Courseiva

CCNA Web Auth And Guest Services Questions

34 questions · Web Auth And Guest Services topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

In a CWA scenario, the user is redirected to the portal, authenticates, but the session is not transitioning from the 'redirected' state to the 'authenticated' state. What is the most likely cause?

A.The NAD is missing the 'aaa server radius dynamic-author' configuration.
B.The Guest user group is missing from the Policy Set.
C.The Redirect ACL is applied to the wrong interface.
D.The portal URL is incorrect.
AnswerA

Dynamic authorisation (CoA) lets the NAD accept change-of-authorisation packets from the RADIUS server. Without 'aaa server radius dynamic-author', the switch cannot process the CoA that moves the session from redirected to authenticated after portal login.

Why this answer

In a CWA (Central Web Authentication) flow, after the user authenticates on the portal, ISE must send a Change of Authorization (CoA) to the NAD to move the session from redirected to authenticated. This requires the NAD to be configured with the 'aaa server radius dynamic-author' command so it can accept CoA requests from ISE. Without it, the NAD ignores the CoA and the session remains in the redirected state.

Exam trap

SISE often tests the CWA post-authentication CoA requirement, and candidates frequently blame the portal or policy set instead of the NAD's missing dynamic-author configuration, which is the actual cause of a stuck redirected session.

How to eliminate wrong answers

Option B is wrong because a missing Guest user group in the Policy Set would cause authentication to fail entirely, not a successful authentication with a stuck redirected state. Option C is wrong because a misapplied Redirect ACL would prevent the initial redirect to the portal, not the post-authentication transition. Option D is wrong because an incorrect portal URL would prevent the user from reaching the portal at all, not cause a post-authentication state transition failure.

Practice this question →
2
Multi-Selectmedium

Which THREE of the following are required components to successfully implement Central Web Authentication (CWA) with a Cisco WLC?

Select 3 answers
A.A static IP address assigned to all guest clients.
B.A URL Redirect ACL defined on the WLC.
C.An Authorization Profile with 'Web Redirection' enabled.
D.An ISE Authorization Policy rule that returns the redirection profile.
E.A redirection policy in the WLC's WLAN configuration.
AnswersB, C, D

CWA intercepts the client's initial HTTP request and redirects it to the centralised web portal for authentication. The URL redirect ACL on the WLC defines which traffic is intercepted and redirected, while permitting the portal and DNS traffic to pass, so it is a mandatory component.

Why this answer

Central Web Authentication (CWA) on a Cisco WLC requires the WLC to redirect unauthenticated clients to ISE's guest portal, which is accomplished by defining a URL Redirect ACL on the WLC (option B) that matches HTTP/HTTPS traffic and permits DNS and the ISE portal; this ACL is referenced in the WLAN's Layer 3 security configuration so the WLC knows which traffic to intercept. On the ISE side, an Authorization Profile with 'Web Redirection' enabled (option C) supplies the redirect URL and the name of the redirect ACL that must match the WLC's ACL, and an ISE Authorization Policy rule that returns that redirection profile (option D) is what actually triggers the redirect for the MAB-authenticated endpoint before full 802.1X/guest authentication completes. Options A and E are not required: CWA relies on DHCP-assigned addresses rather than static IPs on guest clients, and the redirection is driven by the ISE authorization result plus the WLC redirect ACL, not by a separate 'redirection policy' in the WLAN configuration.

Exam trap

SISE often tests the specific components of CWA — candidates may include WLAN-level redirection policies or static IPs, but the correct trio is URL Redirect ACL, Authorization Profile with Web Redirection, and an ISE Authorization Policy rule returning that profile.

Practice this question →
3
MCQmedium

A network administrator is deploying a guest wireless network using Cisco ISE. They want guests to authenticate through a web portal, but they do not want guests to have to create their own accounts. Instead, they want employees to pre-create guest accounts and provide credentials to visitors. Which ISE feature should the administrator configure to enable this workflow?

A.Sponsor portal
B.Hotspot portal
C.Device registration portal
D.Self-registration guest portal
AnswerA

The sponsor portal allows authorized employees (sponsors) to create and manage guest accounts in advance. Sponsors can generate credentials and provide them to visitors. This matches the requirement of employees pre-creating guest accounts. Thus, configuring the sponsor portal is the correct solution.

Why this answer

The sponsor portal is specifically designed for sponsors to create and manage guest accounts. It enables employees to pre-create accounts and provide credentials to guests, which matches the requirement. Other portal types like self-registration or hotspot do not involve sponsors in account creation.

Therefore, the sponsor portal is the correct configuration.

Exam trap

The trap here is confusing the sponsor portal with the self-registration portal, which allows guests to create their own accounts.

Practice this question →
4
MCQmedium

A guest user reports they receive a certificate warning when redirected to the ISE Guest portal. What is the most common cause of this issue?

A.The ISE portal is configured for HTTP instead of HTTPS.
B.The DNS server is not resolving the ISE FQDN.
C.The ISE server certificate is self-signed or not trusted by the client device.
D.The switch is not configured for SSL interception.
AnswerC

Guest portal redirection presents the ISE server certificate to the client browser. If that certificate is self-signed or issued by a CA the client does not trust, the TLS handshake triggers a warning. Replacing it with a CA-signed certificate trusted by client devices resolves the warning.

Why this answer

The most common cause of certificate warnings on the ISE Guest portal is that the ISE server is using a self-signed certificate or a certificate not trusted by the client's browser trust store. Browsers will display a warning when the certificate chain cannot be validated against a trusted CA. Replacing the default self-signed certificate with a CA-signed certificate whose SAN matches the portal FQDN resolves the warning.

Exam trap

SISE often tests the difference between certificate trust issues and DNS/HTTP misconfigurations — candidates may pick DNS or HTTP options, but a certificate warning specifically points to a TLS trust problem, not connectivity.

How to eliminate wrong answers

Option A is wrong because if the portal were configured for HTTP instead of HTTPS, the user would not receive a certificate warning at all — there would be no TLS handshake. Option B is wrong because a DNS resolution failure would result in a 'page cannot be reached' or timeout error, not a certificate warning; the browser would never reach the TLS stage. Option D is wrong because SSL interception is not a switch function in this context, and even if it were, it would not be the typical cause of a guest portal certificate warning; the issue is server certificate trust.

