102 free Cisco 300-715 SISE practice questions from the CertStash pack of 407, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 102 free here, all 407 in the pack, and each step includes the one before it.
Get all 407 questions (US$39) · Download the first 10 as a PDF
Question 1
Which personas can a Cisco ISE node assume?
Show answer and explanation
Correct answer: C. administration, policy service, and monitoring
A Cisco ISE node can take on the Administration, Policy Service and Monitoring personas, and a pxGrid persona in newer releases. Administration handles configuration, Policy Service handles authentication and authorization, and Monitoring collects logs and reports.
Why the other options are wrong
- A. Gatekeeping is not an ISE persona.
- B. Gatekeeping is not an ISE persona, and Policy Service is missing.
- D. Gatekeeping is not an ISE persona, and Monitoring is missing.
Question 2
What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?
Show answer and explanation
Correct answer: D. The primary node becomes standalone.
When a secondary node is deregistered from a two-node distributed deployment, the primary node transitions to standalone mode. This is the expected behavior for maintaining ISE functionality when a secondary node is removed from the deployment.
Why the other options are wrong
- A. The secondary node does not restart when deregistered; it is removed from the deployment.
- B. The primary node does not restart during secondary deregistration; it transitions to standalone mode.
- C. Both nodes do not restart; the secondary is deregistered and the primary becomes standalone.
Question 3
Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose two.)
Show answer and explanation
Correct answer: B, D. hotspot; guest AUP
When the primary admin node is down and the secondary has not been promoted, hotspot and guest AUP remain available because these features are cached and do not require real-time policy decisions from the primary node. New AD authentication, posture checks, and BYOD all require active policy service node connectivity.
Why the other options are wrong
- A. New AD user 802.1X authentication requires active policy decisions from a functioning policy service node.
- C. Posture assessment requires the primary node to be operational or the secondary to be promoted.
- E. BYOD functionality depends on the primary admin node or a promoted secondary for policy evaluation.
Question 4
Which supplicant(s) and server(s) are capable of supporting EAP-CHAINING?
Show answer and explanation
Correct answer: B. Cisco AnyConnect NAM and Cisco Identity Service Engine
Cisco AnyConnect NAM (Network Access Manager) supplicant and Cisco Identity Service Engine server are the components capable of supporting EAP-CHAINING. This feature allows multiple EAP methods to be chained together in a single authentication exchange, and only these specific Cisco products provide this functionality.
Why the other options are wrong
- A. Cisco Secure Services Client does not support EAP-CHAINING; Cisco Access Control Server is not the correct server component.
- C. Cisco Access Control Server does not support EAP-CHAINING; ISE is the correct server for this feature.
- D. Windows Native Supplicant does not support EAP-CHAINING; while ISE is correct, the supplicant component is incorrect.
Question 5
What is a requirement for Feed Service to work?
Show answer and explanation
Correct answer: D. Cisco ISE has Internet access to download feed update.
Feed Service requires Cisco ISE to have Internet access to download feed updates from Cisco servers. This internet connectivity is essential for ISE to retrieve threat intelligence, malware feeds, and other dynamic security data used by the system.
Why the other options are wrong
- A. TCP port 8080 is not the requirement; feed updates are typically downloaded over HTTPS on port 443.
- B. Feed Service accesses external Cisco servers, not an internal server, for updates.
- C. A base license is not sufficient; specific licensing or subscriptions may be required, but internet access is the primary technical requirement.
Question 6
What is a method for transporting security group tags throughout the network?
Show answer and explanation
Correct answer: B. by the Security Group Tag Exchange Protocol
The Security Group Tag Exchange Protocol (SXP) is the method for transporting security group tags throughout the network. SXP allows ISE to propagate SGT information to network devices that may not have direct ISE connectivity, enabling consistent policy enforcement across the infrastructure.
Why the other options are wrong
- A. Embedding SGT in the 802.1Q header is not the standard method; SXP is the protocol used for SGT exchange.
- C. 802.1AE is a link security standard and is not the mechanism for SGT transport.
- D. Embedding SGT in the IP header is not how ISE propagates security group tags; SXP is the dedicated protocol.
Question 7
An engineer is configuring a virtual Cisco ISE deployment and needs each persona to be on a different node. Which persona should be configured with the largest amount of storage in this environment?
Show answer and explanation
Correct answer: A. Monitoring and Troubleshooting
The Monitoring and Troubleshooting persona requires the largest storage allocation in a distributed virtual ISE deployment. This persona generates and stores extensive logging, reporting, and troubleshooting data from all other nodes, making it storage-intensive.
Why the other options are wrong
- B. Policy Services requires significant resources but less storage than the Monitoring node due to less data retention needs.
- C. Primary Administration handles policy configuration but does not store the volume of logs that Monitoring does.
- D. Platform Exchange Grid is not a recognized ISE persona; the three personas are Administration, Policy Service, and Monitoring.
Question 8
In a standalone Cisco ISE deployment, which two personas are configured on a node? (Choose two.)
Show answer and explanation
Correct answer: C, E. administration; policy service
In a standalone Cisco ISE deployment, a single node is configured with both the administration persona and the policy service persona. These two personas together provide complete ISE functionality on one platform without distributed architecture.
Why the other options are wrong
- A. Subscriber is not an ISE persona; ISE uses primary and secondary designations in distributed mode.
- B. Primary is a designation used in distributed deployments, not in standalone deployments.
- D. Publisher is not a standard ISE persona designation; distributed deployments use primary and secondary nodes.
Question 9
A network engineer must enforce access control using special tags, without re-engineering the network design. Which feature should be configured to achieve this in a scalable manner?
Show answer and explanation
Correct answer: C. SGT
Security Group Tags (SGT) are Cisco's solution for enforcing access control based on special tags without requiring network redesign. SGTs enable scalable, identity-based access control that works across the network infrastructure by tagging traffic and applying policies based on those tags. RBAC is role-based access control for administrative functions, dACL is dynamic ACL which requires network reconfiguration, and VLAN segmentation requires network redesign.
Why the other options are wrong
- A. RBAC controls administrative access, not data plane traffic filtering based on tags.
- B. dACL requires network reconfiguration and doesn't use special tags natively.
- D. VLAN segmentation requires network redesign, which the requirement explicitly avoids.
Question 10
A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed interface. Which command should be used to accomplish this task?
Show answer and explanation
Correct answer: D. cts role-based enforcement
The 'cts role-based enforcement' command enables role-based access control enforcement on a routed interface using security group tags. This command configures the device to filter traffic based on security policies that reference SGTs. The other commands relate to policy priority, caching, and authorization lists, which do not directly enable SGT-based filtering on an interface.
Why the other options are wrong
- A. cts role-based policy priority-static sets policy priority, not enforcement on interfaces.
- B. cts cache enable configures caching for performance, not enforcement mechanisms.
- C. cts authorization list defines authorization rules but doesn't enable enforcement on routed interfaces.
What people say about the full 300-715 pack 5.0 from 2
Some issues appeared difficult at first but the explanations provided in these dumps clarified everything. It is a fantastic resource.
Question 11
The security team wants to secure the wired network. A legacy printer on the network with the MAC address 00:43:08:50:64:60 does not support 802.1X. Which setting must be enabled in the Allowed Authentication Protocols list in your Authentication Policy for Cisco ISE to support MAB for this MAC address?
Show answer and explanation
Correct answer: D. Process Host Lookup
To support MAC Authentication Bypass (MAB) in Cisco ISE for devices that do not support 802.1X, the 'Process Host Lookup' setting must be enabled in the Allowed Authentication Protocols list. This setting enables the system to perform MAC-based authentication and query identity stores for MAC addresses.
Why the other options are wrong
- A. MS-CHAPv2 is a challenge-response authentication protocol used for user credentials, not MAC-based authentication.
- B. EAP-TLS is used for 802.1X authentication and requires client certificates, which legacy devices without 802.1X support cannot use.
- C. PAP is a user authentication protocol and does not enable MAB functionality for MAC addresses.
Question 12
An administrator connects an HP printer to a dot1x enable port, but the printer is nor accessible. Which feature must the administrator enable to access the printer?
Show answer and explanation
Correct answer: B. MAC authentication bypass
MAC Authentication Bypass (MAB) enables network access for devices that do not support 802.1X authentication, such as most printers. When enabled on a port, MAB allows the switch to authenticate devices based on their MAC address if they fail to respond to 802.1X requests, providing network connectivity to non-compliant devices while maintaining security posture.
Why the other options are wrong
- A. Change of Authorization is a RADIUS feature for dynamic policy updates, not for authenticating non-802.1X devices.
- C. TACACS authentication is used for administrative access to devices, not for endpoint network access.
- D. RADIUS authentication alone does not bypass 802.1X requirements; MAB is the specific feature needed.
Question 13
Which protocol must be allowed for a BYOD device to access the BYOD portal?
Show answer and explanation
Correct answer: A. HTTPS
HTTPS is the required protocol for BYOD portal access because it provides encrypted, secure communication between the device and the portal. This protects sensitive authentication credentials and device information during the onboarding and authentication process. HTTP transmits data in plaintext, SSH is for remote shell access, and SMTP is for email, none are appropriate for web portal access.
Why the other options are wrong
- B. HTTP is unencrypted and unsuitable for transmitting sensitive BYOD authentication data.
- C. SSH is a remote shell protocol, not used for web portal access.
- D. SMTP is an email protocol unrelated to portal access.
Question 14
An engineer must configure Cisco ISE to provide internet access for guests in which guests are required to enter a code to gain network access. Which action accomplishes the goal?
Show answer and explanation
Correct answer: A. Configure the hotspot portal for guest access and require an access code.
The hotspot portal in Cisco ISE is specifically designed for guest access scenarios where visitors enter a code or credentials to gain internet access. This portal type supports access code requirements and provides the necessary guest authentication and authorization workflow.
Why the other options are wrong
- B. The sponsor portal is for guest account management by sponsors, not for guest self-service access code entry.
- C. Self-registered guest portals allow users to create accounts but are not specifically designed for code-based access.
- D. BYOD policies are for employee device management, not guest internet access with access codes.
Question 15
What happens when an internal user is configured with an external identity store for authentication, but an engineer uses the Cisco ISE admin portal to select an internal identity store as the identity source?
Show answer and explanation
Correct answer: D. Authentication is redirected to the external identity source.
When an internal user is configured with an external identity store for authentication but the administrator manually selects an internal identity store in the ISE admin portal, the authentication is redirected to the external identity source that was configured for the user. The user configuration takes precedence over the administrator's portal selection, maintaining the originally configured external authentication path.
Why the other options are wrong
- A. Authentication is not redirected to the internal identity source; the user's configured external store takes precedence.
- B. Authentication is not automatically granted without proper validation against the configured identity source.
- C. Authentication does not fail; it redirects to the external identity source as configured for that user.
Question 16
How is policy services node redundancy achieved in a deployment?
Show answer and explanation
Correct answer: D. by utilizing RADIUS server list on the NAD
Policy Services Node redundancy is achieved by configuring Network Access Devices (NADs) with a RADIUS server list containing multiple PSN nodes. When a NAD is configured with a list of RADIUS servers, it can failover to alternative PSN nodes if the primary node becomes unavailable, ensuring continuous authentication and authorization services.
Why the other options are wrong
- A. Node groups are used for administrative organization, not for achieving PSN redundancy.
- B. ISE uses a Primary/Secondary architecture for PAN, not for PSN redundancy.
- C. VIP (Virtual IP) is a load balancing mechanism but is not the primary method for PSN redundancy; NAD server lists are the standard approach.
Question 17
What allows an endpoint to obtain a digital certificate from Cisco ISE during a BYOD flow?
Show answer and explanation
Correct answer: B. Supplicant Provisioning Wizard
During BYOD onboarding, the Supplicant Provisioning Wizard (Network Setup Assistant) runs on the endpoint, generates the key pair and certificate request, and obtains the certificate from the ISE internal CA. It also configures the native supplicant to use that certificate.
Why the other options are wrong
- A. Application Visibility and Control identifies and controls applications and does not issue certificates.
- C. The My Devices portal lets users manage registered devices but does not perform certificate enrollment.
- D. Network Access Control is the overall concept, not the mechanism that obtains the certificate.
Question 18
An engineer tests Cisco ISE posture services on the network and must configure the compliance module to automatically download and install on endpoints. Which action accomplishes this task for VPN users?
Show answer and explanation
Correct answer: D. Create a Cisco AnyConnect configuration and Client Provisioning policy within Cisco ISE.
To automatically download and install the compliance module on VPN endpoints, create a Cisco AnyConnect configuration and Client Provisioning policy within Cisco ISE. This combination enables ISE to push the necessary compliance module components to VPN users during their connection process, ensuring they have the required posture agent before posture checks are performed.
Why the other options are wrong
- A. Cisco FTD is a firewall product and does not handle compliance module provisioning for ISE.
- B. Compound posture conditions evaluate existing posture, not provision modules automatically.
