Courseiva

CCNA BYOD Questions

34 questions · BYOD · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selecthard

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

Select 3 answers
A.The user must manually 'Install' the configuration profile
B.The device must be connected via VPN
C.HTTPS access to the ISE portal
D.The profile must be signed by a trusted certificate
E.The device must be jailbroken
AnswersA, C, D

Native Supplicant Provisioning delivers the profile via the ISE portal, but iOS requires explicit user consent before the configuration profile installs. The user must tap Install and authenticate, so manual installation is a necessary step for the supplicant to receive its certificate and Wi-Fi settings.

Why this answer

Option A is correct because Native Supplicant Provisioning (NSP) on iOS requires the user to manually tap 'Install' to accept and install the generated .mobileconfig profile — iOS does not allow silent installation of Wi-Fi/802.1X profiles pushed by ISE. Option C is correct because the iOS device must reach the ISE Guest/Sponsor/ BYOD portal over HTTPS (TCP 443) to authenticate, download the provisioning profile, and complete the onboarding flow. Option D is correct because the configuration profile delivered during NSP must be signed by a certificate that the iOS device trusts (e.g., a publicly trusted CA or an internal CA whose root is already installed), otherwise iOS rejects the profile as unsigned/untrusted.

Option B is not required — NSP operates over the existing Wi-Fi/HTTPS path to the ISE portal, not a VPN tunnel. Option E is not required — NSP is a supported, Apple-sanctioned workflow on non-jailbroken iOS devices.

Exam trap

SISE often tests the requirements for NSP, and candidates may incorrectly assume VPN or jailbreaking is needed, or overlook the need for a trusted certificate.

Practice this question →
2
Multi-Selecteasy

Which TWO of the following are valid device attributes that can be used to identify a device for BYOD onboarding?

Select 2 answers
A.Device-Type
B.Operating-System
C.VLAN-ID
D.RADIUS-Session-ID
E.Port-Number
AnswersA, B

Device-Type is a profiled attribute derived from endpoint fingerprinting, such as distinguishing a phone from a laptop. BYOD onboarding policies can match on it to apply the correct registration flow and authorisation result for that class of device.

Why this answer

Device-Type (A) is a valid device attribute for BYOD onboarding because onboarding policies in solutions like Cisco ISE use the endpoint's device category (e.g., smartphone, tablet, laptop) to match authorization rules and assign the appropriate access. Operating-System (B) is also valid because the endpoint's OS (e.g., Windows, macOS, iOS, Android) is a recognized attribute used in BYOD device-identification and policy conditions. VLAN-ID (C) is not a device attribute; it is a network segmentation value assigned to a switch port or SSID, not a property of the endpoint itself.

RADIUS-Session-ID (D) is a per-session identifier generated during RADIUS authentication, not a persistent device attribute. Port-Number (E) identifies the switch port or network interface the device connects through, which is a network location attribute rather than a device attribute.

Exam trap

SISE often tests the distinction between endpoint/device identity attributes (Device-Type, Operating-System) and network access attributes (VLAN-ID, Port-Number, RADIUS-Session-ID), causing candidates to select network-layer values as device identifiers.

Practice this question →
3
MCQmedium

In the BYOD flow, what occurs immediately after the user provides credentials in the portal?

A.The device is automatically moved to the production VLAN
B.The user is disconnected from the network
C.The device is provisioned with a certificate
D.The device is registered in the Active Directory
AnswerC

After portal authentication, Microsoft Entra ID issues a device certificate to the BYOD endpoint, satisfying the stem's requirement for the step immediately following credential submission. This certificate then serves as the identity credential for subsequent EAP-TLS authentication, removing the need to re-prompt the user for credentials during network onboarding.

Why this answer

In the BYOD flow, after the user authenticates to the device registration portal, ISE provisions the device with a certificate (typically an X.509 client certificate from the internal CA) so the device can be trusted for future 802.1X/EAP-TLS authentications. This certificate-based trust is the core of the BYOD onboarding process.

Exam trap

The trap is that candidates think the device is immediately placed on the production VLAN after login, but the actual next step is certificate provisioning — the VLAN move only happens after the full onboarding and posture cycle completes.

How to eliminate wrong answers

Option A is wrong because moving the device to the production VLAN happens after successful onboarding and posture compliance, not immediately after credential entry. Option B is wrong because the user is not disconnected at this point — the session continues through the onboarding workflow. Option D is wrong because registering the device in Active Directory is not part of the ISE BYOD flow; ISE registers the device in its own endpoint database and issues a certificate, not an AD computer object.

Practice this question →
4
Multi-Selectmedium

Which TWO of the following are benefits of integrating MDM with Cisco ISE for BYOD?

Select 2 answers
A.Ability to trigger remote wipe or lock commands
B.Faster SSID connection speed
C.Automated device compliance status checks
D.Automatic creation of Active Directory accounts
E.Increased bandwidth for BYOD users
AnswersA, C

MDM integration lets ISE instruct the MDM server to issue remote wipe or lock commands when a BYOD device is lost, stolen or non-compliant. This satisfies the benefit requirement by enforcing remediation directly on the endpoint through the MDM API.

Why this answer

Option A (Ability to trigger remote wipe or lock commands) is correct because integrating an MDM with Cisco ISE allows ISE to invoke MDM APIs to issue remote wipe or lock actions on noncompliant or lost/stolen BYOD endpoints, typically via the MDM's REST API during posture or remediation workflows. Option C (Automated device compliance status checks) is correct because the ISE-MDM integration uses the MDM's API to poll or receive device compliance attributes (e.g., jailbroken/rooted status, OS version, PIN enforcement, encryption), which ISE then uses in authorization policies to grant, restrict, or quarantine network access. Option B is incorrect because SSID connection speed is determined by wireless RF conditions, PHY rates, and 802.11 negotiation, not by MDM-ISE integration.

Option D is incorrect because ISE-MDM integration does not create Active Directory accounts; AD account provisioning is handled by separate identity management or directory tools. Option E is incorrect because bandwidth allocation is governed by QoS, WLAN policies, and network capacity, not by MDM-ISE integration.

Exam trap

SISE often tests the distinction between MDM integration benefits and general network performance improvements, causing candidates to select options like faster SSID connection or increased bandwidth, which are unrelated to MDM.

Practice this question →
5
MCQmedium

A user reports that their BYOD device is not being recognized as 'Compliant' even though the MDM shows it is compliant. Which ISE component is responsible for retrieving this status?

