Courseiva

CCNA Architecture And Deployment Questions

27 questions · Architecture And Deployment · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

When designing an ISE deployment across WAN links, what is the primary recommendation regarding MnT nodes?

A.Distributed MnTs across all WAN sites
B.Always place MnT in the cloud
C.Disable logging for remote sites
D.Keep the MnT node in the same high-speed network as the PAN
AnswerD

MnT nodes write session and accounting data continuously to the PAN, so placing them on the same high-speed network avoids WAN latency and bandwidth saturation. This satisfies the deployment's performance constraint, since replication and logging traffic across slow WAN links degrades PAN responsiveness and reporting accuracy.

Why this answer

Cisco recommends keeping the MnT (Monitoring and Troubleshooting) node in the same high-speed network as the PAN (Policy Administration Node) because MnT stores and processes large volumes of logging and session data, and it frequently communicates with the PAN for policy and configuration synchronization. Placing MnT across a WAN link introduces latency and potential replication issues.

Exam trap

SISE often tests the placement of ISE personas — candidates may assume MnT can be distributed like PSNs, but the trap is forgetting that MnT must be co-located with PAN for performance and replication.

How to eliminate wrong answers

Option A is wrong because distributing MnT nodes across all WAN sites is not supported in a single ISE deployment; MnT is a centralized role, and multiple MnT nodes must be in the same LAN as the PAN for proper operation. Option B is wrong because ISE does not support deploying MnT in the cloud as a standalone role; ISE nodes must be on-premises or in a supported cloud environment with proper connectivity. Option C is wrong because disabling logging for remote sites would eliminate visibility and violate compliance requirements, and it does not address MnT placement.

Practice this question →
2
MCQmedium

In a distributed environment, if the Primary PAN goes offline, what happens to the Secondary PAN?

A.It disconnects from the PSNs
B.It remains in Secondary mode until manually promoted
C.It stops accepting configuration changes
D.It automatically assumes the Primary role
AnswerB

The Secondary PAN stays passive because Cisco ISE does not provide automatic failover; promotion to Primary requires an administrator to run the `application configure ise` promotion command or use the CLI. This satisfies the stem's constraint: no automatic role transition occurs when the Primary PAN goes offline.

Why this answer

In a Cisco ISE distributed deployment, the Secondary PAN does not automatically take over the Primary role. The Secondary PAN remains in a standby state and must be manually promoted via the ISE CLI (application configure ise) or GUI before it can serve as the active Primary PAN. This design prevents split-brain scenarios where two nodes simultaneously believe they are Primary.

Exam trap

SISE often tests the misconception that ISE PAN nodes support automatic failover like a firewall cluster — candidates assume the Secondary PAN auto-promotes, but ISE requires manual promotion.

How to eliminate wrong answers

Option A is wrong because the Secondary PAN does not manage PSN connections directly — PSNs register with the Primary PAN and continue operating independently if the Primary goes offline. Option C is wrong because configuration changes are already only accepted on the Primary PAN, so the Secondary stopping config changes is not a consequence of Primary failure. Option D is wrong because ISE does not support automatic PAN failover; promotion is always a manual administrative action.

Practice this question →
3
MCQeasy

What is the default persona of a newly installed Cisco ISE appliance before any configuration changes?

A.PSN
B.Standalone
C.Monitoring node
D.Primary PAN
AnswerB

A freshly installed Cisco ISE appliance defaults to the Standalone persona, operating independently with no distributed deployment roles assigned. Until an administrator promotes it to Primary PAN, Secondary PAN or PSN, it functions self-contained, which is why Standalone is the correct default.

Why this answer

A newly installed Cisco ISE appliance defaults to the Standalone persona, meaning it performs all roles (Policy Administration Node, Policy Service Node, and Monitoring Node) on a single node. This is the out-of-box state before any distributed deployment configuration is applied. Administrators must explicitly promote or register nodes to change personas.

Exam trap

SISE often tests the default persona of a fresh ISE appliance — candidates incorrectly assume it is a PSN or Primary PAN, but it is Standalone until explicitly changed.

How to eliminate wrong answers

Option A is wrong because PSN (Policy Service Node) is a distributed persona that a node assumes only after being registered to a Primary PAN — it is not the default. Option C is wrong because a Monitoring node is a dedicated persona for logging and reporting, configured only in distributed deployments. Option D is wrong because Primary PAN is a role assigned during distributed setup; a fresh appliance is not automatically a Primary PAN.

Practice this question →
4
MCQhard

When configuring a load balancer for a group of PSNs, what is the best practice for handling RADIUS traffic?

A.SSL-offloading
B.Source-IP affinity (persistence)
C.Active-passive failover only
D.Round-robin without persistence
AnswerB

Source-IP affinity pins each client's RADIUS session to one PSN for its duration, preserving session state across the load balancer. RADIUS is stateful, so persistence prevents authentication failures caused by requests landing on different PSNs.

