Policy Enforcement (25%)

SISE · 75 questions

• A hospital is enabling 802.1X on its corporate WLAN. Every laptop already carries a machine certificate from the internal PKI, the team wants no password prompt at sign-in, and the device must also confirm it is talking to the real RADIUS server. Which EAP method belongs in the wireless profile?
• A city university is piloting 802.1X on 3,000 lab and classroom ports that still serve legacy printers and badge readers, and every existing session must keep flowing for the whole eight-week trial. The ISE logs still need to show which endpoints fail authentication and which stay completely silent. Which IBNS 2.0 port mode fits this pilot?
• A network engineer for a plant with 400 access switches is writing one authentication rule and wants to know how ISE resolves credentials when the first store cannot answer. Employees sit in Active Directory while 30 contractor accounts exist only as ISE internal users, and the sequence lists Active Directory first. How does the identity source sequence behave when the domain controller is offline?
• A manufacturer runs one policy set for its wired and Wi-Fi access ports. The authorization rule list reads in this order: a general rule granting the corporate VLAN to authenticated users, a rule granting lab privileges to members of AD group OT-Engineers, and a catch-all granting lab privileges to any authenticated endpoint. Which rule ordering limits lab access to OT-Engineers?
• A logistics firm is tagging traffic across its TrustSec data center. The print server VLAN spans three access switches where cables get re-patched regularly among ports configured with different SGTs, DHCP relay stops at the central server so ISE never sees those leases, fabric switches carry SGT tags inline, and the IDS sensor accepts only IP-to-SGT bindings over SXP. Which classification and propagation design fits these constraints?
• ISE must reuse each person's signed-in Windows session for network access, a new group membership must apply after ISE's directory membership cache expires with no repeat admin work in ISE, and the group list in ISE should contain only the two groups used in policy. Which directory configuration in ISE meets these requirements?
• A university research lab runs a temperature logger, a badge reader, and a student laptop off one wall jack, all needing the same lab VLAN. Each device must complete its own 802.1X or MAB exchange and appear as its own ISE session, so each can be deauthenticated while the others stay up. Which IBNS 2.0 host mode gives each device its own session on this port?
• A logistics company is adding an external LDAP identity source in ISE so warehouse staff can sign into the corporate Wi-Fi with their existing directory passwords. The directory team created exactly one dedicated service account, policy allows only that account to bind, and directory traffic must be encrypted in transit. Which bind setup should the ISE administrator configure?
• A university lab building runs IBNS 2.0 on its access switches with ISE. After a student's 802.1X session succeeds, the port must receive a service template carrying a voice VLAN and a campus ACL, while a second template must take over when ISE is unreachable. Which switch configuration places these templates under IBNS 2.0 policy-map control?
• A regional hospital runs WPA2-Enterprise with EAP-PEAP and ISE as its RADIUS server, with accounting enabled. When ISE sends a Change of Authorization to move a laptop into a restricted VLAN, the controller accepts the request and reauthenticates the session, yet the laptop stays in its original VLAN. Which WLAN setting must be enabled for the new VLAN attributes to take effect?
• A warehouse deploys handheld scanners on access ports configured for MAC Authentication Bypass (MAB). Each scanner must land in VLAN 214 automatically, get a downloadable ACL limiting it to the warehouse management servers, carry SGT 27 for TrustSec enforcement, and start working with zero user interaction. Which authorization profile result set satisfies the warehouse access requirements?
• A university's campus switches run in TrustSec monitor mode. The security team wants GenSeq SGT 205 limited to TCP 8443 when it reaches Compute SGT 215, every other SGT pair to behave as it does today, and the rule verified from switch counters before enforcement starts. Which configuration step implements this SGACL matrix requirement?
• A traffic department adds IP cameras that the profiler classifies with a custom profile named IP Camera. The cameras share one Field Devices identity group with sensors and lights, so that single group covers all three kinds of hardware, and a hardware swap should leave the rule untouched. The rule therefore has to read the profiler's dictionary value on every session. Which authorization condition design meets the dictionary-driven requirement?
• A retail chain is rolling out 802.1X to 4,000 access ports holding legacy printers and IP phones that will initially fail authentication. For 60 days the team wants every attempt logged to ISE while every host keeps its current connectivity untouched, and enforcement will follow later. Which IBNS 2.0 mode fits this observation phase?
