Web Auth and Guest Services (15%)

SISE · 45 questions

• At a manufacturing plant, contractors plug into the PlantGuest guest ports and must type a username at a captive portal before user traffic flows. The switch must steer the unauthenticated session toward ISE's portal, and after a successful login the live session must be re-evaluated by the guest authorization policy. Which mechanism completes this central web authentication flow?
• A coworking space issues sponsor-created guest passes to visitors meeting on site. Each pass must stay valid for seven days from creation, allow at most four hours of connected time, and free the seat after twenty minutes of inactivity. Which combination of guest time limits meets all three requirements?
• A logistics company is adding guest Wi-Fi at three warehouses, and its design rules say the terms-of-use login page and its processing must run on the ISE node itself, with guest accounts kept in ISE's local guest database. The architect must explain how the guest browser reaches that page and who validates each login. Which ISE web authentication behavior meets both design rules?
• A community college runs central web authentication for guests on its wireless controllers. The splash page opens and the guest credentials are accepted, yet the device stays limited to the portal while the internet remains unreachable. Which message re-authorizes the endpoint after the portal form is submitted?
• A hotel chain is launching sponsored guest Wi-Fi through ISE: staff create accounts in the sponsor portal, and printed QR codes must open a branded page at connect.hotel.example.com. Both portals must run over HTTPS, with the padlock validating cleanly on supported guest devices with current trust stores. Which portal setup serves both pages at the printed name with a clean padlock?
• A hosting company's coordinator has the names of 14 auditors arriving next week. Policy requires a sponsored guest account that expires when the visit ends, and each auditor must be online in the meeting room on arrival with no kiosk stop or approval wait. Which guest access type should ISE use for them?
• A university lets the central help desk create 7-day visitor accounts for anyone on campus, while departmental receptionists may only view, extend and cancel the accounts they created themselves. Both roles must work from the sponsor portal, and auditors need every action tied to a named sponsor. Which sponsor-group design meets these requirements?
• A logistics warehouse enables web authentication on its access switches so contractor laptops can authenticate before touching the warehouse VLAN, and the login page must come from the switch rather than from ISE. Every submitted login still has to appear as an ISE session for auditing. Which statement describes the local web authentication flow used here?
• A weekend technology expo expects several hundred visitors to register themselves at lobby kiosks using only an email address and an acceptable-use page, because no company sponsor will be on the floor after hours. Security still wants every visitor to hold a named, expiring account instead of anonymous access. Which guest access type fits this self-service flow?
• A convention center runs guest Wi-Fi through a sponsor-approved web portal. Walk-in visitors need accounts that switch off when the hall closes, while pre-approved contractors must stay online across the three-day event. Which guest account lifecycle design meets both the expiry and time-limit needs?
• A conference center publishes its branded ISE guest portal at wifi.riverfront-expo.com so visitors can self-register and sponsors can vouch for VIP attendees. Attendees carry personal phones with no enterprise root certificates installed, and organizers want the landing page to open with no browser certificate warning. Which portal configuration meets the certificate and FQDN requirement for the guest landing page?
• A resort chain runs guest Wi-Fi through 40 controllers, each showing its own splash page, and the current flow leaves AUP acceptance unrecorded while returning guests must re-register on every visit. Security wants one portal that records the AUP and lets returning guests authenticate without re-registering until their guest account expires. Which web authentication design should the chain standardize on?
• Reception at a manufacturing plant issues guest accounts to visiting engineers for a single eight-hour shift, and the same engineer often returns the next morning. Accounts stay open indefinitely, so the guest list grows daily and repeat visits create duplicates. Which guest account settings address both problems?
• A private hospital is hosting a two-day clinical conference in its lobby. Every visitor must be approved by a named staff sponsor before joining the guest Wi-Fi, and each session has to end automatically at the close of the conference day. Which guest access design should the ISE team deploy for these visitors?
• A regional clinic runs guest Wi-Fi with central web authentication: the controller redirects the guest's browser to the ISE hotspot portal, the guest accepts the terms, and the login succeeds. Several tablets then keep the pre-authentication policy and never pick up the guest role on the WLAN. Which step of the central web authentication flow should be verified first to apply the post-login result?
• A university helpdesk of nine staff issues visitor passes through the ISE sponsor portal. Every pass must expire within 24 hours, and each created guest must land in the Visitor-Short identity group used by the guest wireless rule. Which ISE element should hold both the duration ceiling and the identity group for the passes they create?
• A boutique hotel wants a branded guest portal at portal.seaview.example, sponsored by the front desk. Guests arrive with their own phones, so the page must open without a certificate warning, the name must resolve on the guest WLAN, and the branded sponsorship page must load instead of the default ISE login. Which DNS, certificate and portal settings are required for the page to open on a guest phone?
• A conference centre must switch on its visitor Wi-Fi on Monday. Walk-in attendees register themselves at a kiosk and go online immediately, visiting contractors must wait for their host's approval, and press badge holders only need to accept a terms page for a four-hour session. Which guest access arrangement matches all three groups?
• A convention center issues sponsor-created guest accounts for a three-day trade show. Visitors arrive at unpredictable times, and every account must stop working at the end of the day it is first used. Which guest account validity setting should the sponsor select when creating the account?
• A boutique hotel runs a single guest SSID on its wireless controllers. Guests must reach an ISE-hosted splash page that validates a voucher code against the ISE guest database before any 802.1X credentials are exchanged, and the controller must hold the client in a webauth state until that check finishes. Which web authentication behavior supports this guest login flow?
• A retail chain wants a branded guest portal at guest.northwind.com, opened on personal phones that carry no company profile, showing the company logo and colours without any certificate warning. Which certificate and naming setup should the guest portal use?
• A hotel hosts a three-day conference and sells Wi-Fi to delegates. Front-desk staff create accounts in advance, every account must stop working by itself when the conference ends, each delegate is limited to one simultaneous session, and logins must stay possible throughout the event. Which guest account design should be configured?
• A hospital runs central web authentication on its guest WLAN. Users reach the splash page and accept the usage terms, and ISE logs an Access-Accept carrying the guest profile, yet the clients stay in the pre-auth role with no internet access. Which step must ISE perform so the controller applies that guest profile to the live session?
• At a regional hospital, front-desk clerks must create 24-hour guest accounts for visiting vendors, while only the IT service desk may extend, disable, or delete an account. Both teams work in the sponsor portal and an auditor reviews changes each week. Which sponsor group permission design enforces these role boundaries?
• A retail chain uses the ISE sponsor portal so store managers can create guest accounts. Corporate requires that each sponsor can issue only their own store's guest type, that every account expires within three days, and that sponsors may manage only the accounts they created themselves. Which ISE configuration enforces all three rules for those sponsors?
• A retail chain hosts its guest and sponsor portals on ISE and publishes one address, guest.retailco.com, in every store redirect. Guests must see a trusted padlock on arrival, the certificate must chain to the corporate issuing CA, and the sponsor links must resolve to that same address. Which certificate and portal URL setup meets all of these requirements?
• A manufacturing plant hosts a different contractor crew each week, none of whom have corporate accounts, and each crew must be approved by the employee who booked the visit and be limited to the booked shift. Which guest type should reception configure to handle these contractor check-ins?
• A logistics warehouse wants visiting drivers to join a guest SSID at a site whose only web server is ISE itself. Each driver enters a name and mobile number on a login page served by ISE, and access must stop after eight hours. Which web authentication design meets these requirements?
• Guests at a warehouse scan a QR code, reach the ISE hotspot page and sign in successfully. ISE then logs a RADIUS Access-Accept, yet the switch keeps them in the pre-auth VLAN and the session stays unchanged. Which part of the central web authentication flow should be verified first?
• A logistics company is branding its guest Wi-Fi. Visitors must open https://guest.northwind.example to self-register, the sponsor approval email links to that same address, and the browser must show a trusted certificate with no name warning. Security policy prohibits wildcard certificates. Today the portal is served with a node certificate that lists only ise01.corp.example. Which certificate and DNS preparation must be completed before the portal goes live?
