How should I use these Policy Enforcement practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Policy Enforcement questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Policy Enforcement domain.

SISE · topic practice

Policy Enforcement practice questions

Policy Enforcement on 300-715 covers how ISE turns authentication into access control: policy sets, authorization rules, authorization profiles, downloadable ACLs, and TrustSec SGT/SGACL enforcement. Questions test menu paths, default policy set behavior, dACL syntax, and the components that make up a Security Group policy decision.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Policy Enforcement

Practice 10 questions Browse domain →

What the exam tests

What to know about Policy Enforcement

Be able to build a policy set, add authorization rules, and attach an authorization profile that pushes a dACL, VLAN, or SGT. The critical detail is dACL ordering: deny the target subnet first, then permit everything else, remembering the implicit deny.

Ordered evaluation of policy sets and authorization rules, including the Default policy set fallback behavior

Authorization Profile configuration under Policy > Policy Elements > Results, including dACL and VLAN attributes

dACL syntax with permit/deny ACEs and the implicit deny ip any any terminal line

TrustSec Security Group components: SGT classification, SGACL enforcement, and SXP or inline tagging propagation

Watch out for

Common Policy Enforcement exam traps

▸Forgetting that a dACL ends with an implicit deny, so a final permit ip any any is required to allow remaining traffic
▸Assuming the Default policy set can be deleted; it is the fallback and cannot be removed
▸Confusing authorization profiles (results) with authorization policy rules (conditions), and editing the wrong object

Practice set

Policy Enforcement questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Open the full VLAN trunking answer →

When configuring a RADIUS authorization policy for a dot1x deployment, which TWO attributes are commonly used to assign a dynamic VLAN?

Trap 1: Service-Type equals Framed

Generic attribute, not specific to VLANs.

Trap 2: Framed-IP-Address

Used for IP allocation, not VLAN assignment.

Trap 3: Cisco-AV-Pair

Used for custom attributes, but not the standard way to set a VLAN.

Study all Policy Enforcement common traps →

A
Service-Type equals Framed
Why it fails: Generic attribute, not specific to VLANs.
B
Framed-IP-Address
Why it fails: Used for IP allocation, not VLAN assignment.
C
Tunnel-Type equals VLAN
Mandatory to define the tunnel type.
D
Tunnel-Medium-Type equals 802
Mandatory to specify the medium type for the tunnel.
E
Cisco-AV-Pair
Why it fails: Used for custom attributes, but not the standard way to set a VLAN.

Policy Enforcement practice questions

What to know about Policy Enforcement

Common Policy Enforcement exam traps

Policy Enforcement questions

When configuring a RADIUS authorization policy for a dot1x deployment, which TWO attributes are commonly used to assign a dynamic VLAN?

When configuring dACLs for enforcement on Cisco IOS switches, which TWO of the following are true regarding the behavior of the dACL downloaded from Cisco ISE?

You are implementing Cisco TrustSec and need to restrict traffic between two different SGTs on a Cisco Catalyst switch. Which policy component enforces this communication restriction?

An administrator needs to implement SGT-based access control where SGT 10 (Finance) cannot communicate with SGT 20 (HR). What is the mandatory prerequisite on the ISE policy side?

A network administrator needs to ensure that wired 802.1X devices are assigned a specific VLAN based on their AD group membership. Which component in the ISE Policy Set should be configured to map the AD group to a specific VLAN assignment?

You are configuring a policy set for wireless guest access and need to ensure that the authorization policy only triggers if the user has successfully authenticated via the Guest portal. Which condition should you use?

Which attribute is used to enforce dACLs on a Cisco Catalyst switch from ISE?

Which of the following is a valid condition for an ISE Authorization Policy?

Which of the following is NOT a standard RADIUS attribute type used in ISE?

Which of the following is a key requirement for dACL enforcement on a Cisco switch?

What does the 'Fallthrough' option in an ISE Policy Set rule do?

Which TWO of the following are valid ways to assign a VLAN in an ISE Authorization Profile?

Which THREE of the following are required to successfully implement SXP (SGT Exchange Protocol)?

Which THREE of the following are valid Policy Set conditions?

Which THREE of the following are necessary to configure CWA (Centralized Web Authentication)?

Which TWO of the following are steps to handle a user authentication failure in ISE?

You are implementing SGT-based enforcement on a Catalyst switch. The switch is not correctly applying the SGACLs. What is the first step you should verify on the Cisco ISE side to ensure the SGT is being correctly communicated?

You are troubleshooting a scenario where an SGT is not being assigned to a session. You notice the Authorization Profile is correctly configured. What must be configured on the Network Access Device (NAD) to allow the SGT to be learned from the RADIUS Access-Accept?

When creating a Policy Condition in Cisco ISE, which attribute is most commonly used to identify a user's location?

Which THREE attributes can be used within a Cisco ISE Authorization Policy condition?

Track your progress over time

Start a Policy Enforcement only practice session

Related SISE topic practice pages

Architecture And Deployment practice questions

BYOD practice questions

Endpoint Compliance practice questions

Web Auth And Guest Services practice questions

Network Access Device Administration practice questions

Profiler practice questions

Policy Enforcement practice questions

SISE fundamentals practice questions

SISE scenario practice questions

SISE troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid