deployment-level configuration, and candidates frequently confuse global policy rules or external ID stores as node-specific when they are actually deployment-wide.

Full explanation →

168

MCQeasy

Where do you upload the AnyConnect posture agent packages to make them available for Client Provisioning?

A.Operations > Troubleshoot > Client Provisioning

B.Policy > Policy Elements > Results > Client Provisioning > Resources

C.Policy > Posture > Policy

D.Administration > System > Settings > Posture

AnswerB

AnyConnect posture agent packages are uploaded as Client Provisioning resources under Policy > Policy Elements > Results > Client Provisioning > Resources. From there they are referenced by client provisioning policies and pushed to endpoints during onboarding.

Why this answer

AnyConnect posture agent packages are uploaded in ISE under Policy > Policy Elements > Results > Client Provisioning > Resources. This is where administrators add agent resources (such as AnyConnect .pkg or .msi files) and compliance modules, which are then referenced by Client Provisioning policies to be pushed to endpoints.

Exam trap

SISE often tests the exact navigation path for uploading resources — candidates confuse the Client Provisioning Resources page with Posture Policy or global Posture Settings, leading to wrong menu selections.

How to eliminate wrong answers

Option A is wrong because Operations > Troubleshoot > Client Provisioning is for troubleshooting and diagnostics of provisioning events, not for uploading resources. Option C is wrong because Policy > Posture > Policy defines posture conditions and requirements, not the agent packages themselves. Option D is wrong because Administration > System > Settings > Posture contains global posture settings (like posture general settings and remediation), not the resource repository for agent packages.

Full explanation →

169

MCQeasy

A network administrator is configuring posture remediation for Windows endpoints that fail a check for Windows Defender real-time protection. The administrator wants to provide users with a link to enable real-time protection manually. Which remediation type should be configured in the posture policy to achieve this?

A.Application

B.File

C.Link

D.Script

AnswerC

A Link remediation action provides a clickable URL that users can follow to perform a manual remediation step, such as enabling Windows Defender real-time protection. This is ideal when the remediation cannot be automated or when the administrator wants to guide users to a specific resource. It does not require scripting or file distribution.

Why this answer

The Link remediation type is designed to present users with a URL they can click to access instructions or a resource for manual remediation. In this scenario, the administrator wants users to manually enable real-time protection, so providing a link to a help page or a direct setting is the correct approach. It is the simplest and most direct method for guiding users.

Exam trap

The trap here is confusing remediation types that automate actions (Script, File, Application) with those that guide users (Link), when the requirement is for manual user action.

Full explanation →

170

MCQmedium

When a new device connects, you notice it stays in the 'Unknown' profile state. You have confirmed the probes are active. What is the most likely step to fix this?

A.Increase the SNMP timeout.

B.Disable and re-enable the PSN service.

C.Create or update a Profiling Policy to match the collected attributes.

D.Delete the endpoint from the database.

AnswerC

Probes collect endpoint attributes, but Cisco ISE only assigns a profile when a profiling policy matches those attributes. With probes active yet devices stuck at Unknown, the missing or outdated profiling policy is the gap preventing attribute-based classification.

Why this answer

If a device remains in the 'Unknown' profile state despite active probes, it means ISE is collecting attributes but no profiling policy matches those attributes to assign a known profile. Creating or updating a profiling policy to match the collected attributes will allow ISE to classify the device correctly. The other options do not address the root cause: SNMP timeout, PSN service restart, or deleting the endpoint are not relevant to policy matching.

Exam trap

The trap is assuming that active probes automatically lead to profiling. Candidates might overlook that profiling policies must explicitly match the collected attributes. They might also be tempted to troubleshoot probes or services instead of policy configuration.

How to eliminate wrong answers

Option A is wrong because increasing SNMP timeout would only help if SNMP data is not being collected, but the question states probes are active, implying data is collected. Option B is wrong because disabling and re-enabling the PSN service is a drastic step that would affect all endpoints and is unlikely to resolve a single device's profiling issue. Option D is wrong because deleting the endpoint from the database would remove it and force re-profiling, but without a matching policy, it would still remain Unknown.

Full explanation →

171

MCQmedium

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

A.Post-Posture Authorization Rule

B.Client Provisioning Policy

C.File Remediation Action

D.Posture Requirement

AnswerC

A File Remediation Action specifies the download link and instructions presented to the user when a posture check fails, satisfying the requirement to supply compliance software. Other remediation types, such as Windows or Antivirus actions, trigger local updates rather than offering a downloadable installer.

Why this answer

A File Remediation Action in Cisco ISE is specifically designed to provide users with a downloadable link or instructions to obtain the required compliance software when a posture check fails. It is the remediation component that bridges the gap between a failed posture condition and the user's ability to fix it.

Exam trap

The trap is confusing the posture requirement (the condition to check) with the remediation action (the fix provided) — candidates often pick 'Posture Requirement' when the question asks about delivering software to the user.

How to eliminate wrong answers

Option A is wrong because a Post-Posture Authorization Rule determines what access a user gets after posture evaluation, not how to deliver remediation software. Option B is wrong because a Client Provisioning Policy controls which posture agent or supplicant is installed on the endpoint, not the remediation link for failed compliance. Option D is wrong because a Posture Requirement defines the condition that must be met (e.g., antivirus enabled), not the remediation action taken when it fails.

Full explanation →

172

MCQmedium

If a user is assigned a Shell Profile with a specific 'Auto-Command' configured, what happens when they log into the network device?

A.The user is immediately disconnected

B.The user is prompted to run the command manually

C.The command is executed on the device upon login

D.The shell profile is ignored

AnswerC

The Shell Profile's Auto-Command runs automatically once authentication succeeds, satisfying the requirement that a predefined command execute at login. Cisco ISE pushes this attribute to the network device during authorisation, so the device executes it immediately without user input, which is precisely the behaviour the scenario describes.

Why this answer

When a user is assigned a Shell Profile with an 'Auto-Command' configured in Cisco ISE, that command is automatically executed on the network device immediately after the user successfully logs in via TACACS+. This is often used to restrict users to a specific menu or command, enhancing security and simplifying access.

Exam trap

SISE often tests the behavior of shell profiles; candidates may think auto-command requires manual execution or is a prompt, but it is automatically executed upon login.

How to eliminate wrong answers

Option A is wrong because the user is not disconnected; the auto-command is executed to provide a controlled session. Option B is wrong because the command is not prompted for manual execution; it runs automatically. Option D is wrong because the shell profile is not ignored; the auto-command is a feature of the shell profile and is applied upon login.

Full explanation →

173

MCQmedium

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

A.Condition matching

B.Random selection

C.Alphabetical order

D.Authentication protocol

AnswerA

Each Policy Set contains conditions evaluated top-down against the RADIUS request attributes; the first set whose conditions all evaluate true is selected. This condition matching is the mechanism that determines Policy Set selection before authentication policy is applied.

Why this answer

In Cisco ISE, each Policy Set contains a set of conditions that are evaluated against incoming RADIUS request attributes (such as NAS-IP-Address, Calling-Station-ID, or Service-Type). The first Policy Set whose conditions match the request is selected for further processing. This condition-based matching allows granular control over which authentication and authorization policies apply to different users, devices, or locations.

Exam trap

SISE often tests the misconception that Policy Sets are selected based on the order they appear in the GUI (alphabetical or creation order) rather than condition matching, leading candidates to overlook the role of conditions.

How to eliminate wrong answers

Option B is wrong because ISE does not randomly select a Policy Set; selection is deterministic based on configured conditions. Option C is wrong because Policy Sets are not evaluated in alphabetical order; the order is defined by the administrator's priority settings, but matching is still condition-driven. Option D is wrong because the authentication protocol (e.g., EAP, PAP) is part of the request but does not determine Policy Set selection; it is one of many attributes that can be used in conditions.

Full explanation →

174

MCQhard

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

A.Framed-IP-Address

B.Called-Station-ID

C.Calling-Station-ID

D.NAS-IP-Address

AnswerB

Called-Station-ID carries the network attachment point — typically the access point's BSSID or the switch port identifier — so RADIUS accounting and authorisation policies can map each guest session to its physical location, satisfying the requirement to track where the request originates.

Why this answer

Called-Station-ID is the RADIUS attribute that carries the identifier of the network access point (e.g., the SSID or the MAC address of the wireless controller/AP) that the guest is connecting to. In a guest flow, this attribute is used to determine the physical location of the request because it identifies the specific access device. Cisco ISE uses Called-Station-ID in authorization policies to apply location-based restrictions or to track where a guest session originates.

Exam trap

SISE often tests the confusion between Calling-Station-ID (device MAC) and Called-Station-ID (network access point), so candidates must remember that location is tied to the network side, not the client side.

How to eliminate wrong answers

Option A is wrong because Framed-IP-Address is the IP address assigned to the guest device, not the location of the network access point. Option C is wrong because Calling-Station-ID is the MAC address of the guest device, which identifies the device but not its physical location. Option D is wrong because NAS-IP-Address is the IP address of the network access server (e.g., the switch or controller), which may be in a different location than the access point itself.

Full explanation →

175

MCQeasy

A customer is planning a large campus deployment with 50,000 concurrent endpoints. Which persona should be dedicated to handle the authentication load to ensure high performance?

A.Policy Administration Node (PAN)

B.Policy Service Node (PSN)

C.Standalone Node

D.Monitoring and Troubleshooting Node (MnT)

AnswerB

PSNs handle RADIUS authentication and authorisation for endpoints, so dedicating this persona distributes the 50,000 concurrent authentication requests across nodes. The PAN concentrates policy administration and monitoring, not session processing, making it unsuitable for that load.

Why this answer

Policy Service Nodes (PSNs) are the workhorses of an ISE deployment — they handle all authentication, authorization, and accounting (AAA) requests from network devices via RADIUS. For 50,000 concurrent endpoints, the deployment must scale PSNs horizontally (typically in a dedicated PSN persona) so authentication load is distributed and no single node becomes a bottleneck.

Exam trap

SISE often tests the distinction between the control plane (PAN) and the data plane (PSN) — candidates who pick PAN assume 'policy' means authentication, but PAN only stores and distributes policy, it never processes RADIUS.

