SISE practice questions
Cisco · SISE · 300 questions
Original practice questions for the Implementing and Configuring Cisco Identity Services Engine exam, covering every domain of the official exam outline.
This course contains the use of artificial intelligence.
About the SISE exam
- Questions
- not published
- Passing score
- not published
- Format
- 90-minute exam associated with the CCNP Security certification
Schedule this exam The certification this earns
Exam details published by the vendor, checked 3 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Architecture and Deployment (10%) · 30 questions
- A hospital's single ISE appliance serves several thousand endpoints, and the shift-change login surge already pushes it near capacity. Security wants one place where administrators author policy, plus the ability to add authentication capacity in stages without rewriting policy. Which ISE deployment design meets all of these requirements?
- A hospital runs ISE in a distributed deployment with two Policy Service nodes. Every switch, WLAN controller and VPN gateway lists only PSN-1 as its RADIUS server, and a maintenance window requires taking PSN-1 offline for patching. The design must run with no extra appliance between the network devices and ISE. Which high-availability change for the Policy Service nodes keeps authentication available?
- A manufacturer runs ISE as three VMs on a shared vSphere cluster that still has spare CPU and memory. The licence already covers every endpoint, wired profiling is active, and the monitoring dashboards stay responsive, yet RADIUS requests queue and time out in the 08:00 reauthentication wave. Which change best restores authentication capacity?
- A hosting company brings four new ISE PSN appliances online in two regions and wants each node to configure itself at first boot instead of an engineer typing the setup script. Every node must come up with its own hostname, addressing, DNS, NTP and admin login already in place. Which ISE feature delivers this zero-touch initial provisioning?
- A university is splitting ISE across two VMs. The first VM already runs the admin GUI, the policy configuration and the monitoring database, and the team wants policy edited from that one node only. At peak, 15,000 endpoints hit RADIUS, MAB and captive-portal authentication at once, while a SIEM consumes the monitoring feed. Which ISE persona should run on the second VM to carry that authentication load?
- An insurance company adds a second ISE VM to carry RADIUS traffic for a new campus building and to keep AAA running while the first node is offline for maintenance. The first node is already the primary Administration node, the primary Monitoring node, and a Policy Service Node. Which persona assignment on the second node completes this design?
- A 600-person manufacturer runs ISE on a single headquarters node that does authentication, profiling, posture and TACACS+. Two new plants need wired 802.1X, endpoint count will roughly double, and the team must keep one configuration console while each site's logins are answered locally. Which deployment design meets those requirements?
- A bank is adding a second data center and ships an ISE appliance straight to the colo, where no ISE administrator has console access. The site has internal DNS that resolves the existing PAN, and the new node's first-boot installation and network setup must complete with nobody touching it locally. Which zero-touch provisioning approach should the team use?
- A state university runs ISE on two virtual machines: one hosting the administration and monitoring personas, and one hosting the policy service persona. At 8 a.m. about 4,000 wireless users authenticate within minutes, RADIUS replies slow to a crawl, and clients start retrying. Which performance specification should the team re-size first to protect authentication throughput?
- A logistics company runs one ISE node holding both the administration and monitoring personas, and adds a second server in the datacenter to absorb 802.1X load for 5,000 handheld scanners. Policy edits must stay on the existing node while the new server answers endpoint requests with the same rules. Which persona assignment and registration step will integrate it correctly?
- A retail chain runs 120 stores, each with a Catalyst switch stack and two ISE policy service nodes in the back office. The security lead forbids adding any network appliance in the stores, and a single PSN outage must leave new 802.1X authentications running. Session state lives on each PSN instead of being shared, so which switch-side design should be used?
- A manufacturer is rolling ISE out to three regions. Policy must be edited from one console, logins must keep working when a region's WAN link to the data center drops while local identity services remain reachable, the incident-response team needs heavy live-session searches that leave configuration and policy decisions unaffected, and the next-generation firewall wants live endpoint context. Which ISE persona design meets all four requirements?
- A retail chain is building one ISE deployment for 40 stores: a PAN in the data center and a PSN per region. Engineers deploy ISE virtual machines from a template and want first boot to complete initial setup with minimal console typing, while policy content stays managed from the PAN. What does zero-touch provisioning provide during that first boot?
- A logistics firm runs six Policy Service nodes that the switches address individually, and peak authentication volume already saturates one node during shift change. The security lead also requires that authentication continue automatically if a node fails. Which RADIUS distribution design meets both requirements?
- A county health system is extending ISE across four appliances. Appliance 1 must terminate RADIUS for 300 access switches and run profiling, appliance 2 is the only place engineers may edit policy, appliance 3 gives SOC analysts live sessions and diagnostics, appliance 4 shares identity and session context with the firewall. Which persona assignment satisfies each requirement?
- A hospital group is replacing its ISE hardware appliances with VMs on a cluster that also runs other security workloads. The replacement must sustain the same peak RADIUS authentication rate as the appliance, absorb heavy session-log volume without slowing authentication, and stay predictable when neighboring VMs spike. Which VM sizing approach meets all of these requirements?
- A distributed ISE design must keep every site's policy sets under one administrative point, while each site keeps authenticating even when the central node fails or the wide area link drops. Assuming each site's identity source remains reachable locally, which node layout satisfies both requirements?
- A retailer runs a central ISE PAN at headquarters and has just installed a second ISE VM for the regional site. The regional switches and wireless controllers must authenticate with the same policy set headquarters maintains, and headquarters must remain the only administrative console in the deployment. Which persona assignment and registration step makes the regional node part of the deployment?
- A platform team must stand up a new ISE region as six blank OVA nodes in a remote datacenter, and the build standard says every node's install, host and network details, DNS and NTP settings, and enabled services must come from one prepared file with no engineer answering setup prompts at a console. Which capability meets that build standard?
- A financial firm is sizing an ISE VM to handle RADIUS, profiling collection, and session logging for 12,000 endpoints on a hypervisor shared with other guests. During load testing, datastore latency rises while CPU and memory remain within their configured limits. Which ISE VM resource is most likely to be the bottleneck?
- A hospital is standing up four ISE virtual machines, one for each role. One VM must be the authoritative source for policy and network device configuration; another must collect authentication and failure logs; a third must answer RADIUS requests from switches and wireless controllers; a fourth must share session and posture data with the SIEM. Which persona assignment matches each of the four virtual machines?
- A regional bank piloted ISE as one all-in-one node in its lab. For production, RADIUS and TACACS+ logins must keep working if a single server fails, administrators must keep a usable management console during that outage, and all policy must stay authored from one console. Which ISE deployment option meets all three continuity requirements?
- A company runs three policy service nodes serving 250 access switches for 802.1X. Administrators report that user sessions occasionally restart mid-morning even though no node has failed, and RADIUS load counters show nearly all traffic landing on one node. Which load balancing design for the policy service nodes would restore both distribution and session continuity?
- A retail chain is deploying ISE at headquarters and at four stores. Corporate wants one place where policies are built and changed, while each store must still evaluate its own 802.1X authentications when the link to headquarters is down. The administrator is assigning personas in the deployment wizard. Which persona layout for headquarters and store nodes fits these two requirements?
- A retailer runs one appliance in the data center for centralized policy, monitoring and directory integration, and places a smaller server in each store behind a wireless controller that must authorize shoppers and push re-authorizations on the fly. Store logins must be answered locally without proxying AAA traffic, while logs still roll up to the central collector. Which persona role should run on each store server?
- A bank's single ISE node at HQ handles administration, monitoring and policy for 1,200 switches. A second appliance at the branch will authenticate 3,000 wireless users with HQ's shared policy, while administration and monitoring remain at HQ. Which persona plan and registration order should the branch node follow?
- A logistics company has a data center and three warehouses on VPN links that can drop for ten minutes during storms. Warehouse authentication uses ISE internal users and must keep working during an outage, policy must be authored in one place, and this year's budget allows exactly four ISE nodes. Which ISE deployment design meets all three constraints?
- A retail chain is deploying ISE on a shared vSphere cluster that also runs point-of-sale servers. The infrastructure team wants the policy VM to have guaranteed CPU and memory capacity, while the design must still absorb the 6 a.m. burst when thousands of endpoints re-authenticate. Which VM resource configuration fits Cisco's sizing guidance?
- A packaging plant runs three Policy Service Nodes behind two PANs, but each switch lists a single PSN as its primary RADIUS server. When that node is patched, re-authentication stalls until it returns. The architect wants one address on every switch and traffic spread evenly across the nodes. Which deployment design meets both goals?
- A provider is deploying twelve ISE VMs across three regions in one weekend window, and the team has banned per-node console setup so nobody is answering setup prompts at 3 a.m. Every node must also land in the existing deployment and be governed by the primary admin node. Which provisioning approach satisfies both the unattended first boot and the single-deployment requirement?
Policy Enforcement (25%) · 75 questions
- A hospital is enabling 802.1X on its corporate WLAN. Every laptop already carries a machine certificate from the internal PKI, the team wants no password prompt at sign-in, and the device must also confirm it is talking to the real RADIUS server. Which EAP method belongs in the wireless profile?
- A city university is piloting 802.1X on 3,000 lab and classroom ports that still serve legacy printers and badge readers, and every existing session must keep flowing for the whole eight-week trial. The ISE logs still need to show which endpoints fail authentication and which stay completely silent. Which IBNS 2.0 port mode fits this pilot?
- A network engineer for a plant with 400 access switches is writing one authentication rule and wants to know how ISE resolves credentials when the first store cannot answer. Employees sit in Active Directory while 30 contractor accounts exist only as ISE internal users, and the sequence lists Active Directory first. How does the identity source sequence behave when the domain controller is offline?
- A manufacturer runs one policy set for its wired and Wi-Fi access ports. The authorization rule list reads in this order: a general rule granting the corporate VLAN to authenticated users, a rule granting lab privileges to members of AD group OT-Engineers, and a catch-all granting lab privileges to any authenticated endpoint. Which rule ordering limits lab access to OT-Engineers?
- A logistics firm is tagging traffic across its TrustSec data center. The print server VLAN spans three access switches where cables get re-patched regularly among ports configured with different SGTs, DHCP relay stops at the central server so ISE never sees those leases, fabric switches carry SGT tags inline, and the IDS sensor accepts only IP-to-SGT bindings over SXP. Which classification and propagation design fits these constraints?
- ISE must reuse each person's signed-in Windows session for network access, a new group membership must apply after ISE's directory membership cache expires with no repeat admin work in ISE, and the group list in ISE should contain only the two groups used in policy. Which directory configuration in ISE meets these requirements?