Why this answer

RADIUS is a UDP-based protocol where the NAS and PSN maintain session state across the Access-Request/Access-Challenge/Access-Accept exchange. If a load balancer distributes successive packets from the same client to different PSNs, the challenge/response state is lost and authentication fails. Source-IP affinity (persistence) ensures all RADIUS packets from a given NAS or endpoint land on the same PSN for the duration of the session.

Exam trap

SISE often tests whether candidates understand that RADIUS is stateful per transaction, tempting them to choose round-robin or SSL offloading options that sound like standard load-balancing best practices but break authentication.

How to eliminate wrong answers

Option A is wrong because SSL offloading applies to TLS-wrapped protocols (HTTPS, LDAPS) and is irrelevant to RADIUS, which is not TLS-encrypted at the transport layer (RadSec is a separate case). Option C is wrong because active-passive failover only addresses availability, not the per-session state consistency required for RADIUS; it also wastes capacity and does not solve multi-PSN load distribution. Option D is wrong because round-robin without persistence actively breaks RADIUS by scattering packets across PSNs, causing authentication failures mid-exchange.

Practice this question →
5
MCQmedium

A network engineer is deploying Cisco ISE in a distributed architecture. The engineer needs to ensure that the deployment can scale to handle a large number of concurrent authentication requests. Which factor primarily determines the number of PSNs required?

A.The number of endpoints in the network.
B.The number of concurrent authentication requests and the required throughput.
C.The number of administrators who will manage the ISE deployment.
D.The number of network access devices (NADs) in the network.
AnswerB

The number of PSNs is primarily determined by the expected concurrent authentication load and the required throughput. Each PSN has performance limits, and adding PSNs distributes the load. Factors include the rate of authentications per second, the complexity of policies, and the use of features like profiling and posture.

Why this answer

The number of PSNs is driven by the concurrent authentication load and required throughput. Each PSN has capacity limits, so deploying additional PSNs distributes the load and ensures scalability. Other factors like endpoint count and NAD count are secondary to the actual transaction rate and performance needs.

Exam trap

The trap here is assuming that endpoint count alone dictates PSN count, ignoring the actual authentication rate and performance characteristics.

Practice this question →
6
MCQmedium

When adding a secondary PAN, what is the consequence if the time synchronization (NTP) differs significantly between nodes?

A.The node will operate in read-only mode
B.The node will join but logs will be out of order
C.Only TACACS+ services will be impacted
D.The registration process will fail
AnswerD

Secondary PAN registration relies on certificate-based authentication, which fails when node clocks differ significantly. Valid certificates appear expired or not-yet-valid outside the tolerance window, so the time synchronisation mismatch causes the registration process itself to fail.

Why this answer

When adding a secondary PAN to a Cisco ISE deployment, time synchronization is critical for certificate validation and secure communication. If NTP differs significantly between nodes, the secondary PAN will fail to register because the certificate exchange and authentication processes require synchronized clocks. This is a common requirement in distributed systems to prevent replay attacks and ensure log integrity.

Exam trap

SISE often tests the misconception that NTP issues only affect logging or minor services, when in fact they can cause complete registration failure due to certificate validation.

How to eliminate wrong answers

Option A is wrong because read-only mode is not a consequence of NTP mismatch; it's typically a result of licensing or role configuration. Option B is wrong because while logs might be out of order, the more immediate and severe consequence is registration failure. Option C is wrong because TACACS+ services are not the only impacted service; the entire node registration fails, affecting all ISE personas.

Practice this question →
7
MCQmedium

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

A.Initiate registration from the Primary PAN under Administration > System > Deployment
B.Configure the Secondary node as an standalone node and merge databases
C.Run the join command from the secondary node's CLI
D.Create a cluster via the ISE CLI setup wizard
AnswerA

Registration must be initiated from the Primary PAN, which generates a one-time registration key; the secondary node then uses that key to join. Starting from the secondary node is not supported, so this sequence satisfies the deployment's requirement that the Primary PAN authorises the new node.

Why this answer

In Cisco ISE, the Primary PAN is the authoritative node that maintains the deployment database and controls node registration. To add a secondary node, you log into the Primary PAN, navigate to Administration > System > Deployment, and use the 'Register an ISE node' action to initiate the join. The secondary node must already be installed and reachable, but the registration workflow is always driven from the Primary PAN, not the joining node.

Exam trap

SISE often tests the misconception that a secondary node initiates its own join via CLI or setup wizard, when in fact all node registration is initiated from the Primary PAN's Deployment page.