Practice this question →
5
MCQmedium

You are troubleshooting a Guest flow where the client hits the portal but cannot authenticate. You notice the MAC address is not being cached properly. Which setting in the Guest Portal configuration is responsible for enabling MAC caching?

A.Enable Auto-Login
B.Enable Guest Flow Bypass
C.Enable MAC Caching
D.Enable Device Registration
AnswerC

Enabling MAC Caching lets the guest portal cache the endpoint's MAC address after successful authentication, so returning clients bypass the portal. This directly satisfies the stem's requirement: the MAC address is not being cached, causing repeated authentication failures. The setting is the specific control governing that caching behaviour.

Why this answer

MAC caching in the ISE Guest Portal configuration allows the client's MAC address to be remembered after successful authentication, so subsequent connections bypass the portal and are authenticated automatically. If MAC caching is not enabled, the MAC address is not cached, and the client is forced to re-authenticate through the portal each time, which matches the reported symptom. Enabling MAC Caching in the Guest Portal settings resolves this.

Exam trap

SISE often tests the distinction between MAC caching, Auto-Login, and Device Registration — candidates may confuse these features, but only MAC Caching directly addresses caching the MAC address for guest re-authentication.

How to eliminate wrong answers

Option A is wrong because Auto-Login allows a previously authenticated user to be logged in automatically based on a cookie or credential, but it does not cache the MAC address; it's a different mechanism. Option B is wrong because Guest Flow Bypass is not a standard ISE Guest Portal setting for MAC caching; it may refer to bypassing the guest flow entirely, which is not the issue. Option D is wrong because Device Registration is for registering devices for BYOD or posture, not for caching MAC addresses for guest re-authentication.

Practice this question →
6
MCQmedium

A network administrator needs to implement self-registered guest access where the guest must provide an email address for validation. Which feature in the Guest Portal settings allows for this?

A.Registration Form settings.
B.Authentication Policy rules.
C.Guest Type settings.
D.Device Registration settings.
E.Sponsor Group settings.
AnswerA

Registration Form settings let you enable self-registration and require specific fields, such as email address, before a guest is validated. This directly satisfies the stem's constraint that guests self-register and supply an email address for validation, rather than relying on sponsor-created or pre-populated accounts.

Why this answer

The Registration Form settings in the ISE Guest Portal configuration control the fields presented to self-registering guests, including the option to require an email address for validation. Enabling the email field with validation forces guests to enter a valid email before the account is created and credentials are delivered. This is the specific portal-level feature that governs what data guests must supply during self-registration.

Exam trap

SISE often tests the distinction between portal presentation settings (Registration Form fields) and portal authorization settings (Guest Type, Sponsor Group), causing candidates to pick Guest Type when the question is really about what data the guest must supply.

How to eliminate wrong answers

Option B is wrong because Authentication Policy rules determine how credentials are validated (e.g., against the guest identity store), not what fields appear on the registration form. Option C is wrong because Guest Type settings define account duration, sponsor requirements, and login behavior, but not the registration form fields themselves. Option D is wrong because Device Registration settings apply to BYOD device onboarding portals, not guest self-registration email validation.

Option E is wrong because Sponsor Group settings control which sponsors can approve guests and their permissions, not the guest-facing registration form.

Practice this question →
7
Multi-Selecthard

Which THREE of the following are steps involved in the guest portal sponsor approval process?

Select 3 answers
A.The sponsor logs into the sponsor portal to review and approve the request.
B.The guest registers for an account on the self-registration portal.
C.The ISE automatically approves the account after 10 minutes.
D.The sponsor receives an automated email notification about the pending account.
E.The guest must physically visit the sponsor's office.
AnswersA, B, D

The sponsor authenticates to the sponsor portal and approves or denies the pending guest account there. This review action is the decision point of the workflow, converting the pending registration into an active account, and is distinct from the notification that merely prompts it.

Why this answer

In the Cisco ISE guest sponsor approval workflow, the process begins when the guest registers for an account on the self-registration portal (B), which creates a pending guest account that requires sponsor action. The sponsor then logs into the sponsor portal to review and approve the request (A), which is the core approval step that activates the guest account. The sponsor also receives an automated email notification about the pending account (D), alerting them that a guest is awaiting approval so they can act on it.

Option C is incorrect because ISE does not automatically approve accounts after 10 minutes; approval requires explicit sponsor action (or a configured automatic approval policy, not a fixed timer). Option E is incorrect because the entire sponsor approval process is performed through the portals and email notifications, with no requirement for the guest to physically visit the sponsor's office.

Exam trap

SISE often tests the sequence and actors in the sponsor approval flow — candidates add plausible but non-existent steps like auto-approval timers or in-person visits.

Practice this question →
8
MCQmedium

If you want a guest user to be automatically redirected to a specific webpage (e.g., company news) after a successful login, where is this configured?

A.In the Authorization Profile.
B.In the Guest Type configuration.
C.In the Redirect ACL on the NAD.
D.In the Guest Portal Settings under 'Post-Login' page.
AnswerD

The Guest Portal's Post-Login page holds the redirect URL applied after successful authentication, so guests land on the specified company news page. Configuring it there ties the redirect to the portal flow itself, rather than to authorisation policy or endpoint posture settings.

Why this answer

The post-login redirect URL for guest users is configured in the Guest Portal Settings under the 'Post-Login' page, where administrators specify the URL to which guests are redirected after successful authentication. This is a portal-level setting, not an authorization or NAD-level configuration, because the redirect is part of the web portal experience rather than the network enforcement.

Exam trap

The trap is conflating the NAD's pre-login redirect ACL (which forces users to the portal) with the portal's post-login redirect setting (which sends users to a landing page after authentication).

How to eliminate wrong answers

Option A is wrong because the Authorization Profile controls network-level attributes like VLAN, dACL, and SGT — it does not control web portal redirect behavior. Option B is wrong because Guest Type configuration defines account parameters (sponsor, duration, login options), not the post-login landing page. Option C is wrong because the Redirect ACL on the NAD controls which traffic is intercepted for redirection to the portal, not where the user lands after login.

Practice this question →
9
MCQmedium

Which guest portal type should you select if you want to allow users to connect to the network without any authentication, simply by clicking an 'Accept' button?