How to eliminate wrong answers

Option A is wrong because the PAN is the management and configuration plane — it runs the admin UI, stores policy configuration, and handles replication, but it does not process endpoint authentication traffic. Option C is wrong because a Standalone Node combines PAN, PSN, and MnT roles on one appliance, which is suitable only for small labs or pilots and cannot scale to 50,000 concurrent endpoints. Option D is wrong because the MnT node handles logging, reporting, and troubleshooting data collection — it does not perform authentication.

Full explanation →

176

MCQmedium

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

A.Rsync over SSH

B.RADIUS Change of Authorization (CoA)

C.Distributed Configuration Synchronization via HTTPS

D.SNMPv3 Trap propagation

AnswerC

Distributed Configuration Synchronization replicates the Primary PAN's configuration to all secondary nodes over HTTPS, keeping policy, identity and admin data consistent across the deployment. This mechanism maintains the configuration integrity the scenario demands, ensuring every node enforces identical policy.

Why this answer

In a distributed ISE deployment, the Primary PAN synchronizes configuration changes to all secondary nodes using a secure HTTPS-based mechanism called Distributed Configuration Synchronization. This ensures that all nodes have a consistent view of policies, identities, and other configuration data. The synchronization occurs automatically when changes are made on the Primary PAN, and it uses TLS to protect the data in transit.

Exam trap

SISE often tests the confusion between configuration synchronization and other inter-node communications like CoA or monitoring. Candidates may incorrectly choose CoA because it's a familiar ISE feature, but CoA is for session control, not configuration.

How to eliminate wrong answers

Option A is wrong because Rsync over SSH is not used for ISE configuration synchronization; ISE uses its own proprietary mechanism over HTTPS. Option B is wrong because RADIUS Change of Authorization (CoA) is used to dynamically change authorization for active sessions, not to synchronize configuration. Option D is wrong because SNMPv3 traps are used for monitoring and alerts, not for configuration synchronization.

Full explanation →

177

MCQeasy

What is the primary function of the 'Client Provisioning' policy in the context of BYOD?

A.To restrict the number of devices a user can register.

B.To determine which provisioning resources are delivered to the device based on its attributes.

C.To define which users are authorized to access the network.

D.To configure the MDM server connection settings.

AnswerB

Client Provisioning policies in Microsoft Entra ID evaluate device attributes—such as platform, ownership and compliance state—to decide which configuration profiles, certificates and profiles are pushed during BYOD onboarding. This attribute-driven targeting satisfies the stem's requirement to control what provisioning resources reach each device.

Why this answer

The Client Provisioning policy in Cisco ISE determines which provisioning resources — such as supplicants, native supplicants, profiles, and agent installers — are delivered to an endpoint based on its attributes (OS, posture, device type). It is the policy layer that matches endpoint conditions to the correct provisioning portal and resource package. It does not govern device registration limits, user authorization, or MDM server settings.

Exam trap

SISE often tests the distinction between Client Provisioning (resource delivery based on endpoint attributes) and Authorization Policy (access decisions based on user/group) — candidates confuse the two because both are policy engines in ISE.

How to eliminate wrong answers

Option A is wrong because restricting the number of devices a user can register is controlled by the Guest/BYOD registration policy and endpoint limits, not by Client Provisioning. Option C is wrong because defining which users are authorized to access the network is the function of Authorization Policies, not Client Provisioning. Option D is wrong because configuring the MDM server connection is done in the MDM integration settings under External MDM, not in the Client Provisioning policy.

Full explanation →

178

MCQhard

You are configuring EAP-TLS for BYOD. What must be included in the 'Allowed Protocols' list in ISE?

A.LEAP

B.EAP-FAST

C.EAP-TLS

D.PEAP-MSCHAPv2

AnswerC

EAP-TLS must appear in the Allowed Protocols list because ISE only negotiates methods explicitly enabled there; without it, the supplicant's TLS handshake is rejected during EAP method negotiation. This satisfies the BYOD certificate-based authentication requirement, where the client presents a certificate and ISE validates it against Microsoft Entra ID-issued trust chains.

Why this answer

EAP-TLS requires both the client and server to present digital certificates for mutual authentication, so EAP-TLS must be explicitly listed in ISE's Allowed Protocols for the BYOD flow to negotiate it. Without EAP-TLS in the allowed list, ISE will reject or fail the TLS handshake even if certificates are valid.

Exam trap

SISE often tests the assumption that enabling certificate services or PKI is enough, when the Allowed Protocols list must explicitly include EAP-TLS for the method to be negotiated.

How to eliminate wrong answers

Option A is wrong because LEAP is a legacy Cisco-proprietary protocol with weak MS-CHAPv1-based authentication and no certificate support, unsuitable for BYOD EAP-TLS. Option B is wrong because EAP-FAST uses PACs (Protected Access Credentials) and is typically used for flexible authentication, not certificate-based EAP-TLS. Option D is wrong because PEAP-MSCHAPv2 tunnels MSCHAPv2 inside TLS but authenticates the client with username/password, not a client certificate, so it does not satisfy EAP-TLS requirements.

Full explanation →

179

MCQmedium

An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?

A.Authorization Profile

B.Network Device Group

C.Policy Set Authentication Sequence

D.Device Administration Policy Set

AnswerA

An Authorization Profile is the ISE object that carries the dACL name returned to the network access device in the RADIUS Access-Accept, satisfying the requirement to push the dACL to the NAD. The profile references the dACL, which the device then resolves and applies to the user session.

Why this answer

The Authorization Profile is the ISE object that contains the dACL name (and other authorization attributes like VLAN, SGT, or URL redirect) returned to the NAD in the RADIUS Access-Accept. The authorization rule references the Authorization Profile, and ISE pushes the dACL to the switch as part of the authorization result. Without configuring the dACL in an Authorization Profile, ISE has no mechanism to deliver it.

Exam trap

The trap is confusing authentication components (Policy Set Authentication Sequence, Network Device Group) with the authorization component (Authorization Profile) that actually carries the dACL to the NAD.

How to eliminate wrong answers

Option B is wrong because a Network Device Group is used to categorize NADs (e.g., by location or device type) for policy conditions — it does not carry authorization attributes like dACLs. Option C is wrong because the Policy Set Authentication Sequence defines how the identity is authenticated (e.g., 802.1X, MAB, EAP methods), not what authorization attributes are returned. Option D is wrong because the Device Administration Policy Set governs TACACS+ device-admin access (who can log into the switch CLI), not network access authorization for user sessions.

Full explanation →

180

MCQmedium

Which of the following is required for AnyConnect to perform posture assessment on a Mac endpoint?

A.The 'AnyConnect Compliance Module' must be installed

B.The Mac must be domain joined

C.A separate 'Posture Proxy' must be configured

D.The user must have root access

AnswerA

The Compliance Module supplies the posture agents that inspect a Mac endpoint's antivirus, firewall and disk-encryption state, then return that data to the headend for policy evaluation. Without it, AnyConnect can establish the VPN tunnel but cannot collect the compliance attributes posture assessment requires.

Why this answer

The AnyConnect Compliance Module is required on a Mac endpoint to perform posture assessment. It provides the posture agents that check endpoint compliance with policies such as antivirus, firewall, and OS version.

Exam trap

SISE often tests whether candidates assume posture requires domain join or root access, when the actual requirement is the AnyConnect Compliance Module and proper posture profile configuration.

How to eliminate wrong answers

Option B is wrong because domain join is not required for posture assessment on Mac; posture checks are agent-based and do not depend on Active Directory membership. Option C is wrong because there is no separate 'Posture Proxy' component in AnyConnect; posture is performed by the Compliance Module. Option D is wrong because root access is not required for posture assessment; the AnyConnect client runs with sufficient privileges to perform checks.

Full explanation →

181

MCQmedium

You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?

A.It automatically emails the sponsor.

B.It sets the guest account status to 'Pending' until approved.

C.It sends a RADIUS request to the sponsor's device.

D.It allows the guest to bypass the login screen.

AnswerB

Setting the guest account to 'Pending' holds the account inactive until a sponsor approves it, satisfying the sponsor-approval requirement. The portal does not grant access at creation; the account remains unusable until the sponsor's approval transitions it to active.

Why this answer

The 'Sponsor Approval' setting in a Guest Portal configuration sets the guest account status to 'Pending' until a sponsor approves the request. This means the guest cannot access the network until the sponsor explicitly grants approval, typically via the Sponsor Portal. The setting enforces a workflow where guest access is gated by sponsor action.

Exam trap

The trap is confusing the notification aspect (email) with the actual state change (Pending). Candidates might think the setting merely sends an email, but it fundamentally changes the account status and blocks access until approval.

How to eliminate wrong answers

Option A is wrong because while the system may send notifications to the sponsor, the core function of the setting is to set the account to Pending, not just to email. Option C is wrong because RADIUS requests are not sent to the sponsor's device; sponsors interact via the Sponsor Portal, not RADIUS. Option D is wrong because the setting does not allow bypassing the login screen; it adds an approval step, not removes authentication.

Full explanation →

182

MCQmedium

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

A.Policy > Policy Elements > Results > Certificate Templates

B.Operations > RADIUS Livelog

C.Operations > Reports > Endpoints and Users > Certificate Provisioning

D.Administration > System > Certificates > Certificate Signing Requests

AnswerC

The Certificate Provisioning report records each CA interaction, including the SCEP or EST enrolment exchange, so it isolates why issuance fails after successful registration. It satisfies the stem's constraint by showing the specific CA error rather than generic endpoint or authentication data.

Why this answer

The Certificate Provisioning report under Operations > Reports > Endpoints and Users is the dedicated location where ISE logs the outcome of CA interactions during BYOD onboarding, including certificate enrollment requests, successes, and failures. When devices register successfully but certificate issuance fails, this report captures the SCEP/PKCS or EST exchange between ISE and the CA, showing error codes returned by the CA.

Exam trap

SISE often tests the distinction between configuration objects (Certificate Templates, CSR management) and operational log locations, tricking candidates into picking a config page when the question asks where to examine logs.

How to eliminate wrong answers

Option A is wrong because Certificate Templates under Policy Elements define which certificate template ISE requests from the CA — they are configuration objects, not logs, so they cannot show runtime CA interaction failures. Option B is wrong because the RADIUS Livelog only shows authentication/authorization exchanges between the NAD and ISE, not the backend CA enrollment traffic. Option D is wrong because Certificate Signing Requests under Administration > System > Certificates is where you manage ISE's own internal CSRs for admin/eap/portal certificates, not the client certificate provisioning workflow for BYOD endpoints.