A.The ISE MDM Server connector
B.The ISE Policy Information Point (PIP)
C.The ISE Monitoring node
D.The ISE RADIUS service
AnswerA

The ISE MDM Server connector polls the external MDM to obtain device compliance and jailbreak status, then feeds it into authorisation. Without this connector, ISE cannot learn the MDM's verdict, so the device never matches a Compliant condition despite the MDM reporting compliance.

Why this answer

The ISE MDM Server connector is the component that communicates directly with external MDM systems (such as Intune, AirWatch, or MobileIron) to retrieve device compliance status. It uses the MDM API to poll or receive push notifications about device posture, then feeds that data into ISE's authorization policies. Without this connector, ISE would have no way to know whether a BYOD device meets compliance requirements, even if the MDM itself reports it as compliant.

Exam trap

SISE often tests the distinction between components that retrieve external data (MDM connector) versus those that store it (PIP) or enforce it (RADIUS), so candidates must remember that the connector is the active retrieval agent.

How to eliminate wrong answers

Option B is wrong because the Policy Information Point (PIP) is an internal ISE database that stores attributes retrieved by other components—it does not itself communicate with external MDMs. Option C is wrong because the Monitoring node handles logging, reporting, and troubleshooting, not external data retrieval. Option D is wrong because the RADIUS service processes authentication and authorization requests but does not fetch MDM compliance data; it relies on the MDM connector to supply that information.

Practice this question →
6
Multi-Selectmedium

Which TWO of the following are common troubleshooting steps for a failed BYOD portal redirection?

Select 2 answers
A.Restart the Active Directory domain controller
B.Check the Authorization Policy for the correct URL-Redirect attribute
C.Verify the redirect ACL permits access to ISE
D.Re-configure the DHCP server
E.Change the switch model
AnswersB, C

The Authorization Policy's URL-Redirect attribute determines where the BYOD portal sends unregistered devices after authentication. If it points to a stale or incorrect portal address, redirection fails silently. Verifying this attribute directly satisfies the stem's requirement to troubleshoot failed redirection, since the policy governs the redirect target itself.

Why this answer

Option B is correct because in Cisco ISE BYOD flows the Authorization Policy must return the correct URL-Redirect attribute (e.g., the Cisco AV pair url-redirect pointing to the guest/BYOD portal) so the endpoint is redirected to the portal instead of being denied or passed through. Option C is correct because the redirect ACL applied to the authorization result must permit the client's traffic to reach ISE (TCP 8443 for the portal, and DNS resolution), otherwise the HTTP redirect cannot complete and the portal never loads. Restarting the Active Directory domain controller (A) is unrelated to portal redirection and would not fix a redirect attribute or ACL problem.

Re-configuring the DHCP server (D) is unnecessary unless IP addressing is broken, which is not the described symptom. Changing the switch model (E) is irrelevant since redirection depends on policy and ACL configuration, not hardware model.

Exam trap

SISE often tests the misconception that BYOD redirection failures are caused by backend infrastructure (AD, DHCP, hardware) rather than the two configuration touchpoints that actually control redirection: the Authorization Policy's URL-Redirect attribute and the redirect ACL on the NAD.

Practice this question →
7
MCQmedium

Which of the following is a requirement for a successful BYOD certificate provisioning flow?

A.The client must have the Root CA certificate installed in its trusted store
B.The client must use a specific third-party supplicant
C.The client must be joined to the Active Directory domain
D.The device must be managed by the same MDM as the enterprise devices
AnswerA

The client must trust the issuing CA before it will accept the provisioned certificate; without the Root CA in its trusted store, the device rejects the certificate chain and provisioning fails. This satisfies the stem's requirement for a successful BYOD certificate provisioning flow.

Why this answer

For BYOD certificate provisioning (e.g., via the native supplicant or Cisco Network Setup Assistant), the client must trust the ISE certificate chain, which requires the Root CA certificate to be installed in the client's trusted store. Without that trust anchor, the TLS handshake during enrollment fails and the certificate cannot be provisioned. This is a fundamental PKI requirement for any certificate-based onboarding flow.

Exam trap

SISE often tests the misconception that BYOD certificate provisioning requires domain join or MDM management, when in fact the only hard requirement is that the client trusts the issuing CA's root certificate.

How to eliminate wrong answers

Option B is wrong because ISE BYOD provisioning supports native supplicants (Windows, macOS, iOS, Android) and does not require a specific third-party supplicant. Option C is wrong because BYOD devices are typically personal and not domain-joined; AD membership is not a prerequisite for certificate provisioning. Option D is wrong because BYOD devices are by definition not managed by the enterprise MDM; the flow is designed for unmanaged devices, so MDM management is not required.

Practice this question →
8
MCQhard

A company has deployed Cisco ISE BYOD with native supplicant provisioning. Employees are reporting that their Windows 10 devices fail to complete the onboarding process. The administrator reviews the ISE logs and sees that the devices are successfully authenticated and authorized for the BYOD onboarding portal, but the supplicant provisioning wizard fails to run. The administrator suspects that the issue is related to the supplicant provisioning settings. Which of the following should the administrator verify first to resolve this issue?

A.The Windows 10 devices have the latest version of the Cisco AnyConnect Network Access Manager installed
B.The supplicant provisioning profile in ISE is configured to use the correct Windows supplicant and the provisioning wizard is enabled
C.The certificate authority (CA) in ISE is configured to issue certificates with a validity period of at least one year
D.The client provisioning policy is configured to use a guest portal instead of a BYOD portal
AnswerB

For native supplicant provisioning on Windows, ISE must be configured with a supplicant provisioning profile that specifies the Windows native supplicant and includes the provisioning wizard. If the profile is misconfigured or the wizard is disabled, the provisioning will fail even if authentication succeeds. The administrator should verify that the supplicant profile is correctly set to use the Windows supplicant and that the wizard is enabled for the device type.

Why this answer

For native supplicant provisioning to work on Windows 10, ISE must have a supplicant provisioning profile that correctly identifies the Windows native supplicant and enables the provisioning wizard. If the profile is misconfigured or the wizard is not enabled, the device will fail to run the wizard even after successful authentication. The administrator should verify the supplicant profile settings, including the supplicant type and the provisioning wizard configuration.

Other options, such as requiring AnyConnect or checking certificate validity, are not relevant to the wizard execution failure.

Exam trap

The trap here is assuming that third-party supplicant software like AnyConnect is required, when native supplicant provisioning uses the built-in Windows supplicant.

Practice this question →
9
MCQeasy

What is the purpose of the 'Redirect ACL' on the network access device?

