Courseiva

CCNA Policy Enforcement Questions

57 questions · Policy Enforcement topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQeasy

What is the primary benefit of using a Policy Set compared to the legacy 'Rule-Based' approach in ISE?

A.Improved logical organization and modularity
B.Requires fewer licenses
C.Eliminates the need for external identity sources
D.Faster performance
AnswerA

Policy Sets group multiple authentication and authorisation policy objects into a single reusable container, so a change applies everywhere the set is referenced. This delivers the modularity and logical organisation that the legacy rule-based model, with its flat per-rule structure, cannot.

Why this answer

The primary benefit of a Policy Set over the legacy rule-based approach is improved logical organization and modularity. Policy Sets let you group authentication and authorization rules by use case (e.g., wired 802.1X, wireless guest, VPN) with their own conditions, making large deployments easier to manage and troubleshoot.

Exam trap

SISE often tests whether candidates understand that Policy Sets are an organizational and modularity improvement, not a licensing, identity-source, or performance feature.

How to eliminate wrong answers

Option B is wrong because Policy Sets do not change licensing requirements; licensing is based on node counts and features, not on policy structure. Option C is wrong because Policy Sets do not eliminate the need for external identity sources; they still rely on AD, LDAP, or other stores for authentication. Option D is wrong because Policy Sets do not inherently improve performance; they are an organizational construct, and performance depends on PSN sizing and deployment design.

Practice this question →
2
Multi-Selecthard

Which THREE of the following are steps required to configure Cisco ISE for TACACS+ command authorization?

Select 3 answers
A.Define a Shell Profile
B.Configure an SGT
C.Create a Device Administration Policy
D.Define a Command Set
E.Enable MAB
AnswersA, C, D

A Shell Profile supplies the privilege-level and default command-set attributes returned in the TACACS+ authorisation response, binding the user to the correct privilege level and command restrictions. It is the mandatory companion object that pairs with the Command Set in the authorisation policy rule.

Why this answer

Option A (Define a Shell Profile) is correct because the Shell Profile in Cisco ISE specifies the TACACS+ privilege level and the default command set (permit/deny) applied to the administrative session, which is required for command authorization to function. Option C (Create a Device Administration Policy) is correct because the Device Administration authorization policy set maps the matched identity/group conditions to the Shell Profile and Command Set, thereby enforcing TACACS+ command authorization on network devices. Option D (Define a Command Set) is correct because a Command Set is the reusable list of permitted or denied CLI commands (with optional arguments) that ISE references when evaluating each command sent by the device.

Option B (Configure an SGT) is not required, as Security Group Tags are used for TrustSec segmentation, not TACACS+ command authorization. Option E (Enable MAB) is not required, since MAC Authentication Bypass is a network access authentication method for endpoints, not a step in configuring device administration command authorization.

Exam trap

SISE often tests the confusion between TACACS+ device administration components (Shell Profile, Command Set, Device Administration Policy) and unrelated ISE features like SGT or MAB; candidates pick SGT because it appears in other ISE questions.

Practice this question →
3
MCQeasy

Which Cisco ISE construct is used to combine authentication and authorization policies into a single logical container?

A.Identity Source Sequence
B.Policy Elements
C.Policy Set
D.Authorization Profile
AnswerC

A Policy Set binds authentication and authorisation rules into one logical container, letting ISE evaluate identity and authorisation policy together per connection. It satisfies the stem's requirement for a single construct combining both policy types, unlike standalone authentication or authorisation policy objects.

Why this answer

A Policy Set in Cisco ISE is the top-level container that binds together authentication and authorization policies for a specific set of conditions (e.g., matching a device type, protocol, or network device). It allows you to define a single logical unit where the authentication policy (who can authenticate) and authorization policy (what they are allowed to do) are evaluated in sequence. This structure simplifies management by grouping related rules, and ISE evaluates policy sets in a top-down order based on their rank.

The correct answer is Policy Set because it is explicitly designed to combine these two policy types into one container.

Exam trap

SISE often tests the confusion between Policy Sets and Policy Elements, where candidates mistakenly think Policy Elements combine authentication and authorization, when in fact Policy Sets are the logical containers that do so.

How to eliminate wrong answers

Option A is wrong because an Identity Source Sequence is a list of identity stores (e.g., AD, LDAP) that ISE queries in order during authentication, but it does not contain authorization policies. Option B is wrong because Policy Elements are reusable building blocks (e.g., conditions, authorization profiles, allowed protocols) that are referenced within policies, not a container that combines authentication and authorization. Option D is wrong because an Authorization Profile is a set of attributes (e.g., VLAN, DACL) applied to a session after successful authorization, but it is only one component within an authorization policy and does not include authentication logic.

Practice this question →
4
Multi-Selecteasy

Which TWO of the following are types of Identity Sources in ISE?

Select 2 answers
A.Policy Set
B.Authorization Profile
C.Internal Users
D.Command Set
E.Active Directory
AnswersC, E

Internal Users is a valid identity source in Cisco ISE, holding locally defined accounts for authentication when external directories are unavailable or unsuitable. It satisfies the question by naming a native ISE repository, distinct from external sources such as Active Directory or LDAP.

Why this answer

In Cisco ISE, an Identity Source is a repository that ISE queries to authenticate and retrieve attributes about a user or endpoint, and both Internal Users (C) and Active Directory (E) are valid Identity Source types. Internal Users (C) is correct because ISE's built-in internal user database can serve as an identity store for local authentication, including users, passwords, and identity group assignments. Active Directory (E) is correct because ISE can join an AD domain and use it as an external identity source via the ISE AD connector for authentication and group/attribute retrieval.

The other options are not identity sources: Policy Set (A) is a container that binds conditions to authentication/authorization policies, Authorization Profile (B) is a set of attributes (such as VLAN, dACL, or SGT) applied in an authorization rule result, and Command Set (D) is a TACACS+ construct that defines which CLI commands a user is permitted to run.

Exam trap

SISE often tests whether candidates can distinguish identity sources (where credentials are validated) from policy elements and results (what happens after authentication), so options like Authorization Profile and Command Set are placed to lure candidates who confuse policy constructs with identity stores.

Practice this question →
5
MCQmedium

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

A.By creating a Network Device Group
B.By using IP address ranges in the policy
C.By tagging them with SGTs
D.By using the Device Name in the condition
AnswerA

A Network Device Group lets you tag devices by location, and authorisation policy conditions can then match on that group. This satisfies the requirement that different devices trigger different policies based on where they sit, since the group is the attribute evaluated in the policy rule.

Why this answer

Creating a Network Device Group (NDG) is the best way to group network devices by location so that authorization policies can differentiate them. NDGs can be hierarchical (e.g., Location#Branch) and are referenced directly in policy conditions, making location-based policy enforcement clean and scalable.

Exam trap

SISE often tests the purpose of Network Device Groups versus SGTs or IP-based conditions, and candidates incorrectly choose SGTs or IP ranges for grouping network devices by location.

How to eliminate wrong answers

Option B is wrong because using IP address ranges in policy conditions is brittle and hard to maintain as subnets change, and it does not scale well across many sites. Option C is wrong because SGTs (Security Group Tags) are used for group-based access control of endpoints and users, not for grouping network devices by location for policy conditions. Option D is wrong because using the Device Name in a condition requires listing individual devices, which does not scale and is not a grouping mechanism.

Practice this question →
6
MCQmedium

A user is authenticating using EAP-TLS. Where is the certificate validation policy configured in ISE?

A.Identity Source Sequence
B.Authorization Profile
C.Policy Set Condition
D.Allowed Protocols
AnswerD

Certificate validation for EAP-TLS is governed by the Allowed Protocols configuration, where the specific EAP method's options define which certificate authorities and checks ISE accepts. Enabling EAP-TLS there determines how the client certificate is validated during authentication.

Why this answer

In ISE, the certificate validation policy for EAP-TLS is configured under Allowed Protocols. This is where you enable EAP-TLS and configure whether to validate the client certificate against a specific CA, check certificate revocation, and set other TLS-specific options. The Allowed Protocols service is the central place for EAP method configuration.

Exam trap

SISE often tests the confusion between where authentication methods are configured (Allowed Protocols) and where authorization attributes are defined (Authorization Profile), tricking candidates into picking the wrong service.

How to eliminate wrong answers

Option A is wrong because Identity Source Sequence defines the order of identity stores for authentication, not certificate validation. Option B is wrong because Authorization Profile defines the attributes returned to the NAD after authorization, not certificate validation. Option C is wrong because Policy Set Conditions determine which policy set matches the request, not how certificates are validated.

Practice this question →
7
Multi-Selecthard

A network engineer is deploying Cisco ISE to enforce Security Group Tags (SGTs) in a wired environment. The engineer wants to ensure that the SGT is assigned to the endpoint during authorization and that the switch enforces the SGT-based policy. Which two actions are required to enable SGT enforcement on the switch? (Choose two.)

Select 2 answers
A.Enable SXP on the switch to propagate SGTs to other devices.
B.Configure the authorization profile in ISE to include the 'cisco-av-pair' attribute with the SGT value.
C.Configure the switch to send the Calling-Station-ID in the RADIUS request.
D.Enable SGACL enforcement on the switch by configuring the 'cts role-based enforcement' command.
E.Configure the switch to use MACsec for SGT propagation.
AnswersB, D

When ISE authorizes an endpoint, it can assign an SGT by sending the 'cisco-av-pair' RADIUS attribute with the value 'cts:security-group-tag=xxx'. This attribute is used by the switch to tag the endpoint's traffic with the specified SGT. Without this, the endpoint will not receive an SGT, and enforcement cannot occur. This is a required step for dynamic SGT assignment.

Why this answer

To enforce SGT-based policies on a switch, two key actions are required: the switch must have role-based enforcement enabled using the 'cts role-based enforcement' command, and ISE must assign an SGT to the endpoint via the 'cisco-av-pair' attribute in the authorization profile. These steps ensure that the switch tags traffic with an SGT and enforces SGACLs accordingly.

Exam trap

The trap here is confusing SGT propagation methods like SXP or MACsec with the actual enforcement mechanism, which requires both role-based enforcement on the switch and SGT assignment from ISE.

Practice this question →
8
MCQhard

You are implementing 'Device Administration' (TACACS+) and want to restrict an admin to 'show' commands only. How do you construct this policy?

A.Use the 'Admin' group in the authentication policy
B.Create a shell profile with privilege level 1
C.Create a command set with 'show' and assign to an authorization policy rule
D.Configure a dACL on the device
AnswerC

A command set listing 'show' is bound to an authorization policy rule, so TACACS+ permits only matching commands and denies the rest. This satisfies the stem's constraint of restricting the administrator to show commands exclusively.

