scenario questions

Which THREE of the following are necessary to support 'Native Supplicant Provisioning' for iOS devices?

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

What is the primary benefit of using a Policy Set compared to the legacy 'Rule-Based' approach in ISE?

When defining a Shell Profile for a TACACS+ administrator, which setting ensures the user is placed into privilege level 15 immediately upon login?

Which THREE of the following are steps required to configure Cisco ISE for TACACS+ command authorization?

When setting up a custom endpoint identity group for printers, what is the best practice for assigning devices to that group?

Which TWO of the following are valid device attributes that can be used to identify a device for BYOD onboarding?

When designing an ISE deployment across WAN links, what is the primary recommendation regarding MnT nodes?

You need to allow users to remediate a non-compliant status manually. Which feature allows them to 'retry' the posture check after they have fixed the issue?

Which attribute in a Shell Profile is used to control whether a user can perform 'enable' commands?

You are implementing TACACS+ device administration for a group of routers. You need to assign specific privilege levels to different users. Where in the ISE policy set is this privilege assignment configured?

Which Cisco ISE construct is used to combine authentication and authorization policies into a single logical container?

In the BYOD flow, what occurs immediately after the user provides credentials in the portal?

Which TWO of the following are benefits of integrating MDM with Cisco ISE for BYOD?

Which TWO of the following are types of Identity Sources in ISE?

A user reports that their BYOD device is not being recognized as 'Compliant' even though the MDM shows it is compliant. Which ISE component is responsible for retrieving this status?

In a distributed environment, if the Primary PAN goes offline, what happens to the Secondary PAN?

What is the default persona of a newly installed Cisco ISE appliance before any configuration changes?

You need to ensure that the AnyConnect posture agent is updated automatically. Where is this configured?

What is the effect of setting a Posture Requirement to 'Optional'?

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

A user is authenticating using EAP-TLS. Where is the certificate validation policy configured in ISE?

Which THREE of the following are required components to successfully implement Central Web Authentication (CWA) with a Cisco WLC?

A network engineer is deploying Cisco ISE to enforce Security Group Tags (SGTs) in a wired environment. The engineer wants to ensure that the SGT is assigned to the endpoint during authorization and that the switch enforces the SGT-based policy. Which two actions are required to enable SGT enforcement on the switch? (Choose two.)

You are implementing 'Device Administration' (TACACS+) and want to restrict an admin to 'show' commands only. How do you construct this policy?

Which TWO of the following represent ways to verify the posture status of an endpoint?

In an ISE Authorization Policy, what happens if no rules match a request?

A TACACS+ command authorization policy is failing to restrict specific configuration changes on a Cisco IOS device. Which field in the TACACS+ Profile must be correctly configured to ensure the command list is evaluated?

You are troubleshooting a scenario where an admin cannot execute a specific command despite the Command Set having 'Permit' for that command. What is a common reason?

A network administrator is deploying a guest wireless network using Cisco ISE. They want guests to authenticate through a web portal, but they do not want guests to have to create their own accounts. Instead, they want employees to pre-create guest accounts and provide credentials to visitors. Which ISE feature should the administrator configure to enable this workflow?

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

When configuring a load balancer for a group of PSNs, what is the best practice for handling RADIUS traffic?

Which TWO of the following are common troubleshooting steps for a failed BYOD portal redirection?

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

Which of the following is a requirement for a successful BYOD certificate provisioning flow?

A guest user reports they receive a certificate warning when redirected to the ISE Guest portal. What is the most common cause of this issue?

Which THREE of the following are true regarding the Cisco ISE Profiler Feed Service?

You are troubleshooting a Guest flow where the client hits the portal but cannot authenticate. You notice the MAC address is not being cached properly. Which setting in the Guest Portal configuration is responsible for enabling MAC caching?

A network administrator needs to implement self-registered guest access where the guest must provide an email address for validation. Which feature in the Guest Portal settings allows for this?

A network engineer is deploying Cisco ISE in a distributed architecture. The engineer needs to ensure that the deployment can scale to handle a large number of concurrent authentication requests. Which factor primarily determines the number of PSNs required?