A.To encrypt the traffic between the client and the switch
B.To limit the bandwidth for BYOD users
C.To force the client to use a specific DNS server
D.To permit access to the ISE portal while blocking all other traffic
AnswerD

The Redirect ACL on the switch or WLC permits client traffic to the ISE portal and DNS while denying everything else, forcing the endpoint into the captive portal for authentication or remediation before broader access is granted.

Why this answer

The Redirect ACL on the NAD (switch/WLC) is a pre-auth ACL that permits only the traffic required to reach the ISE portal (DNS, DHCP, HTTP/HTTPS to ISE) and denies everything else, forcing the client into the guest/BYOD/posture flow. Once the client is authorized, ISE sends a CoA that replaces the redirect ACL with the appropriate authorization ACL (e.g., full access or limited access). This is the mechanism that makes centralized web authentication and BYOD onboarding work.

Exam trap

SISE often tests the misconception that the Redirect ACL is a security enforcement ACL for post-auth traffic, when in fact it is a pre-auth traffic-steering mechanism whose only job is to funnel the client to the ISE portal.

How to eliminate wrong answers

Option A is wrong because the Redirect ACL does not encrypt traffic; encryption on the access layer is handled by MACsec (802.1AE) or by the EAP TLS tunnel, not by an ACL. Option B is wrong because bandwidth limiting is enforced by QoS policies (rate limiting, policing) on the NAD, not by an ACL. Option C is wrong because forcing a specific DNS server is done via DHCP option 6 or DNS snooping/redirection, not by the Redirect ACL — the ACL merely permits DNS traffic to whatever server the client is configured to use.

Practice this question →
10
MCQmedium

If a user is successfully registered but cannot connect after the BYOD flow, which status should you check in the 'Endpoints' menu?

A.User ID
B.Registration Status
C.Last Access Date
D.Device Type
AnswerB

Registration Status shows whether the endpoint completed onboarding and holds a valid certificate, satisfying the stem's constraint of a registered user who cannot connect. A failed or pending status reveals the certificate was never issued, explaining the connection failure.

Why this answer

The 'Registration Status' field in the Endpoints menu directly indicates whether a device completed the BYOD onboarding/registration process successfully. If a user is registered but cannot connect, checking Registration Status confirms whether the endpoint actually finished the registration handshake or is stuck in a pending/failed state. This is the authoritative field for diagnosing post-registration connectivity issues in the BYOD flow.

Exam trap

The trap here is confusing user-level identity fields (User ID) with endpoint-level onboarding state (Registration Status), causing candidates to pick the field that seems most 'identifying' rather than the one that reflects BYOD completion.

How to eliminate wrong answers

Option A is wrong because User ID only identifies the account owner and does not reflect whether the device itself completed registration or is authorized to connect. Option C is wrong because Last Access Date is a historical audit field showing the last successful connection, not the current registration or authorization state. Option D is wrong because Device Type is merely descriptive metadata about the endpoint hardware/OS and has no bearing on whether registration or connectivity succeeded.

Practice this question →
11
MCQmedium

You are configuring a BYOD flow where users must register their devices via the self-service portal. Which ISE component is responsible for triggering the redirection to the BYOD portal after an initial MAC Authentication Bypass (MAB) success?

A.Policy Set with a global redirect object
B.Authentication Policy with a portal trigger
C.RADIUS server-side redirect attribute
D.Authorization Profile with a redirect ACL and URL redirect
AnswerD

The Authorization Profile carries the redirect ACL and URL redirect attributes returned in the RADIUS Access-Accept after MAB succeeds. These attributes instruct the switch to intercept the session and send the user's browser to the BYOD self-service portal for registration.

Why this answer

The Authorization Profile with a redirect ACL and URL redirect is responsible for triggering the redirection to the BYOD portal after an initial MAB success. When a device authenticates via MAB, ISE evaluates the authorization policy and returns an Authorization Profile that includes a redirect ACL and a URL redirect to the BYOD portal. The NAS then applies the redirect ACL and sends the user's HTTP traffic to the portal.

Exam trap

SISE often tests the specific ISE component that triggers redirection. Candidates may think redirection is configured in the authentication policy or via a global object, but it is actually an Authorization Profile with redirect attributes.

How to eliminate wrong answers

Option A is wrong because a Policy Set with a global redirect object is not a specific ISE component; redirection is achieved via Authorization Profiles. Option B is wrong because an Authentication Policy with a portal trigger is not how redirection is implemented; authentication policies determine authentication methods, not redirection. Option C is wrong because a RADIUS server-side redirect attribute is not a standard ISE term; redirection is done via Authorization Profile attributes like Cisco-AVPair.

Practice this question →
12
MCQmedium

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

A.Device Profiling
B.RADIUS Accounting
C.Active Directory Identity Store
D.Policy Sets
AnswerA

Device profiling fingerprints the connecting endpoint, using attributes such as DHCP, HTTP user-agent and MAC OUI to identify whether it is an iPhone, Windows or other device type. This satisfies the stem's requirement to identify device type so the appropriate configuration is applied.

Why this answer

Device Profiling is the ISE component that identifies the device type (e.g., iPhone vs. Windows) by collecting attributes via probes such as DHCP, RADIUS, SNMP, and NMAP, then matching them against profiling policies. This identification drives the appropriate BYOD configuration and authorization.

Exam trap

SISE often tests which component performs device identification, and candidates confuse profiling with authorization constructs like policy sets or identity stores.

How to eliminate wrong answers

Option B is wrong because RADIUS Accounting provides session start/stop and traffic data, not device type identification — it does not classify endpoints. Option C is wrong because Active Directory is an identity store for user authentication, not a device classification engine. Option D is wrong because Policy Sets are containers that group authentication and authorization rules; they consume profiling data but do not themselves identify device types.

Practice this question →
13
MCQhard

A company uses Cisco ISE BYOD with certificate-based authentication. Employees report that their devices successfully onboard and receive a certificate, but after a few days, they are unable to connect to the corporate SSID. The administrator checks ISE and finds that the devices are failing authentication with the error 'Certificate revoked'. The administrator verifies that the certificates are still valid and not expired. Which ISE feature should the administrator check to resolve this issue?

A.Certificate Revocation List (CRL) distribution point and ISE's revocation check settings
B.Certificate Revocation List (CRL) settings in the certificate template
C.Certificate template's validity period and renewal settings
D.Online Certificate Status Protocol (OCSP) configuration in ISE
AnswerA

The error 'Certificate revoked' indicates that ISE is checking the certificate against a CRL and finding it listed as revoked, or the CRL is improperly configured. The administrator should verify the CRL distribution point in the certificate and ensure ISE can reach it and that the CRL is current. If the CRL incorrectly includes the certificate, or if ISE is using a stale CRL, it will reject valid certificates. Adjusting revocation check settings or updating the CRL resolves the issue.