- A university research lab runs a temperature logger, a badge reader, and a student laptop off one wall jack, all needing the same lab VLAN. Each device must complete its own 802.1X or MAB exchange and appear as its own ISE session, so each can be deauthenticated while the others stay up. Which IBNS 2.0 host mode gives each device its own session on this port?
- A logistics company is adding an external LDAP identity source in ISE so warehouse staff can sign into the corporate Wi-Fi with their existing directory passwords. The directory team created exactly one dedicated service account, policy allows only that account to bind, and directory traffic must be encrypted in transit. Which bind setup should the ISE administrator configure?
- A university lab building runs IBNS 2.0 on its access switches with ISE. After a student's 802.1X session succeeds, the port must receive a service template carrying a voice VLAN and a campus ACL, while a second template must take over when ISE is unreachable. Which switch configuration places these templates under IBNS 2.0 policy-map control?
- A regional hospital runs WPA2-Enterprise with EAP-PEAP and ISE as its RADIUS server, with accounting enabled. When ISE sends a Change of Authorization to move a laptop into a restricted VLAN, the controller accepts the request and reauthenticates the session, yet the laptop stays in its original VLAN. Which WLAN setting must be enabled for the new VLAN attributes to take effect?
- A warehouse deploys handheld scanners on access ports configured for MAC Authentication Bypass (MAB). Each scanner must land in VLAN 214 automatically, get a downloadable ACL limiting it to the warehouse management servers, carry SGT 27 for TrustSec enforcement, and start working with zero user interaction. Which authorization profile result set satisfies the warehouse access requirements?
- A university's campus switches run in TrustSec monitor mode. The security team wants GenSeq SGT 205 limited to TCP 8443 when it reaches Compute SGT 215, every other SGT pair to behave as it does today, and the rule verified from switch counters before enforcement starts. Which configuration step implements this SGACL matrix requirement?
- A traffic department adds IP cameras that the profiler classifies with a custom profile named IP Camera. The cameras share one Field Devices identity group with sensors and lights, so that single group covers all three kinds of hardware, and a hardware swap should leave the rule untouched. The rule therefore has to read the profiler's dictionary value on every session. Which authorization condition design meets the dictionary-driven requirement?
- A retail chain is rolling out 802.1X to 4,000 access ports holding legacy printers and IP phones that will initially fail authentication. For 60 days the team wants every attempt logged to ISE while every host keeps its current connectivity untouched, and enforcement will follow later. Which IBNS 2.0 mode fits this observation phase?
- A county hospital builds one policy set for wired access. Clinicians must be offered only certificate-based EAP-TLS, MAB infusion pumps must be admitted with MAB alone, pumps must reach the restricted rule even though a broader clinician rule matches their session first, and every other endpoint must be denied. Which policy design meets all of these requirements?
- A manufacturer is moving 8,000 domain-joined laptops onto 802.1X, and every VLAN and dACL decision depends on Active Directory security groups. Thirty shared kiosk accounts are not in Active Directory and are used only on the lobby machines, while field contractors must present a one-time passcode from the existing RSA SecurID server during RADIUS login. Which identity store design covers all three groups correctly?
- A large hospital deploys label printers and SIP handsets that run without any 802.1X supplicant installed. The access switches enable 802.1X with MAB as the alternate method after the EAP exchange times out, and the printers must land on a restricted VLAN with a downloadable ACL. Which MAB identification step does the switch perform for these endpoints?
- A firm is turning on 802.1X on its WLAN. Staff laptops already carry machine certificates from the internal CA and must use certificate-based mutual authentication, while contractor phones are unmanaged, hold only usernames and passwords, and IT forbids any profile installation on them. Which EAP method assignment fits both groups?
- A regional bank authenticates temporary paralegal laptops with 802.1X on its wired ports. Policy requires these sessions to land in quarantine VLAN 250, reach only DHCP, DNS and the WSUS server, and continue straight through with no portal step. The access switches are older models without SGT or TrustSec enforcement. Which authorization profile should the contractor authorization rule return?
- A three-node ISE deployment has one policy administration node and two policy service nodes in separate buildings. Only the PAN has been joined to corp.example.com, so the finance authorization rules never match for logins handled by the second PSN, and machine authentication must keep working exactly as it does at the first site. Which change restores Active Directory group matching on that node?
- A logistics firm is rolling out IBNS 2.0 ports across its warehouse offices. Every desk port carries one Cisco IP phone with no supplicant, authorized first through CDP device detection, plus one PC using EAP-TLS. The phone and the PC must receive independent authorization results, and a failed PC must leave the phone working. Which 802.1X host mode belongs on these access ports?
- A food processing plant has 600 employees in Active Directory and 40 legacy machine accounts in an OpenLDAP server slated for a merge next year. Past domain controller outages stopped every plant login, and the team keeps three break-glass ISE accounts for emergencies. Which identity source sequence order should be configured for plant logins?
- A bank's campus core propagates SGTs with inline tagging, and ISE classifies endpoints dynamically during 802.1X authorization. One branch building runs a switch that supports SXP but lacks inline tagging hardware, and it filters traffic by IP address. Which TrustSec design keeps SGT-based policy enforceable in that building?
- You are rolling out IBNS 2.0 on hospital access switches. Medical devices must receive a per-user dACL and a dynamic SGT after 802.1X succeeds, printers that fail authentication must land in a quarantine VLAN, and the port must pass traffic only after authorization completes. Which combination satisfies all three requirements?
- In MAB, the endpoint has no supplicant and stays silent when the authenticator sends its EAP identity request. Which message then carries the identity that ISE matches for that endpoint, and in what form does it arrive?
- A city government network has three trust groups: staff workstations (SGT 12), research servers (SGT 51), and records servers (SGT 76). Policy allows staff to reach research, but only administrators (SGT 40) may reach records, and the network team wants policy keyed to trust groups rather than subnets. Which TrustSec enforcement step makes this SGT-to-SGT policy take effect on east-west traffic?
- At a distribution warehouse, 300 handheld scanners join an SSID that authenticates against ISE with PEAP, and every attempt ends in an Access-Accept. When an engineer edits the authorization rule mid-shift, the connected scanners keep their original access until they roam or reconnect. Which controller-to-ISE setting must be verified first to push a new authorization result to a live session?
- Cisco ISE can use an LDAP directory as an external identity source, and the connection settings cover the port, the bind account and the directory search base. For a directory of 400,000 entries in which only the workforce subtree holds employees, which LDAP connection design delivers encrypted binding, read-only access and a search scope limited to workforce entries?
- During a campus rollout you must touch every access port this weekend. IP phones and legacy printers must retain the network access they need while they authenticate, unauthorized clients must be restricted before authorization instead of given the full LAN, and the audit needs start and stop session records in ISE rather than only in the switch log. Which IBNS port mode and logging choice meets all three requirements?
- A retail chain standardizing policy across 400 stores needs one shared rule that matches contractors in the Contractors identity group connecting from a device in the West region, and the same match must stay reusable in several policy sets. Which ISE element should hold that combined condition?
- A healthcare provider must admit 200 domain-joined staff with PEAP, 60 contractors who exist only in the corporate OpenLDAP directory, 20 lab devices that authenticate with machine certificates, and 12 administrators who must pass a second factor. Which identity store should serve each of these four groups?
- A manufacturing firm runs one wired policy set covering every plant-floor switch. The team added a rule for contractor groups that should land on a restricted VLAN, but contractors still get the general Engineering department result because that broader rule sits above it. Everyone authenticates to the same directory, and the team wants to keep a single policy set. Which authorization policy change makes the contractor rule match first?
- A campus refresh uses access switches that stamp SGTs into frames inline, while the data-center ToR switches forward plain IP and cannot mark tags. The servers behind them must still present an SGT to the SGT-aware firewall. Which propagation method should carry those server bindings?
- A defense contractor protects its WLAN with a 9800 controller and ISE across 600 laptops. Every laptop holds a user certificate from the internal CA, policy forbids any user password for network access, and authorization must key off the signed-in person rather than the computer account. Which EAP method should be configured?
- Each desk on a new trading floor has a Cisco IP phone with a PC plugged into its pass-through port. The phone must be authorized with MAB into the voice domain, the PC must pass 802.1X into the data domain, and each needs its own authorization result. Which IBNS 2.0 host mode is designed for one voice device and one data device on the port?
- A regional bank runs a single authentication policy rule backed by an identity source sequence: employees live in Active Directory, auditors in a separate LDAP directory, and a break-glass account sits in the ISE internal user database. Identical service usernames exist in both directories and must resolve to Active Directory. Which sequence order meets all of the bank's login requirements?
- A warehouse added 120 barcode scanners with no 802.1X supplicant, while existing laptops must still authenticate with EAP-TLS. The access template also requires ISE to profile each scanner before it receives a restricted profile. Which port authentication sequence supports this design?
- After joining ISE to the corporate domain, users sign in with their domain accounts but the employee-access rule never matches; the live log shows the identity name with no group attached. The policy team uses native AD identity sources only. Which step in the AD join and group retrieval workflow should the engineer verify first?
- A financial services firm requires the Employee-to-Finance-Server rule to be enforced at the access port, to survive a server readdressing, and to avoid a separate rule hand-entered on every access switch. Which TrustSec enforcement design should be deployed?
- A hospital hands identical access ports to desk phones and to desk PCs, and the security team needs BYOD laptops moved into quarantine VLAN 210 when their identity group changes and authorization is reevaluated. No remediation portal is deployed and no per-application filtering is required. Which authorization result should the authorization profile return to enforce that isolation?
- A manufacturer is standardizing wired ports across three plant floors. Every port must try 802.1X first and fall back to MAB for printers and scanners, hold unauthenticated devices on a restricted pre-authentication VLAN, and move each authorized session to the corporate VLAN with its scalable group tag. Which IBNS 2.0 policy-map and service-template arrangement meets this design?
- A retail chain must authorize warehouse staff whose accounts live in a single OpenLDAP directory. The engineer creates an external LDAP identity source, enters the server address with StartTLS, and supplies a dedicated bind account with read access to the OU holding 4,000 users. Test Connection succeeds. A warehouse worker then signs in with their own directory password. How is the dedicated bind account used during that LDAP sign-in?
- A logistics firm needs one authorization rule to cover every printer that profiling places in the Printer identity group, the same logic must be reusable in a second policy set, and re-patching cables must not change the result. Which condition should be built for that authorization rule?