Full explanation →

183

Multi-Selectmedium

Which THREE of the following are considered 'probes' in the Cisco ISE Profiling architecture?

Select 3 answers

A.ICMP Echo

B.DHCP

C.ARP Inspection

D.SNMP Query

E.HTTP

AnswersB, D, E

DHCP is a profiling probe because Cisco ISE consumes DHCP packets relayed from the switch, extracting option 12 hostname, option 60 vendor class and MAC-to-IP bindings to build endpoint profiles. This satisfies the stem's requirement for a genuine probe rather than a collector or feed.

Why this answer

In Cisco ISE profiling, a probe is any mechanism that collects endpoint attribute data to feed the profiling engine, and DHCP, SNMP Query, and HTTP are all valid probe types. DHCP (B) is correct because ISE uses DHCP probes (via DHCP snooping/relay or the DHCP probe on the PSN) to capture DHCP option fields such as Option 55 parameter request list, hostname, and vendor class for endpoint classification. SNMP Query (D) is correct because ISE can actively poll network devices via SNMP to retrieve information like ARP tables, MAC address tables, CDP/LLDP neighbors, and session data, which are used as profiling attributes.

HTTP (E) is correct because the HTTP probe captures User-Agent strings and other HTTP header data from web traffic to help identify endpoint OS and device type. ICMP Echo (A) is not a profiling probe in ISE; it is only used for reachability testing (e.g., in posture or endpoint tests), not for gathering profiling attributes. ARP Inspection (C) is a switch security feature (Dynamic ARP Inspection) rather than an ISE profiling probe; ISE may consume ARP data via SNMP or other probes, but ARP Inspection itself is not classified as a probe.

Exam trap

SISE often tests the distinction between probes and other ISE features, and candidates may confuse security features like ARP Inspection or general protocols like ICMP with profiling probes.

Full explanation →

184

MCQmedium

Which attribute is used by the MAC OUI probe to determine the device manufacturer?

A.User-Agent string

B.IP Address

C.DHCP Client ID

D.MAC Address prefix (first 3 bytes)

AnswerD

The first three bytes of a MAC address form the OUI, which the IEEE assigns to a specific manufacturer. The probe reads that prefix and matches it against the OUI registry, so it identifies the vendor without needing the device's full 48-bit address or host portion.

Why this answer

The MAC OUI (Organizationally Unique Identifier) probe inspects the first 3 bytes (24 bits) of a device's MAC address, which is the OUI assigned by the IEEE to a specific manufacturer. ISE maintains an internal OUI-to-vendor mapping database, so when an endpoint's MAC address is seen, the probe matches the prefix to identify the manufacturer (e.g., Apple, Samsung, Cisco). This is why the first 3 bytes are the correct answer.

Exam trap

SISE often tests the misconception that the full MAC address or the IP address identifies the manufacturer, when in fact only the first 3 bytes (OUI) carry vendor information.

How to eliminate wrong answers

Option A is wrong because the User-Agent string is an HTTP header used by the HTTP probe to identify browser/OS information, not the manufacturer from a MAC address. Option B is wrong because the IP address is a Layer 3 logical identifier that can be reassigned and does not encode vendor information. Option C is wrong because the DHCP Client ID is an optional DHCP option (option 61) used for client identification during address assignment, not for OUI-based manufacturer lookup.

Full explanation →

185

MCQeasy

How do you verify the current licensing status and consumption on your ISE deployment?

A.Dashboard > Licensing

B.Policy > Licensing

C.Administration > System > Licensing

D.Operations > Licensing

AnswerC

Administration > System > Licensing displays the current licence type, compliance status and node consumption counters for the ISE deployment, directly satisfying the requirement to verify licensing status and consumption. It is the only page reporting both registration state and per-node usage, unlike Smart Licensing registration or deployment pages.

Why this answer

In Cisco ISE, licensing status and consumption are viewed under Administration > System > Licensing. This page shows the license type (Base, Plus, Apex), the number of concurrent sessions consumed, and the evaluation period remaining. It is the authoritative location for verifying license compliance and usage.

Exam trap

SISE often tests the exact menu path for licensing, tricking candidates into choosing plausible but incorrect paths like 'Dashboard > Licensing' or 'Operations > Licensing' instead of the correct 'Administration > System > Licensing'.

How to eliminate wrong answers

Option A is wrong because 'Dashboard > Licensing' does not exist in ISE; the Dashboard menu contains overview and health dashboards, not licensing. Option B is wrong because 'Policy > Licensing' is not a valid menu path; Policy deals with authentication and authorization rules. Option D is wrong because 'Operations > Licensing' is not a valid path; Operations contains live logs, reports, and troubleshooting tools.

Full explanation →

186

MCQmedium

Which statement best describes the role of the TACACS+ 'Accounting' feature?

A.It validates user credentials

B.It limits the commands a user can run

C.It encrypts the communication channel

D.It records command execution details

AnswerD

TACACS+ Accounting logs session activity, including the exact commands executed by users on network devices, plus timestamps and user identities. This command-level record-keeping distinguishes it from Authentication and Authorisation, and exceeds RADIUS accounting's typically coarser start/stop session data.

Why this answer

TACACS+ separates AAA functions into distinct roles: Authentication verifies identity, Authorization determines what a user may do, and Accounting logs what the user actually did. The Accounting feature specifically records command execution details such as the command entered, the user, timestamp, and result, sending them to the TACACS+ server for auditing. This makes it the mechanism for tracking administrative activity on network devices.

Exam trap

SISE often tests the confusion between the three AAA components — candidates frequently pick Authorization (command limiting) when the question actually asks about Accounting (logging/auditing).

How to eliminate wrong answers

Option A is wrong because validating user credentials is the function of TACACS+ Authentication, not Accounting. Option B is wrong because limiting which commands a user can run is the function of TACACS+ Authorization (via command sets), not Accounting. Option C is wrong because encryption of the TACACS+ communication channel is a transport-layer property of the protocol itself (TACACS+ encrypts the entire payload using a shared secret), not a function of the Accounting feature.

Full explanation →

187

Multi-Selecthard

Which THREE items are configurable within a TACACS+ Shell Profile in Cisco ISE?

Select 3 answers

A.Shared Secret

B.RADIUS Service Type

C.Idle Timeout

D.Default Privilege Level

E.Auto-command

AnswersC, D, E

Idle Timeout is configurable in a TACACS+ Shell Profile, defining how long an authenticated session may remain inactive before the device terminates it. This satisfies the stem's requirement for a shell-profile attribute, alongside privilege level and auto-command.

Why this answer

In Cisco ISE, a TACACS+ Shell Profile defines the authorization attributes returned to a network device for a shell session, and it includes the Idle Timeout (C), which sets the inactivity period in minutes before the session is terminated, the Default Privilege Level (D), which assigns the initial privilege level (0-15) for the user's EXEC session, and the Auto-command (E), which specifies a command to run automatically upon login. These three attributes are all configurable fields within the Shell Profile's authorization settings. The Shared Secret (A) is not part of a Shell Profile; it is configured on the TACACS+ device/network access device definition to secure communication between ISE and the NAD.

The RADIUS Service Type (B) is a RADIUS authorization attribute and is not applicable to TACACS+ shell profiles, which use TACACS+ AV pairs instead.

Exam trap

SISE often tests whether candidates confuse TACACS+ Shell Profile attributes with RADIUS attributes or global TACACS+ settings like the Shared Secret, catching those who blur the two protocols.

Full explanation →

188

MCQhard

You need to create a posture condition to verify that the 'Cisco AnyConnect' service is running. Which condition type should you select?

A.Service Condition

B.Registry Condition

C.Process Condition

D.Application Condition

AnswerA

A Service Condition inspects the endpoint's running services and processes via the posture agent, matching the named 'Cisco AnyConnect' service. It directly satisfies the requirement to verify that specific service is running, unlike file, registry or application conditions.

Why this answer

In Cisco ISE posture conditions, a Service Condition is used to check whether a specific service (such as the Cisco AnyConnect service) is running on the endpoint. This condition type queries the endpoint's service status via the posture agent and returns a compliant or non-compliant result based on whether the service is active. It is the correct choice for verifying that a named service is running.

Exam trap

SISE often tests the distinction between Service, Process, and Application conditions — candidates frequently confuse a running service with a running process, but AnyConnect is a service, not just a process.

How to eliminate wrong answers

Option B is wrong because a Registry Condition checks for the presence or value of a specific Windows registry key, not a running service. Option C is wrong because a Process Condition checks for a running process by executable name, which is different from a Windows service — AnyConnect runs as a service, not just a process. Option D is wrong because an Application Condition checks for installed applications (via Add/Remove Programs or similar), not whether a service is currently running.

Full explanation →

189

Multi-Selectmedium

Which THREE resources are monitored via the ISE dashboard to ensure deployment health?

Select 3 answers

A.CPU utilization

B.Memory usage

C.Bandwidth per user

D.Temperature of the appliance

E.Disk space usage

AnswersA, B, E

Monitors compute load.

Why this answer

The Cisco ISE dashboard's System Health/Deployment Health monitoring reports the appliance's core system resources, and CPU utilization (A) is one of them because sustained high CPU on a PSN or PAN degrades authentication and policy-processing throughput. Memory usage (B) is also monitored, since ISE services such as the profiler, session directory, and M&T database can exhaust RAM and cause service failures if not tracked. Disk space usage (E) is the third monitored resource, as ISE depends on local disk for logging, the M&T data store, and backups, and low disk space triggers alarms and can halt logging or database operations.

Bandwidth per user (C) is not a node-level health resource tracked by the ISE dashboard; it is a network-traffic metric, not an ISE appliance resource. Temperature of the appliance (D) is not reported by the ISE dashboard either; hardware thermal status is handled by the underlying platform/CIMC or hypervisor, not by ISE's deployment-health monitoring.

Exam trap

SISE often tests the specific resources monitored in the ISE dashboard, and candidates may confuse them with general system monitoring metrics like bandwidth or temperature, which are not part of ISE's health dashboard.

Full explanation →

190

MCQhard

In a CWA flow, what is the significance of the 'cisco-av-pair = url-redirect-acl' attribute?

A.It defines the URL to which the user is redirected.

B.It triggers the CoA process.

C.It defines the guest group permissions.

D.It specifies the name of the ACL on the NAD that defines traffic to be intercepted.

