CCNA BYOD Questions

Multi-Selecthard

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

Select 3 answers

A.The user must manually 'Install' the configuration profile

B.The device must be connected via VPN

C.HTTPS access to the ISE portal

D.The profile must be signed by a trusted certificate

E.The device must be jailbroken

AnswersA, C, D

iOS forces the user to manually accept and install the profile in Settings.

Why this answer

iOS requires an Apple-signed profile, which ISE generates. The device must be able to reach the portal via HTTPS, and the profile must be trusted by the OS.

Practice this question →

Multi-Selecteasy

Which TWO of the following are valid device attributes that can be used to identify a device for BYOD onboarding?

Select 2 answers

A.Device-Type

B.Operating-System

C.VLAN-ID

D.RADIUS-Session-ID

E.Port-Number

AnswersA, B

This attribute identifies the hardware or category of the device.

Why this answer

Device type and operating system are fundamental attributes used in policy conditions to distinguish BYOD devices.

Practice this question →

MCQmedium

In the BYOD flow, what occurs immediately after the user provides credentials in the portal?

A.The device is automatically moved to the production VLAN

B.The user is disconnected from the network

C.The device is provisioned with a certificate

D.The device is registered in the Active Directory

AnswerC

Credential validation is the prerequisite for the certificate enrollment process.

Why this answer

After credentials are verified, the ISE portal triggers the download of the Network Setup Assistant or the SCEP enrollment process.

Practice this question →

Multi-Selectmedium

Which TWO of the following are benefits of integrating MDM with Cisco ISE for BYOD?

Select 2 answers

A.Ability to trigger remote wipe or lock commands

B.Faster SSID connection speed

C.Automated device compliance status checks

D.Automatic creation of Active Directory accounts

E.Increased bandwidth for BYOD users

AnswersA, C

Administrators can trigger MDM actions from the ISE dashboard.

Why this answer

MDM integration enables automated compliance checks and the ability to wipe or lock devices if they are lost.

Practice this question →

MCQhard

An organization wants to implement EAP-TLS for BYOD. What is the correct sequence of the certificate lifecycle during the onboarding process?

A.Certificate Request > Authentication > Signing > Installation

B.Authentication > Certificate Signing Request > CA Signing > Installation

C.CA Signing > Authentication > Request > Installation

D.Installation > Signing > Authentication > Request

AnswerB

The standard flow requires user authentication, followed by the generation of a CSR, signing by the CA, and installation on the device.

Why this answer

After the user authenticates, the client submits a CSR, ISE (via SCEP) signs it, and the certificate is pushed back to the client.

Practice this question →

MCQmedium

A user reports that their BYOD device is not being recognized as 'Compliant' even though the MDM shows it is compliant. Which ISE component is responsible for retrieving this status?

A.The ISE MDM Server connector

B.The ISE Policy Information Point (PIP)

C.The ISE Monitoring node

D.The ISE RADIUS service

AnswerA

The connector is the bridge that retrieves status updates from the MDM.

Why this answer

The ISE MDM Server connector periodically polls or receives webhooks from the MDM to update the endpoint status in the ISE database.

Practice this question →

Multi-Selectmedium

Which TWO of the following are common troubleshooting steps for a failed BYOD portal redirection?

Select 2 answers

A.Restart the Active Directory domain controller

B.Check the Authorization Policy for the correct URL-Redirect attribute

C.Verify the redirect ACL permits access to ISE

D.Re-configure the DHCP server

E.Change the switch model

AnswersB, C

This attribute forces the browser to the portal.

Why this answer

Verifying the redirect ACL and checking the Authorization Policy for the correct URL redirect attribute are the first steps.

Practice this question →

MCQmedium

Which of the following is a requirement for a successful BYOD certificate provisioning flow?

A.The client must have the Root CA certificate installed in its trusted store

B.The client must use a specific third-party supplicant

C.The client must be joined to the Active Directory domain

D.The device must be managed by the same MDM as the enterprise devices

AnswerA

Without trusting the CA, the device will reject the certificate issued during onboarding.

Why this answer

The client must trust the Root CA that signed the ISE portal/certificate to ensure the enrollment process is secure.

Practice this question →

MCQeasy

What is the purpose of the 'Redirect ACL' on the network access device?