• A county hospital builds one policy set for wired access. Clinicians must be offered only certificate-based EAP-TLS, MAB infusion pumps must be admitted with MAB alone, pumps must reach the restricted rule even though a broader clinician rule matches their session first, and every other endpoint must be denied. Which policy design meets all of these requirements?
• A manufacturer is moving 8,000 domain-joined laptops onto 802.1X, and every VLAN and dACL decision depends on Active Directory security groups. Thirty shared kiosk accounts are not in Active Directory and are used only on the lobby machines, while field contractors must present a one-time passcode from the existing RSA SecurID server during RADIUS login. Which identity store design covers all three groups correctly?
• A large hospital deploys label printers and SIP handsets that run without any 802.1X supplicant installed. The access switches enable 802.1X with MAB as the alternate method after the EAP exchange times out, and the printers must land on a restricted VLAN with a downloadable ACL. Which MAB identification step does the switch perform for these endpoints?
• A firm is turning on 802.1X on its WLAN. Staff laptops already carry machine certificates from the internal CA and must use certificate-based mutual authentication, while contractor phones are unmanaged, hold only usernames and passwords, and IT forbids any profile installation on them. Which EAP method assignment fits both groups?
• A regional bank authenticates temporary paralegal laptops with 802.1X on its wired ports. Policy requires these sessions to land in quarantine VLAN 250, reach only DHCP, DNS and the WSUS server, and continue straight through with no portal step. The access switches are older models without SGT or TrustSec enforcement. Which authorization profile should the contractor authorization rule return?
• A three-node ISE deployment has one policy administration node and two policy service nodes in separate buildings. Only the PAN has been joined to corp.example.com, so the finance authorization rules never match for logins handled by the second PSN, and machine authentication must keep working exactly as it does at the first site. Which change restores Active Directory group matching on that node?
• A logistics firm is rolling out IBNS 2.0 ports across its warehouse offices. Every desk port carries one Cisco IP phone with no supplicant, authorized first through CDP device detection, plus one PC using EAP-TLS. The phone and the PC must receive independent authorization results, and a failed PC must leave the phone working. Which 802.1X host mode belongs on these access ports?
• A food processing plant has 600 employees in Active Directory and 40 legacy machine accounts in an OpenLDAP server slated for a merge next year. Past domain controller outages stopped every plant login, and the team keeps three break-glass ISE accounts for emergencies. Which identity source sequence order should be configured for plant logins?
• A bank's campus core propagates SGTs with inline tagging, and ISE classifies endpoints dynamically during 802.1X authorization. One branch building runs a switch that supports SXP but lacks inline tagging hardware, and it filters traffic by IP address. Which TrustSec design keeps SGT-based policy enforceable in that building?
• You are rolling out IBNS 2.0 on hospital access switches. Medical devices must receive a per-user dACL and a dynamic SGT after 802.1X succeeds, printers that fail authentication must land in a quarantine VLAN, and the port must pass traffic only after authorization completes. Which combination satisfies all three requirements?
• In MAB, the endpoint has no supplicant and stays silent when the authenticator sends its EAP identity request. Which message then carries the identity that ISE matches for that endpoint, and in what form does it arrive?
• A city government network has three trust groups: staff workstations (SGT 12), research servers (SGT 51), and records servers (SGT 76). Policy allows staff to reach research, but only administrators (SGT 40) may reach records, and the network team wants policy keyed to trust groups rather than subnets. Which TrustSec enforcement step makes this SGT-to-SGT policy take effect on east-west traffic?
• At a distribution warehouse, 300 handheld scanners join an SSID that authenticates against ISE with PEAP, and every attempt ends in an Access-Accept. When an engineer edits the authorization rule mid-shift, the connected scanners keep their original access until they roam or reconnect. Which controller-to-ISE setting must be verified first to push a new authorization result to a live session?
• Cisco ISE can use an LDAP directory as an external identity source, and the connection settings cover the port, the bind account and the directory search base. For a directory of 400,000 entries in which only the workforce subtree holds employees, which LDAP connection design delivers encrypted binding, read-only access and a search scope limited to workforce entries?
• During a campus rollout you must touch every access port this weekend. IP phones and legacy printers must retain the network access they need while they authenticate, unauthorized clients must be restricted before authorization instead of given the full LAN, and the audit needs start and stop session records in ISE rather than only in the switch log. Which IBNS port mode and logging choice meets all three requirements?