A.Sponsored Guest Portal
B.Guest Portal
C.Self-Registered Guest Portal
D.Hotspot Portal
AnswerD

The Hotspot Portal satisfies the no-authentication constraint by presenting a click-through Accept button, granting network access without credentials. Unlike the Sponsored-Guest or Self-Registered portals, which require sponsor approval or credential creation, the Hotspot flow performs no identity lookup against Microsoft Entra ID, so unauthenticated visitors gain access immediately.

Why this answer

The Hotspot Portal is specifically designed for unauthenticated guest access where users simply click an 'Accept' button (or similar) to acknowledge the acceptable use policy and gain network access. It requires no credentials, sponsorship, or self-registration, making it the correct choice for click-through access.

Exam trap

SISE often tests the differences between Hotspot, Self-Registered, and Sponsored portals, so candidates who confuse 'click-through' with 'self-registration' will pick the wrong portal type.

How to eliminate wrong answers

Option A is wrong because a Sponsored Guest Portal requires a sponsor to create credentials for the guest, which involves authentication. Option B is wrong because the generic 'Guest Portal' typically refers to a portal that requires login credentials (self-registered or sponsored). Option C is wrong because a Self-Registered Guest Portal requires the user to fill out a registration form and create an account, which is more than just clicking 'Accept'.

Practice this question →
10
MCQhard

A user is authenticating via the Sponsored Guest portal. After the sponsor approves the guest, the user still cannot access the network. What is the most common reason for this if the RADIUS flow is correct?

A.The NAD is not processing the CoA request sent by ISE.
B.The guest password has expired.
C.The guest account is not in the correct group.
D.The browser cache is preventing the redirect.
AnswerA

The CoA is necessary to change the authorization state from 'pending' to 'authorized'.

Why this answer

After a sponsor approves a guest, ISE must push a Change of Authorization (CoA) to the NAD to move the session from the restricted guest VLAN/ACL to the authorized state. If the NAD does not support, is not configured for, or rejects the CoA (RFC 5176), the guest remains in the limited-access state even though ISE shows the account as approved. This is the most common cause when the RADIUS authentication flow itself is working correctly.

Exam trap

SISE often tests the assumption that sponsor approval alone grants access, ignoring the CoA dependency — candidates forget that ISE must actively signal the NAD to change the session.

How to eliminate wrong answers

Option B is wrong because an expired password would cause authentication to fail outright, not a post-approval access issue. Option C is wrong because group membership is typically validated at authentication time; if the group were wrong, the initial login would fail or the sponsor flow would not complete. Option D is wrong because browser cache affects the redirect experience, not the enforcement of network access after approval.

Practice this question →
11
MCQeasy

Which portal is intended for guest users to manage their own registered devices, such as adding or removing their personal laptops?

A.My Devices Portal
B.Hotspot Portal
C.Sponsor Portal
D.Guest Portal
AnswerA

My Devices Portal lets guest users self-manage their registered devices, satisfying the stem's requirement that guests add or remove personal laptops themselves. It authenticates against Microsoft Entra ID and permits device registration, renaming, and removal without administrator involvement, unlike the Sponsor or Admin portals.

Why this answer

The My Devices Portal is specifically designed for end users (including guests) to self-register, add, and remove their personal devices, such as laptops and smartphones, without sponsor intervention. It provides a self-service interface for device management tied to the user's account.

Exam trap

SISE often tests the distinction between the Guest Portal (authentication entry), Sponsor Portal (sponsor-managed guest accounts), Hotspot Portal (click-through guest access), and My Devices Portal (self-service device registration), so candidates who pick the Guest Portal miss the self-service device management purpose.

How to eliminate wrong answers

Option B is wrong because the Hotspot Portal is used for guest access with a simple click-through or self-registration flow, not for managing registered devices. Option C is wrong because the Sponsor Portal is used by sponsors to create and manage guest accounts, not by guests to manage their own devices. Option D is wrong because the Guest Portal is the entry point for guest authentication and registration, not the self-service device management interface.

Practice this question →
12
Multi-Selecthard

Which THREE of the following are valid actions an administrator can take in the Sponsor Portal?

Select 3 answers
A.Change the global ISE logging level.
B.Create a new guest account.
C.Modify the existing portal theme.
D.Delete an existing guest account.
E.Extend the expiration time of a guest account.
AnswersB, D, E

Creating a guest account provisions a new sponsored identity with defined start and end times, which the Sponsor Portal supports. This satisfies the stem's requirement for valid administrator actions, since account creation is the portal's primary sponsor workflow.

Why this answer

The Sponsor Portal in Cisco ISE is designed for sponsor users to manage guest accounts, so option B (Create a new guest account) is correct because sponsors can provision new guest users directly from the portal. Option D (Delete an existing guest account) is correct because sponsors are permitted to remove guest accounts they manage, revoking access. Option E (Extend the expiration time of a guest account) is correct because sponsors can modify guest account settings, including extending the account's validity period.

Option A (Change the global ISE logging level) is not a Sponsor Portal function; logging levels are configured in the ISE GUI under Administration > System > Logging. Option C (Modify the existing portal theme) is also not a Sponsor Portal action; portal customization is performed by administrators in the ISE GUI under Guest Access > Portals & Components.

Exam trap

SISE often tests the boundary between sponsor-level actions and administrator-level actions, and candidates incorrectly include administrative tasks like changing logging levels or portal themes as sponsor capabilities.

Practice this question →
13
MCQmedium

You want to customize the guest portal so that it displays the company logo and specific terms of use. Where is this configuration performed within the Cisco ISE GUI?

A.Administration > System > Settings > Portal Configuration
B.Policy > Policy Elements > Results > Authorization > Authorization Profiles
C.Work Centers > Guest Access > Portals & Components
D.Operations > Troubleshoot > Diagnostic Tools
AnswerC

Guest portal branding and terms of use are configured under Work Centers > Guest Access > Portals & Components, where each portal's logo, acceptable-use text and language settings are edited. This satisfies the requirement to customise the guest portal's appearance and terms.

Why this answer

The guest portal customization—including uploading a company logo and defining specific terms of use—is performed in the Work Centers > Guest Access > Portals & Components section of the Cisco ISE GUI. This area provides a centralized location for creating and editing all guest-facing portals (e.g., Hotspot, Self-Registered, Sponsored) and their associated components like logos, banners, and acceptance policies. The other options are unrelated to portal branding or terms of use configuration.