Why this answer

The 'Certificate revoked' error means ISE's revocation check is determining the certificate is revoked. This typically occurs when the CRL distribution point is unreachable, the CRL is stale, or the certificate is incorrectly listed as revoked. The administrator should verify the CRL distribution point in the certificate and ISE's revocation settings.

Ensuring ISE can retrieve a current CRL and that the certificate is not actually revoked will resolve the authentication failures.

Exam trap

The trap here is focusing on certificate expiration or template settings, while the error explicitly indicates a revocation issue, pointing to CRL or OCSP configuration.

Practice this question →
14
MCQhard

If a user's certificate expires, how can the user renew it using the ISE BYOD flow?

A.The certificate renews automatically in the background
B.Re-install the Network Setup Assistant manually
C.Reconnect to the SSID and follow the re-enrollment prompt in the portal
D.Contact the administrator to manually push a new certificate
AnswerC

Reconnecting to the SSID triggers the BYOD flow, which detects the expired certificate and presents the re-enrollment prompt in the portal, satisfying the renewal requirement. The user then re-runs certificate provisioning to obtain a fresh certificate without manual administrator intervention.

Why this answer

When a user's certificate expires in an ISE BYOD flow, the user can renew it by reconnecting to the SSID and following the re-enrollment prompt in the portal. This triggers the BYOD onboarding process again, allowing the user to obtain a new certificate. The certificate does not renew automatically, nor does it require manual administrator intervention or re-installing the Network Setup Assistant.

Exam trap

SISE often tests the self-service nature of BYOD certificate renewal, and candidates may think automatic renewal or admin intervention is required.

How to eliminate wrong answers

Option A is wrong because certificates do not renew automatically in the background; they have a fixed validity period and require re-enrollment. Option B is wrong because re-installing the Network Setup Assistant is not the standard renewal method; the user should reconnect to the SSID to trigger the portal. Option D is wrong because contacting the administrator to manually push a new certificate is not the self-service BYOD flow; the user can renew it themselves via the portal.

Practice this question →
15
MCQeasy

When a user's device is stolen, which action should be taken in the 'My Devices' portal?

A.Deregister or Blacklist the device
B.Perform a factory reset on the device remotely
C.Delete the user's account
D.Change the user's AD password
AnswerA

Deregistering or blacklisting the stolen device in the My Devices portal immediately revokes its trust with Microsoft Entra ID, preventing further access to corporate resources. This satisfies the stem's stolen-device constraint by severing the device identity record, so any cached credentials or tokens tied to that registration can no longer authenticate.

Why this answer

In the 'My Devices' portal, the appropriate action when a device is stolen is to deregister or blacklist the device. Deregistration removes the device from the user's profile, while blacklisting prevents it from reconnecting to the network. This mitigates risk by ensuring the stolen device cannot access corporate resources.

Exam trap

SISE often tests the confusion between self-service portal actions and administrative actions, leading candidates to choose remote wipe or account deletion when the question specifically asks about the 'My Devices' portal.

How to eliminate wrong answers

Option B is wrong because the 'My Devices' portal does not have the capability to perform a remote factory reset; that would require a mobile device management (MDM) solution. Option C is wrong because deleting the user's account is an administrative action that affects the user's access entirely, not just the stolen device, and is not performed in the 'My Devices' portal. Option D is wrong because changing the user's AD password does not directly address the stolen device's access and is not an action available in the 'My Devices' portal.

Practice this question →
16
MCQhard

You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?

A.To sign certificates for the endpoints
B.To encrypt the SCEP traffic between ISE and the endpoint
C.To store the Private Keys of the issued certificates
D.To allow devices to request certificates from the CA via the ISE node
AnswerD

The SCEP proxy relays certificate requests from BYOD endpoints to the CA, since endpoints cannot reach the CA directly. ISE acts as intermediary, forwarding the request and returning the issued certificate. This satisfies the stem's constraint of enrolling BYOD devices without direct CA connectivity.

Why this answer

The SCEP proxy in ISE acts as an intermediary between the endpoint and the Certificate Authority (CA). Instead of the endpoint contacting the CA directly, it sends its SCEP request to ISE, which forwards it to the CA, obtains the certificate, and returns it to the endpoint. This allows ISE to enforce BYOD policies, apply authorization, and avoid exposing the CA directly to endpoints.

Exam trap

SISE often tests whether candidates think ISE signs certificates or stores private keys — the exam expects you to know ISE is only a proxy and never handles private keys or performs signing.

How to eliminate wrong answers

Option A is wrong because ISE does not sign certificates — the CA (e.g., Microsoft AD CS, EJBCA) performs the actual signing; ISE only proxies the request. Option B is wrong because while SCEP traffic can be encrypted (typically via HTTPS), the primary role of the SCEP proxy is not encryption but brokering the request. Option C is wrong because ISE never stores the endpoint's private key — the private key is generated on the endpoint and never leaves it; only the public key is sent in the CSR.

Practice this question →
17
MCQmedium

You are configuring a BYOD flow for iOS devices and notice that the native supplicant provisioning process is failing during the installation of the mobile configuration profile. Where should you check the logs in ISE to determine if the issue is related to the SCEP proxy communication?

A.Policy > Policy Elements > Results > Certificate Profiles
B.Administration > System > Licensing
C.Operations > RADIUS Livelog
D.Operations > Troubleshoot > Debug Wizard > scep
AnswerD

The Debug Wizard's scep option enables targeted SCEP proxy debugging, capturing certificate enrolment exchanges between ISE and the CA. This isolates whether profile installation failed due to SCEP communication rather than supplicant or MDM issues.

Why this answer

The Debug Wizard under Operations > Troubleshoot allows you to enable targeted debug logging for specific ISE services, including the SCEP proxy (scep). When native supplicant provisioning fails during mobile configuration profile installation, the SCEP proxy is responsible for forwarding certificate requests to the CA; enabling the scep debug lets you see the actual SCEP enrollment exchange and pinpoint failures. This is the correct place to check SCEP proxy communication logs.

Exam trap

SISE often tests the confusion between configuration menus (where you set up certificate profiles) and troubleshooting menus (where you view logs), causing candidates to pick Policy > Policy Elements instead of the Debug Wizard.