How to eliminate wrong answers

Option B is wrong because ISE nodes cannot be configured as standalone and then have databases merged — there is no database merge feature; nodes must be registered into the deployment from the Primary PAN. Option C is wrong because there is no CLI 'join' command on the secondary node for deployment registration; the CLI is used for initial setup, not for joining an existing deployment. Option D is wrong because the setup wizard configures a standalone node's basic parameters (hostname, IP, DNS, NTP, passwords) but does not create or join a cluster — cluster membership is established only via the Primary PAN's Deployment page.

Practice this question →
8
MCQhard

Which specific ISE process is responsible for managing the communication between the PAN and PSNs?

A.ISE Messaging Service
B.Application Server
C.Radius Core
D.Monitoring Service
AnswerA

The ISE Messaging Service handles inter-node communication, carrying configuration and operational data between the PAN and PSNs. This satisfies the stem's constraint of identifying the specific process managing PAN-to-PSN communication, rather than a broader service such as the database or API gateway.

Why this answer

The ISE Messaging Service is the internal process that handles communication between the Policy Administration Node (PAN) and the Policy Service Nodes (PSNs). It uses a messaging bus to propagate policy configuration, session data, and administrative changes across the deployment.

Exam trap

SISE often tests whether candidates confuse the Messaging Service (PAN-PSN communication) with the Application Server (UI/API) or Radius Core (protocol processing), so knowing the specific role of each ISE process is essential.

How to eliminate wrong answers

Option B is wrong because the Application Server hosts the web UI and REST APIs, not the PAN-to-PSN messaging channel. Option C is wrong because Radius Core handles RADIUS protocol processing for authentication and authorization, not inter-node communication. Option D is wrong because the Monitoring Service collects and stores logging and reporting data, not the messaging between PAN and PSN.

Practice this question →
9
MCQmedium

What is the purpose of the 'PAN' role in a deployment?

A.Log aggregation and reports
B.Centralized policy management
C.Authentication of endpoints
D.Database backups
AnswerB

The PAN role provides centralised policy management, acting as the single point where administrators define and push policy to managed firewalls and enforcement nodes. This satisfies the deployment requirement for consistent, centrally administered policy rather than per-device configuration.

Why this answer

The Policy Administration Node (PAN) in Cisco ISE is the central controller that hosts the policy repository, manages all configuration, and distributes policies to Policy Service Nodes (PSNs). It provides centralized policy management for the entire distributed deployment.

Exam trap

SISE often tests the confusion between ISE personas — candidates mistakenly assign authentication or logging duties to the PAN when those belong to PSNs and MnT nodes respectively.

How to eliminate wrong answers

Option A is wrong because log aggregation and reporting are handled by the Monitoring and Troubleshooting Node (MnT), not the PAN. Option C is wrong because endpoint authentication is performed by PSNs, which handle RADIUS/TACACS+ requests; the PAN does not authenticate endpoints. Option D is wrong because database backups are an administrative function that can be performed on the PAN but are not its primary role — the PAN's core purpose is policy administration and distribution.

Practice this question →
10
MCQmedium

When decommissioning an ISE node, what is the correct order of steps?

A.Change node to standalone, then remove
B.Shut down the node, then remove from deployment
C.Re-image the node, then remove from deployment
D.Remove from deployment, then shut down
AnswerD

Removing the node from the deployment first ensures ISE stops advertising it and no policy sets or session traffic route to it, preventing authentication failures. Shutting down afterwards avoids orphaned entries and replication issues, satisfying the stem's requirement for the correct decommissioning order.

Why this answer

The correct decommissioning sequence is to first remove the node from the ISE deployment via the PAN (Deregister), then shut it down. Removing the node from the deployment first ensures the PAN stops replicating configuration to it and other nodes stop forwarding logs or authentication requests to it, preventing orphaned references and replication errors.

Exam trap

SISE often tests the principle that ISE is a coordinated cluster — the trap is candidates treating a node as an isolated appliance and shutting it down first, ignoring that the PAN must be informed to avoid replication and logging errors.

How to eliminate wrong answers

Option A is wrong because changing a node to standalone mode is not a decommissioning step — it would actually detach the node from the deployment in an unsupported way and leave stale entries in the PAN. Option B is wrong because shutting down the node first leaves it registered in the deployment, causing the PAN to log replication failures and PSNs to attempt communication with a dead node. Option C is wrong because re-imaging destroys the node's configuration and certificates before it is cleanly removed from the deployment, which can leave the PAN with an unrecoverable stale node entry.

Practice this question →
11
MCQmedium

What is the function of the 'PassiveID' feature in a distributed ISE deployment?

A.It enables redundant authentication
B.It replaces the need for PSNs
C.It caches RADIUS requests
D.It provides user identity mapping without active probing
AnswerD

PassiveID derives user identity from existing authentication traffic, such as RADIUS accounting or AD logins, without sending probes to endpoints. This satisfies scenarios where active probing is undesirable, mapping users to sessions passively while avoiding the network disruption and endpoint agent requirements active methods impose.