Exam trap

SISE often tests the distinction between portal customization (Work Centers > Guest Access > Portals & Components) and authorization policy configuration (Policy > Policy Elements > Results > Authorization > Authorization Profiles), causing candidates to confuse where branding and terms of use are set versus where network access results are defined.

How to eliminate wrong answers

Option A is wrong because Administration > System > Settings > Portal Configuration does not exist as a path for guest portal customization; system settings under Administration typically cover global ISE operational parameters, not guest portal branding. Option B is wrong because Policy > Policy Elements > Results > Authorization > Authorization Profiles is used to define authorization results (e.g., VLAN, DACL, SGT) that are applied after authentication, not to customize the visual appearance or terms of use of a guest portal. Option D is wrong because Operations > Troubleshoot > Diagnostic Tools is for troubleshooting and diagnostics (e.g., running diagnostic tests, evaluating policies), not for configuring portal content.

Practice this question →
14
MCQhard

If a user is redirected to the Guest portal but receives a '404 Page Not Found' error, what is the most likely configuration issue?

A.The NAD is blocking the traffic.
B.The Guest Portal is not enabled on the PSN.
C.The redirect URL is pointing to a non-existent portal path or the PSN is not reachable.
D.The user's account is expired.
AnswerC

A 404 arises when the redirect targets a portal path that does not exist, or the Policy Service Node cannot serve the Guest portal. This satisfies the stem's symptom of a failed redirect to the Guest portal.

Why this answer

A '404 Page Not Found' on the guest portal almost always means the redirect URL the NAD was given points to a path that does not exist on the PSN, or the PSN hosting the portal is unreachable from the client. ISE constructs the redirect URL from the portal configuration and the PSN's hostname/FQDN, so a mismatch in the portal name, a stale DNS entry, or an unreachable PSN produces a 404 rather than a login page.

Exam trap

SISE often tests whether candidates can distinguish HTTP-layer errors (404) from network-layer failures (timeouts) — a 404 means the web server was reached but the path was wrong, not that traffic was blocked.

How to eliminate wrong answers

Option A is wrong because a NAD blocking traffic would typically cause a timeout or connection reset, not an HTTP 404 returned by a web server. Option B is wrong because a disabled portal usually results in a different error or no redirect at all — the client would not reach a web server capable of returning 404. Option D is wrong because an expired account produces an authentication failure message on the portal, not a page-not-found error, since the portal page itself would still load.

Practice this question →
15
MCQeasy

What is the purpose of the 'Guest Type' configuration in Cisco ISE?

A.To define the graphical user interface layout of the guest portal.
B.To assign a specific sponsor to a guest.
C.To set the IP address pool for the guest VLAN.
D.To define the attributes of the guest account such as duration and permissions.
AnswerD

Guest Type defines the account attributes applied to guest users, including access duration and permissions, determining how long the account remains valid and what it may reach. This governs sponsor-created guest access within Cisco ISE.

Why this answer

The 'Guest Type' configuration in Cisco ISE defines the attributes of a guest account, such as the duration of access, the maximum number of devices, and the permissions or roles assigned to the guest. It is a template that determines the guest's access privileges and account lifecycle. This allows administrators to create different guest types (e.g., contractor, visitor) with tailored settings.

Exam trap

The trap is confusing Guest Type with portal customization or sponsor assignment; candidates must remember that Guest Type defines account attributes like duration and permissions, not UI or sponsor settings.

How to eliminate wrong answers

Option A is wrong because the graphical user interface layout of the guest portal is controlled by portal customization settings, not by Guest Type. Option B is wrong because assigning a sponsor to a guest is done through sponsor groups and guest sponsor policies, not through Guest Type. Option C is wrong because the IP address pool for the guest VLAN is configured in the network device (switch/controller) or in authorization profiles, not in the Guest Type definition.

Practice this question →
16
MCQmedium

When setting up a self-registration portal, you want to require that the guest's email address is validated before granting access. Which feature should you enable?

A.Enable Guest MAC Caching
B.Self-Registration Account Activation
C.Enable Captcha
D.Require Sponsor Approval
AnswerB

Self-Registration Account Activation sends a verification email containing an activation link; the guest account remains inactive until the link is clicked, so the email address is validated before access is granted. Without it, sponsors approve accounts without proving email ownership.

Why this answer

Self-Registration Account Activation is the ISE guest portal feature that requires the guest to validate their email address by clicking an activation link before the account becomes active. When enabled, ISE sends a confirmation email and holds the account in a pending state until the link is clicked. This directly satisfies the requirement to validate the guest's email before granting access.

Exam trap

SISE often tests the distinction between email validation (Self-Registration Account Activation) and sponsor approval, so candidates who see 'email' and pick 'Require Sponsor Approval' fall into the trap of confusing two different approval workflows.

How to eliminate wrong answers

Option A is wrong because Guest MAC Caching allows returning devices to bypass the portal, which is unrelated to email validation. Option C is wrong because Captcha prevents automated bot registrations but does not validate the email address. Option D is wrong because Sponsor Approval requires a sponsor to manually approve the guest, which is a different workflow from email self-validation.

Practice this question →
17
MCQmedium

You are configuring Central Web Authentication (CWA) and need to ensure the client is redirected to the Cisco ISE portal. Which authorization profile configuration is mandatory to achieve this redirection?

A.Set the Access Type to Permit Access and enable URL Redirect with the portal ID.
B.Enable 'Authentication Bypass' in the authorization profile to allow the traffic to hit the redirect rule.
C.Configure the profile as a standard permit access profile with a dynamic VLAN assignment.
D.Set the Access Type to Web Auth and manually input the redirect IP address in the Custom Attributes field.
AnswerA

The Web Redirection settings must be configured to point to the specific portal, which triggers the WLC to send a redirect URL to the client.

Why this answer

Central Web Authentication requires the authorization profile to permit access and simultaneously return a URL redirect AV pair pointing to the ISE guest/central portal. In ISE, the authorization profile's 'Access Type = ACCESS_ACCEPT' plus the 'Web Redirection (CWA)' setting with the correct portal ID is what tells the WLC/switch to redirect the client's HTTP traffic to the ISE portal. Without the URL redirect attribute, the client is simply permitted and never sees the portal.

Exam trap

SISE often tests the misconception that any 'Permit Access' profile enables CWA — candidates forget that the mandatory piece is the URL redirect AV pair with the correct portal ID, not just the access type.