How to eliminate wrong answers

Option A is wrong because Policy > Policy Elements > Results > Certificate Profiles is where you configure certificate templates and RA/CA settings, not where you view runtime logs. Option B is wrong because Administration > System > Licensing only shows license consumption and has nothing to do with SCEP troubleshooting. Option C is wrong because Operations > RADIUS Livelog shows live RADIUS authentication/authorization events, not SCEP proxy or certificate enrollment traffic.

Practice this question →
18
MCQmedium

Which protocol is used by ISE to communicate with the MDM server for device status checks?

A.SNMP
B.REST API
C.RADIUS
D.LDAP
AnswerB

ISE queries the MDM server over its REST API, sending device identifiers and receiving compliance attributes such as jailbroken or managed status. This is the actual transport for MDM status checks, distinguishing it from RADIUS, TACACS+ or SNMP, which serve other ISE functions.

Why this answer

ISE communicates with MDM servers using REST API calls to query device status and compliance information. This allows ISE to integrate with MDM solutions for device registration and compliance checks.

Exam trap

The trap is confusing the protocol used for MDM integration with other protocols like RADIUS or LDAP; the exam expects you to know that ISE uses REST API for MDM communication.

How to eliminate wrong answers

Option A is wrong because SNMP is used for network monitoring, not MDM integration. Option C is wrong because RADIUS is used for authentication, authorization, and accounting, not for querying MDM servers. Option D is wrong because LDAP is used for directory services, not MDM integration.

Practice this question →
19
Multi-Selecthard

Which THREE of the following items are required for the EAP-TLS authentication process to succeed?

Select 3 answers
A.User password stored in the endpoint registry
B.Client certificate installed on the device
C.ISE server certificate installed on the PSN
D.Trust anchor (Root CA) installed on both client and server
E.Active Directory GPO to force login
AnswersB, C, D

EAP-TLS mandates mutual authentication, so the supplicant must present its own X.509 certificate to prove device identity to ISE. Without this client certificate, the TLS handshake cannot complete, since ISE requires the endpoint to authenticate itself rather than relying on credentials.

Why this answer

EAP-TLS is a mutual certificate-based authentication method, so the client must present its own identity certificate: option B (client certificate installed on the device) is required for the supplicant to authenticate to the network. The authentication server must also prove its identity, so option C (ISE server certificate installed on the PSN) is required for the Policy Service Node to present a valid server certificate during the TLS handshake. Both sides must validate the other's certificate chain, so option D (trust anchor/Root CA installed on both client and server) is required to build and verify the certificate path.

Option A is incorrect because EAP-TLS does not use a user password in the registry; authentication is based on certificates, not stored credentials. Option E is incorrect because an Active Directory GPO forcing login is not a prerequisite for the EAP-TLS handshake itself, even if AD may be used for authorization or identity mapping.

Exam trap

SISE often tests the misconception that EAP-TLS requires a password or that Active Directory configuration alone is sufficient, when in fact it is purely certificate-based and requires a trust anchor on both sides.

Practice this question →
20
MCQeasy

What is the primary benefit of using native supplicant provisioning in ISE?

A.It provides complete control over the device's file system
B.It encrypts the entire hard drive
C.It leverages the built-in OS capabilities for connectivity
D.It removes the need for RADIUS authentication
AnswerC

Native supplicant provisioning uses the operating system's built-in 802.1X supplicant rather than installing Cisco AnyConnect or another client, so endpoints connect using existing OS capabilities. This satisfies the requirement to avoid additional software on managed devices.

Why this answer

Native supplicant provisioning in Cisco ISE leverages the built-in 802.1X supplicant already present in the operating system (e.g., Windows Wired AutoConfig, macOS native supplicant) to establish network connectivity, rather than deploying a third-party supplicant like Cisco AnyConnect NAM. This reduces deployment complexity and cost while still enabling ISE to push configuration profiles and certificates to the endpoint.

Exam trap

The trap is assuming native supplicant provisioning eliminates RADIUS or provides deep device control; it only changes which 802.1X client is used, while authentication still flows through ISE/RADIUS.

How to eliminate wrong answers

Option A is wrong because native supplicant provisioning does not grant control over the device's file system; it configures network authentication settings via the OS supplicant. Option B is wrong because encrypting the entire hard drive is a function of full disk encryption (BitLocker/FileVault), not supplicant provisioning. Option D is wrong because native supplicant provisioning still relies on RADIUS authentication through ISE — it changes the supplicant, not the authentication protocol.

Practice this question →
21
MCQhard

You are troubleshooting a certificate provisioning failure where the error is 'Internal CA Error'. What is the most likely cause?

A.The ISE node is not configured as a subordinate CA correctly
B.The user password has expired
C.The client certificate is too small
D.The network switch is blocking port 443
AnswerA

The 'Internal CA Error' arises when ISE's internal certificate authority cannot issue the endpoint certificate, typically because the node's subordinate CA configuration, including the CA certificate chain, is incorrect or incomplete. This satisfies the stem's certificate provisioning failure scenario.

Why this answer

The 'Internal CA Error' in Cisco ISE certificate provisioning typically indicates that the ISE node's internal Certificate Authority (CA) is not properly configured as a subordinate CA to the enterprise PKI, or the CA certificate chain is incomplete/misconfigured. ISE uses its internal CA to issue certificates for BYOD, posture, and admin services, and if the subordinate CA relationship is broken, provisioning fails with this error. The correct fix is to verify the subordinate CA configuration and certificate chain.

Exam trap

SISE often tests whether candidates can distinguish between certificate provisioning errors caused by CA misconfiguration versus authentication or connectivity errors, causing them to pick a password or port-related answer when the error explicitly mentions 'Internal CA'.

How to eliminate wrong answers

Option B is wrong because an expired user password would produce an authentication failure (e.g., 'Authentication failed' or 'User password expired'), not an 'Internal CA Error' related to certificate provisioning. Option C is wrong because certificate key size (e.g., 1024 vs 2048 bits) would produce a key-strength or algorithm error, not an internal CA error. Option D is wrong because a switch blocking port 443 would cause a connectivity/timeout error (e.g., 'Unable to reach server'), not an internal CA error generated by ISE's CA subsystem.

Practice this question →
22
Multi-Selecthard

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

Select 3 answers
A.SMTP
B.HTTPS
C.FTP
D.RADIUS
E.SCEP
AnswersB, D, E

HTTPS secures browser-based onboarding and certificate enrolment traffic, satisfying the BYOD requirement that unmanaged personal devices authenticate over untrusted networks. Its TLS encryption protects credentials and device posture data in transit, and it underpins the web portals used for registration, compliance checks and remediation throughout the device lifecycle.

