Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) SISE Questions 226–262 | Page 4/4

226

Multi-Selectmedium

Which TWO of the following are true about Shell Profiles? (Choose two)

Select 2 answers

A.They replace the need for accounting

B.They can include custom attributes for specific vendors

C.They define the command set to be used

D.They define the initial privilege level

E.They are used for RADIUS authentication only

AnswersB, D

Shell Profiles support vendor-specific attributes, letting you define custom RADIUS dictionary entries for non-standard attributes that particular network access devices require. This satisfies the stem's constraint by extending authorisation beyond built-in attributes, enabling granular policy enforcement for third-party vendors whose attributes Microsoft Entra ID does not natively recognise.

Why this answer

Shell Profiles in Cisco ISE (TACACS+) are policy elements that define the authorization attributes returned to a network device after successful authentication. Option B is correct because Shell Profiles can include custom attributes (such as Cisco AV pairs) tailored to specific vendors, allowing device-specific authorization behavior. Option D is correct because Shell Profiles define the initial privilege level (for example, privilege level 15) assigned to the user's session upon login.

Option A is incorrect because accounting is a separate TACACS+ function that logs user activity and is not replaced by Shell Profiles. Option C is incorrect because the command set is defined by Command Sets, not Shell Profiles, although both are authorization policy elements. Option E is incorrect because Shell Profiles are used with TACACS+ authorization, not exclusively with RADIUS authentication.

Exam trap

The trap is confusing shell profiles with command sets or accounting. Candidates might think shell profiles define the command set, but that's a separate configuration. Also, shell profiles are for TACACS+, not RADIUS.

Full explanation →

227

MCQmedium

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

A.Command Set

B.Shell Profile

C.Authorization Profile

D.Device Administration Policy

AnswerB

The shell profile result object carries the TACACS+ privilege level (priv-lvl) returned in the authorisation response, determining the CLI privilege the user receives after authentication. It satisfies the stem's requirement because device administration privilege is conveyed through this attribute, not through the authentication reply itself.

Why this answer

In Cisco ISE TACACS+ device administration, the Shell Profile is the result object that defines the privilege level (e.g., Privilege Level 15) assigned to a user after successful authentication and authorization. It is referenced within an Authorization Policy rule and returned as an AV-pair (such as shell:priv-lvl=15) to the network device, which then enforces the user's CLI privilege.

Exam trap

SISE often tests the distinction between the Shell Profile (which carries the privilege level AV-pair) and the Authorization Profile (which references it) — candidates frequently pick Authorization Profile thinking it directly sets privilege.

How to eliminate wrong answers

Option A is wrong because a Command Set defines which individual commands (permit/deny) a user may execute, not the overall privilege level. Option C is wrong because an Authorization Profile is a broader container that bundles shell profiles, command sets, and other attributes — it does not itself define the privilege level. Option D is wrong because Device Administration Policy is the overall policy framework (the rule set), not a result object that carries the privilege value.

Full explanation →

228

Multi-Selectmedium

When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?

Select 3 answers

A.ISE Live Logs

B.ISE Posture Reports

C.Cisco IOS syslog

D.AnyConnect VPN Gateway logs

E.AnyConnect DART bundle

AnswersA, B, E

ISE Live Logs show the authentication and authorisation decisions plus posture condition results for each session. They reveal which compliance check failed and the resulting authorisation profile, making them the primary troubleshooting source for posture failures.

Why this answer

ISE Live Logs (A) are the primary real-time troubleshooting tool because they show the posture policy evaluation, the exact posture condition that failed, and the authorization result for the session as it happens. ISE Posture Reports (B) aggregate posture compliance data and show which posture policies and conditions are failing across endpoints, which helps confirm the specific compliance check that caused the failure. The AnyConnect DART bundle (E) collects the client-side posture logs, including the Posture Agent (cscan/ISEPosture) and compliance module logs, which reveal why the endpoint's posture assessment failed on the client.

Cisco IOS syslog (C) only records router/switch events and does not contain posture policy evaluation details, and AnyConnect VPN Gateway logs (D) cover tunnel establishment and connection events rather than the posture compliance decision made by ISE.

Exam trap

The trap is selecting VPN gateway or IOS syslog as posture troubleshooting sources — candidates confuse VPN connectivity logs with posture compliance logs, which are separate subsystems.

Full explanation →

229

MCQhard

What is the purpose of the 'Guest Flow' setting in the Authorization Profile?

A.It defines the session timeout.

B.It enables MAC caching.

C.It defines the Guest Group.

D.It tells the ISE to trigger the Guest Portal.

AnswerD

The Guest Flow setting in an Authorization Profile instructs Cisco ISE to redirect the endpoint to the Guest Portal, satisfying the requirement to onboard unknown or unregistered guests. When applied, ISE returns a URL redirect in the authorisation result, forcing the supplicant's browser to the portal for registration or sponsor approval before network access is granted.

Why this answer

The 'Guest Flow' setting in an ISE Authorization Profile tells ISE to redirect the endpoint to the Guest Portal for registration or sponsorship, rather than granting normal network access. It is the mechanism that triggers the guest onboarding workflow when a user or device is not yet known to ISE. This is distinct from session timeout, MAC caching, or group definition, which are separate authorization attributes.

Exam trap

SISE often tests whether candidates confuse the Guest Flow attribute with other Authorization Profile attributes like session timeout or MAC caching, so the trap is selecting a plausible-sounding but functionally different authorization setting.

How to eliminate wrong answers

Option A is wrong because session timeout is configured via the 'Reauthentication' or 'Session Timeout' attributes in the Authorization Profile, not the Guest Flow setting. Option B is wrong because MAC caching is enabled through the 'MACSec' or 'MAC Caching' attributes and is used to remember a device's authorization result, not to trigger a guest portal. Option C is wrong because the Guest Group is defined in the guest sponsor or guest type configuration, not in the Authorization Profile's Guest Flow setting — the Guest Flow setting references the portal, not the group.

Full explanation →

230

MCQhard

A network administrator is implementing a TACACS+ command authorization policy on Cisco ISE for a group of network devices. The administrator wants to allow users in the 'NetOps' group to execute only 'show' commands and deny all other commands. The policy set for TACACS+ device administration is already configured with the correct conditions. Where in ISE should the administrator define the permitted commands and associate them with the 'NetOps' group?

A.In the External Identity Source configuration for the 'NetOps' group, add the permitted commands as attributes.

B.In the Authorization Policy, create a rule that references a Command Set containing the permitted 'show' commands, and set the condition to match the 'NetOps' group.

C.In the TACACS+ Command Authorization settings under Device Administration, create a command set and assign it directly to the user's group.

D.In the Policy Set's Allowed Protocols section, enable TACACS+ and specify the allowed command list.