Why this answer

PassiveID in Cisco ISE is a service that listens to and analyzes existing network traffic (such as RADIUS accounting, DHCP, and SNMP) to build a user identity mapping without actively probing endpoints. It passively collects user and device information from sources like Active Directory logs, syslog, and NetFlow, associating IP addresses with usernames. This is especially useful for devices that cannot run an active supplicant or for guest/BYOD scenarios where active probing is not feasible.

Thus, it provides identity mapping without generating additional network traffic or requiring active probes.

Exam trap

SISE often tests the distinction between passive and active identity collection methods, and candidates may confuse PassiveID with authentication or caching features, leading them to select options that imply active involvement or redundancy.

How to eliminate wrong answers

Option A is wrong because PassiveID does not provide redundant authentication; redundancy in ISE is achieved through PSN failover and load balancing, not PassiveID. Option B is wrong because PassiveID does not replace Policy Service Nodes (PSNs); PSNs are required for policy evaluation and enforcement, while PassiveID only supplements identity information. Option C is wrong because PassiveID does not cache RADIUS requests; RADIUS caching is not a function of PassiveID, and caching is typically handled by the RADIUS server itself or through session management.

Practice this question →
12
Multi-Selecthard

A security architect is designing a Cisco ISE deployment for a large enterprise with 20,000 endpoints. The design must ensure that RADIUS authentication and authorization continue even if the Primary PAN and Secondary PAN both become unreachable. The architect is evaluating the roles and services that must be enabled on the PSNs to support this requirement. Which two statements correctly describe the behavior or configuration needed to meet this goal? (Choose two.)

Select 2 answers
A.The PassiveID service must be enabled on each PSN to ensure RADIUS requests are processed during a PAN outage.
B.PSNs cache the last known policy configuration and can continue to process RADIUS authentications and authorizations for a limited time when PAN connectivity is lost.
C.The Administration service must be enabled on at least one PSN to allow it to process RADIUS requests when the PANs are unavailable.
D.PSNs must be manually reconfigured to point to a temporary PAN before they can resume RADIUS processing after a PAN outage.
E.The Policy Service service must be enabled on each PSN to allow it to handle RADIUS authentication and authorization requests from network access devices.
AnswersB, E

Cisco ISE PSNs maintain a local cache of the policy configuration received from the PAN. If the PAN becomes unreachable, PSNs can continue to process RADIUS requests using this cached policy for a period of time. This behavior is critical for maintaining authentication and authorization availability during administrative outages, though some features that require live PAN communication may be limited.

Why this answer

To maintain RADIUS authentication and authorization during a PAN outage, PSNs must have the Policy Service enabled and must be able to rely on their cached policy configuration. The Policy Service is the persona that processes RADIUS requests, and the cache allows continued operation when the PAN is unreachable. Together, these two statements correctly describe the required configuration and behavior for high availability of AAA services.

Exam trap

The trap here is confusing the Administration service with the Policy Service, or assuming PassiveID plays a role in RADIUS processing during a PAN outage.

Practice this question →
13
Multi-Selecteasy

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

Select 2 answers
A.Policy distribution
B.Reporting and analytics
C.RADIUS authentication
D.Log aggregation from all nodes
E.Endpoint profiling probe
AnswersB, D

Reporting and analytics is a core Monitoring and Troubleshooting function, letting the persona aggregate and visualise authentication, authorisation and posture data across the deployment. This satisfies the stem's requirement for an MnT duty, distinct from configuration or policy-definition tasks owned by other personas.

Why this answer

The Monitoring and Troubleshooting (MnT) persona in Cisco ISE is responsible for collecting and storing operational data, so option B (Reporting and analytics) is correct because MnT nodes host the reporting and analytics services that let administrators run operational reports, live logs, and dashboards on authentication, authorization, and accounting events. Option D (Log aggregation from all nodes) is also correct because all Policy Services Nodes (PSNs) and other ISE nodes forward their syslog and session data to the MnT node, which aggregates and stores it in the MnT database for troubleshooting and audit purposes. Option A (Policy distribution) is not an MnT function; policy configuration and distribution are handled by the Policy Administration Node (PAN), which pushes policies to PSNs.

Option C (RADIUS authentication) is performed by Policy Services Nodes, which handle RADIUS and TACACS+ authentication, authorization, and accounting, not the MnT persona. Option E (Endpoint profiling probe) is a function of the PSN, where profiling probes (e.g., RADIUS, SNMP, DHCP, NetFlow) collect endpoint attributes, not the MnT node.

Exam trap

SISE often tests persona responsibilities, and candidates confuse MnT functions (reporting, log aggregation) with PAN functions (policy distribution) or PSN functions (RADIUS authentication, profiling), leading to incorrect selections.