Why this answer

To restrict a TACACS+ admin to 'show' commands only, you create a Command Set that defines the permitted commands (e.g., 'show') and then assign that Command Set to an Authorization Policy rule that matches the admin's identity or group. The Command Set is the ISE object that specifies which commands are allowed or denied, and the Authorization Policy rule applies it to the session.

Exam trap

SISE often tests the difference between Shell Profiles (which set session attributes like privilege level) and Command Sets (which control specific commands) — candidates may choose Shell Profile thinking it restricts commands, but only Command Sets provide command-level granularity.

How to eliminate wrong answers

Option A is wrong because the 'Admin' group in the authentication policy only determines how the admin authenticates (e.g., against AD) and does not control command authorization. Option B is wrong because a shell profile with privilege level 1 grants a broad set of commands (typically all show commands plus some others) but does not provide granular command-level restriction to only 'show' — and it does not allow specifying individual commands. Option D is wrong because a dACL is used for network access control (filtering traffic), not for TACACS+ command authorization on a device.

Practice this question →
9
MCQmedium

In an ISE Authorization Policy, what happens if no rules match a request?

A.The request is sent to the primary PAN
B.The request hits the Default rule in the Policy Set
C.The request is automatically permitted
D.The NAD closes the port
AnswerB

A Policy Set always ends with a non-editable Default rule, which matches any request that no preceding rule matched. It therefore guarantees a deterministic result rather than an undefined one, satisfying the stem's requirement that every request receives a decision even when no configured rule applies.

Why this answer

If no rules match a request in an ISE Authorization Policy, the request hits the Default rule in the Policy Set. The Default rule is a catch-all that typically has a result of 'DenyAccess' unless explicitly configured otherwise. This ensures that unmatched requests are handled consistently, often denying access by default.

Exam trap

The trap is thinking that unmatched requests are automatically permitted or that they are sent to another node. The correct behavior is to hit the Default rule, which typically denies access. Candidates might forget the existence of the Default rule.

How to eliminate wrong answers

Option A is wrong because sending the request to the primary PAN is not a standard authorization policy behavior; the PAN is for administration, not policy evaluation. Option C is wrong because automatically permitting would be a security risk; the default is usually deny. Option D is wrong because the NAD closing the port is a result of a deny action, but it's not the immediate next step; the policy evaluation first hits the Default rule, which may then result in a deny that causes the NAD to close the port.

Practice this question →
10
MCQhard

A TACACS+ command authorization policy is failing to restrict specific configuration changes on a Cisco IOS device. Which field in the TACACS+ Profile must be correctly configured to ensure the command list is evaluated?

A.Command Sets
B.Device Administration Policy
C.Policy Set Condition
D.Shell Profile
AnswerA

The Command Set holds the permitted or denied command list that TACACS+ evaluates during authorisation. If it is unconfigured or wrongly attached to the profile, ISE cannot match commands, so configuration changes are not restricted.

Why this answer

In a TACACS+ Profile in Cisco ISE, the Command Sets field is where you define the list of commands (permit/deny) that will be evaluated for command authorization. If the command list is not correctly configured in the Command Sets, the device will not receive the proper authorization response, and the policy will fail to restrict commands. Therefore, Command Sets is the field that must be correctly configured.

Exam trap

SISE often tests the specific field within a TACACS+ Profile that contains the command list — candidates may confuse Command Sets with Shell Profile or Device Administration Policy, but only Command Sets holds the actual command authorization rules.

How to eliminate wrong answers

Option B is wrong because Device Administration Policy is a broader policy that references the TACACS+ Profile, but it does not contain the command list itself. Option C is wrong because Policy Set Condition determines which policy set applies to the request, not the command authorization list. Option D is wrong because Shell Profile defines the shell attributes (e.g., privilege level, timeout) for the user session, not the command authorization list.

Practice this question →
11
MCQmedium

When using TACACS+ for device administration, what role does the 'Shell Profile' play?

A.It stores the device credentials
B.It defines which users can access the device
C.It defines the privilege level for the session
D.It defines the list of allowed commands
AnswerC

The Shell Profile maps the authenticated TACACS+ user to a specific privilege level (0–15) applied to the shell session, satisfying the stem's requirement to define authorisation for device administration. Without it, the session defaults to the lowest privilege, so it directly controls the level granted.

Why this answer

The Shell Profile in TACACS+ defines the privilege level for the session. When a user authenticates via TACACS+, the Shell Profile is used to specify the privilege level (e.g., privilege 15) that the user will have on the device. This determines what commands the user can execute.

The Shell Profile is part of the authorization process and is often configured on the TACACS+ server.

Exam trap

SISE often tests the role of Shell Profile in TACACS+ authorization. Candidates may confuse it with command authorization or user authentication, but it specifically sets the privilege level for the session.

How to eliminate wrong answers

Option A is wrong because the Shell Profile does not store device credentials; credentials are stored in the authentication database. Option B is wrong because the Shell Profile does not define which users can access the device; that is determined by authentication and authorization policies. Option D is wrong because the Shell Profile does not define the list of allowed commands; command authorization is handled separately, often via command sets.

Practice this question →
12
MCQeasy

Which ISE menu path is used to create a new Authorization Profile?

A.Policy -> Policy Sets -> Add
B.Policy -> Policy Elements -> Conditions
C.Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles
D.Administration -> Identity Management -> Groups
AnswerC

Authorization Profiles are result objects, so they live under Policy Elements alongside other reusable results. The path Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles is where a new profile is created for later reference in authorization policy rules.

Why this answer

In Cisco ISE, Authorization Profiles define the actual permissions or attributes (e.g., VLAN, dACL, SGT) that are applied to a session after a successful authorization policy match. They are created and managed under Policy -> Policy Elements -> Results -> Authorization -> Authorization Profiles. This is the only path among the options that leads to the Authorization Profiles configuration page.

Exam trap

SISE often tests the distinction between policy elements that define conditions versus those that define results, and candidates frequently confuse the Authorization Profiles path with Policy Sets or Conditions.

How to eliminate wrong answers

Option A is wrong because Policy -> Policy Sets -> Add is used to create a new policy set (a collection of authentication and authorization rules), not an authorization profile. Option B is wrong because Policy -> Policy Elements -> Conditions is where you define conditions (e.g., AD group membership, time-of-day) that are used in policy rules, not the results that are applied. Option D is wrong because Administration -> Identity Management -> Groups is for managing identity groups (e.g., user identity groups or endpoint identity groups), which are used in conditions but are not authorization profiles.

Practice this question →
13
MCQhard

During an 802.1X process, the NAD sends an Access-Request with a specific Calling-Station-ID. If ISE does not find this in its Endpoint DB, what is the default behavior for the 'Unknown' status?

A.Always deny
B.Always permit
C.Automatically add to database
D.Process based on Authorization Policy match
AnswerD

Endpoints absent from the Identity Services Engine Endpoint DB receive the Unknown status, which does not block authentication. ISE instead evaluates the request against the matching Authorization Policy rules, applying the resulting authorisation profile to permit or restrict access.

Why this answer

When ISE receives an Access-Request with a Calling-Station-ID (MAC address) that is not present in the Endpoint Database, the endpoint is assigned the 'Unknown' identity group by default. ISE does not automatically deny or permit — it simply proceeds to evaluate the Authorization Policy, where the 'Unknown' group can be matched by a specific rule (e.g., redirect to guest portal, apply a restrictive dACL, or deny). The outcome is entirely determined by which authorization rule matches.

Exam trap

SISE often tests the misconception that ISE has a hardcoded default action (deny or permit) for unknown endpoints, when in reality the behavior is entirely driven by the Authorization Policy match.

How to eliminate wrong answers

Option A is wrong because ISE has no built-in 'always deny' behavior for unknown endpoints — denial only happens if an authorization rule explicitly matches the Unknown group and returns a DenyAccess result. Option B is wrong because 'always permit' would be a severe security default and is not how ISE behaves; permitting requires an explicit authorization rule. Option C is wrong because ISE does not automatically add unknown endpoints to the Endpoint Database during authentication — endpoints are added via profiling probes, manual entry, or the guest/MAC registration flows, not as a side effect of an unknown Calling-Station-ID.

Practice this question →
14
MCQhard

A guest user is failing authentication because they are hitting the wrong policy set. How can you ensure the guest traffic is matched to the 'Guest' policy set?

A.Modify the guest portal settings
B.Change the authentication sequence
C.Reorder the policy sets
D.Adjust the Policy Set conditions
AnswerD

Policy Set conditions determine which policy set a request matches, evaluated before authentication rules inside it. Refining those conditions so guest attributes, such as the guest user's identity source or group, match the Guest policy set routes the traffic correctly.

Why this answer

Policy Set conditions are the top-level matching criteria that determine which policy set a request is evaluated against. If guest traffic is landing in the wrong policy set, the fix is to adjust the conditions (e.g., SSID, NAS-IP-Address, device type, or RADIUS attributes) so the guest session matches the 'Guest' policy set. Reordering only changes evaluation order among policy sets that already match — it does not change which conditions cause a match.

Exam trap

SISE often tests the confusion between policy set selection (conditions) and policy set ordering (reordering), tricking candidates into picking 'reorder' when the real issue is that the conditions themselves don't match the traffic.

How to eliminate wrong answers

Option A is wrong because guest portal settings control the web authentication experience (redirect URL, acceptable use policy, login page), not which policy set the RADIUS request is matched against. Option B is wrong because the authentication sequence defines the order of identity stores (AD, LDAP, internal users) within a policy set, not which policy set is selected. Option C is wrong because reordering policy sets only affects the evaluation order of already-matching sets; it cannot force a non-matching request into the Guest set.

Practice this question →
15
Multi-Selectmedium

Which TWO of the following are valid components of an ISE Authorization Policy rule?

Select 2 answers
A.Results
B.Device Groups
C.Authentication protocols
D.Identity Source
E.Conditions
AnswersA, E

Results specify the authorization profile or permissions returned when a rule's conditions match, such as a VLAN, dACL or SGT. They form the second core component of an ISE authorization policy rule, determining what access the matched session receives.

Why this answer

In Cisco ISE, an Authorization Policy rule is built from two main parts: Conditions and Results. Option E (Conditions) is correct because the rule's conditions define the matching criteria — such as identity group, AD group, device type, or posture status — that determine whether the rule applies to a session. Option A (Results) is correct because the results define what authorization profile or permissions (e.g., VLAN, dACL, SGT, or downloadable ACL) are applied when the conditions match.