A.To encrypt the traffic between the client and the switch

B.To limit the bandwidth for BYOD users

C.To force the client to use a specific DNS server

D.To permit access to the ISE portal while blocking all other traffic

AnswerD

This ensures the user is forced into the portal flow before gaining network access.

Why this answer

The redirect ACL allows DNS and traffic to the ISE portal while blocking all other traffic until the device is provisioned.

Practice this question →

MCQmedium

If a user is successfully registered but cannot connect after the BYOD flow, which status should you check in the 'Endpoints' menu?

A.User ID

B.Registration Status

C.Last Access Date

D.Device Type

AnswerB

This indicates if the device is marked as 'Registered', which is required for authorization policies.

Why this answer

Checking the 'Registration Status' in the Endpoints menu confirms if the database correctly marked the device as registered.

Practice this question →

MCQmedium

You are configuring a BYOD flow where users must register their devices via the self-service portal. Which ISE component is responsible for triggering the redirection to the BYOD portal after an initial MAC Authentication Bypass (MAB) success?

A.Policy Set with a global redirect object

B.Authentication Policy with a portal trigger

C.RADIUS server-side redirect attribute

D.Authorization Profile with a redirect ACL and URL redirect

AnswerD

This is the standard mechanism for redirecting web traffic to the portal.

Why this answer

The Authorization Profile containing the 'Redirect' attribute is what forces the client to the portal.

Practice this question →

MCQmedium

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

A.Device Profiling

B.RADIUS Accounting

C.Active Directory Identity Store

D.Policy Sets

AnswerA

Profiling identifies the device capabilities, which determines the provisioning policy.

Why this answer

ISE uses 'Device Profiling' (via DHCP fingerprinting, HTTP User-Agent, etc.) to identify the device and trigger the correct provisioning flow.

Practice this question →

MCQhard

If a user's certificate expires, how can the user renew it using the ISE BYOD flow?

A.The certificate renews automatically in the background

B.Re-install the Network Setup Assistant manually

C.Reconnect to the SSID and follow the re-enrollment prompt in the portal

D.Contact the administrator to manually push a new certificate

AnswerC

ISE detects the expired certificate or lack of authentication and redirects the user to the portal to renew.

Why this answer

The user can reconnect to the network, trigger the MAB/Redirect process, and the portal will provide an option to re-enroll or renew the certificate.

Practice this question →

Multi-Selectmedium

Which THREE actions are required when configuring a BYOD flow that involves an external MDM integration?

Select 3 answers

A.Configure the MDM server details in Administration > Network Resources > MDM

B.Import the Root CA of the MDM server into the ISE Trusted Certificates store

C.Set the 'Native Supplicant' to disabled

D.Enable 'Device Compliance' in the Authorization Policy results

E.Configure the WLC to act as an MDM proxy

AnswersA, B, D

This is the required path for MDM integration.

Why this answer

Integrating MDM requires establishing the server connection, defining the authorization policy to check compliance, and ensuring the device is correctly registered in the ISE endpoint database.

Practice this question →

MCQeasy

When a user's device is stolen, which action should be taken in the 'My Devices' portal?

A.Deregister or Blacklist the device

B.Perform a factory reset on the device remotely

C.Delete the user's account

D.Change the user's AD password

AnswerA

Removing the device from the registered list effectively revokes its access rights.

Why this answer

The user or administrator can 'Deregister' or 'Blacklist' the device to revoke its certificate and access.

Practice this question →

MCQhard

You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?

A.To sign certificates for the endpoints

B.To encrypt the SCEP traffic between ISE and the endpoint

C.To store the Private Keys of the issued certificates

D.To allow devices to request certificates from the CA via the ISE node

AnswerD

The proxy acts as a broker between the endpoint and the CA.

Why this answer

The SCEP proxy allows the endpoint to request a certificate from an internal CA through the ISE node, keeping the CA hidden from the internal network.

Practice this question →

MCQmedium

You are configuring a BYOD flow for iOS devices and notice that the native supplicant provisioning process is failing during the installation of the mobile configuration profile. Where should you check the logs in ISE to determine if the issue is related to the SCEP proxy communication?

A.Policy > Policy Elements > Results > Certificate Profiles

B.Administration > System > Licensing

C.Operations > RADIUS Livelog

D.Operations > Troubleshoot > Debug Wizard > scep

AnswerD

The SCEP debug logs are the primary location for troubleshooting certificate issuance issues during the BYOD flow.