• A retail chain standardizing policy across 400 stores needs one shared rule that matches contractors in the Contractors identity group connecting from a device in the West region, and the same match must stay reusable in several policy sets. Which ISE element should hold that combined condition?
• A healthcare provider must admit 200 domain-joined staff with PEAP, 60 contractors who exist only in the corporate OpenLDAP directory, 20 lab devices that authenticate with machine certificates, and 12 administrators who must pass a second factor. Which identity store should serve each of these four groups?
• A manufacturing firm runs one wired policy set covering every plant-floor switch. The team added a rule for contractor groups that should land on a restricted VLAN, but contractors still get the general Engineering department result because that broader rule sits above it. Everyone authenticates to the same directory, and the team wants to keep a single policy set. Which authorization policy change makes the contractor rule match first?
• A campus refresh uses access switches that stamp SGTs into frames inline, while the data-center ToR switches forward plain IP and cannot mark tags. The servers behind them must still present an SGT to the SGT-aware firewall. Which propagation method should carry those server bindings?
• A defense contractor protects its WLAN with a 9800 controller and ISE across 600 laptops. Every laptop holds a user certificate from the internal CA, policy forbids any user password for network access, and authorization must key off the signed-in person rather than the computer account. Which EAP method should be configured?
• Each desk on a new trading floor has a Cisco IP phone with a PC plugged into its pass-through port. The phone must be authorized with MAB into the voice domain, the PC must pass 802.1X into the data domain, and each needs its own authorization result. Which IBNS 2.0 host mode is designed for one voice device and one data device on the port?
• A regional bank runs a single authentication policy rule backed by an identity source sequence: employees live in Active Directory, auditors in a separate LDAP directory, and a break-glass account sits in the ISE internal user database. Identical service usernames exist in both directories and must resolve to Active Directory. Which sequence order meets all of the bank's login requirements?
• A warehouse added 120 barcode scanners with no 802.1X supplicant, while existing laptops must still authenticate with EAP-TLS. The access template also requires ISE to profile each scanner before it receives a restricted profile. Which port authentication sequence supports this design?
• After joining ISE to the corporate domain, users sign in with their domain accounts but the employee-access rule never matches; the live log shows the identity name with no group attached. The policy team uses native AD identity sources only. Which step in the AD join and group retrieval workflow should the engineer verify first?
• A financial services firm requires the Employee-to-Finance-Server rule to be enforced at the access port, to survive a server readdressing, and to avoid a separate rule hand-entered on every access switch. Which TrustSec enforcement design should be deployed?
• A hospital hands identical access ports to desk phones and to desk PCs, and the security team needs BYOD laptops moved into quarantine VLAN 210 when their identity group changes and authorization is reevaluated. No remediation portal is deployed and no per-application filtering is required. Which authorization result should the authorization profile return to enforce that isolation?
• A manufacturer is standardizing wired ports across three plant floors. Every port must try 802.1X first and fall back to MAB for printers and scanners, hold unauthenticated devices on a restricted pre-authentication VLAN, and move each authorized session to the corporate VLAN with its scalable group tag. Which IBNS 2.0 policy-map and service-template arrangement meets this design?
• A retail chain must authorize warehouse staff whose accounts live in a single OpenLDAP directory. The engineer creates an external LDAP identity source, enters the server address with StartTLS, and supplies a dedicated bind account with read access to the OU holding 4,000 users. Test Connection succeeds. A warehouse worker then signs in with their own directory password. How is the dedicated bind account used during that LDAP sign-in?
• A logistics firm needs one authorization rule to cover every printer that profiling places in the Printer identity group, the same logic must be reusable in a second policy set, and re-patching cables must not change the result. Which condition should be built for that authorization rule?
• A bank merges two divisions into one ISE deployment with separate policy sets for wired, wireless and VPN access. Treasury VLAN and time-based exceptions must win over broad department rules, every session must close with an explicit restricted decision, and access must depend on which identity store authenticated the user. Which policy set ordering and authentication design meets all of these requirements?
• A logistics firm runs an AireOS wireless LAN where corporate laptops authenticate with EAP-TLS certificates and badge printers and cameras rely on MAC authentication bypass. After a posture check, ISE must still be able to push a CoA reauthorization that moves a laptop to a quarantine VLAN. Which WLAN configuration on the WLC supports both client types and that reauthorization?