How to eliminate wrong answers

Option B is wrong because Authentication Bypass skips authentication entirely and does not generate the redirect AV pair, so the client would be granted access without being sent to the portal. Option C is wrong because a standard permit profile with dynamic VLAN assignment only authorizes and segments the client; it contains no URL redirect attribute, so no CWA redirection occurs. Option D is wrong because 'Web Auth' is not a valid Access Type in an ISE authorization profile, and manually entering a redirect IP in Custom Attributes does not produce the structured Cisco AV pair (url-redirect / url-redirect-acl) that the NAD requires.

Practice this question →
18
MCQeasy

A network engineer is setting up a guest portal that allows guests to self-register. The company requires that guests provide a valid email address to receive their account credentials. Which portal configuration setting must be enabled to enforce this requirement?

A.Enable guest account expiration
B.Require sponsor approval before guest access
C.Require guest to provide a valid email address
D.Require guest to enter a username and password
AnswerC

Enabling this setting in the Guest Portal configuration forces the guest to enter a valid email address during self-registration. ISE then uses that email to send the account credentials and notifications. This directly meets the company's requirement.

Why this answer

To require guests to provide a valid email address during self-registration, the 'Require guest to provide a valid email address' setting must be enabled in the Guest Portal configuration. This ensures ISE collects the email and uses it to send credentials. Other settings address different aspects of the guest flow.

Exam trap

The trap here is confusing the email requirement with sponsor approval or account expiration, which are separate features not related to enforcing email collection.

Practice this question →
19
MCQhard

A guest user connects to the network and is redirected to the ISE Guest Portal. After entering valid credentials, the user is authenticated, but the browser remains on the 'Redirecting' page and never reaches the intended URL. The NAD logs show repeated MAC authentication bypass (MAB) attempts with the guest endpoint's MAC address, and the authorization result is 'Redirect'. What is the most likely cause of this issue?

A.The guest endpoint is not being reauthenticated after successful web authentication because the NAD is not receiving the Change of Authorization (CoA) from ISE.
B.The guest portal is configured to use a self-signed certificate, causing the browser to block the redirect.
C.The Authorization Profile for the guest flow is missing the 'Web Redirection' attribute, so the NAD does not know where to redirect the user after authentication.
D.The guest user's credentials are being rejected by the external identity store, causing ISE to reapply the redirect policy.
AnswerA

After web authentication, ISE must send a CoA to the NAD to change the session authorization from Redirect to Permit. If the CoA fails (e.g., due to incorrect CoA configuration, unreachable NAD, or shared secret mismatch), the NAD continues to apply the Redirect policy, causing the loop. The repeated MAB attempts indicate the session is stuck in the redirect state.

Why this answer

The most likely cause is that ISE cannot send a successful Change of Authorization to the NAD after web authentication. The NAD remains in the Redirect state, causing the browser to loop. This can happen if CoA is not enabled on the NAD, the CoA shared secret is incorrect, or the NAD is unreachable.

Verifying CoA configuration and connectivity is essential.

Exam trap

The trap here is focusing on certificate or credential issues when the symptom of repeated MAB attempts and persistent redirect after successful authentication points to a CoA failure.

Practice this question →
20
MCQeasy

Where do you customize the visual look and feel of the guest portal, such as logos and background colors?

A.Administration > System > Settings
B.Work Centers > Guest Access > Configure > Guest Portals
C.Policy > Policy Elements > Results
D.Administration > Identity Management > Identities
AnswerB

Guest portal branding—logos, background colours and custom text—is configured under Work Centers > Guest Access > Configure > Guest Portals, where each portal's visual settings are edited. This path satisfies the stem's requirement to customise the portal's look and feel.

Why this answer

Guest portal branding — logos, background images, colors, and text — is customized under Work Centers > Guest Access > Configure > Guest Portals. Within a specific portal's configuration you can edit the Portal Page Customization settings, upload a logo, and adjust the color scheme and language. This is the dedicated location for all guest-facing portal appearance changes.

Exam trap

SISE often tests the difference between global system settings and per-portal configuration — candidates pick Administration > System > Settings because 'branding' sounds global, but portal appearance is always portal-specific.

How to eliminate wrong answers

Option A is wrong because Administration > System > Settings covers global system parameters like FIPS mode, SMTP, and profiler feed settings, not portal branding. Option C is wrong because Policy > Policy Elements > Results defines authorization results such as dACLs, VLANs, and SGTs, which have nothing to do with portal appearance. Option D is wrong because Administration > Identity Management > Identities is where you manage internal user accounts and identity sources, not guest portal look and feel.

Practice this question →
21
Multi-Selecthard

Which THREE of the following items are verified by ISE when a guest attempts to authenticate?

Select 3 answers
A.Account expiration date.
B.The physical location of the NAD.
C.The user's browser version.
D.Password credentials.
E.Account status (e.g., Approved, Pending, Disabled).
AnswersA, D, E

Microsoft Entra ID guest accounts carry an account expiration date, and ISE verifies it during guest authentication to deny access once that date passes. This satisfies the stem's requirement for a verified item, since expired guest credentials must be rejected before authorisation proceeds.

Why this answer

When a guest authenticates against ISE, the guest portal validates the submitted username and password against the internal guest account store, so option D (Password credentials) is verified. ISE also checks the guest account's lifecycle attributes, including the expiration date set when the account was created or sponsored, making option A (Account expiration date) correct. Additionally, ISE evaluates the account's status field — Approved, Pending, Suspended, or Disabled — to decide whether the guest is permitted to log in, which is option E (Account status).

Option B is not verified during authentication because the NAD's physical location is not an attribute ISE checks for guest login, and option C is incorrect because the browser version is not part of ISE's guest authentication validation.

Exam trap

The trap is confusing authentication with authorization. Candidates might think that any attribute used in policy decisions is part of authentication, but authentication strictly verifies identity, while authorization determines access.

Practice this question →
22
Multi-Selectmedium

Which TWO of the following are valid ways to provide access to a guest user?

Select 2 answers
A.Bypassing login via a Hotspot portal.
B.Authentication via the Guest Portal using username/password.
C.Connecting via VPN tunnel only.
D.Using a static IP assigned by the administrator.
E.Authenticating via the CLI on the NAD.
AnswersA, B

A Hotspot portal grants network access without authenticating the guest against an identity provider, so no credentials are validated. This satisfies the stem's requirement for a valid guest access method by using a sponsored or self-registered portal that authorises the device, rather than requiring a Microsoft Entra ID account.