AnswerD

The url-redirect-acl attribute names the downloadable ACL on the NAD that matches the traffic to be intercepted and redirected. It satisfies the CWA requirement by binding the redirect to a specific ACL, so only matching flows are captured for posture assessment rather than all traffic.

Why this answer

In a Central Web Authentication (CWA) flow, the 'cisco-av-pair = url-redirect-acl' attribute tells the network access device (NAD) which ACL to apply to intercept and redirect the user's HTTP traffic to the ISE portal. The ACL itself is defined locally on the NAD and typically permits DNS and the redirect, while denying other traffic until authentication completes. The attribute does not contain the redirect URL — that is carried by a separate 'url-redirect' attribute.

Exam trap

SISE often tests the distinction between 'url-redirect' (the URL) and 'url-redirect-acl' (the ACL name on the NAD), catching candidates who assume the ACL attribute contains the redirect destination.

How to eliminate wrong answers

Option A is wrong because the actual redirect URL is specified by the 'cisco-av-pair = url-redirect' attribute, not 'url-redirect-acl'; the ACL attribute only names the ACL that intercepts traffic. Option B is wrong because the CoA (Change of Authorization) process is triggered by ISE sending a RADIUS CoA packet after authentication or posture change, not by the url-redirect-acl attribute itself. Option C is wrong because guest group permissions are determined by the authorization policy result and the guest user's group membership in ISE, not by the url-redirect-acl AV pair.

Full explanation →

191

MCQhard

You want to improve profiling accuracy for endpoints that do not send DHCP options. You decide to use SNMP Trap profiling. What is a critical prerequisite for this to function?

A.The network device must be configured to send SNMP traps to the ISE PSN IP address.

B.The endpoint must support SNMP agents.

C.The ISE node must have the SNMP Query probe enabled.

D.RADIUS Accounting must be disabled.

AnswerA

SNMP Trap profiling depends on receiving unsolicited trap PDUs from network devices, so each device must target the ISE PSN's IP address as a trap receiver. Without that destination configured, no trap reaches ISE and profiling fails, directly satisfying the stem's requirement for endpoints lacking DHCP options.

Why this answer

SNMP Trap profiling requires the network device (switch, WLC, router) to be configured to send SNMP traps to the ISE PSN's IP address, because ISE relies on receiving those traps to extract endpoint attributes like MAC addresses, link up/down events, and CDP/LLDP neighbor data. Without the device actively sending traps to ISE, the SNMP Trap probe receives no data and profiling cannot occur.

Exam trap

The trap is assuming SNMP profiling requires an SNMP agent on the endpoint, when in fact SNMP Trap profiling depends entirely on the network device sending traps to ISE.

How to eliminate wrong answers

Option B is wrong because SNMP Trap profiling collects data from the network infrastructure, not from SNMP agents running on endpoints — most endpoints (printers, IP phones, IoT) don't run SNMP agents anyway. Option C is wrong because SNMP Query is a separate probe that polls devices; enabling it does not satisfy the SNMP Trap prerequisite. Option D is wrong because RADIUS Accounting is independent of SNMP Trap profiling and is often used alongside it for richer attribute collection.

Full explanation →

192

MCQhard

During the BYOD onboarding process, a user is successfully redirected to the portal, but the certificate installation fails because the client cannot trust the root CA. Which configuration is required to resolve this?

A.Install the CA certificate on the local WLC controller under the WLAN configuration.

B.Add the Root CA to the 'System Certificates' store instead of 'Trusted Certificates'.

C.Enable 'Allow Weak Ciphers' in the global BYOD settings.

D.Import the Root CA certificate into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled.

AnswerD

The client rejects the certificate chain because the root CA is untrusted. Importing it into the Trusted Certificates store with the client-authentication trust checkbox enabled lets the endpoint validate the issued certificate, resolving the onboarding failure.

Why this answer

The certificate installation fails because the client does not trust the root CA. To resolve this, the root CA certificate must be imported into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled. This ensures that the client trusts the CA that issued the certificate, allowing successful installation.

Exam trap

SISE often tests the specific location and settings for importing CA certificates, and candidates may confuse 'System Certificates' with 'Trusted Certificates' or overlook the checkbox for client authentication.

How to eliminate wrong answers

Option A is wrong because installing the CA certificate on the WLC is irrelevant; the trust issue is on the client side. Option B is wrong because 'System Certificates' store is used for ISE's own certificates, not for trusting external CAs for client authentication. Option C is wrong because enabling weak ciphers does not address the root CA trust problem and weakens security.

Full explanation →

193

Multi-Selectmedium

Which THREE of the following are valid components of a RADIUS-based Authorization Policy rule in Cisco ISE?

Select 3 answers

A.Rule Name

B.Condition

C.Identity Source Sequence

D.Command Set

E.Authorization Profile

AnswersA, B, E

Every RADIUS Authorization Policy rule requires a Rule Name, which uniquely identifies it within the policy set and determines its position in the ordered evaluation sequence. Without a name, ISE cannot reference the rule when logging or troubleshooting authorisation decisions.

Why this answer

In Cisco ISE, an Authorization Policy rule is built from three mandatory elements: a Rule Name (A), which uniquely identifies the rule within the policy set; a Condition (B), which defines the matching criteria such as AD group membership, device type, or posture status that must evaluate to true; and an Authorization Profile (E), which specifies the actual permissions or attributes (for example, VLAN, dACL, SGT, or downloadable ACL) returned in the RADIUS Access-Accept. The Identity Source Sequence (C) is not part of an authorization rule — it is referenced in the Authentication Policy to determine where user credentials are verified. The Command Set (D) is not an authorization rule component either; it is a TACACS+ construct used in Device Administration authorization to define permitted CLI commands, not a RADIUS authorization element.

Exam trap

SISE often tests the components of Authorization Policy rules and mixes in elements from Authentication Policy (Identity Source Sequence) and Device Administration (Command Set) — candidates must distinguish the policy type.

Full explanation →

194

MCQeasy

A network administrator is preparing to add a new Cisco ISE node to an existing distributed deployment. The new node will serve as a PSN in a remote branch office. Before registering the node, the administrator must ensure that the node meets the prerequisites for joining the deployment. Which prerequisite is required for the new node to successfully register with the Primary PAN?

A.The new node must have a different hostname and IP address from all other nodes, but no other prerequisites apply.

B.The new node must have the same ISE software version as the Primary PAN.

C.The new node must be manually added to the PAN's database using the ise/admin CLI before it can register.

D.The new node must be configured with the Administration persona before it can join the deployment.

AnswerB

All nodes in a Cisco ISE deployment must run the same software version. If the new node has a different version, registration will fail or the deployment will be inconsistent. Matching the version ensures compatibility of the configuration database, replication, and policy processing across all nodes.

Why this answer

For a new node to join a Cisco ISE deployment, it must run the same software version as the Primary PAN. This ensures that the configuration database, policy model, and replication mechanisms are compatible. While unique hostname and IP address are also required, matching the software version is a critical prerequisite that is often overlooked.

Without version parity, registration will fail or produce an unsupported deployment.

Exam trap

The trap here is assuming that only network settings like hostname and IP address matter, while overlooking the strict requirement for identical ISE software versions across all nodes.

Full explanation →

195

MCQhard

A security engineer is configuring Cisco ISE BYOD with a single SSID for both employee onboarding and corporate access. The engineer wants to ensure that devices without a valid certificate are redirected to the BYOD portal, while devices with a valid certificate are granted full access. The engineer has created a client provisioning policy that provisions the native supplicant with the corporate SSID and a certificate template. However, after provisioning, devices are still being redirected to the BYOD portal on subsequent connections. Which configuration change is required to allow onboarded devices to bypass the portal?

A.Change the client provisioning policy to use a different supplicant profile that includes the certificate.

B.Modify the authorization policy to include a rule that matches devices presenting a valid certificate and assigns a permit access profile, placed above the redirection rule.

C.Add the certificate's issuer to the list of trusted CAs in the BYOD portal settings.

D.Enable the 'Allow employees to bypass BYOD portal' option in the BYOD settings.

AnswerB

The authorization policy must have a rule that matches certificate-based authentication and assigns full access. Placing it above the redirection rule ensures onboarded devices are not redirected again. Without this, all devices matching the redirection rule will continue to be redirected.

Why this answer

After a device is onboarded and presents a valid certificate, the authorization policy must have a rule that matches certificate authentication and grants full access. If the redirection rule is evaluated first or there is no certificate-based permit rule, the device will continue to be redirected. The correct fix is to add or reorder the authorization policy so that certificate-based access is granted before redirection.

Exam trap

The trap here is thinking that provisioning a certificate automatically changes the authorization result, when in fact the authorization policy must explicitly match certificate-based authentication to bypass redirection.

Full explanation →

196

MCQeasy

An administrator is configuring profiling in Cisco ISE and wants to ensure that the MAC OUI probe is used to identify the manufacturer of endpoints. Which statement correctly describes the MAC OUI probe?

A.The MAC OUI probe can only identify Cisco devices; it cannot identify devices from other vendors.

B.The MAC OUI probe uses the first 24 bits of the MAC address to determine the device manufacturer.

C.The MAC OUI probe requires the endpoint to be authenticated via 802.1X before it can determine the manufacturer.

D.The MAC OUI probe uses the last 24 bits of the MAC address to determine the device manufacturer.

AnswerB

The MAC OUI probe extracts the first 24 bits (3 bytes) of the endpoint's MAC address, known as the Organizationally Unique Identifier (OUI). This OUI is assigned by IEEE to the device manufacturer. ISE maintains a database of OUIs and maps them to vendor names. This probe is always enabled and provides a basic level of profiling by identifying the manufacturer, such as Cisco, Apple, or Intel. It does not require any additional configuration or network traffic.

Why this answer

The MAC OUI probe is a fundamental profiling method in Cisco ISE that uses the first 24 bits of a MAC address, the OUI, to identify the manufacturer. It does not require authentication or any special configuration; it works with the MAC address available from the initial connection attempt. It can identify devices from any vendor by referencing the IEEE OUI database.

This probe is always enabled and provides a baseline profile that can be enhanced by other probes like DHCP, CDP, or SNMP.

Exam trap

The trap here is confusing the OUI portion with the NIC-specific portion of the MAC address, or assuming that the MAC OUI probe is Cisco-specific when it actually covers all vendors.