• A university is enabling 802.1X on access switches serving lecture-hall labs full of printers, badge readers, and unmanaged instruments. For a four-week assessment, no port may lose existing connectivity even when authentication fails or no client answers, yet ISE must log the identity and result of every connection. Which IBNS mode fits the assessment phase?
• A regional bank replaced its campus access switches, while the data-centre access switches run on legacy hardware that lacks TrustSec tagging. Policy requires the Finance SGT to reach the data-centre router so client traffic can be matched by security group on egress. Which SGT propagation method should be used across that segment?
• A university lab wires 200 PCs that already hold addresses in VLAN 200. Any PC reaching a port must be sent to the ISE hotspot portal first, and until the portal is finished it may reach only DNS, DHCP, and the portal itself. The port must stay in VLAN 200 so clients keep their addresses. Which authorization profile combination delivers both the redirect and the filtering?
• A retail chain's WLAN must serve company laptops that already carry machine certificates and guest tablets that hold only a username and password. The security lead wants certificate-based authentication on the corporate SSID, with user passwords kept off the air. Which EAP method should the corporate SSID use?
• A university issues laptop certificates from its internal CA, authenticates 3,000 staff with Active Directory passwords, and runs 20 shared lab logins that exist nowhere else. Which ISE authentication configuration can serve all three groups?
• An engineer is building an authorization rule for the ACME.COM domain and needs every PSN to return the same Active Directory group names. Users authenticate with PEAP-MSCHAPv2 and EAP-TLS, and membership changes as staff move teams. Which ISE configuration makes those AD group strings available to every PSN?
• A manufacturer keeps 2,000 employee accounts in Active Directory and 80 shared machine accounts only in the ISE internal store, and several legacy user names exist in both stores with Active Directory authoritative. Which identity source arrangement should ISE apply to each session?
• A retail bank is wiring open-plan desks where each Cisco IP phone has a desktop PC on its PC port. The phone must be authorized as a device, the PC must complete its own 802.1X exchange with the employee's credentials, and the desk standard allows only one data device per port. Which IBNS 2.0 host mode satisfies all three rules for these desk ports?
• A retail chain tags checkout terminals as POS-SG and its database servers as Servers-SG. Only TCP 443 traffic may leave POS-SG for Servers-SG; everything else must be dropped, and the servers' switch must enforce it from the group tags. The POS-SG to Servers-SG cell reads top down and closes with a deny. Where does the permit entry go in the TrustSec matrix?
• A payment processor protects card data with ISE. Finance analysts authenticate both over the remote-access VPN and at office desk ports, and only sessions that arrive through the VPN concentrators while the user belongs to the AD group CardOps may receive the restricted authorization profile that opens the card-subnet ACL. Which condition should the administrator build for that authorization rule?
• A retail chain is moving 80 stores to 802.1X wired access using its Linux OpenLDAP directory as the identity source. The directory policy disables anonymous binds, the security standard requires that directory traffic and the bind password stay encrypted, and group membership must resolve from the staff subtree. The directory uses standard RFC 2307 POSIX group attributes. Which LDAP identity source settings meet the store chain's requirements?
• A logistics firm is enabling 802.1X on its IBNS 2.0 switches. Voice phones with PCs behind them must authenticate with 802.1X, printers must fall back to MAB, each accepted endpoint must receive its own VLAN, SGT and dACL from ISE, and phones must keep working if ISE is unreachable. Which switch configuration approach satisfies all four requirements?
• A university's first authorization rule in its 802.1X policy set matches every authenticated identity and returns Campus-Access, while a later rule in the same set returns Lab-Spec-42 with its own SGT for the engineering lab group. Lab users still land in Campus-Access. Which change gives the lab group its own authorization result?
• A warehouse is turning on 802.1X across its wireless LAN. Employees authenticate with EAP-TLS certificates, contractors use EAP-PEAP, two ISE policy service nodes provide redundancy, and after posture ISE must change a session's VLAN while the user stays connected. The controller's RADIUS server list is still empty. Which controller RADIUS configuration supports this deployment?
• On ports configured for 802.1X with MAB as the fallback method, a switch sends a RADIUS Access-Request after a device ignores its EAPOL identity requests, and ISE must decide access from what the switch places in that request. Which identity does ISE evaluate to authorize the device?