Practice this question →
14
Multi-Selecthard

Which THREE features are configured at the node level in the ISE Administration console?

Select 3 answers
A.Global policy rules
B.Logging categories
C.External ID store configuration
D.Profiling probes
E.Network interface settings
AnswersB, D, E

Logging categories are configured per node under Administration > System > Logging, letting each ISE node emit its own debug or audit levels independently. This satisfies the stem's node-level constraint, since logging settings apply to the individual appliance rather than globally across the deployment.

Why this answer

In the Cisco ISE Administration console, node-level configuration is scoped to a specific ISE node rather than the whole deployment. Logging categories (B) are configured per node under Administration > System > Logging > Logging Categories, allowing each node's logging levels and targets to be tuned independently. Profiling probes (D) are enabled and configured per node under Administration > System > Profiling Configuration, since probes such as SNMP, RADIUS, DHCP, and NetFlow run on individual PSNs.

Network interface settings (E) are also node-specific, configured under Administration > System > Settings > Network Interfaces, because each node has its own NIC, IP address, and VLAN configuration. Global policy rules (A) and external ID store configuration (C) are deployment-wide settings managed at the system level, not per node, so they are not correct answers.

Exam trap

SISE often tests the distinction between node-level and deployment-level configuration, and candidates frequently confuse global policy rules or external ID stores as node-specific when they are actually deployment-wide.

Practice this question →
15
MCQeasy

A customer is planning a large campus deployment with 50,000 concurrent endpoints. Which persona should be dedicated to handle the authentication load to ensure high performance?

A.Policy Administration Node (PAN)
B.Policy Service Node (PSN)
C.Standalone Node
D.Monitoring and Troubleshooting Node (MnT)
AnswerB

PSNs handle RADIUS authentication and authorisation for endpoints, so dedicating this persona distributes the 50,000 concurrent authentication requests across nodes. The PAN concentrates policy administration and monitoring, not session processing, making it unsuitable for that load.

Why this answer

Policy Service Nodes (PSNs) are the workhorses of an ISE deployment — they handle all authentication, authorization, and accounting (AAA) requests from network devices via RADIUS. For 50,000 concurrent endpoints, the deployment must scale PSNs horizontally (typically in a dedicated PSN persona) so authentication load is distributed and no single node becomes a bottleneck.

Exam trap

SISE often tests the distinction between the control plane (PAN) and the data plane (PSN) — candidates who pick PAN assume 'policy' means authentication, but PAN only stores and distributes policy, it never processes RADIUS.

How to eliminate wrong answers

Option A is wrong because the PAN is the management and configuration plane — it runs the admin UI, stores policy configuration, and handles replication, but it does not process endpoint authentication traffic. Option C is wrong because a Standalone Node combines PAN, PSN, and MnT roles on one appliance, which is suitable only for small labs or pilots and cannot scale to 50,000 concurrent endpoints. Option D is wrong because the MnT node handles logging, reporting, and troubleshooting data collection — it does not perform authentication.

Practice this question →
16
MCQmedium

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

A.Rsync over SSH
B.RADIUS Change of Authorization (CoA)
C.Distributed Configuration Synchronization via HTTPS
D.SNMPv3 Trap propagation
AnswerC

Distributed Configuration Synchronization replicates the Primary PAN's configuration to all secondary nodes over HTTPS, keeping policy, identity and admin data consistent across the deployment. This mechanism maintains the configuration integrity the scenario demands, ensuring every node enforces identical policy.

Why this answer

In a distributed ISE deployment, the Primary PAN synchronizes configuration changes to all secondary nodes using a secure HTTPS-based mechanism called Distributed Configuration Synchronization. This ensures that all nodes have a consistent view of policies, identities, and other configuration data. The synchronization occurs automatically when changes are made on the Primary PAN, and it uses TLS to protect the data in transit.

Exam trap

SISE often tests the confusion between configuration synchronization and other inter-node communications like CoA or monitoring. Candidates may incorrectly choose CoA because it's a familiar ISE feature, but CoA is for session control, not configuration.

How to eliminate wrong answers

Option A is wrong because Rsync over SSH is not used for ISE configuration synchronization; ISE uses its own proprietary mechanism over HTTPS. Option B is wrong because RADIUS Change of Authorization (CoA) is used to dynamically change authorization for active sessions, not to synchronize configuration. Option D is wrong because SNMPv3 traps are used for monitoring and alerts, not for configuration synchronization.

Practice this question →
17
MCQeasy

How do you verify the current licensing status and consumption on your ISE deployment?