Full explanation →

197

Multi-Selecteasy

Which TWO of the following are valid components of an ISE Posture Policy?

Select 2 answers

A.Identity Group

B.Posture Requirement

C.Authorization Policy Rule

D.Remediation Action

E.Certificate Profile

AnswersB, D

A Posture Requirement defines the condition an endpoint must satisfy, such as an antivirus definition age or OS patch level, and is evaluated during posture assessment. It is a genuine policy component, distinct from remediation, which fixes failures, and from discovery, which decides whether posture applies.

Why this answer

In Cisco ISE, a Posture Policy is built from two core configurable components: Posture Requirements (option B), which define the conditions a client must satisfy (for example, an antivirus definition age or a specific registry/file check via the posture condition), and Remediation Actions (option D), which specify what ISE does when a requirement fails, such as showing a remediation message, linking to a download, or applying a restricted authorization result. These two elements are exactly what the posture policy editor lets you add per operating system and per posture condition, so B and D are the valid components. Option A (Identity Group) is a condition used in authorization or authentication policies, not a posture policy component.

Option C (Authorization Policy Rule) is a separate policy set element that consumes posture status (e.g., Posture_Status = Compliant) but is not itself part of the posture policy. Option E (Certificate Profile) is used for certificate-based authentication and BYOD/trust operations, not for defining posture checks or remediation.

Exam trap

SISE often tests the distinction between components of Posture Policy versus Authorization Policy, causing candidates to confuse Identity Groups or Authorization Policy Rules as part of Posture Policy.

Full explanation →

198

MCQhard

You are troubleshooting a device that is stuck in the 'Unknown' profile state. You have confirmed that the DHCP probe is receiving packets. What is the next logical step to investigate the failure?

A.Increase the SNMP polling interval.

B.Check the attributes of the endpoint in Context Visibility.

C.Delete the endpoint from the database.

D.Restart the ISE node services.

AnswerB

The DHCP probe confirms the endpoint is reachable, so the failure lies in profiling rather than connectivity. Context Visibility holds the endpoint's attributes and profiling policies; inspecting them reveals whether the correct profile criteria are being matched or misapplied.

Why this answer

When an endpoint is stuck in 'Unknown' despite the DHCP probe receiving packets, the next step is to inspect the endpoint's attributes in Context Visibility to see what ISE actually learned from the probe — such as whether the DHCP class attribute or MAC OUI was populated. This reveals whether the probe data is being parsed correctly or if a profiling condition is failing to match.

Exam trap

The trap is jumping to remediation steps like restarting services or deleting the endpoint instead of first inspecting the collected attributes — profiling troubleshooting always starts with verifying what data ISE actually has.

How to eliminate wrong answers

Option A is wrong because increasing the SNMP polling interval does not address a profiling failure — it only changes how often SNMP data is collected, and SNMP is just one of many probes. Option C is wrong because deleting the endpoint from the database is a destructive action that would not diagnose the root cause and would lose any collected attributes. Option D is wrong because restarting ISE node services is a heavy-handed step that doesn't investigate the specific profiling failure and could disrupt other sessions.

Full explanation →

199

Multi-Selectmedium

Which TWO of the following are components of the Cisco ISE 'Endpoint' object?

Select 2 answers

A.User's home address

B.The user's password hash

C.Custom Attributes

D.MAC Address

E.Device's hard drive serial number

AnswersC, D

Custom Attributes are a configurable field within the Cisco ISE Endpoint object, letting administrators store arbitrary metadata such as asset owner, compliance state, or department against a device. This satisfies the stem's requirement for an Endpoint component, since these attributes persist on the endpoint record and can be referenced by authorisation policies.

Why this answer

In Cisco ISE, an Endpoint (also called an identity group member for network devices) is defined by attributes that identify the device on the network, and MAC Address (D) is the primary unique identifier used for endpoint profiling, authorization policies, and MAB (MAC Authentication Bypass). Custom Attributes (C) are also part of the Endpoint object, allowing administrators to manually add metadata (e.g., device owner, location, or compliance status) to an endpoint for use in policy conditions. The user's home address (A) is not a field in the Endpoint object; it belongs to user/identity data, not device identity.

The user's password hash (B) is stored in the internal user database for authentication, not as an endpoint attribute. The device's hard drive serial number (E) is not a standard ISE Endpoint attribute, though ISE can collect some hardware attributes via profiling probes, the hard drive serial is not a defined component of the Endpoint object.

Exam trap

SISE often tests the boundary between Endpoint attributes and Identity (user) attributes — candidates mistakenly select user-centric data like passwords or addresses, forgetting that Endpoint objects are device-centric and keyed on MAC address.

Full explanation →

200

MCQmedium

A network engineer is configuring an authorization policy in Cisco ISE to enforce SGT-based segmentation on a Catalyst 9000 switch. The engineer wants to assign a static SGT to endpoints that authenticate via 802.1X and belong to a specific Active Directory group. The switch is already configured with 'cts manual' and 'propagate sgt' on the trunk. Which ISE configuration is required to assign the SGT to the endpoint?

A.Enable 'SGT Enforcement' in the switch's global configuration and let ISE push the SGT via Change of Authorization (CoA).

B.Map the Active Directory group to an SGT in ISE's External Identity Sources configuration, and the SGT will be automatically applied.

C.Create a downloadable ACL (dACL) that includes the SGT value, and reference it in the Authorization Profile.

D.Configure the SGT as a RADIUS attribute in the Authorization Profile's advanced attributes using cisco-av-pair with the value 'cts:security-group-tag=xxxx'.

AnswerD

This is correct because Cisco ISE uses the cisco-av-pair RADIUS attribute to pass the SGT value to the switch. The value 'cts:security-group-tag=xxxx' instructs the NAD to apply the specified SGT to the endpoint's traffic. This is the standard method for static SGT assignment in an 802.1X authorization policy.

Why this answer

To assign a static SGT to an endpoint during 802.1X authentication, the authorization policy must return the SGT value in a cisco-av-pair RADIUS attribute. The format 'cts:security-group-tag=xxxx' is recognized by Cisco switches to apply the SGT. Other methods like dACLs or CoA do not perform static SGT assignment.

Therefore, configuring the cisco-av-pair in the Authorization Profile is the correct approach.

Exam trap

The trap here is assuming that SGT assignment can be done via dACL or CoA, but it requires a specific cisco-av-pair attribute in the authorization profile.

Full explanation →

201

MCQmedium

You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?

A.Deny 'show' and permit 'show running-config'

B.Deny 'show running-config' and permit all other commands

C.Permit 'show.*' and deny 'show running-config'

D.Set the command privilege level to 0

AnswerB

TACACS+ command sets evaluate commands sequentially, so explicitly denying 'show running-config' before permitting the remaining 'show' commands blocks only that variant. Ordering matters: a broad permit placed first would authorise the restricted command before the deny is reached.

Why this answer

To block a specific command like 'show running-config' while allowing other 'show' commands, the command set must explicitly deny 'show running-config' and then permit all other commands. TACACS+ command sets are evaluated top-down, so the deny rule for the specific command must come before a permit-all rule. This ensures only that command is blocked.

Exam trap

The trap is rule ordering — candidates forget that TACACS+ command sets are first-match and place the permit-all rule before the specific deny, which allows the blocked command.

How to eliminate wrong answers

Option A is wrong because denying 'show' and permitting 'show running-config' would block all show commands except the one you want to block, which is the opposite of the requirement. Option C is wrong because permitting 'show.*' first would allow 'show running-config' before the deny rule is evaluated, since TACACS+ processes rules in order. Option D is wrong because setting privilege level 0 does not block a specific command; it changes the privilege level and does not provide granular command filtering.

Full explanation →

202

MCQeasy

An administrator needs to ensure that only endpoints with a specific registry key present are allowed access. Where should this posture condition be defined in Cisco ISE?

A.Administration > System > Settings > Posture

B.Policy > Policy Elements > Conditions > Authorization > Compound Condition

C.Policy > Policy Elements > Results > Posture > Remediation Actions

D.Policy > Policy Elements > Conditions > Posture > Registry Condition

AnswerD

Registry conditions are posture policy elements, so they are authored under Policy Elements before being referenced in posture policies. Defining the specific registry key here lets ISE evaluate endpoint compliance and grant access only to matching endpoints.

Why this answer

Posture conditions, such as checking for a specific registry key, are defined under Policy > Policy Elements > Conditions > Posture > Registry Condition. This allows you to create a condition that evaluates the presence of a registry key on the endpoint, which can then be used in posture policies.

Exam trap

SISE often tests the exact location of posture condition definitions, and candidates may confuse them with authorization conditions or remediation actions.

How to eliminate wrong answers

Option A is wrong because Administration > System > Settings > Posture contains global posture settings, not individual condition definitions. Option B is wrong because Authorization Compound Conditions are used for authorization policies, not posture conditions. Option C is wrong because Remediation Actions define what actions to take when a condition fails, not the condition itself.

Full explanation →

203

MCQeasy

Which protocol does the Cisco ISE use to inform the NAD that a guest user's session state has changed (e.g., from 'redirect' to 'authenticated')?

A.RADIUS CoA

B.HTTP

C.SNMP

D.TACACS+

AnswerA

RADIUS Change of Authorization lets Cisco ISE push an unsolicited CoA request to the network access device, instructing it to reauthenticate or alter the session's authorisation state. This changes a guest from redirect to authenticated without waiting for reauthentication, which is the required session-state update.

Why this answer

Cisco ISE uses RADIUS Change of Authorization (CoA) to dynamically change the authorization state of an active session on a Network Access Device (NAD). When a guest user's session state changes (e.g., from redirect to authenticated), ISE sends a RADIUS CoA request (Disconnect or CoA-Request) to the NAD, which then reauthenticates or changes the session's authorization. This is the standard mechanism for dynamic session control.

Exam trap

The trap here is confusing protocols used for different purposes: RADIUS for network access, TACACS+ for device administration, SNMP for monitoring, and HTTP for portals. Candidates might think HTTP is used because the guest portal is web-based, but the actual session state change is signaled via RADIUS CoA.

How to eliminate wrong answers

Option B is wrong because HTTP is used for web-based guest portals and REST APIs, but it does not directly inform the NAD of session state changes. Option C is wrong because SNMP is used for monitoring and management, not for dynamic session control. Option D is wrong because TACACS+ is used for device administration (AAA for CLI access), not for network access session state changes.