Option D (Identity Source) is not a component of the authorization rule itself; identity sources are referenced in authentication policy rules to validate credentials. Option B (Device Groups) is used in network device definitions and policy sets, not as a direct authorization rule component. Option C (Authentication protocols) are configured in authentication policy rules, not in authorization policy rules.

Exam trap

The trap is confusing components of authentication policies with those of authorization policies. Candidates might think identity sources or authentication protocols are part of authorization rules, but they are not; authorization rules only have conditions and results.

Practice this question →
16
MCQeasy

Which component in ISE defines the 'result' of an authorization rule?

A.Policy Set
B.Identity Source
C.Authorization Policy
D.Authorization Profile
AnswerD

The authorization profile holds the actual enforcement attributes — VLAN, dACL, SGT, URL redirect — that ISE returns once a rule matches. The rule's conditions only select it; the profile supplies the result, satisfying the stem's requirement for the component defining the rule's outcome.

Why this answer

In ISE, an Authorization Profile defines the actual result of an authorization rule, such as VLAN assignment, DACL, SGT, or reauthentication timers. The authorization policy contains rules that reference authorization profiles as the 'then' action. Therefore, the component that defines the 'result' is the Authorization Profile.

Exam trap

SISE often tests the distinction between an Authorization Policy (the rule) and an Authorization Profile (the result); candidates may pick the policy when asked for the component that defines the result.

How to eliminate wrong answers

Option A is wrong because a Policy Set is a container that groups authentication and authorization policies based on conditions, but it does not define the result itself. Option B is wrong because an Identity Source (e.g., AD, LDAP) is used during authentication to verify user credentials, not to define authorization results. Option C is wrong because an Authorization Policy is the set of rules that evaluate conditions and then apply an authorization profile; it does not define the result directly—the profile does.

Practice this question →
17
Multi-Selecthard

Which THREE of the following items can be included in an ISE 'Common Task' for authorization?

Select 3 answers
A.Password complexity policy
B.dACL assignment
C.SGT assignment
D.RADIUS session timeout
E.VLAN assignment
AnswersB, C, E

A dACL assignment is a valid Common Task because ISE can push downloadable ACLs to network access devices during authorization. The dACL defines permit and deny entries applied to the switch or wireless controller port, satisfying the stem's requirement that the item be selectable within a Common Task for enforcing authorisation policy.

Why this answer

In Cisco ISE, an authorization policy's Common Tasks are the standard result types that can be returned to a network device after a successful authentication, and they include dACL assignment (B), SGT assignment (C), and VLAN assignment (E). Option B is correct because ISE can push a downloadable ACL (dACL) name to the switch or WLC, which the NAD then applies to the session to filter traffic. Option C is correct because ISE can return a Security Group Tag (SGT) via the RADIUS Cisco-AVPair attribute (cts:security-group-tag), enabling TrustSec enforcement on the network device.

Option E is correct because ISE can return a VLAN ID or VLAN name in the RADIUS Tunnel attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) to place the endpoint into a specific VLAN. Option A is not part of a Common Task because password complexity is configured in authentication/identity policies or the identity store, not returned as an authorization result. Option D is not a Common Task because RADIUS session timeout is a session attribute (Session-Timeout) typically set in authorization profiles or global settings, not one of the standard Common Task result categories.

Exam trap

SISE often tests the boundary between authentication policy elements (password complexity, identity sources) and authorization result elements (dACL, SGT, VLAN); candidates mistakenly include authentication-side items in the Common Task selection.

Practice this question →
18
MCQeasy

When configuring a dACL for a guest user, what is the mandatory format for the access control list entries?

A.Cisco IOS-style extended access-list format
B.SGACL tag format
C.JSON format
D.XML format
AnswerA

TrustSec dACLs require Cisco IOS-style extended access-list syntax, not standard IP ACLs or vendor-neutral formats. This satisfies the stem's mandatory format constraint, as the SISE exam expects entries such as "permit ip any any" with protocol, source, and destination fields.

Why this answer

When you create a downloadable ACL in Cisco ISE, the ACE entries must be written in Cisco IOS-style extended ACL syntax (e.g., 'permit tcp any host 10.1.1.5 eq 443'). ISE does not translate from other formats — it passes the ACE text verbatim to the NAD inside the RADIUS cisco-av-pair attribute, so the syntax must match what the switch's IOS parser expects.

Exam trap

The trap here is confusing dACL syntax with SGACL or API payload formats — candidates who have worked with TrustSec or ISE REST APIs may incorrectly select SGACL tag or JSON format.

How to eliminate wrong answers

Option B is wrong because SGACL tag format is used for TrustSec Security Group ACLs (which reference SGT values, not IP/port tuples) and is a completely different enforcement mechanism from dACLs. Option C is wrong because JSON is a data-interchange format used by ISE's REST APIs and pxGrid, not the format for ACL entries pushed to a switch. Option D is wrong because XML is used for some ISE configuration exports and API payloads, but not for dACL ACE syntax delivered to network devices.

Practice this question →
19
MCQmedium

You have a policy set where authentication succeeds, but the user is hitting the 'Default' authorization rule instead of the expected rule. What should you check first?

A.The RADIUS dictionary version
B.The Identity Store order
C.The Policy Set name
D.The Authorization rule order
AnswerD

Authorization rules are evaluated top-down, so a rule placed above the expected one matches first and terminates processing. Checking the rule order in the policy set confirms whether the Default rule is being reached because a preceding rule already matched.

Why this answer

Authorization rules are evaluated top-down within a policy set, and the first rule whose conditions match is applied. If authentication succeeds but the user falls through to the 'Default' rule, it means no earlier rule matched the user's attributes, or the expected rule is positioned below a broader rule that already matched. Checking the authorization rule order first confirms whether a catch-all or higher-priority rule is intercepting the session before the intended rule is evaluated.

Exam trap

SISE often tests the misconception that authorization rules are matched by specificity or by the 'best' match, when in fact ISE evaluates them strictly top-down and stops at the first match.

How to eliminate wrong answers

Option A is wrong because the RADIUS dictionary version only affects how vendor-specific attributes (VSAs) are parsed and displayed, not which authorization rule matches. Option B is wrong because Identity Store order affects authentication source sequencing, not authorization rule evaluation. Option C is wrong because the Policy Set name is just a label; renaming it does not change which authorization rule fires.

Practice this question →
20
MCQmedium

Which option in an Authorization Profile allows you to specify a URL for a WebAuth redirect?

A.RADIUS Attributes -> Tunnel-Private-Group-ID
B.Advanced Attributes -> ACL
C.VLAN/dACL Filters
D.Common Tasks -> Web Redirection
AnswerD

The Common Tasks section of an Authorization Profile contains the Web Redirection setting, where you supply the redirect URL and its ACL. Selecting it satisfies the requirement to specify a WebAuth redirect destination for the posture-assessed endpoint.

Why this answer

The Web Redirection option is located under Common Tasks in an Authorization Profile, where you select the redirect type (Centralized Web Auth, Hotspot, Client Provisioning, MDM, etc.) and specify the ACL and redirect URL. This is the standard mechanism for sending endpoints to a WebAuth portal for guest or BYOD flows.

Exam trap

SISE often tests whether candidates can locate the Web Redirection setting under Common Tasks rather than confusing it with VLAN, dACL, or advanced RADIUS attribute options.

How to eliminate wrong answers

Option A is wrong because RADIUS Attributes -> Tunnel-Private-Group-ID is used to assign a VLAN via RADIUS tunnel attributes, not to redirect to a web portal. Option B is wrong because Advanced Attributes -> ACL attaches an access list to the authorization result but does not define a WebAuth redirect URL. Option C is wrong because VLAN/dACL Filters are used for VLAN and downloadable ACL assignments, not for web redirection.

Practice this question →
21
MCQhard

A user is failing to receive the expected dACL. The ISE logs show the correct authorization rule was matched, but the dACL is not applied. What is the most likely cause?

A.The dACL is not assigned to the correct interface on the switch
B.The Authorization Profile lacks the correct cisco-av-pair attribute
C.The user is in the wrong AD group
D.The device is in the wrong network device group
AnswerB

The matched rule supplies an authorisation profile, but the dACL only reaches the switch if the profile carries the cisco-av-pair attribute (ip:inacl) containing the ACL name. Without that attribute, RADIUS returns no downloadable ACL, so the switch enforces none.

Why this answer

The most likely cause is that the Authorization Profile in ISE lacks the correct cisco-av-pair attribute that defines the dACL name to be returned to the switch. Even if the authorization rule matches, the switch cannot apply a dACL if the RADIUS response does not include the dACL attribute (typically cisco-av-pair with 'ip:inacl#'). The ISE logs show the rule matched, but the dACL is not applied because the profile is missing the attribute.

Exam trap

SISE often tests the difference between rule matching and attribute return — candidates may blame AD groups or NDGs, but if the rule matched, the issue is in the Authorization Profile's returned attributes, specifically the cisco-av-pair for the dACL.

How to eliminate wrong answers

Option A is wrong because dACLs are applied dynamically via RADIUS, not statically assigned to interfaces; the switch applies the dACL based on the RADIUS response, so interface assignment is not the issue. Option C is wrong because if the user were in the wrong AD group, the authorization rule would not have matched; the logs show the correct rule matched, so AD group membership is not the cause. Option D is wrong because if the device were in the wrong network device group, the authorization rule would not have matched; again, the logs confirm the correct rule matched, so NDG is not the issue.

Practice this question →
22
MCQmedium

Which of the following is an example of an 'Exception' policy in ISE?

A.A Policy Set condition
B.An Identity Source Sequence
C.A rule placed at the top of the Authorization Policy
D.The Default policy set
AnswerC

An exception policy is an authorisation rule positioned above the standard rule set so it is evaluated first. Placing it at the top lets specific identities bypass the normal conditions, which is exactly the exception behaviour the question asks for.

Why this answer

In Cisco ISE, an 'Exception' policy is an authorization rule placed at the top of the Authorization Policy set that matches specific conditions and applies a result before the normal rule flow. It is used to override standard authorization for special cases (e.g., a specific user, endpoint, or device) without disturbing the main policy logic. Placing it at the top ensures it is evaluated first.

Exam trap

SISE often tests the confusion between policy set conditions, identity source sequences, and authorization rules; candidates pick 'Policy Set condition' because it sounds like a policy construct, missing that an exception is specifically a top-of-list authorization rule.

How to eliminate wrong answers

Option A is wrong because a Policy Set condition determines which policy set a request is matched to, not an exception within authorization. Option B is wrong because an Identity Source Sequence defines the order in which identity stores are queried during authentication, not an authorization exception. Option D is wrong because the Default policy set is the fallback policy set used when no other policy set matches — it is not itself an exception rule.

