Architecture and Deployment (10%)

SISE · 30 questions

• A hospital's single ISE appliance serves several thousand endpoints, and the shift-change login surge already pushes it near capacity. Security wants one place where administrators author policy, plus the ability to add authentication capacity in stages without rewriting policy. Which ISE deployment design meets all of these requirements?
• A hospital runs ISE in a distributed deployment with two Policy Service nodes. Every switch, WLAN controller and VPN gateway lists only PSN-1 as its RADIUS server, and a maintenance window requires taking PSN-1 offline for patching. The design must run with no extra appliance between the network devices and ISE. Which high-availability change for the Policy Service nodes keeps authentication available?
• A manufacturer runs ISE as three VMs on a shared vSphere cluster that still has spare CPU and memory. The licence already covers every endpoint, wired profiling is active, and the monitoring dashboards stay responsive, yet RADIUS requests queue and time out in the 08:00 reauthentication wave. Which change best restores authentication capacity?
• A hosting company brings four new ISE PSN appliances online in two regions and wants each node to configure itself at first boot instead of an engineer typing the setup script. Every node must come up with its own hostname, addressing, DNS, NTP and admin login already in place. Which ISE feature delivers this zero-touch initial provisioning?
• A university is splitting ISE across two VMs. The first VM already runs the admin GUI, the policy configuration and the monitoring database, and the team wants policy edited from that one node only. At peak, 15,000 endpoints hit RADIUS, MAB and captive-portal authentication at once, while a SIEM consumes the monitoring feed. Which ISE persona should run on the second VM to carry that authentication load?
• An insurance company adds a second ISE VM to carry RADIUS traffic for a new campus building and to keep AAA running while the first node is offline for maintenance. The first node is already the primary Administration node, the primary Monitoring node, and a Policy Service Node. Which persona assignment on the second node completes this design?
• A 600-person manufacturer runs ISE on a single headquarters node that does authentication, profiling, posture and TACACS+. Two new plants need wired 802.1X, endpoint count will roughly double, and the team must keep one configuration console while each site's logins are answered locally. Which deployment design meets those requirements?
• A bank is adding a second data center and ships an ISE appliance straight to the colo, where no ISE administrator has console access. The site has internal DNS that resolves the existing PAN, and the new node's first-boot installation and network setup must complete with nobody touching it locally. Which zero-touch provisioning approach should the team use?
• A state university runs ISE on two virtual machines: one hosting the administration and monitoring personas, and one hosting the policy service persona. At 8 a.m. about 4,000 wireless users authenticate within minutes, RADIUS replies slow to a crawl, and clients start retrying. Which performance specification should the team re-size first to protect authentication throughput?
• A logistics company runs one ISE node holding both the administration and monitoring personas, and adds a second server in the datacenter to absorb 802.1X load for 5,000 handheld scanners. Policy edits must stay on the existing node while the new server answers endpoint requests with the same rules. Which persona assignment and registration step will integrate it correctly?
• A retail chain runs 120 stores, each with a Catalyst switch stack and two ISE policy service nodes in the back office. The security lead forbids adding any network appliance in the stores, and a single PSN outage must leave new 802.1X authentications running. Session state lives on each PSN instead of being shared, so which switch-side design should be used?
• A manufacturer is rolling ISE out to three regions. Policy must be edited from one console, logins must keep working when a region's WAN link to the data center drops while local identity services remain reachable, the incident-response team needs heavy live-session searches that leave configuration and policy decisions unaffected, and the next-generation firewall wants live endpoint context. Which ISE persona design meets all four requirements?
• A retail chain is building one ISE deployment for 40 stores: a PAN in the data center and a PSN per region. Engineers deploy ISE virtual machines from a template and want first boot to complete initial setup with minimal console typing, while policy content stays managed from the PAN. What does zero-touch provisioning provide during that first boot?
• A logistics firm runs six Policy Service nodes that the switches address individually, and peak authentication volume already saturates one node during shift change. The security lead also requires that authentication continue automatically if a node fails. Which RADIUS distribution design meets both requirements?
• A county health system is extending ISE across four appliances. Appliance 1 must terminate RADIUS for 300 access switches and run profiling, appliance 2 is the only place engineers may edit policy, appliance 3 gives SOC analysts live sessions and diagnostics, appliance 4 shares identity and session context with the firewall. Which persona assignment satisfies each requirement?