AnswerB

In TACACS+ command authorization, the permitted commands are defined in a Command Set, which is then referenced in an Authorization Policy rule. The rule's condition matches the user's group, such as 'NetOps'. This ensures that only the commands in the Command Set are allowed, and all others are denied by default. This is the correct location to define and associate command permissions.

Why this answer

For TACACS+ command authorization in Cisco ISE, you define a Command Set that lists the allowed commands, and then reference that Command Set in an Authorization Policy rule. The rule's condition matches the user's group, such as 'NetOps'. This approach ensures that only the commands in the Command Set are permitted, and any command not explicitly allowed is denied.

The other options describe incorrect locations or methods for defining command permissions.

Exam trap

The trap here is confusing the TACACS+ command authorization configuration area with the Authorization Policy, where command sets are actually referenced and applied.

Full explanation →

231

MCQmedium

You are configuring a device sensor on a Cisco switch to help with ISE profiling. What is the primary benefit of using Device Sensor?

A.It replaces the need for DHCP snooping.

B.It allows the switch to act as a RADIUS server.

C.It enables the switch to send collected device attributes to ISE via RADIUS accounting.

D.It increases the throughput of the switch.

AnswerC

Device Sensor collects attributes such as DHCP, CDP, LLDP and HTTP data from endpoints and forwards them to ISE within RADIUS accounting packets. This enriches ISE profiling without extra probes, satisfying the requirement to profile devices via the switch itself.

Why this answer

The primary benefit of Device Sensor on a Cisco switch is that it collects device attributes (e.g., CDP, LLDP, DHCP, HTTP) and sends them to Cisco ISE via RADIUS accounting packets. This enriches ISE's profiling database, allowing ISE to more accurately identify and classify endpoints. Device Sensor offloads the collection from ISE to the switch, improving scalability and reducing network traffic.

Exam trap

The trap is confusing Device Sensor with DHCP snooping or RADIUS server functionality; candidates must remember that Device Sensor is about collecting and forwarding device attributes to ISE for profiling.

How to eliminate wrong answers

Option A is wrong because Device Sensor does not replace DHCP snooping; DHCP snooping is a security feature that filters DHCP messages, while Device Sensor collects attributes for profiling. Option B is wrong because Device Sensor does not turn the switch into a RADIUS server; the switch remains a RADIUS client. Option D is wrong because Device Sensor does not increase switch throughput; it may add slight overhead due to packet inspection.

Full explanation →

232

MCQmedium

How does Cisco ISE handle requests that do not match any configured TACACS+ Authorization Policy?

A.It defaults to local switch authentication

B.It prompts the user to select a profile

C.It permits access with default privileges

D.It denies access

AnswerD

Unmatched TACACS+ authorisation requests trigger ISE's implicit deny, returning an ACCESS-REJECT to the network device. This satisfies the default-deny constraint: no explicit rule means no authorisation, so the session cannot proceed. Unlike authentication, authorisation requires a matching policy set; absent one, ISE withholds all privileges rather than permitting fallback access.

Why this answer

Cisco ISE uses a default-deny model for TACACS+ authorization: if an authorization request does not match any configured policy rule, ISE returns a deny, and the device will not grant the requested command or privilege. This mirrors the implicit deny at the end of an ACL and ensures no unauthorized access is granted by omission.

Exam trap

SISE often tests the implicit deny in TACACS+ authorization, so candidates who assume ISE 'fails open' or falls back to local authentication on a policy miss will choose the wrong answer.

How to eliminate wrong answers

Option A is wrong because ISE does not fall back to local switch authentication on a policy miss; local fallback only occurs if the device is configured for it and ISE is unreachable, not when a policy simply does not match. Option B is wrong because TACACS+ authorization is a machine-to-machine exchange with no interactive prompt to select a profile. Option C is wrong because permitting access with default privileges would be a fail-open behavior, which contradicts ISE's default-deny authorization model.

Full explanation →

233

Multi-Selectmedium

Which TWO of the following settings are available for customizing the guest portal login page?

Select 2 answers

A.Selection of the switch interface.

B.Inclusion of a mandatory AUP checkbox.

C.Direct editing of the Apache server config files.

D.Configuration of the RADIUS shared secret.

E.Modification of the login form header and footer text.

AnswersB, E

The guest portal supports a mandatory Acceptable Use Policy checkbox, forcing guests to acknowledge terms before gaining network access. This satisfies the customization requirement by adding a compliance gate to the login page, enforceable per portal profile.

Why this answer

Option B is correct because guest portal configurations in ClearPass (and similar NAC solutions) allow administrators to enable a mandatory Acceptable Use Policy checkbox that users must acknowledge before authenticating, which is a standard customization on the login page. Option E is correct because the login form's header and footer text are editable fields within the guest portal customization settings, letting administrators add branding, instructions, or legal notices. Option A is not a guest portal login page setting; switch interface selection relates to network infrastructure configuration, not portal appearance.

Option C is incorrect because direct editing of Apache server config files is not a supported or exposed customization method in the portal UI and would be an unsupported modification. Option D is incorrect because the RADIUS shared secret is an authentication service configuration parameter, not a login page customization option.

Exam trap

SISE often tests the boundary between portal-level customization (header/footer, AUP) and infrastructure-level settings (switch interface, RADIUS secret) — candidates pick infrastructure options that sound related but are configured elsewhere.

Full explanation →

234

MCQeasy

In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?

A.To manage the list of sponsors.

B.To define the portal look and feel.

C.To define attributes like account lifetime and access policies for guest accounts.

D.To configure the RADIUS server settings.

AnswerC

Guest Types define the templates applied to guest accounts, specifying attributes such as account lifetime and the access policies governing them. This configuration therefore controls how long guests remain valid and what they may reach within the Guest flow.

Why this answer

Guest Types in ISE define the template for guest accounts, including account lifetime (duration), maximum simultaneous logins, and the access policies (authorization profiles) that apply to that type of guest. They allow administrators to create different classes of guests (e.g., short-term visitor vs. long-term contractor) with distinct attributes.

Exam trap

SISE often tests the purpose of Guest Types versus other guest configuration objects, so candidates who confuse Guest Types with sponsor groups or portal customization will choose the wrong answer.

How to eliminate wrong answers

Option A is wrong because sponsor management is handled under Sponsor Groups and Sponsor Portals, not Guest Types. Option B is wrong because portal look and feel is configured in the Portal Customization settings, not Guest Types. Option D is wrong because RADIUS server settings are configured under Network Devices and RADIUS configurations, not Guest Types.

Full explanation →

235

MCQeasy

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

A.To provide a VPN tunnel to the internal network

B.To manage the user's Active Directory account

C.To scan the device for malware before allowing network access

D.To configure the native supplicant settings for secure network access

AnswerD

The Network Setup Assistant provisions BYOD endpoints by configuring the native supplicant with the correct SSID, authentication method and certificates. This satisfies the requirement for secure network access without manual user configuration, enabling devices to authenticate against ISE policies.