Practice this question →
23
Multi-Selecteasy

Which TWO of the following authentication protocols are supported by ISE for 802.1X?

Select 2 answers
A.SNMPv2
B.EAP-TLS
C.ICMP
D.PEAP
E.FTP
AnswersB, D

EAP-TLS is certificate-based, using mutual X.509 authentication between supplicant and server, so it satisfies ISE's 802.1X requirement without relying on password credentials. ISE terminates the EAP-TLS tunnel and validates client certificates against its certificate authentication profile, making it a natively supported 802.1X method.

Why this answer

EAP-TLS (Option B) is correct because Cisco ISE supports it as an 802.1X authentication method in which both the supplicant and the server authenticate using X.509 digital certificates, providing mutual certificate-based authentication over EAP. PEAP (Option D) is also correct because ISE supports Protected EAP, which establishes a TLS tunnel between the supplicant and the ISE server and then carries an inner authentication method such as MS-CHAPv2 or EAP-GTC. SNMPv2 (Option A) is a network management protocol used for monitoring and configuring devices, not an 802.1X authentication protocol.

ICMP (Option C) is a control/diagnostic protocol (e.g., ping) and plays no role in 802.1X authentication. FTP (Option E) is a file transfer protocol and is unrelated to 802.1X authentication.

Exam trap

SISE often tests whether candidates can distinguish EAP authentication methods (EAP-TLS, PEAP) from unrelated protocols like SNMP, ICMP, and FTP that appear as distractors.

Practice this question →
24
MCQmedium

You are configuring a policy set for wireless clients and need to ensure that only devices matching a specific internal endpoint group are granted access. Where should you define this requirement in the Cisco ISE policy set?

A.In the Authorization Policy rule conditions
B.In the Results section of the Authentication Policy
C.In the RADIUS dictionary under Policy Elements
D.In the Policy Set general authentication settings
AnswerA

Authorization policy rules evaluate conditions after authentication and are where endpoint identity group membership is matched to grant or deny access. Defining the internal endpoint group here enforces the stem's requirement that only matching devices receive authorisation.

Why this answer

In Cisco ISE, policy sets are composed of authentication and authorization policies. The authorization policy is where you define conditions based on attributes like Endpoint Identity Groups to determine the level of access granted. Therefore, to ensure only devices matching a specific internal endpoint group are granted access, you must define this requirement in the Authorization Policy rule conditions.

This allows ISE to evaluate the endpoint's group membership and enforce the appropriate authorization result.

Exam trap

SISE often tests the distinction between authentication and authorization policies, and candidates may incorrectly assume that endpoint group conditions belong in the authentication policy or general settings, when they are actually evaluated in the authorization policy.

How to eliminate wrong answers

Option B is wrong because the Results section of the Authentication Policy only determines the authentication result (e.g., Pass/Fail) and does not evaluate endpoint group membership for authorization. Option C is wrong because the RADIUS dictionary under Policy Elements is used to define or view RADIUS attributes, not to enforce access based on endpoint groups. Option D is wrong because the Policy Set general authentication settings configure which authentication protocols and identity stores are used, not the conditions for granting access based on endpoint groups.

Practice this question →
25
MCQhard

When troubleshooting a failed authorization, which ISE live log column identifies the specific rule that was matched?

A.Authentication Policy
B.Policy Set
C.Result
D.Authorization Policy
AnswerD

The Authorization Policy column in ISE live logs names the authorisation policy rule that matched the request, showing exactly which condition set granted or denied access. This pinpoints the rule responsible for the failed authorisation, unlike identity or endpoint columns.

Why this answer

The Authorization Policy column in the ISE live logs shows the exact authorization rule that was evaluated and matched for a given session. When a user or endpoint attempts access, ISE processes the request through the authentication policy, then the authorization policy, and the live log records which specific rule within the authorization policy was hit. This allows administrators to quickly identify which condition (e.g., AD group, posture status, device type) triggered the result, such as PermitAccess or DenyAccess.

Exam trap

SISE often tests the distinction between authentication and authorization columns in live logs, and candidates frequently confuse the Authentication Policy column (which shows the authentication rule) with the Authorization Policy column (which shows the authorization rule).

How to eliminate wrong answers

Option A is wrong because the Authentication Policy column indicates the authentication rule that matched (e.g., which identity source or protocol was used), not the authorization rule. Option B is wrong because the Policy Set column shows the overall policy set that was selected based on the initial conditions (like device type or location), but it does not identify the specific authorization rule within that set. Option C is wrong because the Result column displays the final outcome of the authorization (e.g., PermitAccess, DenyAccess), not the rule that produced it.

Practice this question →
26
MCQmedium

A user is authenticated, but their authorization profile returns the wrong VLAN. Which troubleshooting tool in ISE is best suited to verify the attributes sent to the NAD?

A.Monitoring -> Alarms
B.Live Logs
C.Policy Simulation
D.TCP Dump
AnswerB

Live Logs capture the RADIUS authentication and authorization exchange in real time, letting you inspect the actual attributes returned to the network access device. This directly satisfies the stem's requirement to verify which VLAN and other authorization attributes ISE sent, confirming whether the wrong profile or policy caused the mismatch.

Why this answer

Live Logs in ISE provides real-time detailed authentication and authorization logs, including the exact attributes returned to the NAD in the authorization profile. It shows the RADIUS response attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID (VLAN), making it the best tool to verify what was sent to the switch.

Exam trap

SISE often tests the confusion between Policy Simulation (pre-deployment testing) and Live Logs (real-time session inspection), tricking candidates into picking simulation when they need to verify actual attributes sent to the NAD.

How to eliminate wrong answers

Option A is wrong because Monitoring -> Alarms shows system alerts and health events, not per-session authorization attributes. Option C is wrong because Policy Simulation is used to test policy logic before deployment, not to inspect live session attributes. Option D is wrong because TCP Dump captures raw packets but does not decode and present the authorization attributes in a readable, session-centric way like Live Logs.

Practice this question →
27
MCQmedium

You need to ensure that only specific MAC OUI addresses are allowed to connect via MAB. Where do you configure this restriction?

A.Authentication Policy
B.Identity Source Sequence
C.Authorization Policy Condition
D.Authorization Profile
AnswerC

Authorization policy conditions in Cisco ISE restrict MAB by matching endpoint attributes such as MAC OUI, satisfying the requirement that only approved vendors connect. Unlike authentication policies, which select identity stores, authorization conditions evaluate attributes after authentication to enforce granular permit or deny decisions per endpoint.

Why this answer

In Cisco ISE, MAB (MAC Authentication Bypass) authorization decisions are made by the Authorization Policy, and the specific conditions that match attributes like MAC address, OUI, or endpoint identity group are configured as conditions within an Authorization Policy rule. To restrict access to specific MAC OUI addresses, you create a condition (e.g., using the 'MACAddress' or 'EndPointMacAddress' attribute with an OUI prefix match) inside the Authorization Policy rule, which then determines the resulting Authorization Profile.

Exam trap

SISE often tests the confusion between Authentication Policy (how identity is verified) and Authorization Policy (what access is granted), tricking candidates into placing MAC OUI restrictions in the wrong policy.

How to eliminate wrong answers

Option A is wrong because the Authentication Policy determines how the identity is validated (e.g., MAB vs 802.1X vs CWA) — it does not evaluate MAC OUI restrictions for authorization. Option B is wrong because an Identity Source Sequence defines the ordered list of identity stores ISE queries during authentication; it has no role in matching MAC OUI patterns for authorization. Option D is wrong because an Authorization Profile defines the result (VLAN, dACL, SGT, URL redirect) applied when a rule matches — it does not contain the matching condition itself.

Practice this question →
28
Multi-Selecthard

Which THREE of the following are components of a Cisco TrustSec 'Security Group' policy enforcement?

Select 3 answers
A.SGT (Security Group Tag)
B.TACACS+ command set
C.Enforcement device (e.g., Catalyst switch)
D.SGACL (Security Group Access Control List)
E.RADIUS shared secret
AnswersA, C, D

The Security Group Tag is a metadata value inserted into the packet, classifying the source's role or group. TrustSec policy matches on this tag rather than IP addresses, enabling scalable, topology-independent segmentation across the network fabric.

Why this answer

Cisco TrustSec Security Group policy enforcement relies on three core building blocks. Option A, SGT (Security Group Tag), is correct because TrustSec classifies traffic by assigning a 16-bit SGT to a source identity, and that tag is what the fabric carries and enforces against. Option C, the enforcement device (e.g., Catalyst switch), is correct because TrustSec enforcement happens at the network device that receives the tagged packet and applies the policy, such as a Catalyst switch acting as an enforcement point.

Option D, SGACL (Security Group Access Control List), is correct because SGACLs define the actual permissions between source and destination SGTs and are downloaded to enforcement devices to permit or deny traffic. Option B, TACACS+ command set, is not a TrustSec enforcement component; TACACS+ is used for device administration AAA and command authorization, not for SGT-based traffic policy. Option E, RADIUS shared secret, is also not a TrustSec enforcement component; a shared secret is an authentication credential used between a client and a RADIUS server, not a policy enforcement element.

Exam trap

SISE often tests the confusion between TrustSec components (SGT, SGACL, enforcement device) and unrelated AAA constructs like TACACS+ command sets or RADIUS shared secrets.

Practice this question →
29
MCQhard

A user is assigned an SGT, but the switch does not apply the correct filtering. What is the most likely reason for the SGACL enforcement failure?

A.The SGT is not in the ISE database
B.RADIUS shared secret is wrong
C.The switch is missing the 'cts role-based enforcement' command
D.The user is in the wrong AD group
AnswerC

Without the `cts role-based enforcement` command, the switch downloads SGT bindings but never installs SGACLs into hardware, so tagged traffic passes unfiltered. Enabling it activates role-based enforcement, satisfying the stem's requirement that the switch apply the correct filtering for the assigned SGT.

Why this answer

For SGACL enforcement to occur on a switch, the switch must have the 'cts role-based enforcement' command enabled globally (and often on the interface). Without this command, the switch may receive the SGT via RADIUS but will not enforce any SGACL filtering, resulting in the described failure. This is the most likely reason when the SGT is assigned but filtering does not happen.

Exam trap

SISE often tests the specific CLI command required for TrustSec enforcement — candidates may focus on ISE-side configuration or RADIUS issues, but the question asks for the most likely reason on the switch, which is the missing enforcement command.