- A bank merges two divisions into one ISE deployment with separate policy sets for wired, wireless and VPN access. Treasury VLAN and time-based exceptions must win over broad department rules, every session must close with an explicit restricted decision, and access must depend on which identity store authenticated the user. Which policy set ordering and authentication design meets all of these requirements?
- A logistics firm runs an AireOS wireless LAN where corporate laptops authenticate with EAP-TLS certificates and badge printers and cameras rely on MAC authentication bypass. After a posture check, ISE must still be able to push a CoA reauthorization that moves a laptop to a quarantine VLAN. Which WLAN configuration on the WLC supports both client types and that reauthorization?
- A university is enabling 802.1X on access switches serving lecture-hall labs full of printers, badge readers, and unmanaged instruments. For a four-week assessment, no port may lose existing connectivity even when authentication fails or no client answers, yet ISE must log the identity and result of every connection. Which IBNS mode fits the assessment phase?
- A regional bank replaced its campus access switches, while the data-centre access switches run on legacy hardware that lacks TrustSec tagging. Policy requires the Finance SGT to reach the data-centre router so client traffic can be matched by security group on egress. Which SGT propagation method should be used across that segment?
- A university lab wires 200 PCs that already hold addresses in VLAN 200. Any PC reaching a port must be sent to the ISE hotspot portal first, and until the portal is finished it may reach only DNS, DHCP, and the portal itself. The port must stay in VLAN 200 so clients keep their addresses. Which authorization profile combination delivers both the redirect and the filtering?
- A retail chain's WLAN must serve company laptops that already carry machine certificates and guest tablets that hold only a username and password. The security lead wants certificate-based authentication on the corporate SSID, with user passwords kept off the air. Which EAP method should the corporate SSID use?
- A university issues laptop certificates from its internal CA, authenticates 3,000 staff with Active Directory passwords, and runs 20 shared lab logins that exist nowhere else. Which ISE authentication configuration can serve all three groups?
- An engineer is building an authorization rule for the ACME.COM domain and needs every PSN to return the same Active Directory group names. Users authenticate with PEAP-MSCHAPv2 and EAP-TLS, and membership changes as staff move teams. Which ISE configuration makes those AD group strings available to every PSN?
- A manufacturer keeps 2,000 employee accounts in Active Directory and 80 shared machine accounts only in the ISE internal store, and several legacy user names exist in both stores with Active Directory authoritative. Which identity source arrangement should ISE apply to each session?
- A retail bank is wiring open-plan desks where each Cisco IP phone has a desktop PC on its PC port. The phone must be authorized as a device, the PC must complete its own 802.1X exchange with the employee's credentials, and the desk standard allows only one data device per port. Which IBNS 2.0 host mode satisfies all three rules for these desk ports?
- A retail chain tags checkout terminals as POS-SG and its database servers as Servers-SG. Only TCP 443 traffic may leave POS-SG for Servers-SG; everything else must be dropped, and the servers' switch must enforce it from the group tags. The POS-SG to Servers-SG cell reads top down and closes with a deny. Where does the permit entry go in the TrustSec matrix?
- A payment processor protects card data with ISE. Finance analysts authenticate both over the remote-access VPN and at office desk ports, and only sessions that arrive through the VPN concentrators while the user belongs to the AD group CardOps may receive the restricted authorization profile that opens the card-subnet ACL. Which condition should the administrator build for that authorization rule?
- A retail chain is moving 80 stores to 802.1X wired access using its Linux OpenLDAP directory as the identity source. The directory policy disables anonymous binds, the security standard requires that directory traffic and the bind password stay encrypted, and group membership must resolve from the staff subtree. The directory uses standard RFC 2307 POSIX group attributes. Which LDAP identity source settings meet the store chain's requirements?
- A logistics firm is enabling 802.1X on its IBNS 2.0 switches. Voice phones with PCs behind them must authenticate with 802.1X, printers must fall back to MAB, each accepted endpoint must receive its own VLAN, SGT and dACL from ISE, and phones must keep working if ISE is unreachable. Which switch configuration approach satisfies all four requirements?
- A university's first authorization rule in its 802.1X policy set matches every authenticated identity and returns Campus-Access, while a later rule in the same set returns Lab-Spec-42 with its own SGT for the engineering lab group. Lab users still land in Campus-Access. Which change gives the lab group its own authorization result?
- A warehouse is turning on 802.1X across its wireless LAN. Employees authenticate with EAP-TLS certificates, contractors use EAP-PEAP, two ISE policy service nodes provide redundancy, and after posture ISE must change a session's VLAN while the user stays connected. The controller's RADIUS server list is still empty. Which controller RADIUS configuration supports this deployment?
- On ports configured for 802.1X with MAB as the fallback method, a switch sends a RADIUS Access-Request after a device ignores its EAPOL identity requests, and ISE must decide access from what the switch places in that request. Which identity does ISE evaluate to authorize the device?
- A retail chain with 400 stores must roll out wired 802.1X without risking register outages. During the first two weeks every connected device, including unmanaged barcode scanners, must keep passing traffic while ISE records which endpoints fail authentication. Which switch port authorization mode should be enabled for this assessment phase?
- A 300-user insurance firm joins Windows laptops to corp.local for group-based access, keeps ten macOS engineering workstations only in its OpenLDAP directory, and runs forty access switches that must keep authenticating to ISE with EAP-TLS device certificates through quarterly AD maintenance. Administrators signing into ISE also need a second factor. Which combination of identity stores and administrator authentication meets all four requirements?
- A university joins its two ISE nodes to the campus Active Directory domain, and users now authenticate successfully, yet the authorization rule granting wired access to the NET-ENGINEERS group never matches, because the condition simply reads Windows group equals NET-ENGINEERS. The administrator wants membership resolved by ISE from the directory, with no local copy of the users. Which configuration step retrieves that group for policy use?
- A manufacturer is designing WPA2-Enterprise wireless for four thousand staff laptops. Every laptop already holds a user certificate from the corporate internal CA, company policy limits wireless authentication to certificates instead of passwords, and the wireless controller and ISE already present a trusted server certificate. Which EAP method should be selected for the staff WLAN?
- A network operator authenticates every user with PEAP-GTC through one rule: staff accounts exist only in Active Directory, partner accounts only in an LDAP server, and two break-glass admin accounts live inside ISE alone. Groups must come from the store that accepted the user. Which identity source design fits these requirements?
- A hospital access switch must apply three controls from a single authorization profile: place the session in VLAN 120, tag it with SGT 45 for TrustSec, and redirect HTTP to the ISE portal using an ACL already configured on the switch. Which authorization profile result set delivers all three controls together?
- Each analyst desk has an IP phone whose PC port carries a laptop. The phone must be authorized by MAB into the voice domain while the laptop passes 802.1X with EAP-TLS into the data domain, and each device needs its own authorization policy on the same wired port. Which IBNS 2.0 host mode should you enable on the access ports?
- In a hospital refresh, the EHR servers sit behind a firewall that supports SXP, while the server-closet access switches support neither inline SGT tagging nor TrustSec classification and enforcement; a replacement is out of budget this year. ISE learns the authenticated endpoints' IP-to-SGT bindings through RADIUS accounting. The firewall must be able to apply policy using those bindings. Which SGT propagation design should the engineer choose?
- A manufacturer points ISE at its OpenLDAP directory for plant-floor badge logins. The directory has anonymous searches disabled, the engineer wants query rights limited to the user and group branches, and ISE must resolve a user's distinguished name before the password check runs. Which bind account should the ISE identity source use?
- A large university is moving its dorm switches to IBNS 2.0. The team builds a class map that matches MAB sessions, a policy map reacting to session-started and authentication-failure events, and a service template carrying the data VLAN and a device ACL. Which description correctly divides the work on the access port between the policy map and the service template?
- A utilities operator has 1,200 staff in Active Directory whose groups drive authorization, 30 substation device accounts that live only in an OpenLDAP directory, and administrators who must enter an Authenticator-app code after their password. Both directories stay exactly as they are. Which identity store design satisfies all three requirements?
- A regional insurer's access ports serve VoIP phones with no supplicant alongside laptops that must complete 802.1X before any fallback. The phones wait out the full 802.1X failure window before MAB puts them on the voice VLAN, while ISE must still make the authorization call. Which switchport setting change shortens this MAB fallback?
- A hospital segments infusion pumps into SGT PUMP and clinical servers into SGT CLIN, and the matrix cell for PUMP to CLIN permits only HTTPS. Access switches tag frames inline, a TrustSec-capable firewall sits at the server edge, and the auditor wants to know where the deny for everything else is applied. Which component enforces that SGACL on a packet?
- A retail chain is moving its corporate laptops to WPA2-Enterprise on Cisco WLCs with ISE. The laptops carry machine certificates and must authenticate with EAP-TLS, authentication must be handled by ISE rather than the controller, and the controller must accept ISE CoA so access can change mid-session. Which controller configuration satisfies all three requirements for wireless 802.1X?
- A bank must grant the payment-application VLAN only when three conditions hold at once: the user sits in the AD group PAY-ADMINS, the endpoint profile is Corp-Laptop, and the session arrived from the 10.40.0.0/16 branch range. The same decision has to serve wired and wireless policies without duplicated rules. Which policy construct should the engineers build?
Web Auth and Guest Services (15%) · 45 questions
- At a manufacturing plant, contractors plug into the PlantGuest guest ports and must type a username at a captive portal before user traffic flows. The switch must steer the unauthenticated session toward ISE's portal, and after a successful login the live session must be re-evaluated by the guest authorization policy. Which mechanism completes this central web authentication flow?
- A coworking space issues sponsor-created guest passes to visitors meeting on site. Each pass must stay valid for seven days from creation, allow at most four hours of connected time, and free the seat after twenty minutes of inactivity. Which combination of guest time limits meets all three requirements?
- A logistics company is adding guest Wi-Fi at three warehouses, and its design rules say the terms-of-use login page and its processing must run on the ISE node itself, with guest accounts kept in ISE's local guest database. The architect must explain how the guest browser reaches that page and who validates each login. Which ISE web authentication behavior meets both design rules?
- A community college runs central web authentication for guests on its wireless controllers. The splash page opens and the guest credentials are accepted, yet the device stays limited to the portal while the internet remains unreachable. Which message re-authorizes the endpoint after the portal form is submitted?
- A hotel chain is launching sponsored guest Wi-Fi through ISE: staff create accounts in the sponsor portal, and printed QR codes must open a branded page at connect.hotel.example.com. Both portals must run over HTTPS, with the padlock validating cleanly on supported guest devices with current trust stores. Which portal setup serves both pages at the printed name with a clean padlock?