Why this answer

The Network Setup Assistant (NSA) is a client-side provisioning component in Cisco ISE BYOD flows that walks the end user through configuring the native supplicant (Windows WLAN AutoConfig, macOS, iOS, Android, etc.) with the correct SSID, EAP method (PEAP/EAP-TLS), and certificate settings so the device can authenticate via 802.1X. It is downloaded from the ISE Guest/BYOD portal and runs locally on the endpoint to install the required profile. This enables secure EAP-based network access without manual supplicant configuration by the user.

Exam trap

SISE often tests the confusion between the NSA (client-side supplicant provisioning) and ISE's server-side posture, profiling, and VPN functions — candidates pick 'malware scan' or 'VPN' because those are ISE features, but they are not what the NSA does.

How to eliminate wrong answers

Option A is wrong because VPN tunneling is provided by ISE's VPN posture/ASA integration or a separate VPN headend, not by the NSA — the NSA configures 802.1X supplicant settings, not IPsec/SSL tunnels. Option B is wrong because Active Directory account management is handled by ISE's external identity source integration (AD join, LDAP lookups), not by a client-side setup wizard. Option C is wrong because malware scanning is a posture assessment function performed by the ISE posture agent and third-party AV/AS plugins, not by the NSA, which only provisions supplicant configuration.

Full explanation →

236

Multi-Selecthard

Which TWO of the following are true regarding the order of operations in Cisco ISE policy evaluation?

Select 2 answers

A.All policy sets are evaluated simultaneously

B.Policy sets are evaluated from top to bottom based on the list order

C.Authorization policies are evaluated before authentication policies

D.Authorization rules are evaluated from top to bottom

E.The default policy set can be deleted

AnswersB, D

Cisco ISE processes policy sets sequentially in their configured list order, so the first matching set wins and subsequent sets are skipped. This top-to-bottom evaluation satisfies the ordering constraint, meaning set placement directly determines which authentication and authorisation logic applies to a request.

Why this answer

Option B is correct because Cisco ISE evaluates policy sets sequentially in the order they appear in the Policy Sets list, from top to bottom, and stops at the first policy set whose conditions match the request. Option D is correct because within a matched policy set, authorization rules are also evaluated top to bottom, and the first rule whose conditions match is applied (unless the rule is configured to continue). Option A is wrong because policy sets are not evaluated simultaneously; ISE processes them in a defined sequential order.

Option C is wrong because authentication policies are always evaluated before authorization policies within a policy set—a user must be authenticated before authorization rules can be applied. Option E is wrong because the default policy set in Cisco ISE cannot be deleted, ensuring there is always a fallback for unmatched requests.

Exam trap

The trap here is assuming that policy sets or authorization rules are evaluated in parallel or that authorization precedes authentication. Candidates might also think the default policy set can be deleted, but it is a permanent fixture in ISE.

Full explanation →

237

MCQmedium

You are reviewing the ISE logs and see that the Guest Portal authentication is failing. Where should you look to find the exact reason for the failure?

A.Operations > RADIUS Livelogs

B.Monitoring > Reports > Guest

C.Policy > Policy Sets

D.Administration > System > Logging

AnswerA

RADIUS Livelogs under Operations capture authentication transactions in real time, showing the precise failure reason and policy stage where the Guest Portal request was rejected. This granular detail is unavailable in general reports or dashboard summaries.

Why this answer

Operations > RADIUS Livelogs provides real-time, detailed RADIUS authentication and authorization logs, including the exact failure reason for guest portal authentication attempts. It shows the full RADIUS request/response exchange, the policy set matched, and any error codes. This is the primary place to diagnose why a guest authentication is failing.

Exam trap

SISE often tests the difference between Live Logs (real-time RADIUS details) and Reports (historical summaries), so candidates who need the exact failure reason but pick a report or policy page miss the diagnostic tool that actually contains the error code.

How to eliminate wrong answers

Option B is wrong because Monitoring > Reports > Guest provides historical guest activity and accounting summaries, not the granular RADIUS failure reason. Option C is wrong because Policy > Policy Sets is where policies are configured, not where authentication failures are logged. Option D is wrong because Administration > System > Logging configures logging levels and targets, not the authentication failure details.

Full explanation →

238

MCQmedium

Which AnyConnect module is specifically required to perform posture assessment in ISE?

A.AnyConnect AMP Enabler

B.AnyConnect Compliance Module

C.AnyConnect Web Security Module

D.AnyConnect VPN Module

AnswerB

The AnyConnect Compliance Module performs the actual posture assessment on the endpoint, collecting attributes such as antivirus status and OS patches. Without it, ISE receives no posture data, so the Compliance Module is the specific component required for posture evaluation.

Why this answer

The AnyConnect Compliance Module is the component that performs posture assessment on the endpoint. It collects information about the device's security state (e.g., antivirus, firewall, OS patches) and reports it to ISE for policy evaluation.

Exam trap

The trap is confusing the Compliance Module with other AnyConnect modules like AMP Enabler or Web Security; the exam expects you to know that posture assessment specifically requires the Compliance Module.

How to eliminate wrong answers

Option A is wrong because AMP Enabler is for deploying Advanced Malware Protection, not posture. Option C is wrong because Web Security Module provides web filtering, not posture assessment. Option D is wrong because VPN Module is for establishing VPN connections, not posture.

Full explanation →

239

MCQhard

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

A.The agent automatically remediates the issue

B.The device is granted full access

C.The posture agent crashes

D.The device remains Non-Compliant

AnswerD

Posture evaluation records the endpoint's compliance state independently of remediation. Without a configured remediation action, no corrective step is triggered, so the device simply stays in the Non-Compliant state and remains subject to whatever authorisation result that status produces.

Why this answer

If an endpoint is determined to be Non-Compliant and no remediation action is configured, the device remains Non-Compliant. The posture policy will not automatically remediate or grant full access; the status persists until remediation is applied or the policy changes. Thus, option D is correct.

Exam trap

The trap is thinking that ISE automatically remediates or grants access when no remediation is configured, but the status simply remains non-compliant.

How to eliminate wrong answers

Option A is wrong because automatic remediation requires a configured remediation action; without it, no remediation occurs. Option B is wrong because granting full access would violate the posture policy; non-compliant devices are typically restricted. Option C is wrong because the posture agent does not crash due to missing remediation; it simply reports the status.

Full explanation →

240

MCQeasy

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

A.Policy Set Condition

B.Authorization Profile

C.Identity Source Sequence

D.Authentication Policy

AnswerB

The Authorization Profile is the reusable object that carries VLAN and other attributes, which ISE returns in the RADIUS Access-Accept once a matching authorization rule fires. Referencing it in the policy satisfies the stem's requirement to assign a specific VLAN to the wireless client.