How to eliminate wrong answers

Option A is wrong because if the SGT is not in the ISE database, the user would not be assigned an SGT at all — the question states the user is assigned an SGT. Option B is wrong because a wrong RADIUS shared secret would cause authentication to fail entirely, not just SGACL enforcement. Option D is wrong because being in the wrong AD group would result in a different SGT assignment, but the question says the user is assigned an SGT (presumably the correct one) and filtering still fails.

Practice this question →
30
Multi-Selecthard

Which THREE components are required to successfully deploy a Scalable Group Access (SGA) policy for SGT enforcement?

Select 3 answers
A.TACACS+ Command Authorization
B.DHCP Snooping
C.SGACL definition
D.TrustSec Matrix configuration
E.SGT mapping
AnswersC, D, E

SGACLs supply the actual permit or deny rules applied to traffic between source and destination SGTs. Without a defined SGACL, the TrustSec Matrix has no enforceable access control entries, so this component is mandatory for SGT-based enforcement in an SGA policy.

Why this answer

Option C (SGACL definition) is required because Scalable Group Access enforcement relies on Security Group ACLs that specify the permitted or denied traffic between source and destination SGTs; without an SGACL there is no policy to enforce. Option D (TrustSec Matrix configuration) is required because the TrustSec matrix binds source SGTs to destination SGTs and references the SGACLs, defining the actual enforcement policy that the network devices download. Option E (SGT mapping) is required because devices must know which SGT to assign to endpoints or users (via static IP-to-SGT, VLAN-to-SGT, or 802.1X/ISE authorization), otherwise traffic cannot be classified and the matrix/SGACL policy cannot be applied.

Option A (TACACS+ Command Authorization) is not required for SGA/SGT enforcement; it controls CLI command privileges, not group-based traffic policy. Option B (DHCP Snooping) is not required for SGA/SGT enforcement; it is a Layer 2 security feature for DHCP and does not perform SGT classification or SGACL enforcement.

Exam trap

SISE often tests the confusion between classification (SGT mapping) and enforcement (SGACL + Matrix), causing candidates to select ancillary features like DHCP Snooping or TACACS+ that are not part of the core SGA policy triad.

Practice this question →
31
MCQmedium

When configuring a TACACS+ command authorization policy for network device management, where do you define which specific commands a user is allowed to execute?

A.In the Policy Set Authentication rule
B.In the Authorization Profile
C.In the Command Set Policy Element
D.In the User Identity Group
AnswerC

The Command Set Policy Element defines the permitted command list, which is then referenced by the command authorisation rule. This satisfies the stem's requirement of specifying exactly where allowed commands are declared, separating the command definitions from the rule that applies them.

Why this answer

In ISE TACACS+ command authorization, the specific set of commands a user is permitted (or denied) to run is defined inside a Command Set, which is a Policy Element. The Command Set is then referenced by an Authorization Policy rule, which applies it when the user's session matches the rule conditions. This separation lets you reuse the same command list across multiple rules and policy sets.

Exam trap

SISE often tests the distinction between the Command Set (which holds the command list) and the Authorization Profile (which holds the result attributes) — candidates frequently pick the Authorization Profile because it sounds like the place where authorization is defined.

How to eliminate wrong answers

Option A is wrong because the Authentication rule only determines how the user is authenticated (e.g., against AD or internal users) — it does not define command-level permissions. Option B is wrong because an Authorization Profile defines the result of authorization (such as shell profile, privilege level, or downloadable ACL) but does not itself contain the list of permitted commands. Option D is wrong because a User Identity Group is only a logical grouping of identities used in policy conditions; it does not hold command lists.

Practice this question →
32
MCQmedium

A security administrator is configuring a policy set in Cisco ISE to enforce different authorization policies based on the endpoint's posture status. The administrator wants to ensure that non-compliant endpoints are placed in a remediation VLAN. Which condition should be used in the authorization policy to match endpoints that have failed posture assessment?

A.PostureStatus EQUALS NonCompliant
B.ComplianceStatus EQUALS Failed
C.EndPointPolicy EQUALS NonCompliant
D.PostureReport EQUALS NonCompliant
AnswerA

In Cisco ISE, the posture status is represented by the 'PostureStatus' attribute, which can have values such as Compliant, NonCompliant, Unknown, or NotApplicable. To match endpoints that have failed posture assessment, the condition should check if PostureStatus equals NonCompliant. This attribute is populated after posture assessment and can be used in authorization policies to assign remediation VLANs or restricted access.

Why this answer

The PostureStatus attribute in Cisco ISE reflects the result of posture assessment. It can be Compliant, NonCompliant, Unknown, or NotApplicable. To direct non-compliant endpoints to a remediation VLAN, the authorization policy must check for PostureStatus EQUALS NonCompliant.

This ensures that only endpoints that have failed the posture check receive the remediation treatment.

Exam trap

The trap here is confusing the attribute name and its values, such as using 'ComplianceStatus' or 'Failed' instead of the correct 'PostureStatus' and 'NonCompliant'.

Practice this question →
33
MCQhard

You want to implement a 'Change of Authorization' (CoA) after a user changes their location. How is the CoA triggered by ISE?

A.ISE sends a RADIUS CoA message to the NAD
B.The NAD sends a re-authentication request
C.It requires a manual port bounce
D.The user must log out and back in
AnswerA

ISE initiates CoA by sending a RADIUS Change of Authorization packet, defined in RFC 5176, to the network access device. The NAD then reauthenticates or reauthorises the session, applying the new location-based policy without requiring the user to reconnect.

Why this answer

ISE triggers a Change of Authorization (CoA) by sending a RADIUS Disconnect-Request (code 40) or CoA-Request (code 43) packet directly to the Network Access Device (NAD) that currently has the user's session. This allows ISE to dynamically modify the user's authorization (e.g., VLAN, ACL, SGT) without requiring re-authentication. The NAD must support CoA (RFC 5176) and have the ISE node configured as a CoA client.

This is the standard mechanism for enforcing policy changes mid-session.

Exam trap

SISE often tests the direction of CoA messages: candidates may mistakenly think the NAD initiates the change or that re-authentication is required, but ISE is the initiator sending RADIUS CoA to the NAD.

How to eliminate wrong answers

Option B is wrong because the NAD does not initiate a re-authentication request; re-authentication is typically triggered by ISE via CoA or by session timeout, not by the NAD itself. Option C is wrong because a manual port bounce is a disruptive, manual workaround that is not part of ISE's CoA process; CoA is automatic and does not require physical intervention. Option D is wrong because requiring the user to log out and back in is a manual re-authentication that defeats the purpose of CoA, which is to apply changes without user disruption.

Practice this question →
34
Multi-Selectmedium

Which TWO of the following are valid ways to restrict access based on posture status in ISE?

Select 2 answers
A.Change the Identity Source Sequence
B.Create an Authorization Policy rule using Posture status
C.Assign a dACL that denies traffic if non-compliant
D.Use a Shell Profile
E.Create an Authentication Policy rule using Posture status
AnswersB, C

An authorization policy rule can evaluate the posture condition directly, so non-compliant endpoints match a rule that returns a restricted result. This enforces posture-based access at the policy decision point, satisfying the stem's requirement to restrict access according to posture status.

Why this answer

Option B is correct because ISE enforces posture-based access decisions in the Authorization Policy: you create an authorization rule whose conditions include the posture status attribute (e.g., PostureStatus = Compliant or NonCompliant), so endpoints are granted different authorizations depending on their posture result. Option C is correct because a downloadable ACL (dACL) applied in the authorization result can restrict traffic for non-compliant endpoints, for example by denying most traffic while permitting remediation or quarantine access, which is a valid way to enforce posture-based access restriction. Option A is not correct because the Identity Source Sequence only determines which identity stores are queried during authentication and has nothing to do with posture status.

Option D is not correct because a Shell Profile defines CLI/session attributes for TACACS+ device administration, not posture-based network access control. Option E is not correct because the Authentication Policy runs before posture assessment and evaluates identity/authentication conditions, not posture status, which is only known after posture evaluation and is used in the Authorization Policy.

Exam trap

SISE often tests the distinction between authentication and authorization policies, and candidates may incorrectly assume posture status can be used in an Authentication Policy rule or confuse identity source sequences with posture enforcement.

Practice this question →
35
MCQhard

You are troubleshooting SGT propagation. If an SGT is not being embedded in the SXP protocol, what should you verify?

A.Verify the dACL configuration
B.Verify the RADIUS shared secret
C.Verify the EAP protocol version
D.Verify SXP connection status and configuration on both peers
AnswerD

SXP is the protocol that carries SGT mappings to non-Cisco or legacy peers, so if tags are not propagating, the SXP session itself is the fault domain. Checking connection status and configuration on both peers confirms whether the session is up and correctly bound.

Why this answer

SXP (SGT Exchange Protocol) propagates SGTs between devices that cannot natively carry them (e.g., non-Cisco or older switches). If an SGT is not being embedded in SXP, the first thing to verify is the SXP connection status and configuration on both peers — the connection must be established and the correct SGTs permitted. This is the direct troubleshooting step for SXP propagation failures.

Exam trap

SISE often tests the confusion between SGT propagation mechanisms (SXP, inline tagging) and enforcement mechanisms (dACL, SGACL); candidates pick dACL or RADIUS options that are unrelated to SXP propagation.

How to eliminate wrong answers

Option A is wrong because dACL configuration affects enforcement of SGT-based policy, not the SXP propagation of SGTs itself. Option B is wrong because the RADIUS shared secret is used for authentication between the NAD and ISE, not for SXP peer communication. Option C is wrong because the EAP protocol version relates to 802.1X authentication, not SXP SGT propagation.

Practice this question →
36
MCQeasy

What is the purpose of an Authorization Profile's 'Common Tasks'?

A.To group devices together
B.To configure standard RADIUS attributes easily
C.To define user permissions for ISE UI
D.To store identity sources
AnswerB

Common Tasks provides predefined shortcuts that populate standard RADIUS attributes, such as VLAN or ACL assignments, into the authorization profile without manual entry. This simplifies and standardises attribute configuration, ensuring consistent access policy enforcement during authentication.

Why this answer

The 'Common Tasks' section within an Authorization Profile in Cisco ISE provides a simplified interface for configuring frequently used RADIUS attributes, such as VLAN assignment, dACL, and reauthentication timers. These tasks map to standard RADIUS attributes (e.g., Tunnel-Type, Tunnel-Private-Group-ID, Cisco-AVPair) without requiring manual attribute entry. This streamlines policy creation for common network access scenarios.