- A hosting company's coordinator has the names of 14 auditors arriving next week. Policy requires a sponsored guest account that expires when the visit ends, and each auditor must be online in the meeting room on arrival with no kiosk stop or approval wait. Which guest access type should ISE use for them?
- A university lets the central help desk create 7-day visitor accounts for anyone on campus, while departmental receptionists may only view, extend and cancel the accounts they created themselves. Both roles must work from the sponsor portal, and auditors need every action tied to a named sponsor. Which sponsor-group design meets these requirements?
- A logistics warehouse enables web authentication on its access switches so contractor laptops can authenticate before touching the warehouse VLAN, and the login page must come from the switch rather than from ISE. Every submitted login still has to appear as an ISE session for auditing. Which statement describes the local web authentication flow used here?
- A weekend technology expo expects several hundred visitors to register themselves at lobby kiosks using only an email address and an acceptable-use page, because no company sponsor will be on the floor after hours. Security still wants every visitor to hold a named, expiring account instead of anonymous access. Which guest access type fits this self-service flow?
- A convention center runs guest Wi-Fi through a sponsor-approved web portal. Walk-in visitors need accounts that switch off when the hall closes, while pre-approved contractors must stay online across the three-day event. Which guest account lifecycle design meets both the expiry and time-limit needs?
- A conference center publishes its branded ISE guest portal at wifi.riverfront-expo.com so visitors can self-register and sponsors can vouch for VIP attendees. Attendees carry personal phones with no enterprise root certificates installed, and organizers want the landing page to open with no browser certificate warning. Which portal configuration meets the certificate and FQDN requirement for the guest landing page?
- A resort chain runs guest Wi-Fi through 40 controllers, each showing its own splash page, and the current flow leaves AUP acceptance unrecorded while returning guests must re-register on every visit. Security wants one portal that records the AUP and lets returning guests authenticate without re-registering until their guest account expires. Which web authentication design should the chain standardize on?
- Reception at a manufacturing plant issues guest accounts to visiting engineers for a single eight-hour shift, and the same engineer often returns the next morning. Accounts stay open indefinitely, so the guest list grows daily and repeat visits create duplicates. Which guest account settings address both problems?
- A private hospital is hosting a two-day clinical conference in its lobby. Every visitor must be approved by a named staff sponsor before joining the guest Wi-Fi, and each session has to end automatically at the close of the conference day. Which guest access design should the ISE team deploy for these visitors?
- A regional clinic runs guest Wi-Fi with central web authentication: the controller redirects the guest's browser to the ISE hotspot portal, the guest accepts the terms, and the login succeeds. Several tablets then keep the pre-authentication policy and never pick up the guest role on the WLAN. Which step of the central web authentication flow should be verified first to apply the post-login result?
- A university helpdesk of nine staff issues visitor passes through the ISE sponsor portal. Every pass must expire within 24 hours, and each created guest must land in the Visitor-Short identity group used by the guest wireless rule. Which ISE element should hold both the duration ceiling and the identity group for the passes they create?
- A boutique hotel wants a branded guest portal at portal.seaview.example, sponsored by the front desk. Guests arrive with their own phones, so the page must open without a certificate warning, the name must resolve on the guest WLAN, and the branded sponsorship page must load instead of the default ISE login. Which DNS, certificate and portal settings are required for the page to open on a guest phone?
- A conference centre must switch on its visitor Wi-Fi on Monday. Walk-in attendees register themselves at a kiosk and go online immediately, visiting contractors must wait for their host's approval, and press badge holders only need to accept a terms page for a four-hour session. Which guest access arrangement matches all three groups?
- A convention center issues sponsor-created guest accounts for a three-day trade show. Visitors arrive at unpredictable times, and every account must stop working at the end of the day it is first used. Which guest account validity setting should the sponsor select when creating the account?
- A boutique hotel runs a single guest SSID on its wireless controllers. Guests must reach an ISE-hosted splash page that validates a voucher code against the ISE guest database before any 802.1X credentials are exchanged, and the controller must hold the client in a webauth state until that check finishes. Which web authentication behavior supports this guest login flow?
- A retail chain wants a branded guest portal at guest.northwind.com, opened on personal phones that carry no company profile, showing the company logo and colours without any certificate warning. Which certificate and naming setup should the guest portal use?
- A hotel hosts a three-day conference and sells Wi-Fi to delegates. Front-desk staff create accounts in advance, every account must stop working by itself when the conference ends, each delegate is limited to one simultaneous session, and logins must stay possible throughout the event. Which guest account design should be configured?
- A hospital runs central web authentication on its guest WLAN. Users reach the splash page and accept the usage terms, and ISE logs an Access-Accept carrying the guest profile, yet the clients stay in the pre-auth role with no internet access. Which step must ISE perform so the controller applies that guest profile to the live session?
- At a regional hospital, front-desk clerks must create 24-hour guest accounts for visiting vendors, while only the IT service desk may extend, disable, or delete an account. Both teams work in the sponsor portal and an auditor reviews changes each week. Which sponsor group permission design enforces these role boundaries?
- A retail chain uses the ISE sponsor portal so store managers can create guest accounts. Corporate requires that each sponsor can issue only their own store's guest type, that every account expires within three days, and that sponsors may manage only the accounts they created themselves. Which ISE configuration enforces all three rules for those sponsors?
- A retail chain hosts its guest and sponsor portals on ISE and publishes one address, guest.retailco.com, in every store redirect. Guests must see a trusted padlock on arrival, the certificate must chain to the corporate issuing CA, and the sponsor links must resolve to that same address. Which certificate and portal URL setup meets all of these requirements?
- A manufacturing plant hosts a different contractor crew each week, none of whom have corporate accounts, and each crew must be approved by the employee who booked the visit and be limited to the booked shift. Which guest type should reception configure to handle these contractor check-ins?
- A logistics warehouse wants visiting drivers to join a guest SSID at a site whose only web server is ISE itself. Each driver enters a name and mobile number on a login page served by ISE, and access must stop after eight hours. Which web authentication design meets these requirements?
- Guests at a warehouse scan a QR code, reach the ISE hotspot page and sign in successfully. ISE then logs a RADIUS Access-Accept, yet the switch keeps them in the pre-auth VLAN and the session stays unchanged. Which part of the central web authentication flow should be verified first?
- A logistics company is branding its guest Wi-Fi. Visitors must open https://guest.northwind.example to self-register, the sponsor approval email links to that same address, and the browser must show a trusted certificate with no name warning. Security policy prohibits wildcard certificates. Today the portal is served with a node certificate that lists only ise01.corp.example. Which certificate and DNS preparation must be completed before the portal goes live?
- A hotel's guest Wi-Fi relies on central web authentication: the controller returns a redirect URL in the first access-accept, and the guest posts credentials at the central portal. Which message completes the central web authentication flow so internet access starts immediately?
- A conference center hosts a three-day summit for 900 attendees. Reception creates each visitor's account from the ISE sponsor portal, and every account must work for only 48 hours from check-in and then expire on its own. The security team has ruled out one event-wide account with a session cap. Which guest account setting enforces the required lifetime?
- A university runs one ISE guest portal for visiting lecturers. The registrar's office creates and extends accounts only for its own visitors, while the events team must issue bulk accounts for conferences and revoke any guest account belonging to its department. Both teams share the same portal page. Which sponsor group configuration meets both teams' permissions?
- A downtown hotel is hosting a two-day fintech conference. Attendees must be approved by a hotel staff member before they reach the internet, each guest account must be valid for no more than one day, and check-in happens at a lobby kiosk. Which guest access design should the hotel administrator use for the conference attendees?
- A conference hotel runs the sponsor portal from two teams: reception creates, extends and prints guest passes all day, while the security desk only reviews and approves visitor records. Today everyone shares one identical set of portal rights. Which sponsor configuration should be applied so each team holds only its own guest permissions?
- A branch office runs central web authentication on its wireless controller: the controller redirects the guest's HTTP request to the ISE hotspot portal, the guest signs the acceptable-use policy, and only then may the guest use the internet-only VLAN behind a restricted ACL. After the portal page closes, the controller still holds the pre-authentication authorization state. Which control applies the new guest VLAN and ACL to that live session?
- An office WLAN must send every unauthenticated browser request to the ISE login page using the controller's own redirect setting, before any RADIUS request is sent. ISE then validates the submitted credentials against its own internal user store, and the controller finishes the RADIUS exchange for the session. Which web authentication mode matches this redirect and credential-handling flow?
- A retail chain wants its guest Wi-Fi landing page served as guest.retailco.example with the company logo, colors and terms text, while ISE sits behind a load balancer address that differs from that name. Which portal configuration will present the trusted branded page to arriving guests?
- A warehouse training room runs wired ports on a Cisco Catalyst switch. Guest devices must see a login page, ISE must validate the submitted credentials against Active Directory, and the switch must apply a restrictive ACL to the authenticated session on the port. The guest VLAN is isolated from the ISE portal service and reaches only the switch itself. Which web authentication design keeps the page reachable while still checking AD and filtering the session?
- A city health centre sees 150 visitors every day. Each visitor must complete registration themselves at the captive portal using their own name and email, receive internet access straight away, and have the account expire the same evening. Which ISE guest access type fits this visitor journey?
- Guest laptops reach the splash page and sign in, yet they stay in the restricted VLAN until the user disconnects and reconnects. The switch performs URL redirect with a central web authentication ACL. Which part of the central web authentication flow should the engineer verify first?
- A regional hospital sponsors outside contractors through the ISE guest portal. Each account must expire seven days after the contractor’s first login, network access is limited to weekdays between 07:00 and 19:00, and each guest may hold only one active session at a time. Which guest type configuration satisfies all three rules?
- A hotel reception desk runs the ISE sponsor portal. Desk clerks must create one-day visitor accounts when guests arrive, only the security manager may extend or revoke those accounts, and only the IT administrator may create or disable sponsor logins. Which sponsor group design applies the required permission split across the three roles?
- A downtown conference center opens guest Wi-Fi to hundreds of visitors who must register from their own phones with a mobile number and then wait for a staff sponsor to approve each request. Traffic must stay blocked until the visitor enters the approved username and password, and every visitor must hold an individually registered account. Which web authentication design meets these guest access requirements?
- A convention center hosts a three-day expo with 600 visitors checking in at a welcome desk. Every visitor needs a named account, and the assigned staff sponsor must approve it from a phone before internet access starts. Which guest access service fits this approval requirement?