Why this answer

The Authorization Profile in Cisco ISE is where you set attributes like VLAN assignment, dACL, SGT, and reauthentication timers that are returned to the NAD after successful authorization. For wireless clients, the VLAN is typically delivered via RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) configured in the Authorization Profile.

Exam trap

The trap is confusing the Authorization Policy with the Authentication Policy — VLAN assignment is an authorization result, so it belongs in the Authorization Profile, not in authentication or policy set conditions.

How to eliminate wrong answers

Option A is wrong because Policy Set Conditions determine which policy set applies to a session (based on attributes like SSID or location) but do not carry VLAN assignment values. Option C is wrong because Identity Source Sequences define the order in which identity stores are queried during authentication, not authorization results. Option D is wrong because the Authentication Policy determines how the user or device is authenticated (e.g., which protocol and identity store), not what VLAN they receive.

Full explanation →

241

MCQeasy

Which service is required to be enabled on a PSN to allow it to receive RADIUS requests from network access devices?

A.Policy Service

B.Registration Service

C.Administration Service

D.Monitoring Service

AnswerA

The Policy Service must be enabled on the Policy Service Node so it can accept and process RADIUS requests from network access devices. Without it, the PSN cannot act as a RADIUS server, so authentication and authorisation requests from NADs are dropped.

Why this answer

The Policy Service is the Cisco ISE service that must be enabled on a Policy Services Node (PSN) to allow it to receive RADIUS requests from network access devices (NADs). The Policy Service handles authentication, authorization, and accounting (AAA) decisions for RADIUS traffic. Without it, the PSN cannot process RADIUS requests.

Exam trap

SISE often tests the confusion between ISE node services — candidates pick Registration or Monitoring Service, forgetting that only the Policy Service handles RADIUS request processing.

How to eliminate wrong answers

Option B is wrong because the Registration Service is used for node registration and communication with the PAN, not for receiving RADIUS requests. Option C is wrong because the Administration Service is for management and configuration, not RADIUS processing. Option D is wrong because the Monitoring Service handles logging, reporting, and troubleshooting, not RADIUS authentication.

Full explanation →

242

Multi-Selectmedium

Which TWO of the following are valid locations to check for policy match results in ISE?

Select 2 answers

A.Device Administration console

B.Live Logs

C.Identity Group properties

D.Policy Simulation tool

E.RADIUS Secret settings

AnswersB, D

Live Logs display authentication and authorisation events in real time, including the matched policy set, matched authorisation rule and final result for each session. This makes them a valid location to check policy match results, satisfying the stem's requirement.

Why this answer

Option B (Live Logs) is correct because ISE's Live Logs (Operations > Live Logs / RADIUS Live Logs) display real-time authentication and authorization results, including which policy set, authentication rule, and authorization rule matched for each session. Option D (Policy Simulation tool) is correct because the Policy Simulation tool lets you run a simulated authentication/authorization request and shows the exact policy match results, including the matched policy set and rules, without affecting live traffic. Option A (Device Administration console) is incorrect because it is a TACACS+ management area for device administration, not a location for viewing policy match results.

Option C (Identity Group properties) is incorrect because identity groups only define group membership and attributes, not policy evaluation results. Option E (RADIUS Secret settings) is incorrect because it only configures the shared secret used between the NAD and ISE, not policy match outcomes.

Exam trap

The trap is that candidates might think policy match results are only visible in Live Logs, but the Policy Simulation tool also provides this information, and the question asks for TWO valid locations.

Full explanation →

243

MCQmedium

A security engineer is configuring a Cisco ISE guest portal for a conference. Attendees must be able to create their own accounts but must first receive a one-time code via SMS to validate their phone number. The SMS gateway has already been integrated with ISE. Which guest portal flow should the engineer select to meet this requirement?

A.Self-Registered Guest Flow with SMS validation

B.BYOD Onboarding Flow

C.Hotspot Guest Flow

D.Sponsored Guest Flow

AnswerA

The Self-Registered Guest Flow allows guests to create their own accounts. When SMS validation is enabled, ISE sends a one-time code to the provided mobile number, and the guest must enter it correctly to complete registration. This exactly matches the requirement that attendees validate their phone number before gaining access.

Why this answer

The Self-Registered Guest Flow enables guests to create their own accounts without sponsor intervention. Enabling SMS validation within that flow forces the guest to enter a one-time code sent to their mobile phone, confirming the number is valid. The other flows either skip identity validation entirely, require a sponsor, or serve a different purpose such as device onboarding.

Exam trap

The trap here is assuming that any guest flow can be combined with SMS validation, when in fact SMS validation is a specific option available only within the Self-Registered Guest Flow configuration.

Full explanation →

244

MCQmedium

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

A.To force the port to shutdown

B.To provide internet access to guests

C.To perform vulnerability scanning

D.To test the policy before enforcing access control

AnswerD

Monitoring Mode lets Cisco ISE evaluate a device against policy and log the resulting authorisation decision without applying enforcement, such as a downloadable ACL or VLAN change. This satisfies the stem's requirement to test policy safely before enabling enforcement, revealing misconfigurations or profiling gaps while the port still permits traffic.

Why this answer

Monitoring Mode in Cisco ISE is a deployment phase where the switch port is configured to authenticate and authorize endpoints but does not enforce the result. The purpose is to test policies and gather data without impacting network access, allowing administrators to validate configurations before moving to enforcement. Thus, the correct answer is to test the policy before enforcing access control.

Exam trap

The trap is confusing Monitoring Mode with enforcement modes, leading candidates to think it blocks or remediates, when it only observes.

How to eliminate wrong answers

Option A is wrong because Monitoring Mode does not shut down the port; it allows traffic to flow. Option B is wrong because providing internet access to guests is not the purpose of Monitoring Mode; guest access is a separate feature. Option C is wrong because vulnerability scanning is not performed in Monitoring Mode; that is a function of posture assessment or dedicated scanners.

Full explanation →

245

Multi-Selectmedium

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

Select 2 answers

A.Install a dedicated agent on every switch

B.Enable BYOD settings in the device portal configuration

C.Create a local user account for every device

D.Configure an Authorization Policy to redirect BYOD users

E.Disable RADIUS authentication

AnswersB, D

BYOD cannot function unless the device portal configuration explicitly enables BYOD settings; without this toggle, ISE never presents the registration and provisioning portal to supplicants, so the mandatory BYOD flow fails before certificate enrolment begins.