Exam trap

SISE often tests the confusion between Authorization Profiles and other ISE components like Network Device Groups or Admin RBAC roles, leading candidates to incorrectly associate 'Common Tasks' with device grouping or UI permissions.

How to eliminate wrong answers

Option A is wrong because grouping devices is done through Network Device Groups (NDGs) or endpoint identity groups, not Authorization Profiles. Option C is wrong because user permissions for ISE UI are defined by RBAC policies and admin roles, not Authorization Profiles. Option D is wrong because identity sources are configured separately (e.g., Active Directory, LDAP) and referenced in authentication policies, not stored in Authorization Profiles.

Practice this question →
37
MCQmedium

You have multiple Policy Sets. When ISE evaluates incoming RADIUS requests, which mechanism determines which Policy Set is matched?

A.Condition matching
B.Random selection
C.Alphabetical order
D.Authentication protocol
AnswerA

Each Policy Set contains conditions evaluated top-down against the RADIUS request attributes; the first set whose conditions all evaluate true is selected. This condition matching is the mechanism that determines Policy Set selection before authentication policy is applied.

Why this answer

In Cisco ISE, each Policy Set contains a set of conditions that are evaluated against incoming RADIUS request attributes (such as NAS-IP-Address, Calling-Station-ID, or Service-Type). The first Policy Set whose conditions match the request is selected for further processing. This condition-based matching allows granular control over which authentication and authorization policies apply to different users, devices, or locations.

Exam trap

SISE often tests the misconception that Policy Sets are selected based on the order they appear in the GUI (alphabetical or creation order) rather than condition matching, leading candidates to overlook the role of conditions.

How to eliminate wrong answers

Option B is wrong because ISE does not randomly select a Policy Set; selection is deterministic based on configured conditions. Option C is wrong because Policy Sets are not evaluated in alphabetical order; the order is defined by the administrator's priority settings, but matching is still condition-driven. Option D is wrong because the authentication protocol (e.g., EAP, PAP) is part of the request but does not determine Policy Set selection; it is one of many attributes that can be used in conditions.

Practice this question →
38
MCQmedium

An administrator wants to apply a dACL to a user session. Which Cisco ISE component must be configured to ensure the dACL is correctly pushed to the network access device?

A.Authorization Profile
B.Network Device Group
C.Policy Set Authentication Sequence
D.Device Administration Policy Set
AnswerA

An Authorization Profile is the ISE object that carries the dACL name returned to the network access device in the RADIUS Access-Accept, satisfying the requirement to push the dACL to the NAD. The profile references the dACL, which the device then resolves and applies to the user session.

Why this answer

The Authorization Profile is the ISE object that contains the dACL name (and other authorization attributes like VLAN, SGT, or URL redirect) returned to the NAD in the RADIUS Access-Accept. The authorization rule references the Authorization Profile, and ISE pushes the dACL to the switch as part of the authorization result. Without configuring the dACL in an Authorization Profile, ISE has no mechanism to deliver it.

Exam trap

The trap is confusing authentication components (Policy Set Authentication Sequence, Network Device Group) with the authorization component (Authorization Profile) that actually carries the dACL to the NAD.

How to eliminate wrong answers

Option B is wrong because a Network Device Group is used to categorize NADs (e.g., by location or device type) for policy conditions — it does not carry authorization attributes like dACLs. Option C is wrong because the Policy Set Authentication Sequence defines how the identity is authenticated (e.g., 802.1X, MAB, EAP methods), not what authorization attributes are returned. Option D is wrong because the Device Administration Policy Set governs TACACS+ device-admin access (who can log into the switch CLI), not network access authorization for user sessions.

Practice this question →
39
Multi-Selectmedium

Which THREE of the following are valid components of a RADIUS-based Authorization Policy rule in Cisco ISE?

Select 3 answers
A.Rule Name
B.Condition
C.Identity Source Sequence
D.Command Set
E.Authorization Profile
AnswersA, B, E

Every RADIUS Authorization Policy rule requires a Rule Name, which uniquely identifies it within the policy set and determines its position in the ordered evaluation sequence. Without a name, ISE cannot reference the rule when logging or troubleshooting authorisation decisions.

Why this answer

In Cisco ISE, an Authorization Policy rule is built from three mandatory elements: a Rule Name (A), which uniquely identifies the rule within the policy set; a Condition (B), which defines the matching criteria such as AD group membership, device type, or posture status that must evaluate to true; and an Authorization Profile (E), which specifies the actual permissions or attributes (for example, VLAN, dACL, SGT, or downloadable ACL) returned in the RADIUS Access-Accept. The Identity Source Sequence (C) is not part of an authorization rule — it is referenced in the Authentication Policy to determine where user credentials are verified. The Command Set (D) is not an authorization rule component either; it is a TACACS+ construct used in Device Administration authorization to define permitted CLI commands, not a RADIUS authorization element.

Exam trap

SISE often tests the components of Authorization Policy rules and mixes in elements from Authentication Policy (Identity Source Sequence) and Device Administration (Command Set) — candidates must distinguish the policy type.

Practice this question →
40
MCQmedium

A network engineer is configuring an authorization policy in Cisco ISE to enforce SGT-based segmentation on a Catalyst 9000 switch. The engineer wants to assign a static SGT to endpoints that authenticate via 802.1X and belong to a specific Active Directory group. The switch is already configured with 'cts manual' and 'propagate sgt' on the trunk. Which ISE configuration is required to assign the SGT to the endpoint?

A.Enable 'SGT Enforcement' in the switch's global configuration and let ISE push the SGT via Change of Authorization (CoA).
B.Map the Active Directory group to an SGT in ISE's External Identity Sources configuration, and the SGT will be automatically applied.
C.Create a downloadable ACL (dACL) that includes the SGT value, and reference it in the Authorization Profile.
D.Configure the SGT as a RADIUS attribute in the Authorization Profile's advanced attributes using cisco-av-pair with the value 'cts:security-group-tag=xxxx'.
AnswerD

This is correct because Cisco ISE uses the cisco-av-pair RADIUS attribute to pass the SGT value to the switch. The value 'cts:security-group-tag=xxxx' instructs the NAD to apply the specified SGT to the endpoint's traffic. This is the standard method for static SGT assignment in an 802.1X authorization policy.

Why this answer

To assign a static SGT to an endpoint during 802.1X authentication, the authorization policy must return the SGT value in a cisco-av-pair RADIUS attribute. The format 'cts:security-group-tag=xxxx' is recognized by Cisco switches to apply the SGT. Other methods like dACLs or CoA do not perform static SGT assignment.

Therefore, configuring the cisco-av-pair in the Authorization Profile is the correct approach.

Exam trap

The trap here is assuming that SGT assignment can be done via dACL or CoA, but it requires a specific cisco-av-pair attribute in the authorization profile.

Practice this question →
41
Multi-Selectmedium

Which TWO of the following are benefits of using the Cisco TrustSec architecture?

Select 2 answers
A.Eliminates the need for RADIUS
B.Reduces network latency
C.Simplifies policy management by using SGTs
D.Automatic dACL creation
E.Topology-independent security policy
AnswersC, E

Using SGTs decouples policy from IP addresses and VLANs, so rules are written once against group tags and remain valid as endpoints move. This simplifies policy management, satisfying the stem's requirement for a TrustSec benefit, and scales far better than per-subnet ACLs.

Why this answer

Option C is correct because Cisco TrustSec replaces traditional IP- and VLAN-based ACLs with Security Group Tags (SGTs), which are logical labels assigned to users, devices, or endpoints; policies are then written once between source and destination SGT pairs (SGACL matrix) rather than per-subnet, greatly simplifying policy management. Option E is correct because SGTs are carried in the packet's Cisco Metadata (CMD) field or inline tag, so enforcement depends on group membership rather than on where the device sits in the network, making the security policy topology-independent and consistent across wired, wireless, and remote locations. The unmarked options do not belong: TrustSec does not eliminate RADIUS (it typically relies on 802.1X/RADIUS for identity and SGT assignment), it does not inherently reduce network latency (it may add tagging overhead), and while SGACLs can be pushed to devices, automatic dACL creation is a feature associated with Cisco ISE/TrustSec deployment mechanics rather than a core architectural benefit, and it is not one of the two marked answers.

Exam trap

SISE often tests the misconception that TrustSec eliminates RADIUS or automatically creates dACLs, when its real benefits are SGT-based policy simplification and topology-independent enforcement.

Practice this question →
42
MCQhard

You need to apply a dACL that denies all traffic to a specific server subnet (10.1.1.0/24) while permitting everything else. What is the correct syntax for the last line of the dACL?

A.deny ip any 10.1.1.0 0.0.0.255
B.permit tcp any any
C.permit ip any any
D.deny ip any any
AnswerC

Check Point dACLs are evaluated top-down with an implicit drop at the end, so an explicit permit ip any any as the final rule allows all remaining traffic after the earlier deny rule blocks the 10.1.1.0/24 subnet.

Why this answer

A dACL is an ordered list of ACEs evaluated top-down, and IOS ACLs have an implicit 'deny ip any any' at the end. To deny a specific subnet while permitting all other traffic, you place the deny ACE for 10.1.1.0/24 first, then explicitly permit everything else with 'permit ip any any' as the final line. Without that explicit permit, the implicit deny would block all remaining traffic.

Exam trap

The trap is forgetting the implicit 'deny ip any any' at the end of every IOS ACL — candidates who omit the explicit permit inadvertently block all remaining traffic.

How to eliminate wrong answers

Option A is wrong because 'deny ip any 10.1.1.0 0.0.0.255' is only the deny ACE — if it were the last line, the implicit deny would drop all other traffic, contradicting the requirement to permit everything else. Option B is wrong because 'permit tcp any any' only permits TCP traffic, leaving UDP, ICMP, and other protocols to hit the implicit deny — it does not satisfy 'permit everything else'. Option D is wrong because 'deny ip any any' as the last line would block all traffic after the specific deny, which is the opposite of the requirement.

Practice this question →
43
MCQmedium

You are configuring a policy set in Cisco ISE for wireless clients. You need to ensure that the policy set only applies to requests originating from a specific WLC. Which condition should you use?

A.NetworkDevice:Name
B.Radius:NAS-IP-Address
C.Radius:Called-Station-ID
D.Device:Model
AnswerA

NetworkDevice:Name matches the network access device's configured name in ISE, so the policy set applies only to requests from that specific WLC. This satisfies the constraint of scoping the policy set to one wireless controller.

Why this answer

The NetworkDevice:Name condition in Cisco ISE allows you to match requests based on the name of the network device (WLC) as defined in ISE's network device repository. This is the correct condition to ensure a policy set only applies to requests originating from a specific WLC, because the WLC is a network device and its name is a unique identifier in ISE.