- C. Configuring download within posture policy is reactive; proper provisioning should occur proactively through AnyConnect and Client Provisioning.
Question 19
What is a valid guest portal type?
Show answer and explanation
Correct answer: B. Sponsored-Guest
Sponsored-Guest is a valid guest portal type in Cisco ISE that allows sponsors to create and manage guest accounts for network access. This portal type enables organizations to grant temporary network access to external users through a sponsor approval workflow.
Why the other options are wrong
- A. Sponsor is a role or user type, not a guest portal type.
- C. Captive-Guest is not a recognized Cisco ISE guest portal type.
- D. My Devices is a self-service portal type, not a guest portal type.
Question 20
Which two external identity stores support EAP-TLS and PEAP-TLS? (Choose two.)
Show answer and explanation
Correct answer: C, E. Active Directory; LDAP
Active Directory and LDAP are the two external identity stores that support both EAP-TLS and PEAP-TLS authentication methods. These directory services can store user certificates and credentials needed for certificate-based EAP authentication mechanisms.
Why the other options are wrong
- A. RSA SecurID is primarily used for token-based authentication and does not natively support EAP-TLS or PEAP-TLS.
- B. RADIUS Token refers to token servers that support OTP, not certificate-based EAP methods.
- D. Internal Database is ISE's local user repository and supports certificate authentication but is not an external identity store.
Question 21
An administrator is configuring a new profiling policy within Cisco ISE. The organization has several endpoints that are the same device type, and all have the same Block ID in their MAC address. The profiler does not currently have a profiling policy created to categorize these endpoints, therefore a custom profiling policy must be created. Which condition must the administrator use in order to properly profile an ACME AI Connector endpoint for network access with MAC address 01:41:14:65:50:AB?
Show answer and explanation
Correct answer: D. MAC_OUI_STARTSWITH_<MAC ADDRESS>
The MAC OUI (Organizationally Unique Identifier) is the first three octets of a MAC address that identify the manufacturer. Since the question states that all devices of the same type share the same Block ID in their MAC address, using MAC_OUI_STARTSWITH allows profiling based on the manufacturer prefix, which is the correct condition for identifying a specific device family.
Why the other options are wrong
- A. CDP_cdpCacheDeviceID is used for CDP protocol information, not MAC address-based profiling.
- B. While MAC_MACAddress_CONTAINS could match, STARTSWITH with OUI is more precise for manufacturer-based device identification.
- C. Radius_Called_Station-ID is used for RADIUS-based profiling, not for MAC address-based endpoint identification.
Question 22
What is an advantage of using EAP-TLS over EAP-MS-CHAPv2 for client authentication?
Show answer and explanation
Correct answer: C. EAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not.
EAP-TLS requires each client device to present a valid digital certificate for authentication, providing certificate-based mutual authentication between the client and server. This certificate-based approach enhances security by ensuring that only authorized devices with valid certificates can authenticate, whereas EAP-MSCHAPv2 relies on username and password credentials that are more susceptible to compromise.
Why the other options are wrong
- A. EAP-TLS uses certificates, not username and password; EAP-MSCHAPv2 uses username and password, making this statement backward.
- B. Both methods use multiple authentication mechanisms; the distinction is in the type of credential, not the number of forms.
- D. Both EAP-TLS and EAP-MSCHAPv2 use TLS tunnels to secure credential exchange; both protect credentials during transmission.
Question 23
An organization is adding nodes to their Cisco ISE deployment and has two nodes designated as primary and secondary PAN and MnT nodes. The organization also has four PSNs. An administrator is adding two more PSNs to this deployment but is having problems adding one of them. What is the problem?
Show answer and explanation
Correct answer: A. Only five PSNs are allowed to be in the Cisco ISE cube if configured this way.
Cisco ISE deployments have specific node limitations based on configuration. With two PAN/MnT nodes and four existing PSNs, the deployment already has six nodes. Adding two more PSNs would total eight nodes, which exceeds the maximum of five PSNs allowed in a standard distributed deployment configuration. This limitation is a core design constraint of Cisco ISE architecture.
Why the other options are wrong
- B. PxGrid nodes are optional components and not required for adding additional PSNs to the deployment.
- C. New PSN nodes are added to the deployment with their own designated personas; they do not need to be set to primary status.
- D. The PAN node does not have a hard limit of four nodes it can track; the constraint is at the overall deployment architecture level.
Question 24
If a user reports a device lost or stolen, which portal should be used to prevent the device from accessing the network while still providing information about why the device is blocked?