Full explanation →

204

Multi-Selectmedium

Which TWO of the following are benefits of using the Cisco TrustSec architecture?

Select 2 answers

A.Eliminates the need for RADIUS

B.Reduces network latency

C.Simplifies policy management by using SGTs

D.Automatic dACL creation

E.Topology-independent security policy

AnswersC, E

Using SGTs decouples policy from IP addresses and VLANs, so rules are written once against group tags and remain valid as endpoints move. This simplifies policy management, satisfying the stem's requirement for a TrustSec benefit, and scales far better than per-subnet ACLs.

Why this answer

Option C is correct because Cisco TrustSec replaces traditional IP- and VLAN-based ACLs with Security Group Tags (SGTs), which are logical labels assigned to users, devices, or endpoints; policies are then written once between source and destination SGT pairs (SGACL matrix) rather than per-subnet, greatly simplifying policy management. Option E is correct because SGTs are carried in the packet's Cisco Metadata (CMD) field or inline tag, so enforcement depends on group membership rather than on where the device sits in the network, making the security policy topology-independent and consistent across wired, wireless, and remote locations. The unmarked options do not belong: TrustSec does not eliminate RADIUS (it typically relies on 802.1X/RADIUS for identity and SGT assignment), it does not inherently reduce network latency (it may add tagging overhead), and while SGACLs can be pushed to devices, automatic dACL creation is a feature associated with Cisco ISE/TrustSec deployment mechanics rather than a core architectural benefit, and it is not one of the two marked answers.

Exam trap

SISE often tests the misconception that TrustSec eliminates RADIUS or automatically creates dACLs, when its real benefits are SGT-based policy simplification and topology-independent enforcement.

Full explanation →

205

Multi-Selecthard

Which TWO of the following are necessary to correctly configure a custom profiling condition based on DHCP attributes?

Select 2 answers

A.Enable HTTP profiling.

B.Configure a static IP on the endpoint.

C.Define a matching operator (e.g., equals, contains).

D.Clear the MAC address table on the switch.

E.Select the correct DHCP attribute from the attribute list.

AnswersC, E

A condition needs a comparison rule to evaluate the collected DHCP attribute against the expected value. Without a matching operator such as equals or contains, the attribute cannot be tested, so the profiling condition never evaluates to true and the endpoint is not classified.

Why this answer

Option C is correct because a profiling condition must specify a matching operator (such as equals, contains, starts with, or matches regex) that determines how the collected DHCP attribute value is compared against the configured value. Option E is correct because the condition must reference a valid DHCP attribute from the available attribute list (for example, DHCP Option 12 hostname, Option 60 vendor class identifier, or Option 55 parameter request list) so the profiler knows which DHCP field to evaluate. Together, selecting the DHCP attribute and defining its matching operator are the two essential components of a custom DHCP-based profiling condition.

Option A is not required because HTTP profiling is a separate profiling method used for HTTP User-Agent attributes, not DHCP. Option B is not required because DHCP profiling relies on the DHCP request/response exchange and does not depend on the endpoint having a static IP. Option D is not required because clearing the switch MAC address table is unrelated to defining a profiling condition and would not affect DHCP attribute matching.

Exam trap

SISE often tests whether candidates confuse the two mandatory building blocks of a profiling condition — the attribute and the operator — with unrelated probe enablement or endpoint IP configuration settings.

Full explanation →

206

MCQhard

A posture condition is defined to check for a registry key, but it always returns 'Non-Compliant'. You suspect the 'Expected Value' is wrong. Where can you see what the agent actually found on the endpoint?

A.Context Visibility > Endpoints

B.Operations > Reports > Endpoints > Posture Assessment

C.Client Provisioning > Resources

D.Policy > Posture > Conditions

AnswerB

The Posture Assessment report under Operations > Reports > Endpoints displays the actual values the agent evaluated against each posture condition, letting you compare the endpoint's real registry data with the configured Expected Value and identify the mismatch.

Why this answer

The Operations > Reports > Endpoints > Posture Assessment report provides detailed information about posture assessments, including the actual values found on the endpoint for each condition. This allows you to compare the expected value with what the agent reported, helping to diagnose why a condition is returning Non-Compliant.

Exam trap

The trap is confusing where to find posture assessment details. Candidates might think Context Visibility shows the actual values, but it only shows compliance status. The detailed actual values are in the Posture Assessment report.

How to eliminate wrong answers

Option A is wrong because Context Visibility > Endpoints shows endpoint attributes and compliance status but does not provide the detailed posture condition results, such as the actual registry key value. Option C is wrong because Client Provisioning > Resources is for managing client provisioning resources like profiles and agents, not for viewing posture assessment details. Option D is wrong because Policy > Posture > Conditions is where you define the posture conditions, not where you view the results of assessments.

Full explanation →

207

MCQmedium

A network administrator has deployed Cisco ISE with AnyConnect posture. Windows endpoints must run Windows Defender and have real-time protection enabled to be considered compliant. The administrator configures a posture policy with a Windows Defender condition that checks the service status. However, endpoints where Defender is running but real-time protection is disabled are still reported as compliant. What is the most likely cause?

A.The AnyConnect posture module is not installed on the endpoints, so no posture data is collected.

B.The posture policy is set to audit mode, which allows non-compliant endpoints to appear compliant.

C.The Windows Defender firewall is blocking the posture communication between AnyConnect and ISE.

D.The posture condition only checks whether the Windows Defender service is running, not the real-time protection status.

AnswerD

The condition likely verifies the service state (e.g., service exists and is running) but does not evaluate the real-time protection setting. To enforce real-time protection, the condition must check the specific registry key or use a file condition that reflects that setting. Since endpoints with real-time protection disabled still pass, the condition is too shallow.

Why this answer

The condition checks only the service status, not the real-time protection setting. To enforce real-time protection, the condition must evaluate the specific registry key or use a file condition that reflects that setting. The other options would cause different symptoms, such as Unknown status or complete posture failure, not a false Compliant result.

Exam trap

The trap here is assuming that checking the Windows Defender service status is sufficient to verify real-time protection, when in fact the service can be running while real-time protection is disabled.

Full explanation →

208

MCQhard

You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?

A.deny ip any 10.1.1.0 0.0.0.255

B.permit tcp any any

C.permit ip any any

D.deny ip any any

AnswerC

Check Point dACLs are evaluated top-down with an implicit drop at the end, so an explicit permit ip any any as the final rule allows all remaining traffic after the earlier deny rule blocks the 10.1.1.0/24 subnet.

Why this answer

A dACL is an ordered list of ACEs evaluated top-down, and IOS ACLs have an implicit 'deny ip any any' at the end. To deny a specific subnet while permitting all other traffic, you place the deny ACE for 10.1.1.0/24 first, then explicitly permit everything else with 'permit ip any any' as the final line. Without that explicit permit, the implicit deny would block all remaining traffic.

Exam trap

The trap is forgetting the implicit 'deny ip any any' at the end of every IOS ACL — candidates who omit the explicit permit inadvertently block all remaining traffic.

How to eliminate wrong answers

Option A is wrong because 'deny ip any 10.1.1.0 0.0.0.255' is only the deny ACE — if it were the last line, the implicit deny would drop all other traffic, contradicting the requirement to permit everything else. Option B is wrong because 'permit tcp any any' only permits TCP traffic, leaving UDP, ICMP, and other protocols to hit the implicit deny — it does not satisfy 'permit everything else'. Option D is wrong because 'deny ip any any' as the last line would block all traffic after the specific deny, which is the opposite of the requirement.

Full explanation →

209

MCQmedium

When configuring a secondary MnT node, what is the 'Primary' versus 'Secondary' relationship regarding log collection?

A.The Secondary collects from specific PSNs only

B.Both nodes log simultaneously

C.The Primary collects, Secondary is standby

D.Nodes load balance the logs

AnswerC

In a distributed deployment, the primary MnT node actively receives and stores logs from all policy nodes, while the secondary remains in standby mode, replicating data but not accepting live syslog streams. This satisfies the stem's requirement that only one node performs active log collection at any time.

Why this answer

In a two-node MnT deployment, the Primary MnT actively collects, stores, and processes logs from all PSNs and other nodes, while the Secondary MnT operates in standby mode and only takes over log collection if the Primary fails. This is an active/standby relationship, not active/active or load-balanced.

Exam trap

SISE often tests whether candidates assume ISE uses active/active clustering for MnT like it does for PSNs — the trap is confusing PSN load distribution with MnT log collection, which is strictly active/standby.

How to eliminate wrong answers

Option A is wrong because the Secondary does not selectively collect from specific PSNs — all nodes forward logs to the Primary, and the Secondary only receives data after a failover event. Option B is wrong because simultaneous logging from both nodes would create duplicate records and inconsistent reporting; ISE does not support active/active MnT. Option D is wrong because log collection is not load-balanced across MnT nodes — the Primary is the sole collector until failover.

Full explanation →

210

MCQmedium

A network engineer configures a Cisco ISE deployment with profiler probes enabled on the Policy Service nodes. After deploying a new Cisco Catalyst 9300 switch, the engineer notices that endpoints connected to that switch are not appearing in the Endpoints list, even though they are passing 802.1X authentication. The engineer verifies that the switch is sending RADIUS accounting packets to ISE. Which probe should the engineer verify is enabled to collect endpoint attributes from the switch itself?

A.SNMP probe

B.HTTP probe

C.DHCP probe

D.RADIUS probe

AnswerD

The RADIUS probe collects attributes from RADIUS authentication and accounting packets sent by the network access device, including MAC address, username, and NAS information. Without it, endpoints authenticating via 802.1X would not be profiled from RADIUS data. Enabling this probe on the Policy Service node allows ISE to build endpoint profiles from the switch's RADIUS traffic.

Why this answer

The RADIUS probe is responsible for extracting endpoint attributes from RADIUS authentication and accounting packets. When endpoints authenticate via 802.1X, the switch sends RADIUS messages to ISE, and the RADIUS probe uses those to create or update endpoint profiles. If this probe is disabled, endpoints may authenticate successfully but remain unprofiled, which matches the described symptom.

Exam trap

The trap here is assuming that successful 802.1X authentication automatically guarantees profiling, when in fact profiling requires the RADIUS probe to be enabled to harvest attributes from those same packets.

Full explanation →

211

Multi-Selecthard

Which TWO of the following steps are required to deploy the AnyConnect posture agent?