Why this answer

HTTPS (B) is critical because BYOD enrollment, policy delivery, and MDM/UEM management traffic must be encrypted and authenticated over TLS, typically on TCP 443, protecting device and user data in transit. RADIUS (D) is essential for authenticating BYOD devices and users to the network, commonly via 802.1X/EAP, enabling access control and dynamic VLAN or role assignment. SCEP (E) is the Simple Certificate Enrollment Protocol used to automate certificate issuance to BYOD devices, which underpins identity, Wi-Fi/EAP-TLS authentication, and VPN trust in the lifecycle.

SMTP (A) is only for sending email and FTP (C) is a legacy cleartext file-transfer protocol; neither provides the authentication, encryption, or certificate provisioning functions required for BYOD onboarding and management.

Exam trap

SISE often tests which protocols are essential to BYOD, and candidates may incorrectly include generic protocols like SMTP or FTP because they sound like standard network services, missing the security and certificate focus of BYOD.

Practice this question →
23
MCQeasy

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

A.Policy > Policy Sets > [Set Name] > Authorization Policy
B.Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings
C.Operations > Troubleshoot > BYOD Settings
D.Administration > Device Portal Management
AnswerB

The BYOD checkbox lives under the specific portal's own settings, reached via Work Centers > Guest Access > Portals & Components, then the named portal, then Portal Settings. This path satisfies the stem's requirement to enable BYOD for one specific registration portal rather than globally.

Why this answer

The BYOD checkbox for a specific device registration portal is enabled under Work Centers > Guest Access > Portals & Components > [Portal Name] > Portal Settings. This is where the portal configuration includes the option to enable BYOD device registration. The path is specific to the Guest Access work center in ISE.

Exam trap

SISE often tests whether candidates know the exact menu path for portal settings, confusing it with policy sets or administration menus, when the correct location is under Work Centers > Guest Access > Portals & Components.

How to eliminate wrong answers

Option A is wrong because Policy > Policy Sets > Authorization Policy is where authorization rules are defined, not where portal BYOD settings are configured. Option C is wrong because Operations > Troubleshoot > BYOD Settings is not a valid menu path for enabling BYOD on a portal; troubleshooting is for diagnostics. Option D is wrong because Administration > Device Portal Management is not the correct path in current ISE versions; the portal settings are under Work Centers > Guest Access.

Practice this question →
24
MCQeasy

A security team is deploying Cisco ISE BYOD for employee devices. They want to ensure that only devices that have completed the BYOD onboarding process and possess a valid certificate are allowed on the corporate SSID. Which ISE policy element should they configure to enforce this requirement?

A.An authorization policy that permits access only when the endpoint presents a valid certificate and is registered in the BYOD identity group.
B.A guest portal configuration that requires users to register their devices before accessing the network.
C.A client provisioning policy that matches the corporate SSID and requires certificate enrollment.
D.A posture policy that checks for the presence of the BYOD certificate on the endpoint.
AnswerA

The authorization policy is where ISE decides whether to grant, deny, or restrict network access. By requiring a valid certificate and membership in the BYOD identity group, the policy ensures that only devices that completed onboarding and hold a certificate are allowed on the corporate SSID. This directly enforces the stated requirement.

Why this answer

Authorization policies in Cisco ISE determine the level of network access granted to an endpoint. To allow only devices that have completed BYOD onboarding and possess a valid certificate, the policy must evaluate certificate validity and BYOD registration status. This is the correct enforcement point, as client provisioning and posture serve different roles in the BYOD lifecycle.

Exam trap

The trap here is assuming that client provisioning or posture policies enforce ongoing access control, when authorization is the policy set that grants or denies network access.

Practice this question →
25
MCQeasy

What is the primary function of the 'Client Provisioning' policy in the context of BYOD?

A.To restrict the number of devices a user can register.
B.To determine which provisioning resources are delivered to the device based on its attributes.
C.To define which users are authorized to access the network.
D.To configure the MDM server connection settings.
AnswerB

Client Provisioning policies in Microsoft Entra ID evaluate device attributes—such as platform, ownership and compliance state—to decide which configuration profiles, certificates and profiles are pushed during BYOD onboarding. This attribute-driven targeting satisfies the stem's requirement to control what provisioning resources reach each device.

Why this answer

The Client Provisioning policy in Cisco ISE determines which provisioning resources — such as supplicants, native supplicants, profiles, and agent installers — are delivered to an endpoint based on its attributes (OS, posture, device type). It is the policy layer that matches endpoint conditions to the correct provisioning portal and resource package. It does not govern device registration limits, user authorization, or MDM server settings.

Exam trap

SISE often tests the distinction between Client Provisioning (resource delivery based on endpoint attributes) and Authorization Policy (access decisions based on user/group) — candidates confuse the two because both are policy engines in ISE.

How to eliminate wrong answers

Option A is wrong because restricting the number of devices a user can register is controlled by the Guest/BYOD registration policy and endpoint limits, not by Client Provisioning. Option C is wrong because defining which users are authorized to access the network is the function of Authorization Policies, not Client Provisioning. Option D is wrong because configuring the MDM server connection is done in the MDM integration settings under External MDM, not in the Client Provisioning policy.

Practice this question →
26
MCQhard

You are configuring EAP-TLS for BYOD. What must be included in the 'Allowed Protocols' list in ISE?

A.LEAP
B.EAP-FAST
C.EAP-TLS
D.PEAP-MSCHAPv2
AnswerC

EAP-TLS must appear in the Allowed Protocols list because ISE only negotiates methods explicitly enabled there; without it, the supplicant's TLS handshake is rejected during EAP method negotiation. This satisfies the BYOD certificate-based authentication requirement, where the client presents a certificate and ISE validates it against Microsoft Entra ID-issued trust chains.

Why this answer

EAP-TLS requires both the client and server to present digital certificates for mutual authentication, so EAP-TLS must be explicitly listed in ISE's Allowed Protocols for the BYOD flow to negotiate it. Without EAP-TLS in the allowed list, ISE will reject or fail the TLS handshake even if certificates are valid.

Exam trap

SISE often tests the assumption that enabling certificate services or PKI is enough, when the Allowed Protocols list must explicitly include EAP-TLS for the method to be negotiated.