Which port does Cisco ISE use by default for TACACS+ communication with network devices?

You are configuring a Posture policy in Cisco ISE and need to ensure that endpoints running an outdated version of Windows are directed to a specific remediation portal. Which component must you configure to define the conditions that trigger this remediation?

In the context of TACACS+, what is the purpose of the 'Network Device Group'?

Which ISE menu path is used to create a new Authorization Profile?

During an 802.1X process, the NAD sends an Access-Request with a specific Calling-Station-ID. If ISE does not find this in its Endpoint DB, what is the default behavior for the 'Unknown' status?

A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?

Which THREE of the following are steps involved in the guest portal sponsor approval process?

When troubleshooting TACACS+ authentication issues in Cisco ISE, which log file should you monitor to see the specific request details and the policy match result?

A company has deployed Cisco ISE BYOD with native supplicant provisioning. Employees are reporting that their Windows 10 devices fail to complete the onboarding process. The administrator reviews the ISE logs and sees that the devices are successfully authenticated and authorized for the BYOD onboarding portal, but the supplicant provisioning wizard fails to run. The administrator suspects that the issue is related to the supplicant provisioning settings. Which of the following should the administrator verify first to resolve this issue?

Which TWO of the following are valid components of a TACACS+ Authorization Policy in Cisco ISE? (Choose two)

What is the purpose of the 'Redirect ACL' on the network access device?

Which TWO of the following are valid components of an ISE Authorization Policy rule?

If a user is successfully registered but cannot connect after the BYOD flow, which status should you check in the 'Endpoints' menu?

Which probe is most effective for identifying the specific operating system and browser type of an endpoint connecting via a web portal?

When deploying the AnyConnect Posture agent, which specific file must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment?

You are configuring a BYOD flow where users must register their devices via the self-service portal. Which ISE component is responsible for triggering the redirection to the BYOD portal after an initial MAC Authentication Bypass (MAB) success?

A user is complaining that they are stuck in a posture remediation loop despite having the latest antivirus software installed. You verify that the AV check is correctly configured. What is the most likely cause for this behavior?

If you want a guest user to be automatically redirected to a specific webpage (e.g., company news) after a successful login, where is this configured?

A network engineer is troubleshooting a TACACS+ authentication failure on a Cisco switch. The switch is configured to use Cisco ISE as its TACACS+ server. The engineer runs 'debug tacacs' on the switch and sees that the request is sent but no response is received. Which action should the engineer take first to resolve the issue?

When adding a secondary PAN, what is the consequence if the time synchronization (NTP) differs significantly between nodes?

Which guest portal type should you select if you want to allow users to connect to the network without any authentication, simply by clicking an 'Accept' button?

A network engineer is adding a Cisco Catalyst 9300 switch to Cisco ISE for TACACS+ device administration. The switch will use a shared secret of 'C1sco123'. The engineer wants to ensure that ISE can authenticate and authorize administrative sessions from this device. Where should the shared secret be configured in ISE?

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

A user is authenticating via the Sponsored Guest portal. After the sponsor approves the guest, the user still cannot access the network. What is the most common reason for this if the RADIUS flow is correct?

Which of the following is a best practice when configuring TACACS+ for network administration?

A user reports that a device was incorrectly identified as a 'Cisco IP Phone' when it is actually a 'Cisco Access Point'. Which troubleshooting step should you take first?

Where are the TACACS+ accounting logs stored and viewed in the ISE management console?

Which component in ISE defines the 'result' of an authorization rule?

A user is assigned a Command Set that permits all commands, but they are still receiving 'Access Denied' when running 'reload'. What is the most likely reason?

A company uses Cisco ISE BYOD with certificate-based authentication. Employees report that their devices successfully onboard and receive a certificate, but after a few days, they are unable to connect to the corporate SSID. The administrator checks ISE and finds that the devices are failing authentication with the error 'Certificate revoked'. The administrator verifies that the certificates are still valid and not expired. Which ISE feature should the administrator check to resolve this issue?

If a user's certificate expires, how can the user renew it using the ISE BYOD flow?