Why this answer

Option A is correct because a Hotspot portal is a standard Cisco ISE guest-access method that lets visitors self-register or click through a web page and be granted network access without requiring pre-created credentials, effectively bypassing a traditional login. Option B is correct because the Guest Portal (Sponsored or Self-Registered guest flow) authenticates guest users with a username and password stored in the ISE internal guest identity store, which is the canonical way to provide credentialed guest access. Option C is not a valid guest-access method here because a VPN tunnel is a remote-access technology, not a guest onboarding/authentication mechanism in this context.

Option D is not correct because assigning a static IP only provides addressing, not authentication or authorization for a guest. Option E is not correct because authenticating via the CLI on the NAD is an administrative/device-management action, not a supported way to grant a guest user network access.

Exam trap

SISE often tests the distinction between authentication methods and access provisioning, causing candidates to confuse network configuration (like static IP or VPN) with guest access mechanisms.

Practice this question →
23
MCQmedium

Which component is responsible for the actual redirection of the guest user's browser in a CWA flow?

A.The Cisco ISE Policy Service Node (PSN)
B.The Network Access Device (NAD)
C.The endpoint's default browser
D.The Guest Portal application
AnswerB

The Network Access Device intercepts the guest's initial HTTP request and issues the redirect to the Cisco ISE CWA portal. Redirection happens at the NAD, not the client or policy server, because the NAD controls the traffic path before authorisation completes.

Why this answer

The Network Access Device (NAD) is responsible for redirecting the guest user's browser in a Central Web Authentication (CWA) flow. When the endpoint connects, the NAD (e.g., a wireless controller or switch) intercepts the HTTP traffic and redirects the user to the ISE guest portal for authentication.

Exam trap

The trap is thinking that ISE (PSN or portal) performs the redirection. While ISE provides the redirect URL, the actual HTTP redirect is enforced by the NAD. Candidates might confuse the role of the PSN in policy decision with the enforcement point.

How to eliminate wrong answers

Option A is wrong because the Policy Service Node (PSN) makes policy decisions and provides the redirect URL, but it does not perform the actual redirection; the NAD enforces the redirect. Option C is wrong because the endpoint's default browser is the user agent that receives the redirect, but it does not initiate the redirection; it simply follows the HTTP redirect sent by the NAD. Option D is wrong because the Guest Portal application is hosted on ISE and presents the login page, but it does not redirect the browser; the NAD redirects the browser to the portal.

Practice this question →
24
MCQhard

You are implementing a Guest flow where you need to track the physical location of the guest. Which attribute is best used to identify the location of the request?

A.Framed-IP-Address
B.Called-Station-ID
C.Calling-Station-ID
D.NAS-IP-Address
AnswerB

Called-Station-ID carries the network attachment point — typically the access point's BSSID or the switch port identifier — so RADIUS accounting and authorisation policies can map each guest session to its physical location, satisfying the requirement to track where the request originates.

Why this answer

Called-Station-ID is the RADIUS attribute that carries the identifier of the network access point (e.g., the SSID or the MAC address of the wireless controller/AP) that the guest is connecting to. In a guest flow, this attribute is used to determine the physical location of the request because it identifies the specific access device. Cisco ISE uses Called-Station-ID in authorization policies to apply location-based restrictions or to track where a guest session originates.

Exam trap

SISE often tests the confusion between Calling-Station-ID (device MAC) and Called-Station-ID (network access point), so candidates must remember that location is tied to the network side, not the client side.

How to eliminate wrong answers

Option A is wrong because Framed-IP-Address is the IP address assigned to the guest device, not the location of the network access point. Option C is wrong because Calling-Station-ID is the MAC address of the guest device, which identifies the device but not its physical location. Option D is wrong because NAS-IP-Address is the IP address of the network access server (e.g., the switch or controller), which may be in a different location than the access point itself.

Practice this question →
25
MCQmedium

You are configuring a Guest Portal that requires sponsor approval. What does the 'Sponsor Approval' setting inside the portal configuration actually do?

A.It automatically emails the sponsor.
B.It sets the guest account status to 'Pending' until approved.
C.It sends a RADIUS request to the sponsor's device.
D.It allows the guest to bypass the login screen.
AnswerB

Setting the guest account to 'Pending' holds the account inactive until a sponsor approves it, satisfying the sponsor-approval requirement. The portal does not grant access at creation; the account remains unusable until the sponsor's approval transitions it to active.

Why this answer

The 'Sponsor Approval' setting in a Guest Portal configuration sets the guest account status to 'Pending' until a sponsor approves the request. This means the guest cannot access the network until the sponsor explicitly grants approval, typically via the Sponsor Portal. The setting enforces a workflow where guest access is gated by sponsor action.

Exam trap

The trap is confusing the notification aspect (email) with the actual state change (Pending). Candidates might think the setting merely sends an email, but it fundamentally changes the account status and blocks access until approval.

How to eliminate wrong answers

Option A is wrong because while the system may send notifications to the sponsor, the core function of the setting is to set the account to Pending, not just to email. Option C is wrong because RADIUS requests are not sent to the sponsor's device; sponsors interact via the Sponsor Portal, not RADIUS. Option D is wrong because the setting does not allow bypassing the login screen; it adds an approval step, not removes authentication.

Practice this question →
26
MCQhard

In a CWA flow, what is the significance of the 'cisco-av-pair = url-redirect-acl' attribute?

A.It defines the URL to which the user is redirected.
B.It triggers the CoA process.
C.It defines the guest group permissions.
D.It specifies the name of the ACL on the NAD that defines traffic to be intercepted.
AnswerD

The url-redirect-acl attribute names the downloadable ACL on the NAD that matches the traffic to be intercepted and redirected. It satisfies the CWA requirement by binding the redirect to a specific ACL, so only matching flows are captured for posture assessment rather than all traffic.

Why this answer

In a Central Web Authentication (CWA) flow, the 'cisco-av-pair = url-redirect-acl' attribute tells the network access device (NAD) which ACL to apply to intercept and redirect the user's HTTP traffic to the ISE portal. The ACL itself is defined locally on the NAD and typically permits DNS and the redirect, while denying other traffic until authentication completes. The attribute does not contain the redirect URL — that is carried by a separate 'url-redirect' attribute.