• A hotel's guest Wi-Fi relies on central web authentication: the controller returns a redirect URL in the first access-accept, and the guest posts credentials at the central portal. Which message completes the central web authentication flow so internet access starts immediately?
• A conference center hosts a three-day summit for 900 attendees. Reception creates each visitor's account from the ISE sponsor portal, and every account must work for only 48 hours from check-in and then expire on its own. The security team has ruled out one event-wide account with a session cap. Which guest account setting enforces the required lifetime?
• A university runs one ISE guest portal for visiting lecturers. The registrar's office creates and extends accounts only for its own visitors, while the events team must issue bulk accounts for conferences and revoke any guest account belonging to its department. Both teams share the same portal page. Which sponsor group configuration meets both teams' permissions?
• A downtown hotel is hosting a two-day fintech conference. Attendees must be approved by a hotel staff member before they reach the internet, each guest account must be valid for no more than one day, and check-in happens at a lobby kiosk. Which guest access design should the hotel administrator use for the conference attendees?
• A conference hotel runs the sponsor portal from two teams: reception creates, extends and prints guest passes all day, while the security desk only reviews and approves visitor records. Today everyone shares one identical set of portal rights. Which sponsor configuration should be applied so each team holds only its own guest permissions?
• A branch office runs central web authentication on its wireless controller: the controller redirects the guest's HTTP request to the ISE hotspot portal, the guest signs the acceptable-use policy, and only then may the guest use the internet-only VLAN behind a restricted ACL. After the portal page closes, the controller still holds the pre-authentication authorization state. Which control applies the new guest VLAN and ACL to that live session?
• An office WLAN must send every unauthenticated browser request to the ISE login page using the controller's own redirect setting, before any RADIUS request is sent. ISE then validates the submitted credentials against its own internal user store, and the controller finishes the RADIUS exchange for the session. Which web authentication mode matches this redirect and credential-handling flow?
• A retail chain wants its guest Wi-Fi landing page served as guest.retailco.example with the company logo, colors and terms text, while ISE sits behind a load balancer address that differs from that name. Which portal configuration will present the trusted branded page to arriving guests?
• A warehouse training room runs wired ports on a Cisco Catalyst switch. Guest devices must see a login page, ISE must validate the submitted credentials against Active Directory, and the switch must apply a restrictive ACL to the authenticated session on the port. The guest VLAN is isolated from the ISE portal service and reaches only the switch itself. Which web authentication design keeps the page reachable while still checking AD and filtering the session?
• A city health centre sees 150 visitors every day. Each visitor must complete registration themselves at the captive portal using their own name and email, receive internet access straight away, and have the account expire the same evening. Which ISE guest access type fits this visitor journey?
• Guest laptops reach the splash page and sign in, yet they stay in the restricted VLAN until the user disconnects and reconnects. The switch performs URL redirect with a central web authentication ACL. Which part of the central web authentication flow should the engineer verify first?
• A regional hospital sponsors outside contractors through the ISE guest portal. Each account must expire seven days after the contractor’s first login, network access is limited to weekdays between 07:00 and 19:00, and each guest may hold only one active session at a time. Which guest type configuration satisfies all three rules?
• A hotel reception desk runs the ISE sponsor portal. Desk clerks must create one-day visitor accounts when guests arrive, only the security manager may extend or revoke those accounts, and only the IT administrator may create or disable sponsor logins. Which sponsor group design applies the required permission split across the three roles?
• A downtown conference center opens guest Wi-Fi to hundreds of visitors who must register from their own phones with a mobile number and then wait for a staff sponsor to approve each request. Traffic must stay blocked until the visitor enters the approved username and password, and every visitor must hold an individually registered account. Which web authentication design meets these guest access requirements?
• A convention center hosts a three-day expo with 600 visitors checking in at a welcome desk. Every visitor needs a named account, and the assigned staff sponsor must approve it from a phone before internet access starts. Which guest access service fits this approval requirement?