Why this answer

Option B is correct because enabling BYOD settings in the device portal configuration is a mandatory step: the Cisco ISE device portal (the client provisioning and BYOD portal) must have BYOD functionality turned on so that endpoints can be onboarded, registered, and have supplicant/certificate provisioning performed. Option D is correct because a mandatory part of BYOD is an authorization policy that matches non-compliant or unregistered BYOD endpoints and redirects them to the BYOD/guest portal for onboarding, typically using a redirect URL (e.g., the client provisioning portal) before granting full network access. Option A is incorrect because BYOD onboarding does not require installing a dedicated agent on every switch; Cisco ISE uses RADIUS, web portals, and supplicant provisioning instead.

Option C is incorrect because BYOD does not require creating a local user account for every device; identity is handled through ISE's identity stores, certificates, and endpoint registration. Option E is incorrect because disabling RADIUS authentication would break the 802.1X/MAC authentication and authorization that ISE relies on for BYOD, so it is the opposite of a required step.

Exam trap

SISE often tests whether candidates know that BYOD requires both portal configuration and an authorization policy redirect, so candidates who pick 'install an agent on switches' or 'create local accounts' misunderstand the architecture.

Full explanation →

246

MCQhard

If a PSN loses connectivity to the PAN, what happens to existing user sessions?

A.All sessions are terminated

B.Sessions remain active and the PSN continues to authenticate

C.The PSN enters emergency mode

D.The PSN reboots

AnswerB

PSNs cache policy and authentication data locally, so if PAN connectivity drops, existing sessions stay active and the PSN continues authenticating users. Only administrative configuration changes are unavailable until the PAN link restores, preserving service availability.

Why this answer

When a PSN loses connectivity to the PAN, existing user sessions remain active and the PSN continues to authenticate new sessions using its last known policy configuration. This is by design to maintain network access during PAN outages.

Exam trap

SISE often tests the misconception that PSNs are entirely dependent on the PAN for authentication, when in fact they are designed for resilient standalone operation during PAN outages.

How to eliminate wrong answers

Option A is wrong because ISE does not terminate existing sessions on PAN loss; sessions persist to avoid disrupting users. Option C is wrong because there is no 'emergency mode' in ISE; the PSN simply operates in a standalone-like state. Option D is wrong because the PSN does not reboot on PAN loss; it continues running with cached policies.

Full explanation →

247

MCQhard

You are using the Feed Service to update your profiling policies. How can you ensure that custom profiling policies you have created are not overwritten during the update?

A.Custom policies are not affected by Feed Service updates.

B.Place custom policies in the system policy folder.

C.Export custom policies before every update.

D.Disable automatic updates.

AnswerA

Feed Service updates only refresh the built-in Cisco predefined policies; user-created custom policies are stored separately and are never overwritten or removed during a feed synchronisation, so no export or backup step is required to preserve them.

Why this answer

Cisco ISE's Feed Service updates only the system-provided profiling policies that ship with ISE; custom profiling policies created by administrators are stored separately and are not overwritten or removed during a feed update. This design lets organizations receive updated fingerprints for new device types without losing their own customizations.

Exam trap

SISE often tests the misconception that feed updates overwrite all profiling policies, when in fact only system policies are updated and custom policies are preserved.

How to eliminate wrong answers

Option B is wrong because there is no 'system policy folder' concept in ISE profiling — custom policies are simply stored as user-created objects and are inherently separate from feed-managed system policies. Option C is wrong because exporting custom policies before every update is unnecessary; the Feed Service does not touch custom policies, so there is nothing to protect against. Option D is wrong because disabling automatic updates would prevent you from receiving new system fingerprints and is not a mechanism for protecting custom policies — it is an overreaction based on a misunderstanding of how the feed works.

Full explanation →

248

MCQhard

You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?

A.The device is using a static IP.

B.The necessary probes are not receiving enough attributes to match a policy.

C.The endpoint is not authenticated.

D.The endpoint has a firewall enabled.

AnswerB

Insufficient attributes prevent profiling policies from matching, so the endpoint remains Unknown despite being a Windows workstation. Profiling relies on probes collecting enough identity attributes to satisfy a policy condition; without that threshold, no profile is assigned. This directly addresses the stem's constraint: the workstation is visible but unclassified.

Why this answer

Profiling in ISE relies on collecting attributes from various probes (DHCP, HTTP, RADIUS, SNMP, etc.) and matching them against profiling policies. If the endpoint shows as 'Unknown', the most likely cause is that the probes are not receiving enough attributes — or the attributes received do not match any existing policy condition. Without sufficient attribute data, ISE cannot classify the device even if it is obviously a Windows workstation to a human.

Exam trap

SISE often tests whether candidates blame authentication or IP configuration for profiling failures, when the real issue is almost always missing probe attributes or a policy mismatch — the exam expects you to know profiling is attribute-driven, not auth-driven.

How to eliminate wrong answers

Option A is wrong because a static IP does not prevent profiling; ISE can still profile based on DHCP, HTTP, and other attributes, and static IP is common in some environments without causing 'Unknown' status. Option C is wrong because authentication is separate from profiling — an endpoint can be profiled even if it only does MAC authentication bypass (MAB) or no authentication at all, as long as probes collect attributes. Option D is wrong because a host firewall may block some probes (like SNMP or WMI), but it does not inherently prevent profiling via DHCP/HTTP/RADIUS, and it is not the most likely generic cause.

Full explanation →

249

MCQeasy

Which license type is required to enable advanced profiling and posture services on Cisco ISE?

A.ISE Premier

B.Device Admin License

C.ISE Essentials

D.ISE Advantage

AnswerD

ISE Advantage is the licence tier that unlocks advanced profiling and posture services; lower tiers such as Base or Plus do not include them. This satisfies the stem's constraint of enabling both advanced profiling and posture on the deployment.

Why this answer

Cisco ISE Advantage is the highest-tier license and is required for advanced profiling and posture services. Profiling collects endpoint attributes to classify devices, while posture assesses endpoint compliance (e.g., antivirus, OS patches) before granting access. These features are exclusive to the Advantage license; lower tiers like Essentials or Premier do not include them.

The Device Admin license is for TACACS+ device administration, not for profiling or posture.

Exam trap

SISE often tests the specific license tiers and their feature sets, and candidates frequently confuse Premier with Advantage, assuming Premier includes all advanced features. The trap is that profiling and posture are exclusively Advantage features, not Premier.

How to eliminate wrong answers

Option A is wrong because ISE Premier includes advanced features like BYOD and guest, but not profiling or posture. Option B is wrong because Device Admin License is specifically for TACACS+ command authorization and device administration, not for endpoint profiling or posture. Option C is wrong because ISE Essentials is the base license providing basic AAA and guest services, lacking advanced profiling and posture capabilities.

Full explanation →

250

Multi-Selectmedium

Which THREE of the following items must be configured to ensure a successful SNMP Trap profiling implementation?