How to eliminate wrong answers

Option A is wrong because LEAP is a legacy Cisco-proprietary protocol with weak MS-CHAPv1-based authentication and no certificate support, unsuitable for BYOD EAP-TLS. Option B is wrong because EAP-FAST uses PACs (Protected Access Credentials) and is typically used for flexible authentication, not certificate-based EAP-TLS. Option D is wrong because PEAP-MSCHAPv2 tunnels MSCHAPv2 inside TLS but authenticates the client with username/password, not a client certificate, so it does not satisfy EAP-TLS requirements.

Practice this question →
27
MCQmedium

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

A.Policy > Policy Elements > Results > Certificate Templates
B.Operations > RADIUS Livelog
C.Operations > Reports > Endpoints and Users > Certificate Provisioning
D.Administration > System > Certificates > Certificate Signing Requests
AnswerC

The Certificate Provisioning report records each CA interaction, including the SCEP or EST enrolment exchange, so it isolates why issuance fails after successful registration. It satisfies the stem's constraint by showing the specific CA error rather than generic endpoint or authentication data.

Why this answer

The Certificate Provisioning report under Operations > Reports > Endpoints and Users is the dedicated location where ISE logs the outcome of CA interactions during BYOD onboarding, including certificate enrollment requests, successes, and failures. When devices register successfully but certificate issuance fails, this report captures the SCEP/PKCS or EST exchange between ISE and the CA, showing error codes returned by the CA.

Exam trap

SISE often tests the distinction between configuration objects (Certificate Templates, CSR management) and operational log locations, tricking candidates into picking a config page when the question asks where to examine logs.

How to eliminate wrong answers

Option A is wrong because Certificate Templates under Policy Elements define which certificate template ISE requests from the CA — they are configuration objects, not logs, so they cannot show runtime CA interaction failures. Option B is wrong because the RADIUS Livelog only shows authentication/authorization exchanges between the NAD and ISE, not the backend CA enrollment traffic. Option D is wrong because Certificate Signing Requests under Administration > System > Certificates is where you manage ISE's own internal CSRs for admin/eap/portal certificates, not the client certificate provisioning workflow for BYOD endpoints.

Practice this question →
28
MCQhard

During the BYOD onboarding process, a user is successfully redirected to the portal, but the certificate installation fails because the client cannot trust the root CA. Which configuration is required to resolve this?

A.Install the CA certificate on the local WLC controller under the WLAN configuration.
B.Add the Root CA to the 'System Certificates' store instead of 'Trusted Certificates'.
C.Enable 'Allow Weak Ciphers' in the global BYOD settings.
D.Import the Root CA certificate into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled.
AnswerD

The client rejects the certificate chain because the root CA is untrusted. Importing it into the Trusted Certificates store with the client-authentication trust checkbox enabled lets the endpoint validate the issued certificate, resolving the onboarding failure.

Why this answer

The certificate installation fails because the client does not trust the root CA. To resolve this, the root CA certificate must be imported into the 'Trusted Certificates' store with the 'Trust for client authentication or issuance of users' checkbox enabled. This ensures that the client trusts the CA that issued the certificate, allowing successful installation.

Exam trap

SISE often tests the specific location and settings for importing CA certificates, and candidates may confuse 'System Certificates' with 'Trusted Certificates' or overlook the checkbox for client authentication.

How to eliminate wrong answers

Option A is wrong because installing the CA certificate on the WLC is irrelevant; the trust issue is on the client side. Option B is wrong because 'System Certificates' store is used for ISE's own certificates, not for trusting external CAs for client authentication. Option C is wrong because enabling weak ciphers does not address the root CA trust problem and weakens security.

Practice this question →
29
MCQhard

A security engineer is configuring Cisco ISE BYOD with a single SSID for both employee onboarding and corporate access. The engineer wants to ensure that devices without a valid certificate are redirected to the BYOD portal, while devices with a valid certificate are granted full access. The engineer has created a client provisioning policy that provisions the native supplicant with the corporate SSID and a certificate template. However, after provisioning, devices are still being redirected to the BYOD portal on subsequent connections. Which configuration change is required to allow onboarded devices to bypass the portal?

A.Change the client provisioning policy to use a different supplicant profile that includes the certificate.
B.Modify the authorization policy to include a rule that matches devices presenting a valid certificate and assigns a permit access profile, placed above the redirection rule.
C.Add the certificate's issuer to the list of trusted CAs in the BYOD portal settings.
D.Enable the 'Allow employees to bypass BYOD portal' option in the BYOD settings.
AnswerB

The authorization policy must have a rule that matches certificate-based authentication and assigns full access. Placing it above the redirection rule ensures onboarded devices are not redirected again. Without this, all devices matching the redirection rule will continue to be redirected.

Why this answer

After a device is onboarded and presents a valid certificate, the authorization policy must have a rule that matches certificate authentication and grants full access. If the redirection rule is evaluated first or there is no certificate-based permit rule, the device will continue to be redirected. The correct fix is to add or reorder the authorization policy so that certificate-based access is granted before redirection.

Exam trap

The trap here is thinking that provisioning a certificate automatically changes the authorization result, when in fact the authorization policy must explicitly match certificate-based authentication to bypass redirection.

Practice this question →
30
Multi-Selectmedium

Which TWO of the following are components of the Cisco ISE 'Endpoint' object?

Select 2 answers
A.User's home address
B.The user's password hash
C.Custom Attributes
D.MAC Address
E.Device's hard drive serial number
AnswersC, D

Custom Attributes are a configurable field within the Cisco ISE Endpoint object, letting administrators store arbitrary metadata such as asset owner, compliance state, or department against a device. This satisfies the stem's requirement for an Endpoint component, since these attributes persist on the endpoint record and can be referenced by authorisation policies.

Why this answer

In Cisco ISE, an Endpoint (also called an identity group member for network devices) is defined by attributes that identify the device on the network, and MAC Address (D) is the primary unique identifier used for endpoint profiling, authorization policies, and MAB (MAC Authentication Bypass). Custom Attributes (C) are also part of the Endpoint object, allowing administrators to manually add metadata (e.g., device owner, location, or compliance status) to an endpoint for use in policy conditions. The user's home address (A) is not a field in the Endpoint object; it belongs to user/identity data, not device identity.

The user's password hash (B) is stored in the internal user database for authentication, not as an endpoint attribute. The device's hard drive serial number (E) is not a standard ISE Endpoint attribute, though ISE can collect some hardware attributes via profiling probes, the hard drive serial is not a defined component of the Endpoint object.

Exam trap

SISE often tests the boundary between Endpoint attributes and Identity (user) attributes — candidates mistakenly select user-centric data like passwords or addresses, forgetting that Endpoint objects are device-centric and keyed on MAC address.