A.Dashboard > Licensing
B.Policy > Licensing
C.Administration > System > Licensing
D.Operations > Licensing
AnswerC

Administration > System > Licensing displays the current licence type, compliance status and node consumption counters for the ISE deployment, directly satisfying the requirement to verify licensing status and consumption. It is the only page reporting both registration state and per-node usage, unlike Smart Licensing registration or deployment pages.

Why this answer

In Cisco ISE, licensing status and consumption are viewed under Administration > System > Licensing. This page shows the license type (Base, Plus, Apex), the number of concurrent sessions consumed, and the evaluation period remaining. It is the authoritative location for verifying license compliance and usage.

Exam trap

SISE often tests the exact menu path for licensing, tricking candidates into choosing plausible but incorrect paths like 'Dashboard > Licensing' or 'Operations > Licensing' instead of the correct 'Administration > System > Licensing'.

How to eliminate wrong answers

Option A is wrong because 'Dashboard > Licensing' does not exist in ISE; the Dashboard menu contains overview and health dashboards, not licensing. Option B is wrong because 'Policy > Licensing' is not a valid menu path; Policy deals with authentication and authorization rules. Option D is wrong because 'Operations > Licensing' is not a valid path; Operations contains live logs, reports, and troubleshooting tools.

Practice this question →
18
Multi-Selectmedium

Which THREE resources are monitored via the ISE dashboard to ensure deployment health?

Select 3 answers
A.CPU utilization
B.Memory usage
C.Bandwidth per user
D.Temperature of the appliance
E.Disk space usage
AnswersA, B, E

Monitors compute load.

Why this answer

The Cisco ISE dashboard's System Health/Deployment Health monitoring reports the appliance's core system resources, and CPU utilization (A) is one of them because sustained high CPU on a PSN or PAN degrades authentication and policy-processing throughput. Memory usage (B) is also monitored, since ISE services such as the profiler, session directory, and M&T database can exhaust RAM and cause service failures if not tracked. Disk space usage (E) is the third monitored resource, as ISE depends on local disk for logging, the M&T data store, and backups, and low disk space triggers alarms and can halt logging or database operations.

Bandwidth per user (C) is not a node-level health resource tracked by the ISE dashboard; it is a network-traffic metric, not an ISE appliance resource. Temperature of the appliance (D) is not reported by the ISE dashboard either; hardware thermal status is handled by the underlying platform/CIMC or hypervisor, not by ISE's deployment-health monitoring.

Exam trap

SISE often tests the specific resources monitored in the ISE dashboard, and candidates may confuse them with general system monitoring metrics like bandwidth or temperature, which are not part of ISE's health dashboard.

Practice this question →
19
MCQeasy

A network administrator is preparing to add a new Cisco ISE node to an existing distributed deployment. The new node will serve as a PSN in a remote branch office. Before registering the node, the administrator must ensure that the node meets the prerequisites for joining the deployment. Which prerequisite is required for the new node to successfully register with the Primary PAN?

A.The new node must have a different hostname and IP address from all other nodes, but no other prerequisites apply.
B.The new node must have the same ISE software version as the Primary PAN.
C.The new node must be manually added to the PAN's database using the ise/admin CLI before it can register.
D.The new node must be configured with the Administration persona before it can join the deployment.
AnswerB

All nodes in a Cisco ISE deployment must run the same software version. If the new node has a different version, registration will fail or the deployment will be inconsistent. Matching the version ensures compatibility of the configuration database, replication, and policy processing across all nodes.

Why this answer

For a new node to join a Cisco ISE deployment, it must run the same software version as the Primary PAN. This ensures that the configuration database, policy model, and replication mechanisms are compatible. While unique hostname and IP address are also required, matching the software version is a critical prerequisite that is often overlooked.

Without version parity, registration will fail or produce an unsupported deployment.

Exam trap

The trap here is assuming that only network settings like hostname and IP address matter, while overlooking the strict requirement for identical ISE software versions across all nodes.

Practice this question →
20
MCQmedium

When configuring a secondary MnT node, what is the 'Primary' versus 'Secondary' relationship regarding log collection?

A.The Secondary collects from specific PSNs only
B.Both nodes log simultaneously
C.The Primary collects, Secondary is standby
D.Nodes load balance the logs
AnswerC

In a distributed deployment, the primary MnT node actively receives and stores logs from all policy nodes, while the secondary remains in standby mode, replicating data but not accepting live syslog streams. This satisfies the stem's requirement that only one node performs active log collection at any time.

Why this answer

In a two-node MnT deployment, the Primary MnT actively collects, stores, and processes logs from all PSNs and other nodes, while the Secondary MnT operates in standby mode and only takes over log collection if the Primary fails. This is an active/standby relationship, not active/active or load-balanced.

Exam trap

SISE often tests whether candidates assume ISE uses active/active clustering for MnT like it does for PSNs — the trap is confusing PSN load distribution with MnT log collection, which is strictly active/standby.