Why this answer

The SCEP proxy logs are specifically located under the 'SCEP' category within the Operations > Troubleshooting > Debug Wizard or by monitoring the 'scep.log' file.

Practice this question →

MCQhard

You are integrating an MDM server with ISE for BYOD. The requirement is that ISE must check the compliance status of the device before granting full network access. Which feature must be enabled in the MDM configuration within ISE?

A.Configure a 'Compliance' RADIUS attribute

B.Enable 'Device Compliance' in the MDM server configuration object

C.Enable 'Allow full access' in the Authorization Policy

D.Enable 'MDM Enrollment' in the Policy Set

AnswerB

This setting allows ISE to query the MDM for the compliance status of the registered device.

Why this answer

The 'Device Compliance' checkbox must be enabled in the MDM server configuration to trigger the API calls for status checks.

Practice this question →

MCQhard

During BYOD onboarding, the client is unable to download the Network Setup Assistant (NSA). You verify the portal settings and observe that the 'Client Provisioning' resource is correctly assigned to the policy. What is the most likely cause if the device fails to reach the download page?

A.The user is not part of the Active Directory group assigned to the policy

B.The client does not have the native supplicant installed

C.The redirect ACL is blocking traffic to the ISE IP address on TCP port 8443

D.The certificate on the ISE portal is expired

AnswerC

If the ACL blocks the traffic, the client cannot communicate with the ISE provisioning service.

Why this answer

The redirect ACL must permit traffic to the Cisco ISE server on ports 8443 or 8905 to ensure the client can reach the provisioning services.

Practice this question →

MCQmedium

Which protocol is used by ISE to communicate with the MDM server for device status checks?

A.SNMP

B.REST API

C.RADIUS

D.LDAP

AnswerB

REST API is the standard mechanism for ISE to interact with external MDM platforms.

Why this answer

ISE uses REST APIs to communicate with most modern MDM solutions like AirWatch or Intune.

Practice this question →

Multi-Selecthard

Which THREE of the following items are required for the EAP-TLS authentication process to succeed?

Select 3 answers

A.User password stored in the endpoint registry

B.Client certificate installed on the device

C.ISE server certificate installed on the PSN

D.Trust anchor (Root CA) installed on both client and server

E.Active Directory GPO to force login

AnswersB, C, D

The client must present its certificate to the server.

Why this answer

EAP-TLS requires the client to have a certificate, the server to have a certificate, and both to trust the CA chain.

Practice this question →

MCQmedium

An administrator needs to ensure that only devices enrolled in their corporate MDM (AirWatch) can gain full network access. How should the ISE authorization policy be configured to verify MDM compliance for a BYOD endpoint?

A.Configure a static IP address in the authorization profile.

B.Configure the WLC to send a CoA immediately upon association.

C.Use the 'DeviceRegistrationStatus' equals 'Registered' condition.

D.Use the 'MDMServer' and 'ComplianceStatus' attributes in the authorization policy condition.

AnswerD

These attributes allow ISE to evaluate the compliance status reported by the integrated MDM server.

Why this answer

The 'MDM Compliance' attribute is returned by the MDM server to ISE during the authorization process, which can then be checked in the authorization policy condition.

Practice this question →

MCQeasy

What is the primary benefit of using native supplicant provisioning in ISE?

A.It provides complete control over the device's file system

B.It encrypts the entire hard drive

C.It leverages the built-in OS capabilities for connectivity

D.It removes the need for RADIUS authentication

AnswerC

Using the native supplicant prevents the need for additional, resource-heavy third-party agents.

Why this answer

Native supplicant provisioning simplifies user experience by automatically configuring WiFi settings without requiring third-party software.

Practice this question →

MCQmedium

Which RADIUS attribute is commonly used to inform the Network Access Server (NAS) that a re-authentication is required after a successful BYOD provisioning?

A.Termination-Action: RADIUS-Request

B.Class-Attribute: Re-Authenticate

C.Filter-Id: Refresh

D.Tunnel-Type: VLAN-Change

AnswerA

This tells the switch to re-authenticate the user once the BYOD portal session is closed.

Why this answer

The 'Cisco-AV-Pair' containing 'url-redirect' is used initially, but 'Termination-Action: RADIUS-Request' is often used to force a re-authentication after the BYOD process.

Practice this question →

MCQhard

You are troubleshooting a certificate provisioning failure where the error is 'Internal CA Error'. What is the most likely cause?