Which portal is intended for guest users to manage their own registered devices, such as adding or removing their personal laptops?

Which THREE of the following are common reasons why an endpoint would be listed as 'Unknown' in Cisco ISE?

Which component in Cisco ISE defines the TACACS+ privilege levels and attributes sent to the network device?

Which THREE of the following are valid actions an administrator can take in the Sponsor Portal?

You are configuring a new ISE node for your deployment. What is the correct sequence to join a secondary node to the existing deployment?

Which probe is required to collect the 'User-Agent' string from a web browser to assist in profiling a device as a workstation?

What is the purpose of the 'Posture Discovery' phase?

Which TWO of the following are benefits of using Network Device Groups (NDG)? (Choose two)

Which THREE of the following items can be included in an ISE 'Common Task' for authorization?

Which component in ISE is responsible for mapping an authenticated user to a specific set of permissions and command restrictions in a TACACS+ environment?

When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?

Which specific ISE process is responsible for managing the communication between the PAN and PSNs?

Which THREE of the following items are considered 'results' in an ISE authorization policy? (Choose three)

A network administrator is configuring Cisco ISE profiling for a new branch office. The administrator wants to ensure that endpoints are profiled based on information collected from DHCP packets. Which probe must be enabled on the Policy Service node to collect DHCP attributes?

You are configuring a DHCP probe on a Cisco ISE node to identify endpoints. Which specific configuration step is required to ensure the ISE node receives DHCP traffic when the client and server are on a different subnet?

You want to customize the guest portal so that it displays the company logo and specific terms of use. Where is this configuration performed within the Cisco ISE GUI?

If a user is redirected to the Guest portal but receives a '404 Page Not Found' error, what is the most likely configuration issue?

You have a policy set where authentication succeeds, but the user is hitting the 'Default' authorization rule instead of the expected rule. What should you check first?

Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?

A security team wants to ensure that endpoints connecting via VPN are compliant with the latest antivirus definitions. They configure a posture policy that checks for the antivirus definition date to be within the last 7 days. However, some endpoints with up-to-date antivirus are still marked Non-Compliant. The administrator suspects that the posture condition is not evaluating correctly. Which component should be checked to verify that the antivirus definition date is being read correctly by the AnyConnect Posture module?

When a user's device is stolen, which action should be taken in the 'My Devices' portal?

You are setting up an SCEP profile for BYOD. What is the primary role of the SCEP proxy in the Cisco ISE BYOD flow?

Which protocol is used by the AnyConnect agent to communicate posture information to the ISE Policy Service Node (PSN)?

A user is failing to receive the expected dACL. The ISE logs show the correct authorization rule was matched, but the dACL is not applied. What is the most likely cause?

Which of the following is an example of an 'Exception' policy in ISE?

You are configuring a BYOD flow for iOS devices and notice that the native supplicant provisioning process is failing during the installation of the mobile configuration profile. Where should you check the logs in ISE to determine if the issue is related to the SCEP proxy communication?

How can you verify that ISE is receiving TACACS+ requests from a specific switch?

A network administrator is configuring a Cisco ISE TACACS+ Command Set to allow users to execute 'show running-config' but deny all other 'show' commands. Which command set configuration in ISE achieves this?

Which of the following is a posture requirement setting that defines how often the agent performs a re-scan?

What is the purpose of the 'PAN' role in a deployment?

Which TWO of the following authentication protocols are supported by ISE for 802.1X?

When decommissioning an ISE node, what is the correct order of steps?

You are creating a File Requirement for posture assessment. What is the required behavior if you want to confirm that a specific file exists on the client machine?

What is the function of the 'PassiveID' feature in a distributed ISE deployment?

What is the purpose of the 'Guest Type' configuration in Cisco ISE?

When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?

Which THREE of the following are characteristics of the TACACS+ protocol? (Choose three)

When setting up a self-registration portal, you want to require that the guest's email address is validated before granting access. Which feature should you enable?

Which protocol is used by ISE to communicate with the MDM server for device status checks?

You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?

What is the benefit of using multiple TACACS+ Policy Sets?