Select 3 answers

A.Add the network switch to the ISE Network Devices list.

B.Enable the SNMP Trap probe on the ISE PSN.

C.Enable HTTP probe.

D.Configure the network switch to send SNMP traps to the ISE PSN.

E.Configure DHCP Snooping.

AnswersA, B, D

Adding the switch to the ISE Network Devices list registers it as a known NAD, so ISE accepts and processes SNMP trap packets originating from that device's IP address. Without this entry, traps are discarded as untrusted, breaking the profiling feed.

Why this answer

Option A is correct because the switch sending SNMP traps must exist as a Network Device in ISE, which provides the shared secret and device definition ISE uses to authenticate and process incoming SNMP traffic from that switch. Option B is correct because the SNMP Trap probe must be enabled on the ISE PSN that will receive the traps; without this probe running, ISE will not listen for or process SNMP trap notifications. Option D is correct because the switch itself must be configured with the ISE PSN as a trap destination (snmp-server host <PSN-IP> ...), otherwise no traps are ever sent to ISE and profiling data is never collected.

Option C is not required because the HTTP probe is used for HTTP-based profiling (User-Agent, URL data) and is unrelated to receiving SNMP traps. Option E is not required because DHCP Snooping is a Layer 2 switch security feature for DHCP traffic, not a prerequisite for SNMP Trap profiling.

Exam trap

SISE often tests the misconception that enabling the SNMP Trap probe alone is sufficient, causing candidates to overlook the mandatory Network Devices entry and the switch-side trap destination configuration.

Full explanation →

251

Multi-Selectmedium

Which THREE of the following are found in an Authorization Profile's 'Advanced Attributes'?

Select 3 answers

A.Vendor Specific Attributes (VSAs)

B.Custom RADIUS attributes

C.Policy Set conditions

D.Device admin rules

E.Attribute name/value pairs

AnswersA, B, E

Vendor Specific Attributes appear under Advanced Attributes because they extend RADIUS beyond standard IETF dictionaries, letting Cisco ISE return vendor-defined values such as Cisco-AVPair. This satisfies the stem's requirement for attributes carried in the profile's advanced section rather than the common authentication or authorisation fields.

Why this answer

In Cisco ISE, an Authorization Profile's Advanced Attributes section is where you define RADIUS return attributes that are not part of the standard simple attribute list. Option A is correct because Vendor Specific Attributes (VSAs), such as Cisco-AVPair or other vendor-defined RADIUS attributes, are configured there to send vendor-specific authorization data to the NAD. Option B is correct because Custom RADIUS attributes (user-defined RADIUS dictionary attributes) are also added through Advanced Attributes.

Option E is correct because the Advanced Attributes area lets you specify attribute name/value pairs (for example, cisco-av-pair = ...) that are returned in the Access-Accept. Option C is not correct because Policy Set conditions are evaluated in the policy set's authentication/authorization rules, not inside an Authorization Profile. Option D is not correct because Device Admin rules are a separate policy construct for TACACS+ device administration, not an Authorization Profile advanced attribute.

Exam trap

SISE often tests whether candidates confuse policy-level constructs (conditions, device admin rules) with result-level payloads — Advanced Attributes is strictly about what gets returned in the RADIUS response, not how the rule is matched.

Full explanation →

252

Multi-Selectmedium

Which THREE of the following are valid types of Client Provisioning Resources?

Select 3 answers

A.AnyConnect Profile (XML)

B.Windows Update Agent

C.Compliance Module

D.AnyConnect Core Package

E.Antivirus definition files

AnswersA, C, D

AnyConnect Profile (XML) is a valid Client Provisioning Resource in ISE, delivering VPN client profiles and settings to endpoints. It satisfies the stem's requirement by being one of the recognised resource types alongside agent packages and compliance modules used for provisioning.

Why this answer

In Cisco ISE Client Provisioning, the valid Client Provisioning Resource types include the AnyConnect Profile (XML), which delivers an XML configuration profile that defines VPN, posture, and connection settings to the AnyConnect client, so option A is correct. The Compliance Module is also a valid resource type, as it supplies the posture assessment components (such as OPSWAT libraries) that the AnyConnect posture agent uses to evaluate endpoint compliance, making option C correct. The AnyConnect Core Package is likewise a valid Client Provisioning Resource, since it is the actual AnyConnect client installer package provisioned to endpoints, so option D is correct.

Option B (Windows Update Agent) is not a Client Provisioning Resource type in ISE, and option E (Antivirus definition files) is not provisioned as a client provisioning resource either, as antivirus definitions are handled by the AV vendor rather than ISE client provisioning.

Exam trap

SISE often tests the distinction between Client Provisioning Resources and Posture Conditions/Remediations, causing candidates to mistakenly select items like Windows Update Agent or Antivirus definition files, which are used for posture assessment but are not provisioned as resources.

Full explanation →

253

MCQhard

You want to enforce a policy where personal devices are allowed access, but only if they are not jailbroken. How is this achieved in a BYOD scenario?

A.Use ISE profiling only

B.Use an ACL on the switch

C.Configure a WLC-based check

D.Integrate an MDM that performs jailbreak detection

AnswerD

Jailbreak detection requires an MDM integration, because only an MDM agent on the device can inspect for compromised or rooted state and report it to the policy engine. This satisfies the stem's constraint of allowing personal devices only when not jailbroken.

Why this answer

Jailbreak (root) detection requires inspecting the device's OS integrity state — checking for modified system partitions, sideloaded root binaries (e.g., Cydia, Magisk), or disabled code signing. ISE cannot natively detect jailbreaks because profiling only inspects network-visible attributes like DHCP fingerprints, MAC OUI, and HTTP user-agent strings. An MDM agent runs on the endpoint with elevated privileges and can query the OS for tampering indicators, then report compliance status back to ISE via the MDM API (e.g., Cisco MDM/EMM integration using the Cisco ISE MDM REST API), enabling a posture-based authorization decision.

Exam trap

SISE often tests the misconception that ISE profiling alone can enforce endpoint integrity — candidates confuse device identification (profiling) with device compliance (posture/MDM), which are separate ISE functions.

How to eliminate wrong answers

Option A is wrong because ISE profiling only identifies device type and OS via passive/active probes (DHCP, SNMP, NetFlow, HTTP) and cannot inspect the filesystem for root/jailbreak artifacts. Option B is wrong because a switch ACL filters L3/L4 traffic by IP/port and has no visibility into endpoint OS integrity. Option C is wrong because a WLC-based check only inspects wireless-layer attributes (SSID, 802.1X, RF data) and cannot detect jailbreak state on the endpoint.

Full explanation →

254

MCQmedium

When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?