A.The ISE node is not configured as a subordinate CA correctly

B.The user password has expired

C.The client certificate is too small

D.The network switch is blocking port 443

AnswerA

If ISE is meant to act as a CA, it must be properly tiered and trusted.

Why this answer

The most common cause for an Internal CA error is that the ISE node lacks the necessary permissions or the CA is misconfigured as a root/subordinate.

Practice this question →

Multi-Selecthard

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

Select 3 answers

A.SMTP

B.HTTPS

C.FTP

D.RADIUS

E.SCEP

AnswersB, D, E

Used for the BYOD portal access.

Why this answer

SCEP is for certificates, HTTPS is for the portal, and RADIUS is for network access control.

Practice this question →

MCQeasy

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

A.Policy > Policy Sets > [Set Name] > Authorization Policy

B.Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings

C.Operations > Troubleshoot > BYOD Settings

D.Administration > Device Portal Management

AnswerB

This is the correct navigation to toggle BYOD settings for a specific portal.

Why this answer

The BYOD setting is enabled within the Portal Settings page of a specific Guest or My Devices portal.

Practice this question →

MCQeasy

What is the primary function of the 'Client Provisioning' policy in the context of BYOD?

A.To restrict the number of devices a user can register.

B.To determine which provisioning resources are delivered to the device based on its attributes.

C.To define which users are authorized to access the network.

D.To configure the MDM server connection settings.

AnswerB

This policy maps the device type and other attributes to the correct provisioning package.

Why this answer

The Client Provisioning policy determines which provisioning resources (such as installers or profiles) are pushed to the device based on its OS and requirements.

Practice this question →

MCQhard

You are configuring EAP-TLS for BYOD. What must be included in the 'Allowed Protocols' list in ISE?

A.LEAP

B.EAP-FAST

C.EAP-TLS

D.PEAP-MSCHAPv2

AnswerC

EAP-TLS is the mandatory protocol for certificate-based authentication.

Why this answer

EAP-TLS must be explicitly enabled in the 'Allowed Protocols' section of the Authentication Policy for the handshake to work.

Practice this question →

MCQmedium

When configuring an Authorization Policy for BYOD, which condition should be used to ensure the device has successfully performed BYOD registration?

A.Session:BYODRegistrationStatus EQUALS Registered

B.Endpoint:Profile EQUALS RegisteredDevice

C.Session:RegistrationMode EQUALS Auto

D.Device:AccessType EQUALS BYOD

AnswerA

This attribute is set by ISE once the registration and provisioning flow completes.

Why this answer

The 'BYOD Registered' attribute in the Session object (or Device Registration Status) is the standard way to verify if a device has completed the BYOD flow.

Practice this question →

MCQmedium

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

A.Policy > Policy Elements > Results > Certificate Templates

B.Operations > RADIUS Livelog

C.Operations > Reports > Endpoints and Users > Certificate Provisioning

D.Administration > System > Certificates > Certificate Signing Requests

AnswerC

This report specifically tracks certificate enrollment attempts and failures.

Why this answer

The 'Certificate Provisioning' logs are located under Operations > Reports > Endpoints and Users > Certificate Provisioning.

Practice this question →

MCQhard

During the BYOD onboarding process, a user is successfully redirected to the portal, but the certificate installation fails because the client cannot trust the root CA. Which configuration is required to resolve this?

A.Install the CA certificate on the local WLC controller under the WLAN configuration.

B.Add the Root CA to the 'System Certificates' store instead of 'Trusted Certificates'.

C.Enable 'Allow Weak Ciphers' in the global BYOD settings.

D.Import the Root CA certificate into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled.

AnswerD

This ensures that the ISE node trusts certificates issued by the CA and that the CA certificate is pushed to the client during onboarding.

Why this answer

The Root CA certificate must be uploaded to the 'Trusted Certificates' store in ISE and marked as trusted for 'Client Authentication'.

Practice this question →

Multi-Selectmedium

Which TWO of the following are components of the Cisco ISE 'Endpoint' object?

Select 2 answers

A.User's home address

B.The user's password hash

C.Custom Attributes

D.MAC Address

E.Device's hard drive serial number

AnswersC, D

Custom attributes allow administrators to tag endpoints with specific data.

Why this answer

Endpoint objects contain the MAC address and a collection of custom and system attributes related to the device.

