322 questions total · 5pages · All types, answers revealed
Page 5 of 5
Which TWO of the following are valid remediation actions available in Cisco ISE for posture compliance?
Provides a URL to the user to download patches or software to fix compliance.
Why this answer
Cisco ISE supports various remediation actions including link-based (for web portals) and file-based actions to help users become compliant.
You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?
Insufficient attributes mean no profile policy criteria are met.
Why this answer
If ISE has not received enough attributes to meet the threshold of a profiling policy, it remains 'Unknown'.
Which license type is required to enable advanced profiling and posture services on Cisco ISE?
Advantage provides advanced profiling and posture capabilities.
Why this answer
ISE licenses are tiered, and 'ISE Advantage' is typically required for advanced context-aware features like profiling and posture.
A user is unable to pass posture assessment because the 'AnyConnect Compliance Module' is not detecting the antivirus software. Which log file on the endpoint should be reviewed to troubleshoot the compliance module's scanning logic?
This is the primary log file on the Windows endpoint for troubleshooting compliance agent scan results.
Why this answer
The ACLog.txt or the Compliance Module logs (typically found in %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture) contain details about scan results.
Which of the following is a valid remediation action type in Cisco ISE?
File remediation allows for local file execution or download.
Why this answer
File, Registry, and Service remediation are standard options.
You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?
This condition verifies the session authentication status matches the guest state.
Why this answer
The 'Guest Type' or 'Guest Flow' attributes are specific to the Guest portal authentication process, ensuring the policy only applies after successful portal interaction.
Which THREE of the following items must be configured to ensure a successful SNMP Trap profiling implementation?
ISE needs the device in its inventory to process the traps.
Why this answer
SNMP traps require the network device to be configured to send traps, the ISE PSN to listen for them, and the correct trap community or user context.
Which THREE of the following are found in an Authorization Profile's 'Advanced Attributes'?
VSAs are managed in the advanced section.
Why this answer
Advanced attributes allow for custom RADIUS attributes and vendor-specific fields.
Which THREE of the following are valid types of Client Provisioning Resources?
This is a required resource.
Why this answer
Valid resources include AnyConnect packages, compliance modules, and profiles.
You want to enforce a policy where personal devices are allowed access, but only if they are not jailbroken. How is this achieved in a BYOD scenario?
MDM is the only component capable of deep device health checks like jailbreak detection.
Why this answer
MDM integration is required to perform health checks like jailbreak detection, which is then reported to ISE to inform the authorization decision.
When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?
This is the prerequisite for TACACS+ processing.
Why this answer
Checking this box enables the device to participate in TACACS+ authentication and authorization flows managed by ISE.
Which THREE of the following are valid ways to trigger a profiling scan or update for an endpoint in Cisco ISE?
This forces the profiler to re-evaluate collected data.
Why this answer
Endpoints can be re-profiled via manual refresh, CoA events, or changes in probe data.
A user is compliant, but ISE still classifies the device as 'Unknown'. What is the most likely cause?
If the agent cannot send the report, ISE keeps the status as 'Unknown'.
Why this answer
If the device is 'Unknown', it means the posture agent has not successfully sent the report to the PSN or the PSN has not updated the session state.
Which TWO of the following steps are required to implement SGT-based enforcement using an SXP connection?
The mapping of IP to SGT must be defined so ISE knows what to propagate.
Why this answer
SXP is used to propagate SGTs to devices that are not SGT-capable natively. This involves configuring the connection and ensuring the mapping is present.
You are deploying a Posture agent using the Web Agent. Which mechanism does the Web Agent use to perform compliance checks on a Windows machine?
The Web Agent relies on browser-based plugins or temporary executables to facilitate basic posture checks before full agent deployment.
Why this answer
The AnyConnect Web Agent (now referred to as the posture agent in browser-less scenarios or via the portal) uses a small temporary utility to gather information, but it is limited in scope compared to the persistent AnyConnect agent.
Which THREE factors influence the decision to use multiple PSNs in a deployment?
Reduces latency for remote sites.
Why this answer
Multiple PSNs are used for geographical redundancy, load balancing of authentication requests, and high availability in case of node failure.
Which of the following is a key requirement for dACL enforcement on a Cisco switch?
Dynamic Authorization is required to apply the dACL to the session post-auth.
You are troubleshooting a PSN that is not receiving configuration updates. Which log file on the PSN would provide the most insight into the configuration sync process?
This log traces the configuration distribution process.
Why this answer
The 'config-dist.log' file specifically tracks the configuration distribution and synchronization events between the PAN and PSN.
When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?
NAS-Port-Type indicates if the request is wired or wireless.
Why this answer
The 'NAS-Port-Type' attribute is standard for identifying the access medium (e.g., Wireless-802.11 vs. Ethernet).
Which THREE of the following are valid methods for collecting endpoint attributes for profiling in Cisco ISE?
HTTP probe collects browser information.
In the ISE Policy Set, which component is used to define the user credentials' verification method?
The Authentication Policy defines the allowed protocols and identity sources.
Why this answer
The Authentication Policy defines the Identity Source Sequence, which dictates how ISE verifies credentials.
When setting up TACACS+ for network administration, which THREE configurations must be present on the Cisco network device? (Choose three)
This enables the AAA framework.
Page 5 of 5
Practice SISE by domain
Target a specific domain to shore up weak areas.