Exam trap

SISE often tests the distinction between 'url-redirect' (the URL) and 'url-redirect-acl' (the ACL name on the NAD), catching candidates who assume the ACL attribute contains the redirect destination.

How to eliminate wrong answers

Option A is wrong because the actual redirect URL is specified by the 'cisco-av-pair = url-redirect' attribute, not 'url-redirect-acl'; the ACL attribute only names the ACL that intercepts traffic. Option B is wrong because the CoA (Change of Authorization) process is triggered by ISE sending a RADIUS CoA packet after authentication or posture change, not by the url-redirect-acl attribute itself. Option C is wrong because guest group permissions are determined by the authorization policy result and the guest user's group membership in ISE, not by the url-redirect-acl AV pair.

Practice this question →
27
MCQeasy

Which protocol does the Cisco ISE use to inform the NAD that a guest user's session state has changed (e.g., from 'redirect' to 'authenticated')?

A.RADIUS CoA
B.HTTP
C.SNMP
D.TACACS+
AnswerA

RADIUS Change of Authorization lets Cisco ISE push an unsolicited CoA request to the network access device, instructing it to reauthenticate or alter the session's authorisation state. This changes a guest from redirect to authenticated without waiting for reauthentication, which is the required session-state update.

Why this answer

Cisco ISE uses RADIUS Change of Authorization (CoA) to dynamically change the authorization state of an active session on a Network Access Device (NAD). When a guest user's session state changes (e.g., from redirect to authenticated), ISE sends a RADIUS CoA request (Disconnect or CoA-Request) to the NAD, which then reauthenticates or changes the session's authorization. This is the standard mechanism for dynamic session control.

Exam trap

The trap here is confusing protocols used for different purposes: RADIUS for network access, TACACS+ for device administration, SNMP for monitoring, and HTTP for portals. Candidates might think HTTP is used because the guest portal is web-based, but the actual session state change is signaled via RADIUS CoA.

How to eliminate wrong answers

Option B is wrong because HTTP is used for web-based guest portals and REST APIs, but it does not directly inform the NAD of session state changes. Option C is wrong because SNMP is used for monitoring and management, not for dynamic session control. Option D is wrong because TACACS+ is used for device administration (AAA for CLI access), not for network access session state changes.

Practice this question →
28
Multi-Selecthard

Which TWO of the following tasks are performed within the Sponsor Portal?

Select 2 answers
A.Mapping VLANs to specific guest SSIDs.
B.Configuring global portal branding.
C.Defining RADIUS shared secrets.
D.Creating new guest accounts.
E.Approving guest access requests.
AnswersD, E

Sponsors create guest accounts directly in the Sponsor Portal, supplying the visitor's details and validity period. This satisfies the requirement that guest provisioning be delegated to non-administrative sponsors, with credentials generated and delivered without administrator intervention.

Why this answer

The Sponsor Portal in Cisco ISE is a web interface used by designated sponsors to manage guest lifecycle tasks, so option D (Creating new guest accounts) is correct because sponsors can create guest accounts directly, specifying duration, login credentials, and other guest details. Option E (Approving guest access requests) is also correct because sponsors receive and act on pending guest access requests, approving or denying them so guests can authenticate. Option A (Mapping VLANs to specific guest SSIDs) is incorrect because VLAN-to-SSID mapping is configured on the wireless LAN controller or in the network access policy, not in the Sponsor Portal.

Option B (Configuring global portal branding) is incorrect because portal branding and customization are configured in the Guest Portal settings within ISE administration, not by sponsors in the Sponsor Portal. Option C (Defining RADIUS shared secrets) is incorrect because RADIUS shared secrets are configured on network devices and in ISE's network device definitions, not in the Sponsor Portal.

Exam trap

The trap is confusing the Sponsor Portal with the Admin Portal or Guest Portal. Candidates might think sponsors can configure global settings or network parameters, but those are admin tasks. The Sponsor Portal is limited to guest account management and approval.

Practice this question →
29
MCQmedium

You need to allow guest users to access specific internal resources (like a printer) while they are connected to the Guest network. How do you configure this in ISE?

A.Enable Guest VLAN assignment.
B.Assign a downloadable ACL (dACL) in the Authorization Profile.
C.Modify the Redirect ACL on the switch.
D.Configure a port-based ACL on the switch interface.
AnswerB

A downloadable ACL in the Authorization Profile pushes a per-user access control list to the network device, permitting the guest to reach the printer while denying other internal resources. This satisfies the requirement for granular, session-specific access.

Why this answer

A downloadable ACL (dACL) is a Cisco AV pair that ISE sends to the switch in the RADIUS Access-Accept. The switch then applies this ACL to the client's port to filter traffic. This allows granular control, such as permitting access only to a specific printer IP while denying other internal resources.

The dACL is defined in the Authorization Profile, which is referenced in the authorization policy rule for guest users.

Exam trap

The trap here is confusing VLAN assignment with ACL enforcement; candidates might think putting guests in a separate VLAN automatically restricts internal access, but VLANs alone do not filter traffic to specific resources.

How to eliminate wrong answers

Option A is wrong because Guest VLAN assignment only places the user in a separate VLAN; it does not restrict access to specific internal resources like a printer. Option C is wrong because modifying the Redirect ACL on the switch affects URL redirection for web authentication, not per-user resource access. Option D is wrong because a port-based ACL on the switch interface is static and applies to all devices on that port, not dynamically per guest user.

Practice this question →
30
MCQhard

What is the purpose of the 'Guest Flow' setting in the Authorization Profile?

A.It defines the session timeout.
B.It enables MAC caching.
C.It defines the Guest Group.
D.It tells the ISE to trigger the Guest Portal.
AnswerD

The Guest Flow setting in an Authorization Profile instructs Cisco ISE to redirect the endpoint to the Guest Portal, satisfying the requirement to onboard unknown or unregistered guests. When applied, ISE returns a URL redirect in the authorisation result, forcing the supplicant's browser to the portal for registration or sponsor approval before network access is granted.