A network engineer is setting up a guest portal that allows guests to self-register. The company requires that guests provide a valid email address to receive their account credentials. Which portal configuration setting must be enabled to enforce this requirement?

You are configuring a custom profiling policy and notice that the 'Certainty Factor' is too low for the device to be assigned to the correct group. What is the purpose of the Certainty Factor in ISE?

When configuring an SNMP Query probe, why is it recommended to use SNMPv3 instead of SNMPv1/v2c?

What is the function of the 'RADIUS Accounting' probe in the profiling process?

Which THREE of the following items are required for the EAP-TLS authentication process to succeed?

A security engineer is configuring a Cisco ISE profiling policy to identify and authorize endpoints. The engineer wants to use the SNMP Query probe to gather attributes from network devices. Which two statements are true regarding the SNMP Query probe in Cisco ISE? (Choose two.)

Which component of the Cisco ISE Profiling architecture is responsible for comparing collected attributes against defined profiling policies?

You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?

When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?

A user is authenticated, but their authorization profile returns the wrong VLAN. Which troubleshooting tool in ISE is best suited to verify the attributes sent to the NAD?

What is the primary benefit of using native supplicant provisioning in ISE?

If a user is authenticated via TACACS+ but no authorization policy matches, what is the default behavior?

You need to profile IoT devices that only support mDNS. Which probe should you enable?

Which TWO methods can be used to verify that a TACACS+ request from a network device is reaching the Cisco ISE PSN?

Which TWO of the following are prerequisites for the AnyConnect posture agent to function?

You are troubleshooting a certificate provisioning failure where the error is 'Internal CA Error'. What is the most likely cause?

Which TWO of the following are necessary to successfully profile devices using the SNMP Query probe?

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

Which menu path in Cisco ISE is used to define a new Network Device Group?

A guest user connects to the network and is redirected to the ISE Guest Portal. After entering valid credentials, the user is authenticated, but the browser remains on the 'Redirecting' page and never reaches the intended URL. The NAD logs show repeated MAC authentication bypass (MAB) attempts with the guest endpoint's MAC address, and the authorization result is 'Redirect'. What is the most likely cause of this issue?

Where do you customize the visual look and feel of the guest portal, such as logos and background colors?

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

You need to ensure that only specific ISE nodes perform the NMAP scan probe. Where is this configured?

Which TWO of the following are true regarding TACACS+ command sets? (Choose two)

You are configuring a Network Device Group in Cisco ISE to organize devices by geographical location. Which menu path should you navigate to in order to create a new Network Device Group?

Which THREE of the following protocols or standards are critical for the BYOD lifecycle?

An administrator notices that TACACS+ authentication is failing for devices. The logs show 'RADIUS request received'. What is the most likely cause?

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

Which THREE components are required to successfully deploy a Scalable Group Access (SGA) policy for SGT enforcement?

A network administrator is adding a new Cisco IOS router to Cisco ISE for TACACS+ device administration. The administrator needs to ensure that ISE recognizes the router and accepts its TACACS+ requests. What must be configured in ISE for the router?

Which THREE of the following items are verified by ISE when a guest attempts to authenticate?

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

When configuring a Shell Profile, what is the purpose of the 'Common Tasks' section?

A security administrator is troubleshooting why a particular endpoint is being profiled as a generic 'Windows Workstation' instead of the more specific 'Windows 10 Enterprise' policy. The administrator checks the Profiling Policies and sees that the 'Windows 10 Enterprise' policy has a minimum certainty factor of 20, while the endpoint's current certainty factor is 18. The administrator also notices that the endpoint has matching attributes for both policies. What is the most likely reason the endpoint is not matching the more specific policy?

A security architect is designing a Cisco ISE deployment for a large enterprise with 20,000 endpoints. The design must ensure that RADIUS authentication and authorization continue even if the Primary PAN and Secondary PAN both become unreachable. The architect is evaluating the roles and services that must be enabled on the PSNs to support this requirement. Which two statements correctly describe the behavior or configuration needed to meet this goal? (Choose two.)