A.It enables RADIUS for this device

B.It enables TACACS+ services for this device

C.It forces the switch to use SNMP

D.It automatically configures the switch via CLI

AnswerB

Ticking TACACS+ Authentication Settings on the network device entry activates the TACACS+ shared secret and service for that node, allowing it to send device-administration authentication requests to ISE. Without it, only RADIUS-based services are processed for that device.

Why this answer

When adding a network device in ISE, checking the 'TACACS+ Authentication Settings' checkbox enables TACACS+ services for that device, allowing ISE to process TACACS+ authentication, authorization, and accounting requests from it. This is separate from RADIUS configuration, which is controlled by the RADIUS settings on the same device entry. Enabling TACACS+ is a prerequisite for using ISE for device administration (AAA) on that network device.

Exam trap

SISE often tests the confusion between RADIUS and TACACS+ enablement on a network device, where the TACACS+ checkbox only enables TACACS+ services, not RADIUS.

How to eliminate wrong answers

Option A is wrong because the checkbox specifically enables TACACS+, not RADIUS; RADIUS is enabled via a separate RADIUS settings section on the device configuration. Option C is wrong because SNMP is a monitoring protocol and is not enabled or forced by the TACACS+ checkbox. Option D is wrong because ISE does not automatically configure the switch via CLI; the checkbox only enables ISE to accept TACACS+ requests from the device, and the device must be manually configured to point to ISE.

Full explanation →

255

Multi-Selecthard

Which TWO of the following steps are required to implement SGT-based enforcement using an SXP connection?

Select 2 answers

A.Apply a dACL to every port

B.Define the SGT mapping in the ISE TrustSec configuration

C.Enable TACACS+ on the NAD

D.Configure the SXP connection between the ISE node and the NAD

E.Enable 802.1X on all switch ports

AnswersB, D

Defining SGT mappings in ISE TrustSec configuration is essential because SXP propagates these group assignments to enforcement devices. Without the mapping, ISE cannot translate source identities into SGT values, so the SXP connection has nothing to publish. This satisfies the requirement for SGT-based enforcement by establishing the authoritative tag-to-identity bindings.

Why this answer

To implement SGT-based enforcement over an SXP connection, you must first define the SGT mapping in the ISE TrustSec configuration (option B), because ISE needs the IP-to-SGT bindings that it will propagate to the network device. You must also configure the SXP connection between the ISE node and the NAD (option D), since SXP is the protocol that carries those SGT-to-IP mappings from ISE to the switch or router that enforces the tags. Applying a dACL to every port (option A) is not required for SGT propagation and is a separate enforcement mechanism.

Enabling TACACS+ on the NAD (option C) is for device administration/AAA, not for SXP-based SGT transport. Enabling 802.1X on all switch ports (option E) is an authentication method and is not mandatory for SXP-based SGT enforcement.

Exam trap

The trap is confusing SGT propagation mechanisms — candidates may pick 802.1X or dACL options because they associate SGTs with those features, but SXP specifically requires the SGT mapping definition and the SXP connection, nothing more.

Full explanation →

256

MCQmedium

You are deploying a Posture agent using the Web Agent. Which mechanism does the Web Agent use to perform compliance checks on a Windows machine?

A.It performs deep packet inspection to determine compliance.

B.It requires the full AnyConnect VPN client to be pre-installed.

C.It communicates directly with the Microsoft Update server.

D.It relies on WMI calls initiated by the ISE server.

E.It uses a temporary ActiveX or Java component to scan the system.

AnswerE

The Web Agent performs posture checks by downloading a temporary ActiveX or Java component that runs locally to inspect the Windows endpoint, satisfying the requirement for compliance assessment without a persistent agent. This browser-based mechanism enables the Web Agent to evaluate device state directly, which is precisely how it fulfils the scenario's posture-check constraint.

Why this answer

The Cisco ISE Web Agent is a clientless posture solution that uses a temporary ActiveX control (for Internet Explorer) or Java applet (for other browsers) to perform posture checks on Windows machines. This component is downloaded and executed within the browser session to gather endpoint information such as antivirus status, OS patches, and registry settings. Once the compliance assessment is complete, the temporary component is removed, leaving no persistent software on the endpoint.

Exam trap

SISE often tests the misconception that the Web Agent requires the AnyConnect client or performs deep packet inspection, when in fact it relies on temporary browser components like ActiveX or Java.

How to eliminate wrong answers

Option A is wrong because deep packet inspection is a network-based technique used by firewalls and IPS systems, not by the Web Agent for endpoint compliance; the Web Agent requires host-based data. Option B is wrong because the Web Agent is specifically designed for clientless posture and does not require the full AnyConnect VPN client; that would be the AnyConnect posture module. Option C is wrong because the Web Agent does not communicate directly with Microsoft Update servers; it collects local system information and sends it to ISE for evaluation.

Option D is wrong because WMI calls are not initiated by the ISE server; the Web Agent runs on the endpoint and may use WMI locally, but the server does not remotely initiate WMI calls for posture.

Full explanation →

257

Multi-Selectmedium

Which THREE factors influence the decision to use multiple PSNs in a deployment?

Select 3 answers

A.Increased log storage capacity

B.Centralized database backup

C.Geographical distribution

D.Load balancing of RADIUS requests

E.Redundancy for node failure

AnswersC, D, E

Geographical distribution drives multiple PSNs because each PSN serves endpoints locally, and deploying nodes across distant sites reduces WAN latency for RADIUS authentication and posture traffic. This satisfies the requirement to place PSNs near user populations.

Why this answer

Option C (Geographical distribution) is correct because deploying multiple Policy Service Nodes (PSNs) across different sites lets each location authenticate its own users locally, avoiding WAN latency and link dependency for RADIUS traffic. Option D (Load balancing of RADIUS requests) is correct because multiple PSNs distribute the authentication, authorization, and accounting load, preventing any single PSN from becoming a bottleneck as endpoint counts grow. Option E (Redundancy for node failure) is correct because if one PSN becomes unavailable, NADs can fail over to another PSN, preserving network access during outages.

Options A (Increased log storage capacity) and B (Centralized database backup) are not valid factors: logging and backup are handled by the Monitoring and Policy nodes (MnT/PAN), not by adding PSNs, so they do not drive the decision to deploy multiple PSNs.

Exam trap

SISE often tests whether candidates confuse PAN/MnT responsibilities (backup, logging) with PSN responsibilities (auth traffic handling) — the exam expects you to know PSNs exist for scale, redundancy, and locality.

Full explanation →

258

MCQhard

You are troubleshooting a PSN that is not receiving configuration updates. Which log file on the PSN would provide the most insight into the configuration sync process?

A.config-dist.log

B.catalina.out

C.radius.log

D.prrt-server.log

AnswerA

config-dist.log records the configuration distribution and replication process between the PAN and PSN, capturing sync attempts, failures, and version mismatches. It directly satisfies the troubleshooting constraint by revealing why the PSN is not receiving configuration updates, unlike runtime or authentication logs.