Exam trap

SISE often tests the difference between NetworkDevice:Name and Radius:NAS-IP-Address — candidates may pick NAS-IP-Address because it identifies the WLC, but the question specifically asks for a condition based on the WLC's identity, and Name is the direct match.

How to eliminate wrong answers

Option B is wrong because Radius:NAS-IP-Address matches the IP address of the network device, not its name — while it could identify the WLC, the question asks for a condition that applies to a specific WLC by name, and NAS-IP-Address is less flexible if the IP changes. Option C is wrong because Radius:Called-Station-ID typically contains the SSID or AP MAC address for wireless requests, not the WLC identity. Option D is wrong because Device:Model matches the device model (e.g., 'Cisco 5520 WLC'), which would apply to all WLCs of that model, not a specific one.

Practice this question →
44
MCQhard

You have a Cisco switch that supports both RADIUS and TACACS+. When using ISE for device administration, which protocol is mandatory for command-level authorization?

A.TACACS+
B.SSH
C.RADIUS
D.SNMPv3
AnswerA

TACACS+ separates authentication, authorization and accounting into distinct exchanges, letting ISE return per-command authorisation decisions for device administration. RADIUS bundles authorisation into the authentication response and cannot enforce command-level privileges, so it fails the stem's requirement for granular CLI command control on the Cisco switch.

Why this answer

TACACS+ is mandatory for command-level authorization in Cisco ISE device administration because it separates authentication, authorization, and accounting (AAA) and supports per-command authorization. RADIUS, while used for network access, does not provide the granular command authorization that TACACS+ offers. Therefore, to enforce command-level authorization on a Cisco switch, TACACS+ must be used.

Exam trap

The trap is assuming RADIUS can handle command-level authorization because it is also an AAA protocol; candidates must remember that only TACACS+ supports per-command authorization.

How to eliminate wrong answers

Option B is wrong because SSH is a protocol for secure remote access, not an AAA protocol for authorization. Option C is wrong because RADIUS combines authentication and authorization in a single response and does not support command-level authorization; it is typically used for network access (802.1X) rather than device administration. Option D is wrong because SNMPv3 is used for network management and monitoring, not for command authorization.

Practice this question →
45
MCQeasy

What is the function of the 'Default' policy set in ISE?

A.It is a catch-all for traffic that does not match other Policy Sets
B.It is the only policy set allowed to process MAB requests
C.It is used to manage ISE internal traffic only
D.It cannot be modified
AnswerA

The Default policy set acts as the fallback for any RADIUS or TACACS+ request that matches no other policy set's conditions, ensuring no authentication traffic is dropped. It provides a guaranteed processing path for unmatched requests.

Why this answer

The 'Default' policy set in ISE is a catch-all that processes any authentication or authorization request that does not match any other policy set. It is the last policy set evaluated and ensures that no traffic is left unprocessed. It can be modified, but it cannot be deleted.

Exam trap

SISE often tests the misconception that the Default policy set cannot be modified or is only for specific traffic types, when in fact it is a catch-all that can be customized.

How to eliminate wrong answers

Option B is wrong because MAB requests can be processed by any policy set, not just the Default; the Default is not exclusively for MAB. Option C is wrong because the Default policy set handles all types of traffic, not just ISE internal traffic; internal traffic is typically handled by specific policy sets or system configurations. Option D is wrong because the Default policy set can be modified (e.g., you can change its conditions or authorization policies), though it cannot be deleted.

Practice this question →
46
MCQhard

You are configuring a policy to block access for non-compliant devices. Where do you configure the posture status as a policy condition?

A.Authentication Policy
B.Authorization Policy
C.Endpoint Group
D.Identity Source
AnswerB

The Authorization Policy holds posture conditions, letting you permit or deny based on device compliance status. Configuring posture there enforces the block for non-compliant devices at the policy evaluation point, which is exactly the condition the scenario requires.

Why this answer

Posture status (e.g., Compliant, Non-Compliant, Unknown) is evaluated as a condition within the Authorization Policy, where ISE checks the posture result and applies the appropriate authorization profile — such as a quarantine VLAN or restricted dACL for non-compliant devices. The Authorization Policy is the correct location because posture is an authorization-time attribute, not an authentication-time one.

Exam trap

SISE often tests the confusion between authentication and authorization policies — candidates incorrectly assume posture (a post-authentication attribute) belongs in the Authentication Policy.

How to eliminate wrong answers

Option A is wrong because the Authentication Policy determines how the user/device is authenticated (e.g., 802.1X, MAB, web auth) and does not evaluate posture status. Option C is wrong because Endpoint Groups are used for profiling classification and identity grouping, not for posture-based access decisions. Option D is wrong because Identity Sources define where credentials are validated (AD, LDAP, internal users), not posture conditions.

Practice this question →
47
MCQhard

A customer needs to block access to a specific server subnet for all employees except the IT department. Which method is most scalable using Cisco TrustSec?

A.Configure individual dACLs for every employee
B.Hardcode ACLs on every access switch
C.Assign SGTs to the server subnet and the IT group, then apply an SGACL
D.Use standard RADIUS VLAN steering
AnswerC

Assigning security group tags to both the server subnet and the IT group lets Cisco TrustSec enforce access through a single SGACL, rather than maintaining per-subnet ACLs on every device. This satisfies the scalability constraint: group membership, not IP addressing, drives enforcement, so adding employees or servers requires no new rules.

Why this answer

Cisco TrustSec uses Security Group Tags (SGTs) and Security Group ACLs (SGACLs) to enforce policy based on group membership rather than IP addresses. Assigning an SGT to the server subnet and an SGT to the IT group, then applying an SGACL that permits IT-to-server and denies everyone else, is the most scalable approach because the policy is defined once and enforced across all TrustSec-enabled devices. This avoids per-device or per-user ACL maintenance.

Exam trap

SISE often tests the scalability advantage of TrustSec over traditional ACLs — candidates may choose dACLs or VLAN steering because they are familiar, but the question emphasizes 'most scalable' and 'specific server subnet' which points to SGT/SGACL.

How to eliminate wrong answers

Option A is wrong because configuring individual dACLs for every employee is not scalable — it requires a unique ACL per user and does not leverage group-based policy. Option B is wrong because hardcoding ACLs on every access switch is operationally intensive and error-prone, and it does not scale as the network grows. Option D is wrong because standard RADIUS VLAN steering only places users into VLANs; it does not provide the granular group-based filtering needed to block access to a specific server subnet while allowing IT.

Practice this question →
48
MCQmedium

When using TACACS+ for device administration, which result object is used to define the privilege level of the user?

A.Command Set
B.Shell Profile
C.Authorization Profile
D.Device Administration Policy
AnswerB

The shell profile result object carries the TACACS+ privilege level (priv-lvl) returned in the authorisation response, determining the CLI privilege the user receives after authentication. It satisfies the stem's requirement because device administration privilege is conveyed through this attribute, not through the authentication reply itself.

Why this answer

In Cisco ISE TACACS+ device administration, the Shell Profile is the result object that defines the privilege level (e.g., Privilege Level 15) assigned to a user after successful authentication and authorization. It is referenced within an Authorization Policy rule and returned as an AV-pair (such as shell:priv-lvl=15) to the network device, which then enforces the user's CLI privilege.

Exam trap

SISE often tests the distinction between the Shell Profile (which carries the privilege level AV-pair) and the Authorization Profile (which references it) — candidates frequently pick Authorization Profile thinking it directly sets privilege.

How to eliminate wrong answers

Option A is wrong because a Command Set defines which individual commands (permit/deny) a user may execute, not the overall privilege level. Option C is wrong because an Authorization Profile is a broader container that bundles shell profiles, command sets, and other attributes — it does not itself define the privilege level. Option D is wrong because Device Administration Policy is the overall policy framework (the rule set), not a result object that carries the privilege value.

Practice this question →
49
MCQhard

A network administrator is implementing a TACACS+ command authorization policy on Cisco ISE for a group of network devices. The administrator wants to allow users in the 'NetOps' group to execute only 'show' commands and deny all other commands. The policy set for TACACS+ device administration is already configured with the correct conditions. Where in ISE should the administrator define the permitted commands and associate them with the 'NetOps' group?

A.In the External Identity Source configuration for the 'NetOps' group, add the permitted commands as attributes.
B.In the Authorization Policy, create a rule that references a Command Set containing the permitted 'show' commands, and set the condition to match the 'NetOps' group.
C.In the TACACS+ Command Authorization settings under Device Administration, create a command set and assign it directly to the user's group.
D.In the Policy Set's Allowed Protocols section, enable TACACS+ and specify the allowed command list.
AnswerB

In TACACS+ command authorization, the permitted commands are defined in a Command Set, which is then referenced in an Authorization Policy rule. The rule's condition matches the user's group, such as 'NetOps'. This ensures that only the commands in the Command Set are allowed, and all others are denied by default. This is the correct location to define and associate command permissions.

Why this answer

For TACACS+ command authorization in Cisco ISE, you define a Command Set that lists the allowed commands, and then reference that Command Set in an Authorization Policy rule. The rule's condition matches the user's group, such as 'NetOps'. This approach ensures that only the commands in the Command Set are permitted, and any command not explicitly allowed is denied.

The other options describe incorrect locations or methods for defining command permissions.

Exam trap

The trap here is confusing the TACACS+ command authorization configuration area with the Authorization Policy, where command sets are actually referenced and applied.

Practice this question →
50
Multi-Selecthard

Which TWO of the following are true regarding the order of operations in Cisco ISE policy evaluation?

Select 2 answers
A.All policy sets are evaluated simultaneously
B.Policy sets are evaluated from top to bottom based on the list order
C.Authorization policies are evaluated before authentication policies
D.Authorization rules are evaluated from top to bottom
E.The default policy set can be deleted
AnswersB, D

Cisco ISE processes policy sets sequentially in their configured list order, so the first matching set wins and subsequent sets are skipped. This top-to-bottom evaluation satisfies the ordering constraint, meaning set placement directly determines which authentication and authorisation logic applies to a request.

Why this answer

Option B is correct because Cisco ISE evaluates policy sets sequentially in the order they appear in the Policy Sets list, from top to bottom, and stops at the first policy set whose conditions match the request. Option D is correct because within a matched policy set, authorization rules are also evaluated top to bottom, and the first rule whose conditions match is applied (unless the rule is configured to continue). Option A is wrong because policy sets are not evaluated simultaneously; ISE processes them in a defined sequential order.