A network security engineer is configuring profiling policies in Cisco ISE to identify and classify endpoints. The engineer wants to ensure that the profiling policies correctly match endpoints based on multiple conditions. Which two statements are true regarding profiling policy conditions and certainty factors? (Choose two.)

A security administrator is configuring a policy set in Cisco ISE to enforce different authorization policies based on the endpoint's posture status. The administrator wants to ensure that non-compliant endpoints are placed in a remediation VLAN. Which condition should be used in the authorization policy to match endpoints that have failed posture assessment?

You want to implement a 'Change of Authorization' (CoA) after a user changes their location. How is the CoA triggered by ISE?

Which TWO of the following are valid ways to provide access to a guest user?

A network engineer is deploying TACACS+ device administration with Cisco ISE for a large number of Cisco IOS routers. The engineer wants to centralize the authorization of commands so that users in different groups have different command privileges. The engineer has already configured authentication and authorization policy sets in ISE. Which additional configuration is required on the Cisco IOS routers to ensure that command authorization is enforced by ISE?

A network engineer is configuring a Cisco router to use TACACS+ for device administration with Cisco ISE. The engineer wants to ensure that if the TACACS+ server is unreachable, the router falls back to local authentication. Which command should be configured on the router?

Which TWO of the following are true about Monitor Mode?

Which TWO of the following are valid ways to restrict access based on posture status in ISE?

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

What is the purpose of an Authorization Profile's 'Common Tasks'?

Which ISE menu path is used to enable the 'BYOD' checkbox for a specific device registration portal?

You have created a custom profiler condition that is not matching endpoints correctly. Where should you check the live authentication and profiling logs to verify if the attribute is being received by ISE?

A security team is deploying Cisco ISE BYOD for employee devices. They want to ensure that only devices that have completed the BYOD onboarding process and possess a valid certificate are allowed on the corporate SSID. Which ISE policy element should they configure to enforce this requirement?

Which TWO functions are performed by the Monitoring and Troubleshooting (MnT) persona?

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

You are troubleshooting an issue where IP phones are not being profiled. The SNMP read community string on the switch does not match the one configured in ISE. What is the expected behavior?

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

Which of the following is NOT a valid probe type in Cisco ISE?

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

Which THREE features are configured at the node level in the ISE Administration console?

Where do you upload the AnyConnect posture agent packages to make them available for Client Provisioning?

A network administrator is configuring posture remediation for Windows endpoints that fail a check for Windows Defender real-time protection. The administrator wants to provide users with a link to enable real-time protection manually. Which remediation type should be configured in the posture policy to achieve this?

When a new device connects, you notice it stays in the 'Unknown' profile state. You have confirmed the probes are active. What is the most likely step to fix this?

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

If a user is assigned a Shell Profile with a specific 'Auto-Command' configured, what happens when they log into the network device?

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

A customer is planning a large campus deployment with 50,000 concurrent endpoints. Which persona should be dedicated to handle the authentication load to ensure high performance?

You are deploying a distributed ISE architecture and need to ensure that the Policy Administration Node (PAN) maintains configuration integrity. Which mechanism is used to synchronize configuration changes from the Primary PAN to all secondary nodes?

What is the primary function of the 'Client Provisioning' policy in the context of BYOD?

You are configuring EAP-TLS for BYOD. What must be included in the 'Allowed Protocols' list in ISE?

An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?

Which of the following is required for AnyConnect to perform posture assessment on a Mac endpoint?

You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?

When configuring certificate-based BYOD onboarding, you notice that devices are successfully registered, but the client certificate issuance fails. Where should you examine the logs to troubleshoot the Certificate Authority (CA) interaction?

Which THREE of the following are considered 'probes' in the Cisco ISE Profiling architecture?

Which attribute is used by the MAC OUI probe to determine the device manufacturer?

How do you verify the current licensing status and consumption on your ISE deployment?

Which statement best describes the role of the TACACS+ 'Accounting' feature?

Which THREE items are configurable within a TACACS+ Shell Profile in Cisco ISE?

You need to create a posture condition to verify that the 'Cisco AnyConnect' service is running. Which condition type should you select?