Show answer and explanation
Correct answer: D. Block list
The Block list portal is used to prevent a lost or stolen device from accessing the network while providing visibility into why the device is blocked. This mechanism allows the device to remain listed with a status indicating it is blocked due to being lost or stolen, informing the device owner of the reason for denial without needing to use other portals. Client Provisioning is for onboarding, BYOD is for registration, and Guest portal is for temporary access.
Why the other options are wrong
- A. Client Provisioning is for device onboarding and provisioning, not for blocking lost devices.
- B. BYOD portal is for device registration and enrollment, not for blocking access.
- C. Guest portal is for temporary guest network access, not for blocking lost devices.
Question 25
Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two.)
Show answer and explanation
Correct answer: B, C. TCP 8905; TCP 8443
TCP 8443 is used for secure HTTPS communication between ISE and posture agents, while TCP 8905 is used for posture check communications. These two ports establish the encrypted channels required for the client to receive posture policies and submit compliance data.
Why the other options are wrong
- A. TCP 80 is unencrypted HTTP and is not used for secure posture communications in production deployments.
- D. TCP 8906 is not a standard port used in ISE posture communication architecture.
- E. TCP 443 is standard HTTPS but ISE uses the non-standard 8443 port for its proprietary secure communications.
Question 26
Which two default guest portals are available with Cisco ISE? (Choose two.)
Show answer and explanation
Correct answer: B, E. self-registered; sponsored
Cisco ISE provides two default guest portals: self-registered (for guests who register themselves) and sponsored (for guests registered by sponsors). These two portals cover the primary guest access workflows. WiFi-access, central web authentication, and visitor are not default portal types in Cisco ISE, they represent different authentication mechanisms or portal categories rather than the actual default guest portal offerings.
Why the other options are wrong
- A. WiFi-access is not a named default guest portal type in Cisco ISE.
- C. Central web authentication is an authentication method, not a default guest portal type.
- D. Visitor is not a default guest portal; sponsored and self-registered are the standard portal types.
Question 27
A network administrator must configure endpoints using an 802.1X authentication method with EAP identity certificates that are provided by the Cisco ISE. When the endpoint presents the identity certificate to Cisco ISE to validate the certificate, endpoints must be authorized to connect to the network. Which EAP type must be configured by the network administrator to complete this task?
Show answer and explanation
Correct answer: B. EAP-TLS
EAP-TLS is the EAP method that requires endpoints to present identity certificates for mutual authentication with the authentication server. When an endpoint presents its certificate to Cisco ISE for validation, EAP-TLS provides certificate-based authentication, enabling the network to authorize device access based on validated certificates rather than user credentials.
Why the other options are wrong
- A. EAP-TTLS uses a TLS tunnel but does not require client certificates; inner authentication can be password-based.
- C. EAP-FAST uses a Protected Access Credential (PAC) and does not require identity certificates.
- D. EAP-PEAP-MSCHAPv2 uses a TLS tunnel with password-based inner authentication, not certificate-based authentication.
Question 28
An engineer is creating a new authorization policy to give the endpoints access to VLAN 310 upon successful authentication. The administrator tests the 802.1X authentication for the endpoint and sees that it is authenticating successful. What must be done to ensure that the endpoint is placed into the correct VLAN?
Show answer and explanation
Correct answer: B. Add VLAN 310 in the common tasks of the authorization profile.
VLAN assignment in Cisco ISE is configured within the authorization profile's common tasks section. After successful 802.1X authentication, the authorization policy must specify the VLAN through the authorization profile settings, which then communicates the VLAN assignment to the network access device.
Why the other options are wrong
- A. Static switchport configuration contradicts dynamic VLAN assignment based on authentication results and would not allow per-user VLAN assignment.
- C. Policy set selection determines which policies are evaluated, but VLAN assignment occurs within the authorization profile of a matching policy rule.
- D. Security groups are used for segmentation enforcement after access is granted, not for controlling whether an endpoint receives the initial VLAN assignment.
Question 29
What does the dot1x system-auth-control command do?
Show answer and explanation
Correct answer: A. globally enables 802.1x
The dot1x system-auth-control command globally enables 802.1X on a network access device. This is a prerequisite global command that must be configured before 802.1X can be used on individual interfaces.
Why the other options are wrong
- B. This describes the opposite of what the command does; dot1x system-auth-control enables tracking, not disables it.