Why this answer

The config-dist.log file on a PSN records the configuration distribution process, including synchronization attempts, successes, and failures with the Primary PAN. When a PSN is not receiving configuration updates, this log provides the most direct insight into why the sync is failing (e.g., connectivity, certificate, or replication issues). It is the go-to log for troubleshooting configuration replication.

Exam trap

SISE often tests the specific log file for configuration distribution — candidates confuse config-dist.log with catalina.out or radius.log, but only config-dist.log directly tracks the sync process.

How to eliminate wrong answers

Option B is wrong because catalina.out is the Tomcat application server log, which captures web application errors but not the configuration distribution process specifically. Option C is wrong because radius.log records RADIUS authentication and authorization events, not configuration sync. Option D is wrong because prrt-server.log relates to the Profiler (PRRT = Profiler Runtime) and endpoint profiling, not configuration distribution.

Full explanation →

259

MCQmedium

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

A.Framed-IP-Address

B.NAS-Port-Type

C.Calling-Station-ID

D.Device-Name

AnswerB

NAS-Port-Type is a RADIUS attribute carried in the Access-Request that identifies the physical port category, such as Ethernet or Wireless-IEEE-802.11. Policy sets match on it to route wired and wireless requests down separate rule branches, satisfying the requirement to distinguish access medium.

Why this answer

The NAS-Port-Type RADIUS attribute (attribute 61) identifies the physical port type used by the network access server (NAS) to authenticate the user. Common values include Ethernet (15) for wired and Wireless-IEEE-802.11 (19) for wireless. ISE policy sets commonly use this attribute to differentiate between wired and wireless requests because it is sent by the NAD in the Access-Request and reliably indicates the access medium.

Exam trap

SISE often tests the confusion between attributes that identify the device versus those that identify the access method; candidates may pick Calling-Station-ID because it contains the MAC address, but that does not indicate wired vs. wireless.

How to eliminate wrong answers

Option A is wrong because Framed-IP-Address (attribute 8) indicates the IP address assigned to the user, not the access type; it is often absent in the initial Access-Request. Option C is wrong because Calling-Station-ID (attribute 31) typically contains the client's MAC address or phone number, which does not distinguish wired from wireless. Option D is wrong because Device-Name is not a standard RADIUS attribute; it may refer to a NAD's name but is not used for access type differentiation.

Full explanation →

260

Multi-Selectmedium

Which THREE of the following are valid methods for collecting endpoint attributes for profiling in Cisco ISE?

Select 3 answers

A.FTP inspection

B.SSH terminal login

C.HTTP User-Agent

D.DHCP Snooping/Helper

E.SNMP Query

AnswersC, D, E

HTTP User-Agent is a valid profiling method because ISE inspects the browser's User-Agent string during HTTP traffic to infer the endpoint's operating system and device type. This satisfies the stem's requirement for an endpoint attribute collection method.

Why this answer

HTTP User-Agent (C) is valid because ISE's HTTP profiling probe captures the User-Agent string from web requests to identify the endpoint's OS and browser. DHCP Snooping/Helper (D) is valid because ISE's DHCP probe collects attributes such as DHCP fingerprint, hostname, and vendor class from DHCP traffic relayed by the switch or helper address. SNMP Query (E) is valid because ISE can poll network devices via SNMP to retrieve endpoint attributes like MAC address, ARP tables, and CDP/LLDP neighbor data.

FTP inspection (A) is not a supported ISE profiling probe, and SSH terminal login (B) is not a profiling collection method in ISE.

Exam trap

The trap here is confusing administrative protocols (SSH, FTP) with profiling probes. Candidates might think any protocol that can gather information is a profiling method, but ISE only supports specific probes like DHCP, HTTP, SNMP, and RADIUS.

Full explanation →

261

MCQeasy

In the ISE Policy Set, which component is used to define the user credentials' verification method?

A.Policy Set Condition

B.Authentication Policy

C.Result Profile

D.Authorization Policy

AnswerB

Within the ISE policy set, the authentication policy defines how user credentials are verified, specifying the allowed authentication protocols and identity sources. It therefore determines the verification method, satisfying the stem's requirement for credential verification.

Why this answer

The Authentication Policy within an ISE Policy Set defines the method used to verify user credentials — for example, whether ISE uses an internal identity store, Active Directory, LDAP, or a certificate-based method. It answers the 'how are credentials validated' question, whereas the Authorization Policy answers 'what is the user allowed to do' after authentication succeeds.

Exam trap

SISE often tests the distinction between Authentication Policy (verifies who you are) and Authorization Policy (decides what you can do) — candidates frequently swap these two because both live inside the same Policy Set.

How to eliminate wrong answers

Option A is wrong because Policy Set Conditions only determine which Policy Set a request matches (based on attributes like device type, location, or SSID) — they do not verify credentials. Option C is wrong because a Result Profile is the authorization outcome (VLAN, dACL, SGT, etc.) applied after a successful authorization decision, not a credential verification method. Option D is wrong because the Authorization Policy evaluates identity and posture attributes to grant access rights, but it does not perform the actual credential verification step.

Full explanation →

262

Multi-Selecthard

When setting up TACACS+ for network administration, which THREE configurations must be present on the Cisco network device? (Choose three)

Select 3 answers

A.AAA authentication/authorization commands

B.Local user database for all commands

C.RADIUS server configuration

D.Shared secret matching the ISE configuration

E.TACACS+ server group configuration

AnswersA, D, E

AAA commands define which method lists apply to login and exec sessions, directing the device to consult TACACS+ for authentication and authorisation. They are the enforcement point that activates the configured server group on the network device.

Why this answer

Option A is correct because the device must be configured with AAA commands such as 'aaa new-model' and 'aaa authentication login' / 'aaa authorization exec' to actually invoke TACACS+ for administrative access. Option D is correct because the TACACS+ shared secret (key) configured on the Cisco device must exactly match the key configured on the ISE/TACACS+ server, otherwise authentication packets are rejected. Option E is correct because you must define a TACACS+ server group (e.g., 'aaa group server tacacs+') and add the TACACS+ server host(s) to it so the AAA method lists can reference that group.

Option B is not required because a local user database is only a fallback for when the TACACS+ server is unreachable, not a mandatory part of TACACS+ administration. Option C is not required because RADIUS is a separate AAA protocol and is not needed when implementing TACACS+.

Exam trap

SISE often tests the required TACACS+ device-side configuration elements, and candidates mistakenly include optional local fallback or confuse RADIUS server configuration with TACACS+ server group configuration.

Full explanation →

Cisco Implementing and Configuring Cisco Identity Services Engine (SISE, 300-715, CCNP Security) (SISE) (SISE) — Questions 226–262