Which THREE resources are monitored via the ISE dashboard to ensure deployment health?

In a CWA flow, what is the significance of the 'cisco-av-pair = url-redirect-acl' attribute?

You want to improve profiling accuracy for endpoints that do not send DHCP options. You decide to use SNMP Trap profiling. What is a critical prerequisite for this to function?

During the BYOD onboarding process, a user is successfully redirected to the portal, but the certificate installation fails because the client cannot trust the root CA. Which configuration is required to resolve this?

Which THREE of the following are valid components of a RADIUS-based Authorization Policy rule in Cisco ISE?

A network administrator is preparing to add a new Cisco ISE node to an existing distributed deployment. The new node will serve as a PSN in a remote branch office. Before registering the node, the administrator must ensure that the node meets the prerequisites for joining the deployment. Which prerequisite is required for the new node to successfully register with the Primary PAN?

A security engineer is configuring Cisco ISE BYOD with a single SSID for both employee onboarding and corporate access. The engineer wants to ensure that devices without a valid certificate are redirected to the BYOD portal, while devices with a valid certificate are granted full access. The engineer has created a client provisioning policy that provisions the native supplicant with the corporate SSID and a certificate template. However, after provisioning, devices are still being redirected to the BYOD portal on subsequent connections. Which configuration change is required to allow onboarded devices to bypass the portal?

An administrator is configuring profiling in Cisco ISE and wants to ensure that the MAC OUI probe is used to identify the manufacturer of endpoints. Which statement correctly describes the MAC OUI probe?

Which TWO of the following are valid components of an ISE Posture Policy?

You are troubleshooting a device that is stuck in the 'Unknown' profile state. You have confirmed that the DHCP probe is receiving packets. What is the next logical step to investigate the failure?

Which TWO of the following are components of the Cisco ISE 'Endpoint' object?

A network engineer is configuring an authorization policy in Cisco ISE to enforce SGT-based segmentation on a Catalyst 9000 switch. The engineer wants to assign a static SGT to endpoints that authenticate via 802.1X and belong to a specific Active Directory group. The switch is already configured with 'cts manual' and 'propagate sgt' on the trunk. Which ISE configuration is required to assign the SGT to the endpoint?

You are configuring a TACACS+ command set to restrict an administrator from running 'show running-config' on Cisco switches. Which match condition ensures that this specific command is blocked while allowing other 'show' commands?

An administrator needs to ensure that only endpoints with a specific registry key present are allowed access. Where should this posture condition be defined in Cisco ISE?

Which protocol does the Cisco ISE use to inform the NAD that a guest user's session state has changed (e.g., from 'redirect' to 'authenticated')?

Which TWO of the following are benefits of using the Cisco TrustSec architecture?

Which TWO of the following are necessary to correctly configure a custom profiling condition based on DHCP attributes?

A posture condition is defined to check for a registry key, but it always returns 'Non-Compliant'. You suspect the 'Expected Value' is wrong. Where can you see what the agent actually found on the endpoint?

A network administrator has deployed Cisco ISE with AnyConnect posture. Windows endpoints must run Windows Defender and have real-time protection enabled to be considered compliant. The administrator configures a posture policy with a Windows Defender condition that checks the service status. However, endpoints where Defender is running but real-time protection is disabled are still reported as compliant. What is the most likely cause?

You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?

When configuring a secondary MnT node, what is the 'Primary' versus 'Secondary' relationship regarding log collection?

A network engineer configures a Cisco ISE deployment with profiler probes enabled on the Policy Service nodes. After deploying a new Cisco Catalyst 9300 switch, the engineer notices that endpoints connected to that switch are not appearing in the Endpoints list, even though they are passing 802.1X authentication. The engineer verifies that the switch is sending RADIUS accounting packets to ISE. Which probe should the engineer verify is enabled to collect endpoint attributes from the switch itself?

Which TWO of the following steps are required to deploy the AnyConnect posture agent?

Which THREE of the following are standard probes available in Cisco ISE to gather device information?