How to eliminate wrong answers

Option A is wrong because the Secondary does not selectively collect from specific PSNs — all nodes forward logs to the Primary, and the Secondary only receives data after a failover event. Option B is wrong because simultaneous logging from both nodes would create duplicate records and inconsistent reporting; ISE does not support active/active MnT. Option D is wrong because log collection is not load-balanced across MnT nodes — the Primary is the sole collector until failover.

Practice this question →
21
MCQeasy

Which menu path is used to view the status of all nodes in an ISE deployment?

A.Operations > Reports
B.Administration > Maintenance
C.Administration > System > Deployment
D.Policy > Policy Elements
AnswerC

The Deployment page under Administration > System lists every node, showing roles, personas, and synchronisation status across the deployment. This path satisfies the stem's requirement to view the status of all nodes from the Primary PAN.

Why this answer

In Cisco ISE, the status of all nodes in a deployment is viewed under Administration > System > Deployment. This page lists every node, its persona (PAN, PSN, MnT), role (Primary/Secondary), and operational status, allowing administrators to monitor node health and synchronization.

Exam trap

SISE often tests menu-path memorization — candidates confuse the Deployment page with Maintenance or Reports because they associate 'status' with monitoring or reporting rather than administration.

How to eliminate wrong answers

Option A is wrong because Operations > Reports provides reporting on authentication, accounting, and other events, not node deployment status. Option B is wrong because Administration > Maintenance contains backup, restore, and upgrade tasks, not node status monitoring. Option D is wrong because Policy > Policy Elements is where authentication and authorization policy objects are configured, not where node status is displayed.

Practice this question →
22
MCQeasy

Which of the following describes the 'Standalone' deployment model?

A.PAN and PSN on separate nodes
B.Only PSN role is active
C.Multiple nodes in a cluster
D.All personas on a single node
AnswerD

Standalone places every persona — Policy Administration, Policy Service and Monitoring — on one node, with no distributed or dedicated split. This contrasts with Distributed, where personas are separated across nodes, and with the dedicated deployment variants.

Why this answer

The 'Standalone' deployment model in Cisco ISE refers to a configuration where all personas (Policy Administration Node, Policy Service Node, Monitoring and Troubleshooting Node) are installed on a single node. This is typical for small deployments or lab environments where high availability and scalability are not required. It simplifies management but lacks redundancy.

Exam trap

SISE often tests the confusion between standalone and distributed models, where candidates might think standalone means only one persona is active, rather than all personas on one node.

How to eliminate wrong answers

Option A is wrong because 'PAN and PSN on separate nodes' describes a distributed deployment, not standalone. Option B is wrong because 'Only PSN role is active' is not a deployment model; a standalone node runs all roles. Option C is wrong because 'Multiple nodes in a cluster' describes a distributed or high-availability deployment, not standalone.

Practice this question →
23
MCQeasy

Which service is required to be enabled on a PSN to allow it to receive RADIUS requests from network access devices?

A.Policy Service
B.Registration Service
C.Administration Service
D.Monitoring Service
AnswerA

The Policy Service must be enabled on the Policy Service Node so it can accept and process RADIUS requests from network access devices. Without it, the PSN cannot act as a RADIUS server, so authentication and authorisation requests from NADs are dropped.

Why this answer

The Policy Service is the Cisco ISE service that must be enabled on a Policy Services Node (PSN) to allow it to receive RADIUS requests from network access devices (NADs). The Policy Service handles authentication, authorization, and accounting (AAA) decisions for RADIUS traffic. Without it, the PSN cannot process RADIUS requests.

Exam trap

SISE often tests the confusion between ISE node services — candidates pick Registration or Monitoring Service, forgetting that only the Policy Service handles RADIUS request processing.

How to eliminate wrong answers

Option B is wrong because the Registration Service is used for node registration and communication with the PAN, not for receiving RADIUS requests. Option C is wrong because the Administration Service is for management and configuration, not RADIUS processing. Option D is wrong because the Monitoring Service handles logging, reporting, and troubleshooting, not RADIUS authentication.

Practice this question →
24
MCQhard

If a PSN loses connectivity to the PAN, what happens to existing user sessions?

A.All sessions are terminated
B.Sessions remain active and the PSN continues to authenticate
C.The PSN enters emergency mode
D.The PSN reboots
AnswerB

PSNs cache policy and authentication data locally, so if PAN connectivity drops, existing sessions stay active and the PSN continues authenticating users. Only administrative configuration changes are unavailable until the PAN link restores, preserving service availability.

Why this answer

When a PSN loses connectivity to the PAN, existing user sessions remain active and the PSN continues to authenticate new sessions using its last known policy configuration. This is by design to maintain network access during PAN outages.