Practice this question →

MCQmedium

You have configured a BYOD flow where the user must approve the device. Which portal type must be used to allow this?

A.Client Provisioning portal

B.My Devices portal

C.Sponsor portal

D.Guest portal

AnswerB

The My Devices portal provides user-level control over their registered endpoints.

Why this answer

The 'My Devices' portal allows users to manage, block, or delete their registered BYOD devices.

Practice this question →

Multi-Selectmedium

Which TWO of the following methods can be used to identify a device as 'BYOD' in ISE?

Select 2 answers

A.IP address range

B.Bulk import of MAC addresses

C.SNMP community string

D.Switch port ID

E.Self-registration via the BYOD portal

AnswersB, E

Administrators can import MAC addresses to pre-register devices as BYOD.

Why this answer

Devices can be identified via manual registration by the user or through automated enrollment via the BYOD flow.

Practice this question →

MCQeasy

Which dashboard widget provides a quick summary of BYOD activity in your network?

A.System Resources

B.Active Directory Health

C.BYOD Registration Status

D.RADIUS Latency

AnswerC

This widget is standard in the ISE dashboard for monitoring BYOD adoption.

Why this answer

The BYOD/Registration dashboard widgets provide real-time visibility into the number of registered vs. pending devices.

Practice this question →

MCQmedium

You are troubleshooting a scenario where an Android device is unable to complete the BYOD onboarding flow. You suspect the issue is with the supplicant provisioning wizard. Which tool should you use to verify if the provisioning payload was actually generated?

A.Work Centers > BYOD > Client Provisioning

B.Administration > System > Settings > Proxy

C.Operations > Troubleshoot > TCP Dump

D.Policy > Policy Elements > Conditions > Other > BYOD

AnswerA

This area displays the provisioning rules and the status of resources available for different device types.

Why this answer

The 'Provisioning' resources tab in the ISE portal configuration lists the resources generated for different operating systems.

Practice this question →

MCQmedium

Which of the following is a common reason for a 'Certificate Mismatch' error during EAP-TLS?

A.The ISE node time is out of sync

B.The client does not trust the Root CA that signed the server certificate

C.The device is not in the correct VLAN

D.The SSID is not configured for EAP-TLS

AnswerB

Trust is the foundational requirement for successful EAP-TLS handshakes.

Why this answer

This occurs when the Root CA certificate on the client does not match the CA that signed the certificate provided by the ISE server.

Practice this question →

Multi-Selecthard

Which THREE of the following are potential reasons a device might be placed in a 'Quarantine' VLAN during the BYOD process?

Select 3 answers

A.Device failed MDM compliance check

B.User forgot their Wi-Fi password

C.Device OS version is below the minimum requirement

D.Missing or expired client certificate

E.The device is too new

AnswersA, C, D

Non-compliant devices are often isolated in quarantine.

Why this answer

A device might be quarantined if it fails compliance, is missing a required certificate, or has an outdated OS version detected by the MDM.

Practice this question →

MCQeasy

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

A.To provide a VPN tunnel to the internal network

B.To manage the user's Active Directory account

C.To scan the device for malware before allowing network access

D.To configure the native supplicant settings for secure network access

AnswerD

The NSA automates the configuration of WiFi profiles and certificate installation.

Why this answer

The NSA is a small utility downloaded by the endpoint to configure the supplicant for secure wireless network access.

Practice this question →

Multi-Selectmedium

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

Select 2 answers

A.Install a dedicated agent on every switch

B.Enable BYOD settings in the device portal configuration

C.Create a local user account for every device

D.Configure an Authorization Policy to redirect BYOD users

E.Disable RADIUS authentication

AnswersB, D

This is required to enable the self-service flow.

Why this answer

The two core requirements are enabling the BYOD portal and configuring the authorization policy to handle the registration flow.

Practice this question →

MCQhard

You want to enforce a policy where personal devices are allowed access, but only if they are not jailbroken. How is this achieved in a BYOD scenario?

A.Use ISE profiling only

B.Use an ACL on the switch

C.Configure a WLC-based check

D.Integrate an MDM that performs jailbreak detection

AnswerD

MDM is the only component capable of deep device health checks like jailbreak detection.

Why this answer

MDM integration is required to perform health checks like jailbreak detection, which is then reported to ISE to inform the authorization decision.

Practice this question →