Option C is wrong because authentication policies are always evaluated before authorization policies within a policy set—a user must be authenticated before authorization rules can be applied. Option E is wrong because the default policy set in Cisco ISE cannot be deleted, ensuring there is always a fallback for unmatched requests.

Exam trap

The trap here is assuming that policy sets or authorization rules are evaluated in parallel or that authorization precedes authentication. Candidates might also think the default policy set can be deleted, but it is a permanent fixture in ISE.

Practice this question →
51
MCQeasy

Which option in the Cisco ISE Authorization Policy allows you to set a specific VLAN for a wireless client?

A.Policy Set Condition
B.Authorization Profile
C.Identity Source Sequence
D.Authentication Policy
AnswerB

The Authorization Profile is the reusable object that carries VLAN and other attributes, which ISE returns in the RADIUS Access-Accept once a matching authorization rule fires. Referencing it in the policy satisfies the stem's requirement to assign a specific VLAN to the wireless client.

Why this answer

The Authorization Profile in Cisco ISE is where you set attributes like VLAN assignment, dACL, SGT, and reauthentication timers that are returned to the NAD after successful authorization. For wireless clients, the VLAN is typically delivered via RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) configured in the Authorization Profile.

Exam trap

The trap is confusing the Authorization Policy with the Authentication Policy — VLAN assignment is an authorization result, so it belongs in the Authorization Profile, not in authentication or policy set conditions.

How to eliminate wrong answers

Option A is wrong because Policy Set Conditions determine which policy set applies to a session (based on attributes like SSID or location) but do not carry VLAN assignment values. Option C is wrong because Identity Source Sequences define the order in which identity stores are queried during authentication, not authorization results. Option D is wrong because the Authentication Policy determines how the user or device is authenticated (e.g., which protocol and identity store), not what VLAN they receive.

Practice this question →
52
Multi-Selectmedium

Which TWO of the following are valid locations to check for policy match results in ISE?

Select 2 answers
A.Device Administration console
B.Live Logs
C.Identity Group properties
D.Policy Simulation tool
E.RADIUS Secret settings
AnswersB, D

Live Logs display authentication and authorisation events in real time, including the matched policy set, matched authorisation rule and final result for each session. This makes them a valid location to check policy match results, satisfying the stem's requirement.

Why this answer

Option B (Live Logs) is correct because ISE's Live Logs (Operations > Live Logs / RADIUS Live Logs) display real-time authentication and authorization results, including which policy set, authentication rule, and authorization rule matched for each session. Option D (Policy Simulation tool) is correct because the Policy Simulation tool lets you run a simulated authentication/authorization request and shows the exact policy match results, including the matched policy set and rules, without affecting live traffic. Option A (Device Administration console) is incorrect because it is a TACACS+ management area for device administration, not a location for viewing policy match results.

Option C (Identity Group properties) is incorrect because identity groups only define group membership and attributes, not policy evaluation results. Option E (RADIUS Secret settings) is incorrect because it only configures the shared secret used between the NAD and ISE, not policy match outcomes.

Exam trap

The trap is that candidates might think policy match results are only visible in Live Logs, but the Policy Simulation tool also provides this information, and the question asks for TWO valid locations.

Practice this question →
53
MCQmedium

When a device connects to a port, it is put into 'Monitoring Mode'. What is the purpose of this state?

A.To force the port to shutdown
B.To provide internet access to guests
C.To perform vulnerability scanning
D.To test the policy before enforcing access control
AnswerD

Monitoring Mode lets Cisco ISE evaluate a device against policy and log the resulting authorisation decision without applying enforcement, such as a downloadable ACL or VLAN change. This satisfies the stem's requirement to test policy safely before enabling enforcement, revealing misconfigurations or profiling gaps while the port still permits traffic.

Why this answer

Monitoring Mode in Cisco ISE is a deployment phase where the switch port is configured to authenticate and authorize endpoints but does not enforce the result. The purpose is to test policies and gather data without impacting network access, allowing administrators to validate configurations before moving to enforcement. Thus, the correct answer is to test the policy before enforcing access control.

Exam trap

The trap is confusing Monitoring Mode with enforcement modes, leading candidates to think it blocks or remediates, when it only observes.

How to eliminate wrong answers

Option A is wrong because Monitoring Mode does not shut down the port; it allows traffic to flow. Option B is wrong because providing internet access to guests is not the purpose of Monitoring Mode; guest access is a separate feature. Option C is wrong because vulnerability scanning is not performed in Monitoring Mode; that is a function of posture assessment or dedicated scanners.

Practice this question →
54
Multi-Selectmedium

Which THREE of the following are found in an Authorization Profile's 'Advanced Attributes'?

Select 3 answers
A.Vendor Specific Attributes (VSAs)
B.Custom RADIUS attributes
C.Policy Set conditions
D.Device admin rules
E.Attribute name/value pairs
AnswersA, B, E

Vendor Specific Attributes appear under Advanced Attributes because they extend RADIUS beyond standard IETF dictionaries, letting Cisco ISE return vendor-defined values such as Cisco-AVPair. This satisfies the stem's requirement for attributes carried in the profile's advanced section rather than the common authentication or authorisation fields.

Why this answer

In Cisco ISE, an Authorization Profile's Advanced Attributes section is where you define RADIUS return attributes that are not part of the standard simple attribute list. Option A is correct because Vendor Specific Attributes (VSAs), such as Cisco-AVPair or other vendor-defined RADIUS attributes, are configured there to send vendor-specific authorization data to the NAD. Option B is correct because Custom RADIUS attributes (user-defined RADIUS dictionary attributes) are also added through Advanced Attributes.

Option E is correct because the Advanced Attributes area lets you specify attribute name/value pairs (for example, cisco-av-pair = ...) that are returned in the Access-Accept. Option C is not correct because Policy Set conditions are evaluated in the policy set's authentication/authorization rules, not inside an Authorization Profile. Option D is not correct because Device Admin rules are a separate policy construct for TACACS+ device administration, not an Authorization Profile advanced attribute.

Exam trap

SISE often tests whether candidates confuse policy-level constructs (conditions, device admin rules) with result-level payloads — Advanced Attributes is strictly about what gets returned in the RADIUS response, not how the rule is matched.

Practice this question →
55
Multi-Selecthard

Which TWO of the following steps are required to implement SGT-based enforcement using an SXP connection?

Select 2 answers
A.Apply a dACL to every port
B.Define the SGT mapping in the ISE TrustSec configuration
C.Enable TACACS+ on the NAD
D.Configure the SXP connection between the ISE node and the NAD
E.Enable 802.1X on all switch ports
AnswersB, D

Defining SGT mappings in ISE TrustSec configuration is essential because SXP propagates these group assignments to enforcement devices. Without the mapping, ISE cannot translate source identities into SGT values, so the SXP connection has nothing to publish. This satisfies the requirement for SGT-based enforcement by establishing the authoritative tag-to-identity bindings.

Why this answer

To implement SGT-based enforcement over an SXP connection, you must first define the SGT mapping in the ISE TrustSec configuration (option B), because ISE needs the IP-to-SGT bindings that it will propagate to the network device. You must also configure the SXP connection between the ISE node and the NAD (option D), since SXP is the protocol that carries those SGT-to-IP mappings from ISE to the switch or router that enforces the tags. Applying a dACL to every port (option A) is not required for SGT propagation and is a separate enforcement mechanism.

Enabling TACACS+ on the NAD (option C) is for device administration/AAA, not for SXP-based SGT transport. Enabling 802.1X on all switch ports (option E) is an authentication method and is not mandatory for SXP-based SGT enforcement.

Exam trap

The trap is confusing SGT propagation mechanisms — candidates may pick 802.1X or dACL options because they associate SGTs with those features, but SXP specifically requires the SGT mapping definition and the SXP connection, nothing more.

Practice this question →
56
MCQmedium

When configuring a policy set, which attribute is most commonly used to distinguish between a Wired and Wireless request?

A.Framed-IP-Address
B.NAS-Port-Type
C.Calling-Station-ID
D.Device-Name
AnswerB

NAS-Port-Type is a RADIUS attribute carried in the Access-Request that identifies the physical port category, such as Ethernet or Wireless-IEEE-802.11. Policy sets match on it to route wired and wireless requests down separate rule branches, satisfying the requirement to distinguish access medium.

Why this answer

The NAS-Port-Type RADIUS attribute (attribute 61) identifies the physical port type used by the network access server (NAS) to authenticate the user. Common values include Ethernet (15) for wired and Wireless-IEEE-802.11 (19) for wireless. ISE policy sets commonly use this attribute to differentiate between wired and wireless requests because it is sent by the NAD in the Access-Request and reliably indicates the access medium.

Exam trap

SISE often tests the confusion between attributes that identify the device versus those that identify the access method; candidates may pick Calling-Station-ID because it contains the MAC address, but that does not indicate wired vs. wireless.

How to eliminate wrong answers

Option A is wrong because Framed-IP-Address (attribute 8) indicates the IP address assigned to the user, not the access type; it is often absent in the initial Access-Request. Option C is wrong because Calling-Station-ID (attribute 31) typically contains the client's MAC address or phone number, which does not distinguish wired from wireless. Option D is wrong because Device-Name is not a standard RADIUS attribute; it may refer to a NAD's name but is not used for access type differentiation.

Practice this question →
57
MCQeasy

In the ISE Policy Set, which component is used to define the user credentials' verification method?

A.Policy Set Condition
B.Authentication Policy
C.Result Profile
D.Authorization Policy
AnswerB

Within the ISE policy set, the authentication policy defines how user credentials are verified, specifying the allowed authentication protocols and identity sources. It therefore determines the verification method, satisfying the stem's requirement for credential verification.

Why this answer

The Authentication Policy within an ISE Policy Set defines the method used to verify user credentials — for example, whether ISE uses an internal identity store, Active Directory, LDAP, or a certificate-based method. It answers the 'how are credentials validated' question, whereas the Authorization Policy answers 'what is the user allowed to do' after authentication succeeds.

Exam trap

SISE often tests the distinction between Authentication Policy (verifies who you are) and Authorization Policy (decides what you can do) — candidates frequently swap these two because both live inside the same Policy Set.

How to eliminate wrong answers

Option A is wrong because Policy Set Conditions only determine which Policy Set a request matches (based on attributes like device type, location, or SSID) — they do not verify credentials. Option C is wrong because a Result Profile is the authorization outcome (VLAN, dACL, SGT, etc.) applied after a successful authorization decision, not a credential verification method. Option D is wrong because the Authorization Policy evaluates identity and posture attributes to grant access rights, but it does not perform the actual credential verification step.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Policy Enforcement questions.

Start 20-question session