Exam trap

SISE often tests the misconception that PSNs are entirely dependent on the PAN for authentication, when in fact they are designed for resilient standalone operation during PAN outages.

How to eliminate wrong answers

Option A is wrong because ISE does not terminate existing sessions on PAN loss; sessions persist to avoid disrupting users. Option C is wrong because there is no 'emergency mode' in ISE; the PSN simply operates in a standalone-like state. Option D is wrong because the PSN does not reboot on PAN loss; it continues running with cached policies.

Practice this question →
25
MCQeasy

Which license type is required to enable advanced profiling and posture services on Cisco ISE?

A.ISE Premier
B.Device Admin License
C.ISE Essentials
D.ISE Advantage
AnswerD

ISE Advantage is the licence tier that unlocks advanced profiling and posture services; lower tiers such as Base or Plus do not include them. This satisfies the stem's constraint of enabling both advanced profiling and posture on the deployment.

Why this answer

Cisco ISE Advantage is the highest-tier license and is required for advanced profiling and posture services. Profiling collects endpoint attributes to classify devices, while posture assesses endpoint compliance (e.g., antivirus, OS patches) before granting access. These features are exclusive to the Advantage license; lower tiers like Essentials or Premier do not include them.

The Device Admin license is for TACACS+ device administration, not for profiling or posture.

Exam trap

SISE often tests the specific license tiers and their feature sets, and candidates frequently confuse Premier with Advantage, assuming Premier includes all advanced features. The trap is that profiling and posture are exclusively Advantage features, not Premier.

How to eliminate wrong answers

Option A is wrong because ISE Premier includes advanced features like BYOD and guest, but not profiling or posture. Option B is wrong because Device Admin License is specifically for TACACS+ command authorization and device administration, not for endpoint profiling or posture. Option C is wrong because ISE Essentials is the base license providing basic AAA and guest services, lacking advanced profiling and posture capabilities.

Practice this question →
26
Multi-Selectmedium

Which THREE factors influence the decision to use multiple PSNs in a deployment?

Select 3 answers
A.Increased log storage capacity
B.Centralized database backup
C.Geographical distribution
D.Load balancing of RADIUS requests
E.Redundancy for node failure
AnswersC, D, E

Geographical distribution drives multiple PSNs because each PSN serves endpoints locally, and deploying nodes across distant sites reduces WAN latency for RADIUS authentication and posture traffic. This satisfies the requirement to place PSNs near user populations.

Why this answer

Option C (Geographical distribution) is correct because deploying multiple Policy Service Nodes (PSNs) across different sites lets each location authenticate its own users locally, avoiding WAN latency and link dependency for RADIUS traffic. Option D (Load balancing of RADIUS requests) is correct because multiple PSNs distribute the authentication, authorization, and accounting load, preventing any single PSN from becoming a bottleneck as endpoint counts grow. Option E (Redundancy for node failure) is correct because if one PSN becomes unavailable, NADs can fail over to another PSN, preserving network access during outages.

Options A (Increased log storage capacity) and B (Centralized database backup) are not valid factors: logging and backup are handled by the Monitoring and Policy nodes (MnT/PAN), not by adding PSNs, so they do not drive the decision to deploy multiple PSNs.

Exam trap

SISE often tests whether candidates confuse PAN/MnT responsibilities (backup, logging) with PSN responsibilities (auth traffic handling) — the exam expects you to know PSNs exist for scale, redundancy, and locality.

Practice this question →
27
MCQhard

You are troubleshooting a PSN that is not receiving configuration updates. Which log file on the PSN would provide the most insight into the configuration sync process?

A.config-dist.log
B.catalina.out
C.radius.log
D.prrt-server.log
AnswerA

config-dist.log records the configuration distribution and replication process between the PAN and PSN, capturing sync attempts, failures, and version mismatches. It directly satisfies the troubleshooting constraint by revealing why the PSN is not receiving configuration updates, unlike runtime or authentication logs.

Why this answer

The config-dist.log file on a PSN records the configuration distribution process, including synchronization attempts, successes, and failures with the Primary PAN. When a PSN is not receiving configuration updates, this log provides the most direct insight into why the sync is failing (e.g., connectivity, certificate, or replication issues). It is the go-to log for troubleshooting configuration replication.

Exam trap

SISE often tests the specific log file for configuration distribution — candidates confuse config-dist.log with catalina.out or radius.log, but only config-dist.log directly tracks the sync process.

How to eliminate wrong answers

Option B is wrong because catalina.out is the Tomcat application server log, which captures web application errors but not the configuration distribution process specifically. Option C is wrong because radius.log records RADIUS authentication and authorization events, not configuration sync. Option D is wrong because prrt-server.log relates to the Profiler (PRRT = Profiler Runtime) and endpoint profiling, not configuration distribution.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Architecture And Deployment questions.

Start 20-question session