Profiler (15%) · 45 questions
- A retailer is profiling printers, IP phones and cameras across 40 stores. Security wants a device labelled as an IP phone only when the combined probe evidence is strong, and weaker evidence should fall through to a catch-all profile. Which configuration detail of the profiling policy sets that bar?
- A university's ISE profiles laptops and printers well, but newly purchased VoIP phones show up as Unknown on day one. The team wants new models classified automatically as hardware ships, wants profiling policies left untouched, and still needs the probe data that authorization decisions rely on. Which profiling feature should they enable for the new VoIP models?
- A university keeps seeing unknown laptops profiled as printers when a single DHCP fingerprint matches the printer rule. The team wants a profile applied only when the strongest probe evidence clears a confidence threshold, with weaker evidence falling through to the unknown category. Which profiling policy control provides that gating in ISE?
- A 900-bed hospital must keep 40 infusion pumps matching its Medical-Devices authorization rule. The pumps roam across three floors, take addresses from several subnets, and change DHCP fingerprints after firmware updates, while the same vendor's barcode scanners share their MAC OUI. Which endpoint identity approach holds these pumps in one group?
- A hospital's medical devices sit on a VLAN whose SVI relays DHCP to a central server, and profiling must use the DHCP fingerprint plus the HTTP User-Agent string from that same VLAN. The PSN serving these sessions is 10.5.20.15. Which DHCP helper and SPAN setup feeds both profiling probes?
- A residence-hall network must profile wireless IoT sensors before they reach the building-automation VLAN. The sensors always request their address with DHCP and include a vendor class identifier and a parameter request list, but they generate no HTTP sessions, expose no SNMP service, and drop all active scans. Which ISE profiling probe supplies the attributes that identify these sensors?
- A hospital admits infusion pumps with MAB and laptops with 802.1X. After a profiler update reclassifies an admitted pump, the new authorization must apply immediately, but a reauthentication request leaves its session unchanged, the pump sits idle for minutes, and it must return to service without any manual clearing. Which CoA type should ISE send for that pump?
- A logistics warehouse uses ISE to profile 3,000 scanners, badge readers and IP cameras. Newer models keep landing in the Unknown group because the local profile list lags behind, the team has no time for manual imports, and outbound HTTPS is permitted only from ISE nodes in the services segment. The primary PAN is in that segment. Which profiling service should you turn on to keep device profiles current?
- A media studio's AV network has 40 static-addressed devices: mixers, lighting desks and display screens. They authenticate with MAB, run without SNMP, and stay silent on DHCP and HTTP. Profiling falls back to the MAC OUI and groups them as unknown, yet each device answers connection attempts on its control port. Which probe should be enabled to collect attributes that separate these device types?
- A regional hospital rolled out dozens of new biomedical monitors and digital displays this quarter, and ISE keeps dropping them into the Unknown profile because their MAC OUI prefixes and HTTP user-agent strings are new. The team edits profiling rules every week and wants updated vendor fingerprint data to arrive on its own while the switch configuration stays untouched. Which ISE capability should the team enable to keep that fingerprint data current?
- A hospital network spans twelve VLANs served by one central DHCP server, and ISE in the data center must profile those endpoints for device-based policy. Operations has ruled out SPAN sessions that mirror uplink traffic because the collector links are already saturated. Which configuration delivers DHCP probe data to ISE on every subnet?
- The ISE profiler combines evidence from DHCP, HTTP, SNMP and NetBIOS probes when it evaluates a profiling policy, and different profiles can match the same device to different degrees. Which statement correctly describes how ISE derives a profile's certainty factor?
- A regional hospital has 36 label printers whose MAC addresses are already recorded. A printer authorization rule must match a Medical Printers endpoint identity group, and that membership must hold even if a new profiling sensor later changes each printer's profile. Which ISE setting keeps each printer in the Medical Printers endpoint identity group when profiling runs again?
- On a factory floor, 60 VoIP phones register through MAB and produce only DHCP traffic, with option 60 in each request. The profile must match on that vendor class value to place the phones in the voice policy. Which profiling probe supplies the option 60 value to the policy?
- A warehouse label printer authenticates through MAB and is being moved into a quarantine policy that places it in a different VLAN with its own subnet. The printer keeps the address it already has unless the interface link drops, so the new policy alone would leave it addressing the old subnet. Which CoA action should ISE send so the printer re-learns its address in quarantine?
- An ISE profiler leaves a plant gateway unclassified even though the team's leaf profile matches on sysDescr. The gateway has a fixed address, answers SNMP queries, and keeps its web interface closed. Which probe supplies the attributes that this match needs?
- Your core switch routes three client VLANs for data, voice and printers, and ISE profiles most endpoints as Unknown. Laptops send full DHCP option 55, printers rarely renew but do send HTTP user-agent strings, and the existing DHCP server must keep serving leases. Mirrored copies can be lost at peak, so DHCP from all three client VLANs must reach ISE by relay. Which setup feeds ISE that relayed DHCP plus the printers' HTTP data?
- A hospital runs DHCP, HTTP, SNMP and NetFlow profiling probes across 4,000 endpoints, yet many bedside infusion pumps land in the Unknown profile with out-of-date vendor attribution. The pump vendor forbids active scanning of the bedside VLAN, and the engineer has no time to rewrite profiling rules. Which endpoint profiling data source should be refreshed to give ISE current context for these devices?
- In a campus building the profiler labels every VoIP phone as an unknown endpoint because the policy matches only the HTTP user-agent from a web probe. The security lead wants a phone profile applied only when several independent probes support the match. Which profiling policy setting and conditions should the engineer change to raise profile certainty?
- A factory floor runs 200 badge printers on a single VLAN. The access switches relay DHCP to two Microsoft DHCP servers, so ISE's DHCP probe never receives a copy, and profiling must settle from the first lease. Which switch change will deliver the DHCP probe data that ISE needs to profile these printers?
- After a profiling update, an office laptop and a lobby camera both need new authorization right away. The laptop's 802.1X supplicant supports reauthentication and its live session must stay up. The camera is a MAB endpoint whose firmware never re-registers unless its port link drops. Which CoA action should ISE apply to each session?
- Profiling logs in a campus building show no DHCP data from the client VLANs, whose SVIs relay only to the corporate server, and nothing at all from a legacy segment of static scanners that emit CDP and HTTP. The switch there supports only port mirroring. Which change gives ISE both missing feeds?
- A hospital has 30 infusion pumps that use MAB only, emit no DHCP or HTTP data, and do not respond to any enabled profiling probes, so profiling labels them unknown. The rule granting the medical VLAN keys on Endpoint Identity Group = Medical Devices, and access-switch ports must not change. Which endpoint identity management change places these pumps on the medical VLAN?
- A warehouse deploys barcode scanners joined by MAC authentication with no supplicant, no browser and no SNMP agent, and they only ever send DHCP requests containing vendor parameters. Profiling must classify them on the first connection, while active port scanning is blocked on that WLAN. Which probe supplies the attribute ISE should use to fingerprint the scanners?
- A logistics company runs MAB for handheld barcode scanners. When profiling finishes, ISE learns a scanner's true vendor and must push the corrected authorization to the live session right away, but the handheld must stay connected, keep its DHCP lease, and see no interruption on the port. Which CoA message should ISE send to the switch?
- A university runs profiler-based identity across its campus LAN, where probe data sorts most devices into endpoint identity groups. Four laser printers run vendor firmware that sometimes omits those attributes, and print services needs their endpoint records to sit in the Legacy-Printers group for reporting. Which endpoint assignment approach keeps that group stable?
- A logistics warehouse runs MAB for 600 handheld scanners and label printers whose access ports carry no supplicant traffic. ISE receives only the device MAC address in the RADIUS request, so every device falls into the Unknown profile and lands in the quarantine VLAN. The scanners obtain addresses from DHCP and broadcast hostname and vendor-class data. Which profiling feed must reach ISE so its rules can use that broadcast evidence?
- A retail chain's stockroom connects wired label printers through MAB, and ISE has just re-profiled the fleet into the printer category. The printers must pick up addresses from the new printer scope, each port serves a single printer, and the link must recover with no technician on site. Which CoA action should ISE send so the printers take on the new profile and refresh their addresses?
- A retail chain's Layer 3 access switch serves 60 VoIP phones and badge readers on VLAN 130. The DHCP server sits in the central data center on another subnet, no ip helper-address is configured yet, and every lease must be relayed there while ISE receives only standard RADIUS attributes from the switch. Which configuration both keeps leases central and feeds the DHCP hostname and vendor-class options to the ISE profiler?
- A hospital profiles IP cameras and VoIP phones with ISE. The camera profile currently matches only the HTTP user-agent, but the cameras stop sending HTTP after they are installed. Which profiling design keeps the assigned certainty factor reliable for these endpoints?
- A hospital placed 300 unmanaged infusion pumps and label printers on a monitoring VLAN. They get static addresses, ignore SNMP queries, send no web traffic, and skip 802.1X, yet each model exposes a different set of open TCP ports. Which probe should supply the profiling attributes for these devices?
- A university profiles thousands of BYOD laptops, and many match one broad condition that labels them as Cisco IP phones with a low certainty factor, feeding them into the wrong authorization rule. Which profiler policy control should be used so weak evidence leaves endpoints Unknown?
- A warehouse deployed 60 handheld barcode scanners, but the ISE profiler places them in the Printers endpoint identity group because their DHCP fingerprint matches that template. Policy requires every scanner to land in the Handheld Devices group before authorization rules run, and the profiler must never move them afterward. Which endpoint identity management approach guarantees that group membership?
- A city library runs ISE across twelve branches. The self-service kiosks all use one MAC range, but after firmware updates the profiler labels them printer one week and unmanaged device the next, so they drift between endpoint identity groups. Both the circulation access rule and the monthly asset report read the endpoint identity group Kiosks, so membership must hold across profiling cycles. Which assignment method pins every kiosk to that group?
- A warehouse has profiled scanners and IP phones correctly for years, but a new shipment of handhelds from a second vendor lands in the generic default profile. The team wants ISE to recognize new hardware when Cisco publishes matching profile updates, without anyone hand-editing classifier rules for every model. Which profiler capability should they enable?
- A state university's campus network gains new printer, sensor and lab-device models every term, yet its profiling rules still recognize most of them only by MAC prefix and sort them into a generic profile. The team wants the knowledge base to keep pace with vendors without staff upkeep, SNMP replies from the instrument subnet fail to reach ISE, and ISE can reach Cisco's update servers. Which profiling feature should the team enable to raise classification accuracy?