• A retail chain with 400 stores must roll out wired 802.1X without risking register outages. During the first two weeks every connected device, including unmanaged barcode scanners, must keep passing traffic while ISE records which endpoints fail authentication. Which switch port authorization mode should be enabled for this assessment phase?
• A 300-user insurance firm joins Windows laptops to corp.local for group-based access, keeps ten macOS engineering workstations only in its OpenLDAP directory, and runs forty access switches that must keep authenticating to ISE with EAP-TLS device certificates through quarterly AD maintenance. Administrators signing into ISE also need a second factor. Which combination of identity stores and administrator authentication meets all four requirements?
• A university joins its two ISE nodes to the campus Active Directory domain, and users now authenticate successfully, yet the authorization rule granting wired access to the NET-ENGINEERS group never matches, because the condition simply reads Windows group equals NET-ENGINEERS. The administrator wants membership resolved by ISE from the directory, with no local copy of the users. Which configuration step retrieves that group for policy use?
• A manufacturer is designing WPA2-Enterprise wireless for four thousand staff laptops. Every laptop already holds a user certificate from the corporate internal CA, company policy limits wireless authentication to certificates instead of passwords, and the wireless controller and ISE already present a trusted server certificate. Which EAP method should be selected for the staff WLAN?
• A network operator authenticates every user with PEAP-GTC through one rule: staff accounts exist only in Active Directory, partner accounts only in an LDAP server, and two break-glass admin accounts live inside ISE alone. Groups must come from the store that accepted the user. Which identity source design fits these requirements?
• A hospital access switch must apply three controls from a single authorization profile: place the session in VLAN 120, tag it with SGT 45 for TrustSec, and redirect HTTP to the ISE portal using an ACL already configured on the switch. Which authorization profile result set delivers all three controls together?
• Each analyst desk has an IP phone whose PC port carries a laptop. The phone must be authorized by MAB into the voice domain while the laptop passes 802.1X with EAP-TLS into the data domain, and each device needs its own authorization policy on the same wired port. Which IBNS 2.0 host mode should you enable on the access ports?
• In a hospital refresh, the EHR servers sit behind a firewall that supports SXP, while the server-closet access switches support neither inline SGT tagging nor TrustSec classification and enforcement; a replacement is out of budget this year. ISE learns the authenticated endpoints' IP-to-SGT bindings through RADIUS accounting. The firewall must be able to apply policy using those bindings. Which SGT propagation design should the engineer choose?
• A manufacturer points ISE at its OpenLDAP directory for plant-floor badge logins. The directory has anonymous searches disabled, the engineer wants query rights limited to the user and group branches, and ISE must resolve a user's distinguished name before the password check runs. Which bind account should the ISE identity source use?
• A large university is moving its dorm switches to IBNS 2.0. The team builds a class map that matches MAB sessions, a policy map reacting to session-started and authentication-failure events, and a service template carrying the data VLAN and a device ACL. Which description correctly divides the work on the access port between the policy map and the service template?
• A utilities operator has 1,200 staff in Active Directory whose groups drive authorization, 30 substation device accounts that live only in an OpenLDAP directory, and administrators who must enter an Authenticator-app code after their password. Both directories stay exactly as they are. Which identity store design satisfies all three requirements?
• A regional insurer's access ports serve VoIP phones with no supplicant alongside laptops that must complete 802.1X before any fallback. The phones wait out the full 802.1X failure window before MAB puts them on the voice VLAN, while ISE must still make the authorization call. Which switchport setting change shortens this MAB fallback?
• A hospital segments infusion pumps into SGT PUMP and clinical servers into SGT CLIN, and the matrix cell for PUMP to CLIN permits only HTTPS. Access switches tag frames inline, a TrustSec-capable firewall sits at the server edge, and the auditor wants to know where the deny for everything else is applied. Which component enforces that SGACL on a packet?
• A retail chain is moving its corporate laptops to WPA2-Enterprise on Cisco WLCs with ISE. The laptops carry machine certificates and must authenticate with EAP-TLS, authentication must be handled by ISE rather than the controller, and the controller must accept ISE CoA so access can change mid-session. Which controller configuration satisfies all three requirements for wireless 802.1X?
• A bank must grant the payment-application VLAN only when three conditions hold at once: the user sits in the AD group PAY-ADMINS, the endpoint profile is Corp-Laptop, and the session arrived from the 10.40.0.0/16 branch range. The same decision has to serve wired and wireless policies without duplicated rules. Which policy construct should the engineers build?