Why this answer

The 'Guest Flow' setting in an ISE Authorization Profile tells ISE to redirect the endpoint to the Guest Portal for registration or sponsorship, rather than granting normal network access. It is the mechanism that triggers the guest onboarding workflow when a user or device is not yet known to ISE. This is distinct from session timeout, MAC caching, or group definition, which are separate authorization attributes.

Exam trap

SISE often tests whether candidates confuse the Guest Flow attribute with other Authorization Profile attributes like session timeout or MAC caching, so the trap is selecting a plausible-sounding but functionally different authorization setting.

How to eliminate wrong answers

Option A is wrong because session timeout is configured via the 'Reauthentication' or 'Session Timeout' attributes in the Authorization Profile, not the Guest Flow setting. Option B is wrong because MAC caching is enabled through the 'MACSec' or 'MAC Caching' attributes and is used to remember a device's authorization result, not to trigger a guest portal. Option C is wrong because the Guest Group is defined in the guest sponsor or guest type configuration, not in the Authorization Profile's Guest Flow setting — the Guest Flow setting references the portal, not the group.

Practice this question →
31
Multi-Selectmedium

Which TWO of the following settings are available for customizing the guest portal login page?

Select 2 answers
A.Selection of the switch interface.
B.Inclusion of a mandatory AUP checkbox.
C.Direct editing of the Apache server config files.
D.Configuration of the RADIUS shared secret.
E.Modification of the login form header and footer text.
AnswersB, E

The guest portal supports a mandatory Acceptable Use Policy checkbox, forcing guests to acknowledge terms before gaining network access. This satisfies the customization requirement by adding a compliance gate to the login page, enforceable per portal profile.

Why this answer

Option B is correct because guest portal configurations in ClearPass (and similar NAC solutions) allow administrators to enable a mandatory Acceptable Use Policy checkbox that users must acknowledge before authenticating, which is a standard customization on the login page. Option E is correct because the login form's header and footer text are editable fields within the guest portal customization settings, letting administrators add branding, instructions, or legal notices. Option A is not a guest portal login page setting; switch interface selection relates to network infrastructure configuration, not portal appearance.

Option C is incorrect because direct editing of Apache server config files is not a supported or exposed customization method in the portal UI and would be an unsupported modification. Option D is incorrect because the RADIUS shared secret is an authentication service configuration parameter, not a login page customization option.

Exam trap

SISE often tests the boundary between portal-level customization (header/footer, AUP) and infrastructure-level settings (switch interface, RADIUS secret) — candidates pick infrastructure options that sound related but are configured elsewhere.

Practice this question →
32
MCQeasy

In the context of the Guest flow, what is the purpose of the 'Guest Types' configuration?

A.To manage the list of sponsors.
B.To define the portal look and feel.
C.To define attributes like account lifetime and access policies for guest accounts.
D.To configure the RADIUS server settings.
AnswerC

Guest Types define the templates applied to guest accounts, specifying attributes such as account lifetime and the access policies governing them. This configuration therefore controls how long guests remain valid and what they may reach within the Guest flow.

Why this answer

Guest Types in ISE define the template for guest accounts, including account lifetime (duration), maximum simultaneous logins, and the access policies (authorization profiles) that apply to that type of guest. They allow administrators to create different classes of guests (e.g., short-term visitor vs. long-term contractor) with distinct attributes.

Exam trap

SISE often tests the purpose of Guest Types versus other guest configuration objects, so candidates who confuse Guest Types with sponsor groups or portal customization will choose the wrong answer.

How to eliminate wrong answers

Option A is wrong because sponsor management is handled under Sponsor Groups and Sponsor Portals, not Guest Types. Option B is wrong because portal look and feel is configured in the Portal Customization settings, not Guest Types. Option D is wrong because RADIUS server settings are configured under Network Devices and RADIUS configurations, not Guest Types.

Practice this question →
33
MCQmedium

You are reviewing the ISE logs and see that the Guest Portal authentication is failing. Where should you look to find the exact reason for the failure?

A.Operations > RADIUS Livelogs
B.Monitoring > Reports > Guest
C.Policy > Policy Sets
D.Administration > System > Logging
AnswerA

RADIUS Livelogs under Operations capture authentication transactions in real time, showing the precise failure reason and policy stage where the Guest Portal request was rejected. This granular detail is unavailable in general reports or dashboard summaries.

Why this answer

Operations > RADIUS Livelogs provides real-time, detailed RADIUS authentication and authorization logs, including the exact failure reason for guest portal authentication attempts. It shows the full RADIUS request/response exchange, the policy set matched, and any error codes. This is the primary place to diagnose why a guest authentication is failing.

Exam trap

SISE often tests the difference between Live Logs (real-time RADIUS details) and Reports (historical summaries), so candidates who need the exact failure reason but pick a report or policy page miss the diagnostic tool that actually contains the error code.

How to eliminate wrong answers

Option B is wrong because Monitoring > Reports > Guest provides historical guest activity and accounting summaries, not the granular RADIUS failure reason. Option C is wrong because Policy > Policy Sets is where policies are configured, not where authentication failures are logged. Option D is wrong because Administration > System > Logging configures logging levels and targets, not the authentication failure details.

Practice this question →
34
MCQmedium

A security engineer is configuring a Cisco ISE guest portal for a conference. Attendees must be able to create their own accounts but must first receive a one-time code via SMS to validate their phone number. The SMS gateway has already been integrated with ISE. Which guest portal flow should the engineer select to meet this requirement?

A.Self-Registered Guest Flow with SMS validation
B.BYOD Onboarding Flow
C.Hotspot Guest Flow
D.Sponsored Guest Flow
AnswerA

The Self-Registered Guest Flow allows guests to create their own accounts. When SMS validation is enabled, ISE sends a one-time code to the provided mobile number, and the guest must enter it correctly to complete registration. This exactly matches the requirement that attendees validate their phone number before gaining access.

Why this answer

The Self-Registered Guest Flow enables guests to create their own accounts without sponsor intervention. Enabling SMS validation within that flow forces the guest to enter a one-time code sent to their mobile phone, confirming the number is valid. The other flows either skip identity validation entirely, require a sponsor, or serve a different purpose such as device onboarding.

Exam trap

The trap here is assuming that any guest flow can be combined with SMS validation, when in fact SMS validation is a specific option available only within the Self-Registered Guest Flow configuration.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Web Auth And Guest Services questions.

Start 20-question session
CCNA Web Auth And Guest Services Questions | Courseiva