- A warehouse runs ISE with profiling enabled. A Cisco VoIP handset with an active call is re-profiled into a new authorization profile, and the switch can reauthenticate it. A label printer found on the wrong VLAN ignores reauthentication but re-enters authentication after a port bounce. A quarantined scanner must have its live session ended at the switch instead of being re-admitted under another profile. Which CoA action applies to each endpoint?
- A clinic network runs a central ISE policy service node in the data center, and profiling must classify printers and IP phones across twelve access switches. Both SPAN destination ports on every access switch are already used by the network analyzer, the routed client interfaces on the distribution layer already relay DHCP to a remote server, and the profiler needs DHCP option fingerprints plus the printer HTTP user-agent strings. Which probe and helper design should be configured for the ISE profiler?
- A campus ISE deployment classifies VoIP phones correctly, but a new batch of laser printers lands in the Unknown profile because the DHCP fingerprint selector matches only a few of them. The access team wants higher confidence before granting printing access. Which profiling change should the engineer make first?
- A county hospital's profiler labels infusion pumps and tablets as unknown because its policies match only on the MAC OUI. The team wants the browser and OS string a device advertises in an unencrypted HTTP request, so profiles can match on that value instead. Which probe supplies that profiling attribute?
- At a university engineering lab, ISE profiles wired endpoints behind Cisco switches. A conference IP phone has been recategorized and needs a new dACL on its existing session, an access point must switch from MAB to 802.1X, and a laptop tied to an incident must have its live session ended immediately. Which CoA action fits each of the three cases?
- A logistics warehouse added IP cameras from a vendor that ISE has never seen, so they profile as generic printers and land in the printer VLAN. The security lead wants new device types and MAC maker prefixes to arrive from Cisco on a schedule rather than the team hand-writing rules each quarter. Which ISE feature delivers those profiling updates?
- A campus network engineer is tuning the ISE profiler for a lab subnet holding 40 laser printers and 300 workstations. The printers send only plain address requests, nobody browses to them, and their SNMP community is unknown, but they do accept TCP connections on ports 9100 and 515. Which probe should the engineer enable so the printers match a profile?
- In a warehouse, label printers and handheld scanners both land in the generic endpoint profile, so the printer-only authorization rule stays untested. The scanners must stay out of the printer profile. Only DHCP and SNMP data reach ISE for these label printers, with HTTP and DNS data absent. Which profiling policy change gives the printer profile enough certainty to win?
- A hospital has 40 infusion pumps that must always match an authorization rule keyed on a restricted endpoint identity group, because moving them breaks the clinical VLAN policy. During a firmware rollout the profiler sees incomplete DHCP data for these devices. Which endpoint identity assignment keeps the group membership stable?
BYOD (15%) · 45 questions
- A regional hospital wants staff to use personal phones and tablets on the corporate Wi-Fi while those devices stay outside mobile device management. Self-registration must be limited to employees who sign in first, and every device must receive its own client certificate for network access. Which BYOD onboarding capability delivers all three requirements at once?
- A hospital is switching on BYOD onboarding for its clinical access switches. Clients must receive an address by DHCP, resolve the portal name with the internal DNS server at 10.10.0.10, and reach the onboarding portal on PSN 10.10.50.10 over TCP 80 and 443 while staying blocked from everything else until onboarding finishes. Which pre-authentication ACL belongs on those access ports?
- An insurance firm allows staff to use personal phones on the corporate WLAN. Policy says each phone must end up with its own certificate-based identity rather than the employee's password, and phones that skip onboarding must stay on limited access. Which BYOD onboarding flow gives each phone its own certificate while keeping skipped phones limited?
- A 120-person design firm wants staff to self-onboard personal laptops and phones to corporate Wi-Fi using certificate-based EAP-TLS, with certificates issued by ISE itself and almost no help-desk time. Which BYOD component set in ISE delivers that onboarding?
- An ISE BYOD deployment limits each employee to two registered personal devices. An employee who has hit the limit wants to add a new tablet and no longer carries an older phone that is still listed. Which BYOD device-lifecycle action should the engineer take first?
- A regional bank lets staff use personal laptops on the corporate WLAN and wants the whole registration flow to live on that one network. Users join a single SSID, land on the BYOD portal, install a provisioning profile, then reconnect using the certificate the internal CA issued. Which BYOD onboarding pattern fits a single SSID with certificate-based return access?
- A regional airline issues company tablets to cabin crew and lets staff use personal phones for email and the crew portal. Staff must enroll their own devices, access must survive restarts with no credential prompts, a single lost device must be revocable, and identity must resist MAC-address cloning. Which BYOD capability meets these requirements?
- A state university lets personal devices onto its secure WPA2-Enterprise network, but campus RF policy allows no SSID beyond the existing secure network and the visitor network, and employees are barred from onboarding over the visitor network. The devices have no MDM, every one of them supports 802.1X and can initially authenticate with employee credentials using a certificate-free EAP method, and each must end up holding an ISE-issued device certificate for EAP-TLS. Which BYOD flow meets these constraints?
- A design agency wants 120 employees to use personal laptops on the corporate WLAN. Staff must enroll and remove their own devices without IT visiting each desk, access must be EAP-TLS with a per-user certificate from the company's own CA, and every registered device must remain listed while registered. Which BYOD components in ISE meet these enrollment requirements?
- A university runs BYOD on a Catalyst access switch and a 9800 WLC. Students authenticate with 802.1X and should be sent to the ISE onboarding page as soon as they join, while DHCP, DNS and portal traffic must still pass before authorization completes. Which redirect ACL design works on both the switch and the controller?
- A 400-bed hospital is enabling BYOD with ISE and EAP-TLS. Laptops enroll through SCEP against the hospital's internal Microsoft CA and receive a user certificate, yet ISE rejects every session because it cannot build a trusted chain to the issuing CA. The team must keep the existing CA hierarchy and let devices enroll unattended. Which change makes ISE trust the endpoint certificates issued during BYOD enrollment?
- A 300-person design agency wants staff laptops to join WPA2-Enterprise using EAP-TLS. IT will not ask users to install certificates by hand, and the issuing CA must be ISE itself. On first connection each laptop walks through registration, receives its supplicant settings, and is issued a certificate before normal access is granted. Which ISE components complete this first-time BYOD onboarding flow?
- An employee reports a missing laptop during a security review. The laptop holds a BYOD certificate issued through ISE, and the same user still carries a phone and a tablet that must keep working. The team needs to end the lost laptop's EAP-TLS access while the user's other registered devices continue normally. Which BYOD lifecycle action should the analyst take?
- A hospital wants company laptops and staff-owned phones to share one SSID so the WLAN build stays identical across twelve sites. Staff must sign in with their directory account over 802.1X on that SSID, then register the personal device so it reconnects on its own, while visitors stay on a separate network. Which BYOD design delivers that single-SSID flow?
- A 200-person software firm wants personal laptops on the secure WLAN using EAP-TLS instead of a shared key. Staff can self-serve through a portal, but IT has refused to install software or certificates by hand on every laptop. Which BYOD enrollment path gives each user a certificate-based 802.1X identity with the least manual work?
- Your controller runs an employee WLAN with EAP-TLS and a separate BYOD WLAN where laptops open the portal, enrol with the internal CA, then rejoin with a certificate. On the BYOD WLAN, DNS and DHCP must keep working during the wait, the HTTPS portal must be reachable, authorized devices must work without a second redirect, and the employee WLAN must stay untouched. How must the redirect ACL be scoped and what should it permit?
- A logistics company is starting BYOD, and policy requires every certificate to be issued by ISE itself, with outside certificate authorities out of scope for this budget cycle. Phones must verify the ISE server during EAP-TLS, ISE must validate each issued endpoint certificate, and users must enroll on their own without a help-desk ticket. Which certificate design meets these BYOD requirements?
- A design firm will broadcast only one SSID: WPA2-Enterprise for 45 employees bringing personal laptops and phones. IT requires 802.1X on that SSID and wants employees to register their own device over the air and then keep working on the same SSID with device rights. Which BYOD flow fits these requirements?
- A regional hospital is onboarding 400 clinician iPads to BYOD. The devices sit outside the domain, keys must be generated on each iPad, the identity must come from the corporate Windows CA, and the tablet has to trust that CA before it accepts the profile. Which certificate template design supports this enrollment?
- A bank lets staff use personal laptops and tablets on the corporate WLAN. Each user must run a self-service enrollment once at onboarding that installs a client certificate, and every enrolled device must land in a role that reaches business services rather than the whole corporate network. Which ISE BYOD onboarding design satisfies the enrollment, certificate, and access requirements?
- A retail chain runs BYOD on Cisco 9200 switches in the stockroom and a 9800 controller on the sales floor, both redirecting to ISE. Onboarding needs the portal reached over HTTPS, names resolved first, and everything else blocked before registration. Which redirect ACL design satisfies those three requirements on both platforms?
- A regional clinic can broadcast only one staff SSID. Laptops already authenticate to it with 802.1X, while staff phones arrive unenrolled and must pass through ISE's onboarding portal to receive certificates before they are trusted. Which BYOD flow fits this single-SSID site?
- A company lets employees register personal laptops in the ISE My Devices Portal, and each person may enroll several devices. One employee is returning a company laptop to IT, so only that laptop's registration should be removed while the person's phone and tablet keep their registered access. Which action revokes this single device's BYOD registration?
- A logistics firm enables BYOD onboarding on its Cisco access ports. Any device that fails 802.1X must reach the ISE self-registration portal, resolve that portal by name over DNS, download its provisioning profile from ISE's internal CA, and remain isolated from internal application servers until onboarding completes. Which policy design meets these requirements?
- A design agency with 600 personal phones and tablets allows BYOD on the corporate WLAN. Staff open the BYOD portal from the guest page, accept the usage terms, and register the device; every certificate must come from ISE's internal CA and arrive through the self-service flow, and each device must authenticate with its own certificate rather than the employee's directory password. Which BYOD component sequence delivers that certificate?
- A regional insurer lets each employee register up to three personal devices through the BYOD portal and remove their own devices through that same portal instead of a service ticket. When a device is lost or reassigned, revoking it must cut access right away, and that device must re-enroll before it returns. Which BYOD lifecycle design satisfies both the device limit and the revocation flow?
- A university is starting BYOD onboarding for student laptops. The registration pages must open without any browser certificate warning, the certificates issued to endpoints must come from an ISE certificate template, and ISE must accept those endpoint certificates for EAP-TLS afterwards. Which certificate configuration satisfies all three requirements?