Select 2 answers

A.Set the NAS IP address

B.Enable RADIUS Accounting

C.Create a Client Provisioning policy

D.Configure a TrustSec policy

E.Create a Client Provisioning resource

AnswersC, E

A Client Provisioning policy defines which provisioning resource ISE presents to matching endpoints, so it is required to deliver the AnyConnect posture agent. Without it, no download or installation is offered, so the agent cannot be deployed.

Why this answer

Option C (Create a Client Provisioning policy) is correct because the Client Provisioning policy is what binds the posture requirements and the AnyConnect package to the matching conditions (OS, posture status, etc.) so that ISE can tell the endpoint which agent and profile to download. Option E (Create a Client Provisioning resource) is correct because the resource is the actual AnyConnect package/profile (or other agent) that ISE delivers to the endpoint; without a resource there is nothing for the policy to provision. Option A (Set the NAS IP address) is not required for posture agent deployment; the NAS IP is used in RADIUS/AAA device configuration and does not provision the agent.

Option B (Enable RADIUS Accounting) is not required for deploying the posture agent; accounting is for session logging/accounting records, not for agent provisioning. Option D (Configure a TrustSec policy) is not required for posture agent deployment; TrustSec handles security group tagging/SGACL enforcement, which is separate from provisioning the AnyConnect posture module.

Exam trap

SISE often tests the specific steps for client provisioning, and candidates may confuse it with other ISE features like TrustSec or RADIUS accounting. The trap is selecting steps that are not directly related to provisioning the agent.

Full explanation →

212

Multi-Selecteasy

Which THREE of the following are standard probes available in Cisco ISE to gather device information?

Select 3 answers

A.SMTP

B.HTTP

C.FTP

D.SNMP Query

E.DHCP

AnswersB, D, E

The HTTP probe is a standard Cisco ISE probe that inspects user-agent strings and HTTP headers from endpoint browser traffic. It satisfies the stem's device-information requirement by supplying profiling attributes such as operating system and browser, which feed policy conditions.

Why this answer

In Cisco ISE, standard probes used for endpoint profiling and gathering device information include HTTP, SNMP Query, and DHCP. Option B (HTTP) is correct because ISE uses HTTP probes to inspect User-Agent strings and other HTTP header data from web requests, which helps identify device type and operating system. Option D (SNMP Query) is correct because ISE sends SNMP queries to network devices to collect system information such as sysDescr, sysObjectID, and interface details for profiling.

Option E (DHCP) is correct because ISE can use DHCP probes to capture DHCP requests and options (for example, option 55 parameter request list, hostname, and vendor class) to fingerprint endpoints. Options A (SMTP) and C (FTP) are not standard ISE probes for device information gathering; SMTP and FTP are application protocols unrelated to ISE profiling probes.

Exam trap

The trap is selecting protocols that are not standard ISE probes, such as SMTP or FTP; candidates must remember the specific probes ISE supports, including HTTP, SNMP Query, and DHCP.

Full explanation →

213

MCQmedium

An administrator configures a posture policy that checks for a specific Windows registry key with an expected value of '1'. After deployment, endpoints that have the key correctly set to '1' are still reported as Non-Compliant. The AnyConnect Posture module is installed and the agent is communicating with ISE. Which action should the administrator take first to resolve this issue?

A.Change the posture policy to use a file condition instead of a registry condition, as file checks are more reliable.

B.Reinstall the AnyConnect Posture module on the affected endpoints to ensure the latest version is used.

C.Restart the Cisco ISE Policy Service Node to clear any cached posture results that might be stale.

D.Verify that the registry condition is using the correct operator, such as 'Exists' or 'Equals', and that the expected value matches the data type.

AnswerD

Registry conditions in posture policies require an operator that matches the check's intent. If the condition uses an operator like 'Exists' but expects a specific value, or if the expected value is a string '1' but the registry stores a DWORD, the condition fails. Reviewing the operator and data type is the first logical step because the agent is communicating and the key is present, so the mismatch likely lies in the condition definition.

Why this answer

The endpoints are communicating and the registry key is present, so the failure likely stems from a misconfigured condition. Registry conditions require an operator that matches the check (e.g., 'Exists', 'Equals') and an expected value that matches the registry data type (e.g., DWORD, String). Verifying these settings is the most direct troubleshooting step before considering more invasive actions.

Exam trap

The trap here is assuming that a communicating agent means the posture condition is correctly defined, when often the issue is a mismatch between the operator, expected value, and actual registry data type.

Full explanation →

214

Multi-Selecthard

Which TWO of the following tasks are performed within the Sponsor Portal?

Select 2 answers

A.Mapping VLANs to specific guest SSIDs.

B.Configuring global portal branding.

C.Defining RADIUS shared secrets.

D.Creating new guest accounts.

E.Approving guest access requests.

AnswersD, E

Sponsors create guest accounts directly in the Sponsor Portal, supplying the visitor's details and validity period. This satisfies the requirement that guest provisioning be delegated to non-administrative sponsors, with credentials generated and delivered without administrator intervention.

Why this answer

The Sponsor Portal in Cisco ISE is a web interface used by designated sponsors to manage guest lifecycle tasks, so option D (Creating new guest accounts) is correct because sponsors can create guest accounts directly, specifying duration, login credentials, and other guest details. Option E (Approving guest access requests) is also correct because sponsors receive and act on pending guest access requests, approving or denying them so guests can authenticate. Option A (Mapping VLANs to specific guest SSIDs) is incorrect because VLAN-to-SSID mapping is configured on the wireless LAN controller or in the network access policy, not in the Sponsor Portal.

Option B (Configuring global portal branding) is incorrect because portal branding and customization are configured in the Guest Portal settings within ISE administration, not by sponsors in the Sponsor Portal. Option C (Defining RADIUS shared secrets) is incorrect because RADIUS shared secrets are configured on network devices and in ISE's network device definitions, not in the Sponsor Portal.

Exam trap

The trap is confusing the Sponsor Portal with the Admin Portal or Guest Portal. Candidates might think sponsors can configure global settings or network parameters, but those are admin tasks. The Sponsor Portal is limited to guest account management and approval.

Full explanation →

215

MCQhard

If you want to use a script remediation, where do you define the script content?

A.In the Client Provisioning Resource file

B.In the Posture Policy XML

C.Directly in the 'Script Remediation' action in ISE

D.On the endpoint in the AnyConnect directory

AnswerC

Script remediation content is entered directly within the Script Remediation action in ISE, where the script body is defined and executed on the endpoint. No external repository or file reference is required for this action type.

Why this answer

In Cisco ISE, when configuring a posture policy with a script remediation action, the script content is defined directly within the 'Script Remediation' action itself. This allows the administrator to embed the script that will be executed on the endpoint to remediate the non-compliance.

Exam trap

The trap is assuming that the script content is stored in a separate file or resource. Candidates might think it's in the Client Provisioning Resource or the Posture Policy XML, but it's actually embedded in the remediation action configuration.

How to eliminate wrong answers

Option A is wrong because the Client Provisioning Resource file is used to define the posture agent and profiles, not the remediation script content. Option B is wrong because the Posture Policy XML defines the policy conditions and actions, but the script content is not defined there; it references the remediation action. Option D is wrong because the AnyConnect directory on the endpoint is where the agent resides, but the script content is not defined there; it is pushed from ISE.

Full explanation →

216

MCQeasy

Which dashboard widget provides a quick summary of BYOD activity in your network?

A.System Resources

B.Active Directory Health

C.BYOD Registration Status

D.RADIUS Latency

AnswerC

The BYOD Registration Status widget summarises device onboarding activity, showing registered, pending, and failed endpoints at a glance. This satisfies the stem's requirement for a quick summary of BYOD activity, aggregating registration states without drilling into individual sessions.

Why this answer

The 'BYOD Registration Status' dashboard widget provides a quick summary of BYOD activity, including the number of registered devices, pending registrations, and other relevant metrics. This widget is specifically designed to monitor BYOD onboarding and registration trends.

Exam trap

SISE often tests the purpose of specific dashboard widgets, and candidates may confuse BYOD Registration Status with other monitoring widgets like System Resources or RADIUS Latency.

How to eliminate wrong answers

Option A is wrong because System Resources shows CPU, memory, and disk usage of ISE nodes, not BYOD activity. Option B is wrong because Active Directory Health monitors AD connectivity and performance, not BYOD. Option D is wrong because RADIUS Latency displays authentication latency metrics, not BYOD registration status.

Full explanation →

217

MCQmedium

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

A.NetworkDevice:Name

B.Radius:NAS-IP-Address

C.Radius:Called-Station-ID

D.Device:Model

AnswerA

NetworkDevice:Name matches the network access device's configured name in ISE, so the policy set applies only to requests from that specific WLC. This satisfies the constraint of scoping the policy set to one wireless controller.

Why this answer

The NetworkDevice:Name condition in Cisco ISE allows you to match requests based on the name of the network device (WLC) as defined in ISE's network device repository. This is the correct condition to ensure a policy set only applies to requests originating from a specific WLC, because the WLC is a network device and its name is a unique identifier in ISE.

Exam trap

SISE often tests the difference between NetworkDevice:Name and Radius:NAS-IP-Address — candidates may pick NAS-IP-Address because it identifies the WLC, but the question specifically asks for a condition based on the WLC's identity, and Name is the direct match.

How to eliminate wrong answers

Option B is wrong because Radius:NAS-IP-Address matches the IP address of the network device, not its name — while it could identify the WLC, the question asks for a condition that applies to a specific WLC by name, and NAS-IP-Address is less flexible if the IP changes. Option C is wrong because Radius:Called-Station-ID typically contains the SSID or AP MAC address for wireless requests, not the WLC identity. Option D is wrong because Device:Model matches the device model (e.g., 'Cisco 5520 WLC'), which would apply to all WLCs of that model, not a specific one.

Full explanation →

218

MCQhard

You have a Cisco switch that supports both RADIUS and TACACS+. When using ISE for device administration, which protocol is mandatory for command-level authorization?

A.TACACS+

B.SSH

C.RADIUS

D.SNMPv3

AnswerA

TACACS+ separates authentication, authorization and accounting into distinct exchanges, letting ISE return per-command authorisation decisions for device administration. RADIUS bundles authorisation into the authentication response and cannot enforce command-level privileges, so it fails the stem's requirement for granular CLI command control on the Cisco switch.