• A hospital group is replacing its ISE hardware appliances with VMs on a cluster that also runs other security workloads. The replacement must sustain the same peak RADIUS authentication rate as the appliance, absorb heavy session-log volume without slowing authentication, and stay predictable when neighboring VMs spike. Which VM sizing approach meets all of these requirements?
• A distributed ISE design must keep every site's policy sets under one administrative point, while each site keeps authenticating even when the central node fails or the wide area link drops. Assuming each site's identity source remains reachable locally, which node layout satisfies both requirements?
• A retailer runs a central ISE PAN at headquarters and has just installed a second ISE VM for the regional site. The regional switches and wireless controllers must authenticate with the same policy set headquarters maintains, and headquarters must remain the only administrative console in the deployment. Which persona assignment and registration step makes the regional node part of the deployment?
• A platform team must stand up a new ISE region as six blank OVA nodes in a remote datacenter, and the build standard says every node's install, host and network details, DNS and NTP settings, and enabled services must come from one prepared file with no engineer answering setup prompts at a console. Which capability meets that build standard?
• A financial firm is sizing an ISE VM to handle RADIUS, profiling collection, and session logging for 12,000 endpoints on a hypervisor shared with other guests. During load testing, datastore latency rises while CPU and memory remain within their configured limits. Which ISE VM resource is most likely to be the bottleneck?
• A hospital is standing up four ISE virtual machines, one for each role. One VM must be the authoritative source for policy and network device configuration; another must collect authentication and failure logs; a third must answer RADIUS requests from switches and wireless controllers; a fourth must share session and posture data with the SIEM. Which persona assignment matches each of the four virtual machines?
• A regional bank piloted ISE as one all-in-one node in its lab. For production, RADIUS and TACACS+ logins must keep working if a single server fails, administrators must keep a usable management console during that outage, and all policy must stay authored from one console. Which ISE deployment option meets all three continuity requirements?
• A company runs three policy service nodes serving 250 access switches for 802.1X. Administrators report that user sessions occasionally restart mid-morning even though no node has failed, and RADIUS load counters show nearly all traffic landing on one node. Which load balancing design for the policy service nodes would restore both distribution and session continuity?
• A retail chain is deploying ISE at headquarters and at four stores. Corporate wants one place where policies are built and changed, while each store must still evaluate its own 802.1X authentications when the link to headquarters is down. The administrator is assigning personas in the deployment wizard. Which persona layout for headquarters and store nodes fits these two requirements?
• A retailer runs one appliance in the data center for centralized policy, monitoring and directory integration, and places a smaller server in each store behind a wireless controller that must authorize shoppers and push re-authorizations on the fly. Store logins must be answered locally without proxying AAA traffic, while logs still roll up to the central collector. Which persona role should run on each store server?
• A bank's single ISE node at HQ handles administration, monitoring and policy for 1,200 switches. A second appliance at the branch will authenticate 3,000 wireless users with HQ's shared policy, while administration and monitoring remain at HQ. Which persona plan and registration order should the branch node follow?
• A logistics company has a data center and three warehouses on VPN links that can drop for ten minutes during storms. Warehouse authentication uses ISE internal users and must keep working during an outage, policy must be authored in one place, and this year's budget allows exactly four ISE nodes. Which ISE deployment design meets all three constraints?
• A retail chain is deploying ISE on a shared vSphere cluster that also runs point-of-sale servers. The infrastructure team wants the policy VM to have guaranteed CPU and memory capacity, while the design must still absorb the 6 a.m. burst when thousands of endpoints re-authenticate. Which VM resource configuration fits Cisco's sizing guidance?
• A packaging plant runs three Policy Service Nodes behind two PANs, but each switch lists a single PSN as its primary RADIUS server. When that node is patched, re-authentication stalls until it returns. The architect wants one address on every switch and traffic spread evenly across the nodes. Which deployment design meets both goals?
• A provider is deploying twelve ISE VMs across three regions in one weekend window, and the team has banned per-node console setup so nobody is answering setup prompts at 3 a.m. Every node must also land in the existing deployment and be governed by the primary admin node. Which provisioning approach satisfies both the unattended first boot and the single-deployment requirement?