- A university enables BYOD on the campus wireless network and on wired dormitory ports. Endpoints must be redirected to the ISE onboarding portal before they gain access, and during registration they must get an address, reach DNS, the ISE portals and an internal issuing CA on a separate subnet to install their certificate. Everything else stays blocked until onboarding finishes. Which pre-auth ACL content allows registration while keeping the port locked down?
- A retail chain is starting BYOD across 120 stores. Laptops enroll at the ISE BYOD portal, the corporate CA signs each device certificate through SCEP, and ISE's EAP server certificate comes from that same corporate CA. Each issued certificate must carry the signed-in employee's identity, and both sides must validate the certificate the other presents. Which certificate template and trust configuration covers every check?
- A 300-person company onboards devices using ISE and its WLAN controller only, and wants employees to register personal phones, receive the wireless settings automatically, and have the endpoint record tied to the person who registered it. Which ISE BYOD use case should be configured?
- A telecom's field engineers each carry a company phone and a personal laptop, both onboarded through BYOD and listed under their internal user record. One laptop is reported stolen, and policy requires that only that laptop stops authenticating, the phone keeps working, the laptop must re-enroll before rejoining, and a replacement can still be registered. Which ISE action satisfies all four requirements?
- A municipal office must let staff self-register personal laptops on the corporate WLAN. The building contract allows only one SSID per floor, and policy requires every BYOD device to hold a certificate from the internal CA before it can reach file shares. Which BYOD registration flow meets all three requirements?
- A 300-person finance firm wants staff to use personal laptops and phones on the corporate WLAN. Each device must sign in with the employee's directory credentials, receive a device identity certificate during onboarding, land in a limited-access segment, and keep the user in full control of the device. Which BYOD use case in ISE meets all four requirements?
- A 400-person insurer is turning on BYOD self-registration for personal phones. During onboarding each phone must receive a client certificate that ISE will accept for EAP-TLS, the phone must verify ISE's server certificate during the TLS handshake, and the certificates must be issued by ISE's internal CA, and the security team requires each phone to build its own trust chain. Which certificate arrangement satisfies the BYOD trust requirements?
- A 400-person insurer runs ISE BYOD with the per-user registration limit set to two devices. An analyst has a laptop and a phone registered, has lost the phone, and wants to onboard a tablet this morning, but the My Devices portal refuses the third registration. Which action lets the analyst register the tablet while revoking the lost phone?
- Your company is starting a BYOD program for 400 employee laptops that must join the corporate WLAN with 802.1X EAP-TLS. The security lead wants certificate lifecycle and user enrollment handled inside ISE through a guided browser flow rather than emailed files. Which BYOD component workflow should you design for supplicant and certificate provisioning?
- A 120-person law firm lets partners use their own laptops to reach the document portal, and each laptop must pass 802.1X using a device certificate. IT requires that personal hardware stay free of MDM enrollment. Which BYOD registration approach should the firm use for the personal laptops?
- A 400-person firm runs ISE as its only infrastructure beyond the network gear, so every certificate and profile must come from ISE itself. Staff must register their own smartphones from a web portal, have the 802.1X supplicant configured automatically for certificate-based login, and receive a device certificate while onboarding on their own. Which ISE BYOD component delivers this workflow?
- A bank is rolling out BYOD onboarding on Catalyst access switches, with the ISE internal CA issuing device certificates. Unauthenticated laptops must still resolve DNS and reach the BYOD portal, traffic headed to the ISE server stays outside the redirect match, and the switch must intercept browser requests on standard web ports. Which switch-side redirect configuration should be deployed for BYOD onboarding?
- A regional hospital wants staff using personal phones on the corporate WLAN. Staff must enroll their own devices themselves, with the help desk out of the loop, each phone must connect with EAP-TLS using a certificate issued during that enrollment, and the resulting access must follow the user's identity group rather than the phone's MAC address. Which ISE BYOD provisioning workflow meets all three needs?
- A hospital wants a single wireless network name for staff and personal devices. Employees with unregistered phones must reach a portal, install the onboarding profile, then connect with certificate-based authentication without joining a second network. Which single-SSID BYOD onboarding flow should be configured?
- A bank lets staff keep personal laptops registered through the ISE My Devices portal, and only registered endpoints may reach the finance VLAN. One analyst is retiring her laptop today, her company tablet must keep finance access for another month, and IT's inventory must show the laptop as unregistered. Which BYOD action delivers the right revocation scope?
- A distribution centre is adding ISE-based BYOD to its wireless network, but the site broadcasts a single SSID: 200 handheld scanners were provisioned with that exact profile and the reconfiguration window has closed. Staff must still earn a client certificate before they reach the inventory VLAN, so first-time users need a guided onboarding path. Which BYOD flow fits this one-SSID deployment?
- A 400-person law firm is moving associates' personal phones and laptops off the open guest WLAN. The devices sit outside the corporate domain, IT refuses to walk users through manual certificate steps, and every onboarded device must later authenticate to the corporate SSID with a certificate ISE issues. Which BYOD onboarding design meets those requirements?
- A fintech firm rolls out BYOD with EAP-TLS, and every laptop receives a certificate from the corporate issuing CA during registration. The supplicants accept ISE's server certificate, but ISE rejects the laptop certificates as untrusted. Which trust relationship must ISE hold to validate the endpoint certificates?
Endpoint Compliance (10%) · 30 questions
- Posture in ISE keeps requirement definitions separate from the code that runs checks on the endpoint. A hospital wants its full-disk encryption and antivirus checks to stay current as new Windows 10 and macOS builds ship, with every requirement authored in one place inside ISE. Which source defines the posture requirements that the endpoint agent evaluates?
- A logistics company requires Windows laptops to pass a disk-encryption check before reaching the file share. Laptops missing the compliance agent must be steered to a download page, the agent then reports its result, and the live session must pick up the new policy without waiting for the next periodic reauthentication. Which posture workflow sequence applies?
- A hospital runs agent-based posture with Cisco Secure Client. Endpoints missing the mandated protection update must keep limited access for a short window while IT repairs them, users must see the repair steps, and the endpoint must be rechecked automatically once it is fixed. Which combination of posture and access settings delivers all three behaviours?
- An automotive plant turns on posture checking for its plant-floor laptops over 802.1X. Windows machines are offered the Cisco Secure Client posture module, but the handful of macOS laptops land on a provisioning page that returns a 404, since the deployment offers a package only for Windows. Which change delivers the right agent package to each operating system?
- A regional hospital must place clinical laptops on the app VLAN only when an EDR service is running and the OS patch level meets the current baseline. Laptops failing either check must be sent to a remediation page offering the EDR installer and the patch download. Which ISE posturing design produces that single pass or fail decision?
- A bank applies ISE posture to Windows and macOS laptops. Endpoints whose agent satisfies every required check reach the corporate VLAN, and endpoints whose agent reports a failed check go to a remediation VLAN. Endpoints with no agent installed or with no posture assessment completed must get that same remediation access but be flagged for an onboarding ticket. Which posture result fits that third case?
- A pharmacy chain runs 150 Windows point-of-sale terminals that already have the ISE posture agent installed. Before each terminal reaches the payment systems, three checks must all pass: the vendor agent file exists, anti-malware is current, and the required hotfix is installed. Which posture construct delivers that single all-or-nothing compliance decision?
- A company runs ISE with Secure Client deployed on every laptop. When a laptop fails the antivirus version check, security wants it restricted without bouncing the switch port, and returned to full access after reassessment passes. Which posture flow meets both requirements?
- A healthcare group requires laptops to run the corporate EDR agent and have disk encryption before touching patient systems. Machines that fail must land in a limited-access VLAN and get the missing agent installed automatically. Which posture policy design meets all four requirements?
- A regional hospital requires three posture outcomes for clinician laptops: Compliant receives full EMR access, Unknown receives a restricted VLAN with internet only, and Non-Compliant is sent to the remediation portal. Which authorization design enforces all three posture outcomes exactly as stated?
- A county government issues 400 Windows 11 laptops that are joined to the domain, and its 60 iPads must reach the same wireless network with no software installed. ISE should deliver the posture module to the laptops automatically on their first connection, and it offers the module through a provisioning step after the Access-Accept. Which factor decides which agent package an endpoint is offered?
- A plant's security team is standing up posture for 500 Windows laptops that must show full-disk encryption and current Windows security updates. They want the requirement definitions and compliance checks offered for their ISE release to be the newest published ones. Which ISE source supplies that current posture content?
- A post-production studio gates its master-footage VLAN with ISE posture. Every edit workstation must run the studio EDR with real-time scanning active; when that service stops, the editor gets a guided automatic fix and a fresh compliance check, while limited access applies until the recheck passes. Which ISE posture element performs the fix?
- A logistics firm opens its corporate WLAN to managed laptops only after a posture check passes. Laptops with disk encryption and the endpoint agent must reach full access, laptops failing a check must land in a remediation quarantine right away, and laptops whose agent stays silent must receive limited access as an unresolved case. Which posture result mapping should the policy enforce?
- A hospital requires posture checks for clinicians on the corporate WLAN. A doctor's laptop joins the SSID before anyone installs Cisco Secure Client, so the authorization rule returns a URL redirect to the client provisioning portal. The laptop installs the posture module and reports compliant, yet its session still holds the limited role from the first authentication, and clinicians need full access the moment compliance is reported. Which step completes the posture flow at this point?
- A healthcare company must check every laptop's antivirus and disk-encryption products each morning and keep ISE's support information aligned with newly published Cisco posture updates. Which component should be updated to keep that information current?
- A hospital is enabling posture for wired and wireless users. Windows and macOS laptops must be offered the Cisco Secure Client posture module after the user signs in to the provisioning portal. Which ISE policy decides which client package each endpoint receives?
- A university runs ISE posture over staff laptops and wants the posture library managed from one place. Requirement and agent definitions must refresh automatically, every policy node must serve the same definitions, and the refresh must run server-side without waiting for laptops to connect. Which Posture Work Center configuration meets all of these requirements?
- Windows laptops join the secure WLAN but only reach the remediation network, because the installer download never starts even though the session matches the rule that requires compliance. Which control decides which agent ISE offers after the session is redirected to provisioning?
- A hospital radiology laptop fails the disk-encryption posture check after a vendor driver update hides the drive from the agent. The vendor patch ships in four days, and security needs normal access for exactly that period, then an automatic return to a failed result if the check still fails. Which Posture Work Center configuration provides that time-bound behaviour?