Practice this question →
31
MCQeasy

Which dashboard widget provides a quick summary of BYOD activity in your network?

A.System Resources
B.Active Directory Health
C.BYOD Registration Status
D.RADIUS Latency
AnswerC

The BYOD Registration Status widget summarises device onboarding activity, showing registered, pending, and failed endpoints at a glance. This satisfies the stem's requirement for a quick summary of BYOD activity, aggregating registration states without drilling into individual sessions.

Why this answer

The 'BYOD Registration Status' dashboard widget provides a quick summary of BYOD activity, including the number of registered devices, pending registrations, and other relevant metrics. This widget is specifically designed to monitor BYOD onboarding and registration trends.

Exam trap

SISE often tests the purpose of specific dashboard widgets, and candidates may confuse BYOD Registration Status with other monitoring widgets like System Resources or RADIUS Latency.

How to eliminate wrong answers

Option A is wrong because System Resources shows CPU, memory, and disk usage of ISE nodes, not BYOD activity. Option B is wrong because Active Directory Health monitors AD connectivity and performance, not BYOD. Option D is wrong because RADIUS Latency displays authentication latency metrics, not BYOD registration status.

Practice this question →
32
MCQeasy

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

A.To provide a VPN tunnel to the internal network
B.To manage the user's Active Directory account
C.To scan the device for malware before allowing network access
D.To configure the native supplicant settings for secure network access
AnswerD

The Network Setup Assistant provisions BYOD endpoints by configuring the native supplicant with the correct SSID, authentication method and certificates. This satisfies the requirement for secure network access without manual user configuration, enabling devices to authenticate against ISE policies.

Why this answer

The Network Setup Assistant (NSA) is a client-side provisioning component in Cisco ISE BYOD flows that walks the end user through configuring the native supplicant (Windows WLAN AutoConfig, macOS, iOS, Android, etc.) with the correct SSID, EAP method (PEAP/EAP-TLS), and certificate settings so the device can authenticate via 802.1X. It is downloaded from the ISE Guest/BYOD portal and runs locally on the endpoint to install the required profile. This enables secure EAP-based network access without manual supplicant configuration by the user.

Exam trap

SISE often tests the confusion between the NSA (client-side supplicant provisioning) and ISE's server-side posture, profiling, and VPN functions — candidates pick 'malware scan' or 'VPN' because those are ISE features, but they are not what the NSA does.

How to eliminate wrong answers

Option A is wrong because VPN tunneling is provided by ISE's VPN posture/ASA integration or a separate VPN headend, not by the NSA — the NSA configures 802.1X supplicant settings, not IPsec/SSL tunnels. Option B is wrong because Active Directory account management is handled by ISE's external identity source integration (AD join, LDAP lookups), not by a client-side setup wizard. Option C is wrong because malware scanning is a posture assessment function performed by the ISE posture agent and third-party AV/AS plugins, not by the NSA, which only provisions supplicant configuration.

Practice this question →
33
Multi-Selectmedium

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

Select 2 answers
A.Install a dedicated agent on every switch
B.Enable BYOD settings in the device portal configuration
C.Create a local user account for every device
D.Configure an Authorization Policy to redirect BYOD users
E.Disable RADIUS authentication
AnswersB, D

BYOD cannot function unless the device portal configuration explicitly enables BYOD settings; without this toggle, ISE never presents the registration and provisioning portal to supplicants, so the mandatory BYOD flow fails before certificate enrolment begins.

Why this answer

Option B is correct because enabling BYOD settings in the device portal configuration is a mandatory step: the Cisco ISE device portal (the client provisioning and BYOD portal) must have BYOD functionality turned on so that endpoints can be onboarded, registered, and have supplicant/certificate provisioning performed. Option D is correct because a mandatory part of BYOD is an authorization policy that matches non-compliant or unregistered BYOD endpoints and redirects them to the BYOD/guest portal for onboarding, typically using a redirect URL (e.g., the client provisioning portal) before granting full network access. Option A is incorrect because BYOD onboarding does not require installing a dedicated agent on every switch; Cisco ISE uses RADIUS, web portals, and supplicant provisioning instead.

Option C is incorrect because BYOD does not require creating a local user account for every device; identity is handled through ISE's identity stores, certificates, and endpoint registration. Option E is incorrect because disabling RADIUS authentication would break the 802.1X/MAC authentication and authorization that ISE relies on for BYOD, so it is the opposite of a required step.

Exam trap

SISE often tests whether candidates know that BYOD requires both portal configuration and an authorization policy redirect, so candidates who pick 'install an agent on switches' or 'create local accounts' misunderstand the architecture.

Practice this question →
34
MCQhard

You want to enforce a policy where personal devices are allowed access, but only if they are not jailbroken. How is this achieved in a BYOD scenario?

A.Use ISE profiling only
B.Use an ACL on the switch
C.Configure a WLC-based check
D.Integrate an MDM that performs jailbreak detection
AnswerD

Jailbreak detection requires an MDM integration, because only an MDM agent on the device can inspect for compromised or rooted state and report it to the policy engine. This satisfies the stem's constraint of allowing personal devices only when not jailbroken.

Why this answer

Jailbreak (root) detection requires inspecting the device's OS integrity state — checking for modified system partitions, sideloaded root binaries (e.g., Cydia, Magisk), or disabled code signing. ISE cannot natively detect jailbreaks because profiling only inspects network-visible attributes like DHCP fingerprints, MAC OUI, and HTTP user-agent strings. An MDM agent runs on the endpoint with elevated privileges and can query the OS for tampering indicators, then report compliance status back to ISE via the MDM API (e.g., Cisco MDM/EMM integration using the Cisco ISE MDM REST API), enabling a posture-based authorization decision.

Exam trap

SISE often tests the misconception that ISE profiling alone can enforce endpoint integrity — candidates confuse device identification (profiling) with device compliance (posture/MDM), which are separate ISE functions.

How to eliminate wrong answers

Option A is wrong because ISE profiling only identifies device type and OS via passive/active probes (DHCP, SNMP, NetFlow, HTTP) and cannot inspect the filesystem for root/jailbreak artifacts. Option B is wrong because a switch ACL filters L3/L4 traffic by IP/port and has no visibility into endpoint OS integrity. Option C is wrong because a WLC-based check only inspects wireless-layer attributes (SSID, 802.1X, RF data) and cannot detect jailbreak state on the endpoint.

Practice this question →

Ready to test yourself?

Try a timed practice session using only BYOD questions.

Start 20-question session