Scenario practice questions

You are troubleshooting a scenario where an Android device is unable to complete the BYOD onboarding flow. You suspect the issue is with the supplicant provisioning wizard. Which tool should you use to verify if the provisioning payload was actually generated?

Trap 1: Administration > System > Settings > Proxy

Proxy settings are for outbound ISE communication, not provisioning payload status.

Trap 2: Operations > Troubleshoot > TCP Dump

TCP dump shows packet flow, not the generation of provisioning payloads.

Trap 3: Policy > Policy Elements > Conditions > Other > BYOD

This is for defining conditions, not checking the status of resources.

A
Work Centers > BYOD > Client Provisioning
This area displays the provisioning rules and the status of resources available for different device types.
B
Administration > System > Settings > Proxy
Why wrong: Proxy settings are for outbound ISE communication, not provisioning payload status.
C
Operations > Troubleshoot > TCP Dump
Why wrong: TCP dump shows packet flow, not the generation of provisioning payloads.
D
Policy > Policy Elements > Conditions > Other > BYOD
Why wrong: This is for defining conditions, not checking the status of resources.

Question 2mediummultiple choice

You are deploying a Posture agent using the Web Agent. Which mechanism does the Web Agent use to perform compliance checks on a Windows machine?

Trap 1: It performs deep packet inspection to determine compliance.

Posture assessment is host-based, not network-based packet inspection.

Trap 2: It requires the full AnyConnect VPN client to be pre-installed.

The purpose of the Web Agent is to assist in the initial posture check before the full agent might be fully provisioned.

Trap 3: It communicates directly with the Microsoft Update server.

The agent communicates with ISE, not third-party update servers for assessment.

A
It performs deep packet inspection to determine compliance.
Why wrong: Posture assessment is host-based, not network-based packet inspection.
B
It requires the full AnyConnect VPN client to be pre-installed.
Why wrong: The purpose of the Web Agent is to assist in the initial posture check before the full agent might be fully provisioned.
C
It communicates directly with the Microsoft Update server.
Why wrong: The agent communicates with ISE, not third-party update servers for assessment.
D
It relies on WMI calls initiated by the ISE server.
Why wrong: ISE does not perform direct WMI scans of endpoints for posture; it relies on the agent providing that information.
E
It uses a temporary ActiveX or Java component to scan the system.
The Web Agent relies on browser-based plugins or temporary executables to facilitate basic posture checks before full agent deployment.

Study the full AAA explanation →

Question 3hardmultiple choice

You are troubleshooting a scenario where an SGT is not being assigned to a session. You notice the Authorization Profile is correctly configured. What must be configured on the Network Access Device (NAD) to allow the SGT to be learned from the RADIUS Access-Accept?

Trap 1: Set the switch port to trunk mode

Trunking is for VLANs, not SGT enforcement.

Trap 2: Enable Device Tracking

Device tracking is for IP-to-MAC mapping, not SGTs.

Trap 3: Enable 802.1X globally

802.1X is for authentication, not SGT assignment.

A
Set the switch port to trunk mode
Why wrong: Trunking is for VLANs, not SGT enforcement.
B
Enable Device Tracking
Why wrong: Device tracking is for IP-to-MAC mapping, not SGTs.
C
Enable 802.1X globally
Why wrong: 802.1X is for authentication, not SGT assignment.
D
Configure the CTS environment to support SGTs
The NAD must be CTS-aware and configured to accept SGTs from the AAA server.

Question 4hardmultiple choice

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

Trap 1: The Guest user group is missing from the Policy Set.

This would prevent authentication, not the session state transition.

Trap 2: The Redirect ACL is applied to the wrong interface.

This would prevent initial redirection entirely.

Trap 3: The portal URL is incorrect.

If the portal URL were incorrect, the user would never have reached the portal.

A
The NAD is missing the 'aaa server radius dynamic-author' configuration.
CoA requires this configuration on the switch to listen for ISE's re-authentication request.
B
The Guest user group is missing from the Policy Set.
Why wrong: This would prevent authentication, not the session state transition.
C
The Redirect ACL is applied to the wrong interface.
Why wrong: This would prevent initial redirection entirely.
D
The portal URL is incorrect.
Why wrong: If the portal URL were incorrect, the user would never have reached the portal.

Question 5hardmultiple choice

You are troubleshooting a scenario where guest users are not being redirected when connecting to an open SSID. The WLC reports that the client is stuck in the 'Webauth' state but the portal never loads. Which component should you verify first?

Trap 1: Increase the idle timeout on the WLC's WLAN configuration.

Idle timeout settings affect session termination, not the initial portal redirection process.

Trap 2: Verify the WLC's 'Web Auth Redirect' configuration and ensure the…

While important, the most frequent point of failure in CWA redirection is the client's inability to resolve the ISE FQDN.

Trap 3: Re-import the Guest Portal certificate on the WLC.

The WLC does not require the ISE portal certificate for the initial redirect handshake.

A
Increase the idle timeout on the WLC's WLAN configuration.
Why wrong: Idle timeout settings affect session termination, not the initial portal redirection process.
B
Verify the WLC's 'Web Auth Redirect' configuration and ensure the 'Virtual Gateway' address is reachable.
Why wrong: While important, the most frequent point of failure in CWA redirection is the client's inability to resolve the ISE FQDN.
C
Re-import the Guest Portal certificate on the WLC.
Why wrong: The WLC does not require the ISE portal certificate for the initial redirect handshake.
D
Check if the client can resolve the ISE FQDN via DNS.
For the redirect to occur, the client must be able to resolve the ISE FQDN to an IP address; otherwise, the browser will timeout.

Question 6hardmultiple choice

You are troubleshooting a scenario where an admin cannot execute a specific command despite the Command Set having 'Permit' for that command. What is a common reason?

Trap 1: The ISE Policy Set has 'Deny' as the default

If it matched the command set, the policy set is irrelevant to the command execution logic.

Trap 2: The user is in the wrong AD group

If they reached the command set, auth was fine.

Trap 3: The TACACS+ shared secret is incorrect

The session would not have established.

A
The ISE Policy Set has 'Deny' as the default
Why wrong: If it matched the command set, the policy set is irrelevant to the command execution logic.
B
The user is in the wrong AD group
Why wrong: If they reached the command set, auth was fine.
C
The TACACS+ shared secret is incorrect
Why wrong: The session would not have established.
D
The command is blocked by the switch's local configuration
The switch's own parser can block commands if the privilege level is insufficient.

Question 7hardmultiple choice

You want to enforce a policy where personal devices are allowed access, but only if they are not jailbroken. How is this achieved in a BYOD scenario?

Trap 1: Use ISE profiling only

Profiling cannot detect OS-level jailbreaking.

Trap 2: Use an ACL on the switch

ACLs manage traffic flow, not device integrity.

Trap 3: Configure a WLC-based check

WLCs do not perform device health checks.

A
Use ISE profiling only
Why wrong: Profiling cannot detect OS-level jailbreaking.
B
Use an ACL on the switch
Why wrong: ACLs manage traffic flow, not device integrity.
C
Configure a WLC-based check
Why wrong: WLCs do not perform device health checks.
D
Integrate an MDM that performs jailbreak detection
MDM is the only component capable of deep device health checks like jailbreak detection.