- An insurance firm runs posture on its wired ports. Endpoints authenticate with EAP-TLS and sit on a quarantine VLAN until Secure Client reports its posture result, after which the switch must update the live session immediately without anyone reconnecting. Users report they stay quarantined until someone unplugs the cable. Which control makes ISE re-evaluate the session after the posture check passes?
- A food distributor wants three outcomes on the plant floor: laptops with current antivirus and the host firewall enabled get full access, laptops missing either one get access only to a patch server, and personal devices where no assessment agent can run get access to the update service until an admin reviews them. Which posture design maps these three results correctly?
- A manufacturer requires laptops to run the host firewall and current antivirus before opening the file share, while laptops that fail the posture check must still reach the update servers to repair themselves. Which posture policy design meets both requirements?
- A regional hospital runs ISE posture before granting clinical app access. Its posture support data is several releases old, nurses use Windows laptops, and radiology uses Macs. Both groups must pass antivirus and host firewall checks today, and the team wants ISE to recognize new product versions without manually maintaining product support data. Which step keeps ISE's posture support current?
- A hospital wants VPN posture so that fully patched laptops receive full network access, laptops with one failed check are sent to a remediation server, and devices with no posture agent still reach email only. Your policy must express all three outcomes distinctly so the help desk can tell them apart. Which posture policy structure should you configure in ISE?
- A healthcare firm's posture policy must treat a Windows laptop as compliant only when antivirus is installed, definitions are current, and real-time scanning is on. Endpoints failing any check should reach a remediation server to self-fix, while endpoints with no posture agent must stay on limited network access. Which posture requirement and action set should be configured?
- A logistics firm's posture policy must check Windows 11 laptops and macOS laptops for disk encryption and current antivirus. No device has a client yet, checks must run again after every reboot when the device reconnects, and IT allows installs only from the ISE server itself. Which client provisioning design meets these needs?
- A regional hospital is enabling ISE posture for clinicians' laptops before they reach the electronic-records VLAN. Every laptop must show a current antivirus product and full-disk encryption, and ISE must keep its list of acceptable antivirus builds current as vendors release them. Which posture configuration supplies that application data to the compliance checks?
- A defense contractor runs ISE inside a network that has no route to the internet. The posture library still checks an antivirus version the company retired two years ago, and the team wants Cisco's updated checks and rules without hand-writing them for each product. Which posture update method fits this isolated environment?
- A manufacturer wants posture on the plant WLAN. Endpoints that have yet to install the posture agent must keep limited access while they reach ISE's download portal, the assessment must actually run on the device after Secure Client installs, and ISE must re-authorize the session by CoA once the result arrives. Which posture flow sequence should be configured?
Network Access Device Administration (10%) · 30 questions
- A hospital must place 900 nurses' devices on EAP-TLS 802.1X through ISE while only senior engineers change switch configurations. Every configuration command has to reach the audit log, and administrative traffic must be encrypted beyond the password. Which AAA protocol assignment should the team configure?
- A regional bank is granting its service desk engineers Level 15 access to 60 access switches through ISE TACACS+. Policy requires them to view the running configuration and test reachability, with every configuration change and device restart blocked. Which ISE TACACS+ control enforces this per-command restriction?
- A campus team is moving 40 access switches from enable passwords to ISE for TACACS+ device administration, with shell profiles granting privilege 15 to the network operations group. Operations requires that administrators can still log in over SSH when an ISE node is unreachable during a maintenance window. Which switch AAA configuration delivers ISE device administration with local fallback?
- A regional bank must show auditors both the start and end of every admin session on its campus switches and each privileged command with its arguments, stored centrally. Engineers already authenticate to ISE over TACACS+. Which TACACS+ accounting configuration satisfies the audit?
- A hospital network team is moving switch and router CLI access onto ISE. Their security policy requires per-command authorization of every administrator command plus a full audit trail, and every packet exchanged with the AAA server must be encrypted. The devices must also keep accounting records for sessions that run overnight. Which AAA protocol should they configure on the network devices?
- A managed service provider runs TACACS+ device administration in ISE, with every administrator authenticating against Active Directory. NetOps members must reach privilege 15 on the access switches, while Helpdesk members must sit at privilege 1 with only show commands on those same switches. Which ISE design delivers these two shell outcomes through the device admin policy set?
- A regional bank runs 802.1X on its access switches with RADIUS sessions landing in ISE, while engineers configure routers and firewalls over SSH from a jump host. The security lead wants every configuration command approved before it runs and recorded afterward, with both AAA services administered from the same ISE console. Which AAA protocol should serve the device administration sessions?
- A service provider manages 400 routers and switches through ISE TACACS+ device administration. Tier-1 engineers must be able to run any show command and ping, but every configuration command has to be refused, and each refused attempt must show up in ISE monitoring rather than only on the device. Which TACACS+ element should carry these tier-1 command restrictions?
- A regional hospital is replacing local enable secrets with TACACS+ device administration in ISE. Network engineers must apply configuration changes on switches, routers, and firewalls, while NOC analysts using the same jump hosts may run only show, ping, and traceroute commands. Both teams authenticate against one Active Directory domain through a single device administration workflow. Which policy set and shell profile design should the hospital deploy?
- A regional bank is moving administrator access for 60 routers and switches into Cisco ISE. Policy requires that a SPAN capture show no clear-text passwords or commands, that every privileged command be authorized individually, and that rights for all 60 devices change in one place. Which AAA protocol meets these device-administration requirements?
- A 200-switch hospital campus is moving admin login from local accounts to ISE TACACS+, while command authorization stays on ISE. Each switch already keeps one emergency privilege 15 username, and that account must still work over SSH when the ISE servers are unreachable. Which AAA command set provides the ISE-first login with local fallback?
- A power company auditor asks for evidence of every configuration command run on the core routers last quarter. ISE is the TACACS+ server, and its records show only which engineer logged in and when. Which TACACS+ setting should be enabled so command-level activity is captured for the audit?
- A campus team must run 802.1X on 4,000 wired and wireless ports while giving six engineers CLI access to IOS-XE routers, where each may run only approved commands and every command is recorded. Which AAA protocol pairing should serve network access versus device administration?
- A network team administers 60 switches and routers over SSH, and the help-desk role must be authorized command by command by the AAA server rather than by each device's local table. No administrator password may cross the network in clear text. Which AAA protocol should the team standardize on for device administration?
- The security team wants a TACACS+ record that shows every privileged command an administrator executed on a device, including who ran it and the exact time it ran. The record must be searchable inside ISE. Which TACACS+ accounting type produces that record?
- A campus team administers 30 routers and switches through ISE with TACACS+. Policy requires every routine administrator login to be checked by ISE first, and a break-glass account must still work if the ISE servers are unreachable during an outage. Which AAA configuration on the router gives centralized authentication with a working local fallback?
- A telecom operations center turns on ISE TACACS+ for 120 routers and switches. Tier-1 staff must land at privilege 15 yet run only show and ping, tier-2 staff need full configuration rights, and rules must be chosen by device group rather than per-device configuration. Which device admin policy design fits all three requirements?
- A retail chain's NOC has junior and senior network engineers using ISE for TACACS+ on branch routers. Juniors must run show commands and routine interface changes; only seniors may run reload or clear commands; and any command outside a junior's approved list must be refused. Which command-authorization design fits these two roles?
- A payment processor's NOC gives junior administrators read-only access to 40 routers through ISE TACACS+. Policy requires that they run only show commands, that anything else is denied by default, and that the same rule behaves identically across IOS and IOS-XE devices regardless of the command tables stored locally. Which TACACS+ authorization element should enforce this per-command restriction?
- A hospital's Cisco switch stack must validate every network administrator login through ISE over TACACS+, with ISE deciding the privilege level. During the monthly ISE maintenance window engineers must still get in using an account stored on the switch, and whenever ISE is reachable it must remain the source that decides. Which AAA login method list on the switch satisfies both rules?
- A network operations center is replacing per-device local accounts on its routers and switches with ISE TACACS+. Senior engineers must reach privilege 15 with unrestricted command execution, while helpdesk staff must be limited to a fixed list of read-only show commands on the same devices. The team wants a single device admin policy set to serve both roles. Which device admin design assigns the correct TACACS+ results to both groups?
- A utilities company runs ISE for campus wireless and for router and switch CLI access. Auditors require per-command authorization plus full command accounting on the routers, and the wireless controllers must keep serving 802.1X clients without interruption. Which AAA protocol assignment for network access and device administration meets both the audit and wireless requirements?
- After moving device administration from an old AAA server to ISE, an engineer signs into a core switch over TACACS+ and ISE records the login as accepted, with session start-stop records arriving in the accounting log, yet no privilege 15 command lines appear for the audit trail. Which configuration gap on the switch best explains the missing command accounting?
- A power utility must show auditors that every CLI command entered on its router and firewall consoles is authorized in advance and logged with the operator's identity. Its security standard requires user names and command text to be protected in transit, rather than only partially masked. Which AAA protocol choice best meets the device administration requirements?
- A campus team is enabling TACACS+ device administration on a core router with ISE. Console and vty admins must authenticate against ISE, and when the ISE servers are unreachable the router must still accept logins from its own local user database. Which AAA authentication list should be applied to the router's lines?
- A change-control audit requires proof of the exact CLI commands two administrators ran on a core switch last Friday, and the team also wants to review failed login attempts from a contractor account. The switch already uses TACACS+ for authentication and authorization. Which ISE logging setup should the engineer enable?
- An administrator must secure switch and firewall administration for a team of engineers. Requirements: passwords and command traffic must be unreadable to anyone capturing packets on the management VLAN, lost messages must be detected and retransmitted by the transport, and ISE must authorize every command individually while accounting runs as its own exchange. Which AAA protocol and transport behavior meets all three requirements?
- Junior engineers must reach the core routers and run show and ping, but reload and configure terminal must be blocked for them while seniors keep full access, and every blocked attempt must appear in ISE for audit. The team also manages switches and firewalls centrally. Which TACACS+ device administration control should enforce this command authorization?
- A bank's network team wants switch logins with per-command authorization and command-level accounting during change windows, while the security team enables 802.1X EAP-TLS on the wireless LAN. Both AAA services will terminate on the same ISE cluster. Which AAA protocol assignment correctly separates device administration from network access?
- A telecom NOC gives contractors TACACS+ access to core routers through ISE. Policy requires each session to start at privilege level 1, after which a command set permits only show commands, yet sessions still begin at privilege 15. Which ISE device administration component controls the session's initial privilege level?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Cisco Systems, Inc. and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Cisco Systems, Inc..