An administrator configures a posture policy that checks for a specific Windows registry key with an expected value of '1'. After deployment, endpoints that have the key correctly set to '1' are still reported as Non-Compliant. The AnyConnect Posture module is installed and the agent is communicating with ISE. Which action should the administrator take first to resolve this issue?

Which TWO of the following tasks are performed within the Sponsor Portal?

If you want to use a script remediation, where do you define the script content?

Which dashboard widget provides a quick summary of BYOD activity in your network?

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

You have a Cisco switch that supports both RADIUS and TACACS+. When using ISE for device administration, which protocol is mandatory for command-level authorization?

Which menu path is used to view the status of all nodes in an ISE deployment?

You need to allow guest users to access specific internal resources (like a printer) while they are connected to the Guest network. How do you configure this in ISE?

What is the function of the 'Default' policy set in ISE?

Which of the following describes the 'Standalone' deployment model?

You are configuring a policy to block access for non-compliant devices. Where do you configure the posture status as a policy condition?

A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?

What is the purpose of the 'Endpoint Identity Group' in the context of profiling?

Which TWO of the following are true about Shell Profiles? (Choose two)

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?

What is the purpose of the 'Guest Flow' setting in the Authorization Profile?

A network administrator is implementing a TACACS+ command authorization policy on Cisco ISE for a group of network devices. The administrator wants to allow users in the 'NetOps' group to execute only 'show' commands and deny all other commands. The policy set for TACACS+ device administration is already configured with the correct conditions. Where in ISE should the administrator define the permitted commands and associate them with the 'NetOps' group?

You are configuring a device sensor on a Cisco switch to help with ISE profiling. What is the primary benefit of using Device Sensor?

How does Cisco ISE handle requests that do not match any configured TACACS+ Authorization Policy?

Which TWO of the following settings are available for customizing the guest portal login page?

In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?

What is the purpose of the 'Network Setup Assistant' (NSA) in the context of Cisco ISE BYOD?

Which TWO of the following are true regarding the order of operations in Cisco ISE policy evaluation?

You are reviewing the ISE logs and see that the Guest Portal authentication is failing. Where should you look to find the exact reason for the failure?

Which AnyConnect module is specifically required to perform posture assessment in ISE?

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

Which service is required to be enabled on a PSN to allow it to receive RADIUS requests from network access devices?

Which TWO of the following are valid locations to check for policy match results in ISE?

A security engineer is configuring a Cisco ISE guest portal for a conference. Attendees must be able to create their own accounts but must first receive a one-time code via SMS to validate their phone number. The SMS gateway has already been integrated with ISE. Which guest portal flow should the engineer select to meet this requirement?

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

Which TWO of the following are mandatory steps for configuring BYOD with Cisco ISE?

If a PSN loses connectivity to the PAN, what happens to existing user sessions?

You are using the Feed Service to update your profiling policies. How can you ensure that custom profiling policies you have created are not overwritten during the update?

You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?

Which license type is required to enable advanced profiling and posture services on Cisco ISE?

Which THREE of the following items must be configured to ensure a successful SNMP Trap profiling implementation?

Which THREE of the following are found in an Authorization Profile's 'Advanced Attributes'?

Which THREE of the following are valid types of Client Provisioning Resources?

You want to enforce a policy where personal devices are allowed access, but only if they are not jailbroken. How is this achieved in a BYOD scenario?

When adding a network device to ISE, you select the 'TACACS+ Authentication Settings' checkbox. What is the impact of this action?

Which TWO of the following steps are required to implement SGT-based enforcement using an SXP connection?

You are deploying a Posture agent using the Web Agent. Which mechanism does the Web Agent use to perform compliance checks on a Windows machine?

Which THREE factors influence the decision to use multiple PSNs in a deployment?

You are troubleshooting a PSN that is not receiving configuration updates. Which log file on the PSN would provide the most insight into the configuration sync process?

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

Which THREE of the following are valid methods for collecting endpoint attributes for profiling in Cisco ISE?

In the ISE Policy Set, which component is used to define the user credentials' verification method?

When setting up TACACS+ for network administration, which THREE configurations must be present on the Cisco network device? (Choose three)