Why this answer

TACACS+ is mandatory for command-level authorization in Cisco ISE device administration because it separates authentication, authorization, and accounting (AAA) and supports per-command authorization. RADIUS, while used for network access, does not provide the granular command authorization that TACACS+ offers. Therefore, to enforce command-level authorization on a Cisco switch, TACACS+ must be used.

Exam trap

The trap is assuming RADIUS can handle command-level authorization because it is also an AAA protocol; candidates must remember that only TACACS+ supports per-command authorization.

How to eliminate wrong answers

Option B is wrong because SSH is a protocol for secure remote access, not an AAA protocol for authorization. Option C is wrong because RADIUS combines authentication and authorization in a single response and does not support command-level authorization; it is typically used for network access (802.1X) rather than device administration. Option D is wrong because SNMPv3 is used for network management and monitoring, not for command authorization.

Full explanation →

219

MCQeasy

Which menu path is used to view the status of all nodes in an ISE deployment?

A.Operations > Reports

B.Administration > Maintenance

C.Administration > System > Deployment

D.Policy > Policy Elements

AnswerC

The Deployment page under Administration > System lists every node, showing roles, personas, and synchronisation status across the deployment. This path satisfies the stem's requirement to view the status of all nodes from the Primary PAN.

Why this answer

In Cisco ISE, the status of all nodes in a deployment is viewed under Administration > System > Deployment. This page lists every node, its persona (PAN, PSN, MnT), role (Primary/Secondary), and operational status, allowing administrators to monitor node health and synchronization.

Exam trap

SISE often tests menu-path memorization — candidates confuse the Deployment page with Maintenance or Reports because they associate 'status' with monitoring or reporting rather than administration.

How to eliminate wrong answers

Option A is wrong because Operations > Reports provides reporting on authentication, accounting, and other events, not node deployment status. Option B is wrong because Administration > Maintenance contains backup, restore, and upgrade tasks, not node status monitoring. Option D is wrong because Policy > Policy Elements is where authentication and authorization policy objects are configured, not where node status is displayed.

Full explanation →

220

MCQmedium

You need to allow guest users to access specific internal resources (like a printer) while they are connected to the Guest network. How do you configure this in ISE?

A.Enable Guest VLAN assignment.

B.Assign a downloadable ACL (dACL) in the Authorization Profile.

C.Modify the Redirect ACL on the switch.

D.Configure a port-based ACL on the switch interface.

AnswerB

A downloadable ACL in the Authorization Profile pushes a per-user access control list to the network device, permitting the guest to reach the printer while denying other internal resources. This satisfies the requirement for granular, session-specific access.

Why this answer

A downloadable ACL (dACL) is a Cisco AV pair that ISE sends to the switch in the RADIUS Access-Accept. The switch then applies this ACL to the client's port to filter traffic. This allows granular control, such as permitting access only to a specific printer IP while denying other internal resources.

The dACL is defined in the Authorization Profile, which is referenced in the authorization policy rule for guest users.

Exam trap

The trap here is confusing VLAN assignment with ACL enforcement; candidates might think putting guests in a separate VLAN automatically restricts internal access, but VLANs alone do not filter traffic to specific resources.

How to eliminate wrong answers

Option A is wrong because Guest VLAN assignment only places the user in a separate VLAN; it does not restrict access to specific internal resources like a printer. Option C is wrong because modifying the Redirect ACL on the switch affects URL redirection for web authentication, not per-user resource access. Option D is wrong because a port-based ACL on the switch interface is static and applies to all devices on that port, not dynamically per guest user.

Full explanation →

221

MCQeasy

What is the function of the 'Default' policy set in ISE?

A.It is a catch-all for traffic that does not match other Policy Sets

B.It is the only policy set allowed to process MAB requests

C.It is used to manage ISE internal traffic only

D.It cannot be modified

AnswerA

The Default policy set acts as the fallback for any RADIUS or TACACS+ request that matches no other policy set's conditions, ensuring no authentication traffic is dropped. It provides a guaranteed processing path for unmatched requests.

Why this answer

The 'Default' policy set in ISE is a catch-all that processes any authentication or authorization request that does not match any other policy set. It is the last policy set evaluated and ensures that no traffic is left unprocessed. It can be modified, but it cannot be deleted.

Exam trap

SISE often tests the misconception that the Default policy set cannot be modified or is only for specific traffic types, when in fact it is a catch-all that can be customized.

How to eliminate wrong answers

Option B is wrong because MAB requests can be processed by any policy set, not just the Default; the Default is not exclusively for MAB. Option C is wrong because the Default policy set handles all types of traffic, not just ISE internal traffic; internal traffic is typically handled by specific policy sets or system configurations. Option D is wrong because the Default policy set can be modified (e.g., you can change its conditions or authorization policies), though it cannot be deleted.

Full explanation →

222

MCQeasy

Which of the following describes the 'Standalone' deployment model?

A.PAN and PSN on separate nodes

B.Only PSN role is active

C.Multiple nodes in a cluster

D.All personas on a single node

AnswerD

Standalone places every persona — Policy Administration, Policy Service and Monitoring — on one node, with no distributed or dedicated split. This contrasts with Distributed, where personas are separated across nodes, and with the dedicated deployment variants.

Why this answer

The 'Standalone' deployment model in Cisco ISE refers to a configuration where all personas (Policy Administration Node, Policy Service Node, Monitoring and Troubleshooting Node) are installed on a single node. This is typical for small deployments or lab environments where high availability and scalability are not required. It simplifies management but lacks redundancy.

Exam trap

SISE often tests the confusion between standalone and distributed models, where candidates might think standalone means only one persona is active, rather than all personas on one node.

How to eliminate wrong answers

Option A is wrong because 'PAN and PSN on separate nodes' describes a distributed deployment, not standalone. Option B is wrong because 'Only PSN role is active' is not a deployment model; a standalone node runs all roles. Option C is wrong because 'Multiple nodes in a cluster' describes a distributed or high-availability deployment, not standalone.

Full explanation →

223

MCQhard

You are configuring a policy to block access for non-compliant devices. Where do you configure the posture status as a policy condition?

A.Authentication Policy

B.Authorization Policy

C.Endpoint Group

D.Identity Source

AnswerB

The Authorization Policy holds posture conditions, letting you permit or deny based on device compliance status. Configuring posture there enforces the block for non-compliant devices at the policy evaluation point, which is exactly the condition the scenario requires.

Why this answer

Posture status (e.g., Compliant, Non-Compliant, Unknown) is evaluated as a condition within the Authorization Policy, where ISE checks the posture result and applies the appropriate authorization profile — such as a quarantine VLAN or restricted dACL for non-compliant devices. The Authorization Policy is the correct location because posture is an authorization-time attribute, not an authentication-time one.

Exam trap

SISE often tests the confusion between authentication and authorization policies — candidates incorrectly assume posture (a post-authentication attribute) belongs in the Authentication Policy.

How to eliminate wrong answers

Option A is wrong because the Authentication Policy determines how the user/device is authenticated (e.g., 802.1X, MAB, web auth) and does not evaluate posture status. Option C is wrong because Endpoint Groups are used for profiling classification and identity grouping, not for posture-based access decisions. Option D is wrong because Identity Sources define where credentials are validated (AD, LDAP, internal users), not posture conditions.

Full explanation →

224

MCQhard

A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?

A.Configure individual dACLs for every employee

B.Hardcode ACLs on every access switch

C.Assign SGTs to the server subnet and the IT group, then apply an SGACL

D.Use standard RADIUS VLAN steering

AnswerC

Assigning security group tags to both the server subnet and the IT group lets Cisco TrustSec enforce access through a single SGACL, rather than maintaining per-subnet ACLs on every device. This satisfies the scalability constraint: group membership, not IP addressing, drives enforcement, so adding employees or servers requires no new rules.

Why this answer

Cisco TrustSec uses Security Group Tags (SGTs) and Security Group ACLs (SGACLs) to enforce policy based on group membership rather than IP addresses. Assigning an SGT to the server subnet and an SGT to the IT group, then applying an SGACL that permits IT-to-server and denies everyone else, is the most scalable approach because the policy is defined once and enforced across all TrustSec-enabled devices. This avoids per-device or per-user ACL maintenance.

Exam trap

SISE often tests the scalability advantage of TrustSec over traditional ACLs — candidates may choose dACLs or VLAN steering because they are familiar, but the question emphasizes 'most scalable' and 'specific server subnet' which points to SGT/SGACL.

How to eliminate wrong answers

Option A is wrong because configuring individual dACLs for every employee is not scalable — it requires a unique ACL per user and does not leverage group-based policy. Option B is wrong because hardcoding ACLs on every access switch is operationally intensive and error-prone, and it does not scale as the network grows. Option D is wrong because standard RADIUS VLAN steering only places users into VLANs; it does not provide the granular group-based filtering needed to block access to a specific server subnet while allowing IT.

Full explanation →

225

MCQmedium

What is the purpose of the 'Endpoint Identity Group' in the context of profiling?

A.To manage authentication credentials.

B.To store device hardware serial numbers.

C.To define which PSN handles the device.

D.To classify devices for use in authorization policy rules.

AnswerD

Endpoint Identity Groups classify profiled endpoints so authorization policy rules can reference them, satisfying the requirement to group devices by identity attributes rather than by static IP or subnet. Profiling feeds discovered attributes into these groups, letting policy conditions match device type, posture, or category during authorization decisions.

Why this answer

The Endpoint Identity Group in Cisco ISE is used to classify devices based on their profiling attributes. These groups are then referenced in authorization policy rules to apply appropriate access controls. For example, a group 'Printers' can be used in an authorization rule to grant printers access to specific network resources.

Thus, its primary purpose is to classify devices for use in authorization policy rules.

Exam trap

The trap here is confusing endpoint identity groups with user identity groups or with other ISE constructs like PSN assignment. Candidates might think endpoint identity groups store credentials or serial numbers, but they are purely for classification in authorization.

How to eliminate wrong answers

Option A is wrong because managing authentication credentials is the role of identity stores (e.g., Active Directory, LDAP), not endpoint identity groups. Option B is wrong because storing hardware serial numbers is not the purpose of endpoint identity groups; they store group membership, not detailed hardware attributes. Option C is wrong because defining which PSN handles the device is related to load balancing and node assignment, not to endpoint identity groups.

Full explanation →

Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) (SISE) — Questions 151–225