- C. dot1x system-auth-control is a global command, not an interface-level command; enabling 802.1X on specific interfaces requires additional interface-level commands.
- D. While the command does enable session tracking, the primary purpose is global enablement of 802.1X, making option A more accurate.
Question 30
An administrator is configuring posture with Cisco ISE and wants to check that specific services are present on the workstations that are attempting to access the network. What must be configured to accomplish this goal?
Show answer and explanation
Correct answer: D. Create a service posture condition using a non-OPSWAT API version.
To check that specific services are present and running on workstations, a service posture condition must be created using non-OPSWAT API versions. Service conditions are specifically designed to verify whether particular Windows or system services exist and are in the running state on endpoints attempting network access.
Why the other options are wrong
- A. Compound conditions combine multiple conditions; they are not specifically for checking services.
- B. Application conditions check for installed applications, not for running services.
- C. Registry conditions examine registry values and are not the appropriate mechanism for service verification.
Question 31
Which two features must be used on Cisco ISE to enable the TACACS+ feature? (Choose two.)
Show answer and explanation
Correct answer: C, E. Device Administration License; Device Admin Service
To enable TACACS+ functionality in Cisco ISE, a Device Administration License must be installed to unlock TACACS+ features, and the Device Admin Service must be activated to process TACACS+ authentication and authorization requests. These two components are the foundational requirements for TACACS+ support.
Why the other options are wrong
- A. Command Sets are used within TACACS+ configuration but are not a requirement to enable the feature itself.
- B. Server Sequence relates to RADIUS configuration, not TACACS+ enablement requirements.
- D. External TACACS Servers are remote systems that connect to ISE, not ISE features needed to enable TACACS+ functionality.
Question 32
An engineer is configuring a posture policy for Windows 10 endpoints and wants to ensure that users in each AD group have different conditions to meet to be compliant. What must be done to accomplish this task?
Show answer and explanation
Correct answer: C. Configure a simple condition for each AD group and use it in the posture policy for each use case.
Posture policy rules in Cisco ISE can include other conditions, such as a simple condition matching an AD group attribute. Creating a simple condition per AD group and using it in the matching posture policy rule lets each group be held to its own requirements.
Why the other options are wrong
- A. Posture requirements define what the endpoint must have and how to remediate; they do not contain identity conditions such as AD group.
- B. Service conditions check whether a Windows or macOS service is running on the endpoint; they cannot map user groups to requirements.
- D. The authorization policy decides network access and redirection, but it does not select which posture requirements apply to an endpoint.
Question 33
An engineer is configuring sponsored guest access and needs to limit each sponsored guest to a maximum of two devices. There are other guest services in production that rely on the default guest types. How should this configuration change be made without disrupting the other guest services currently offering three or more guest devices per user?
Show answer and explanation
Correct answer: D. Create a new guest type and set the maximum number of devices sponsored guests can register.
Creating a new guest type allows customization of device limits specific to that guest configuration without affecting existing guest services. Guest types in Cisco ISE are independent configurations, so a new type can be created with a maximum of two devices while leaving other guest types unchanged with their default three-or-more device limits.
Why the other options are wrong
- A. Identity groups control user membership but not device limits; device limits are configured at the guest type level.
- B. LDAP login configuration is for authentication method selection and does not control device registration limits.
- C. Sponsor groups manage who can sponsor guests but do not directly control the number of devices each guest can register; device limits are a guest type setting.
Question 34
A network administrator must configure Cisco ISE Personas in the company to share session information via syslog. Which Cisco ISE personas must be added to syslog receivers to accomplish this goal?
Show answer and explanation
Correct answer: C. monitor
The Monitor persona in Cisco ISE is responsible for collecting, processing, and reporting session and event information across the deployment. To share session information via syslog with external receivers, the Monitor persona must be configured on nodes that will send this data to the syslog receivers.
Why the other options are wrong
- A. The admin persona manages administrative tasks, not session logging.
- B. Policy Services persona handles authentication and authorization, not syslog reporting.
- D. pxGrid is used for sharing context and metadata between ISE and other platforms, not for syslog transmission.
Question 35
Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)
Show answer and explanation
Correct answer: D, E. endpoint profile transition from Apple-device to Apple-iPhone; endpoint profile transition from Unknown to Windows10-Workstation
When CoA is enabled globally for ReAuth, profile transitions trigger CoA events. Specifically, when an endpoint transitions from Unknown to a known profile like Windows10-Workstation or from one device type to another like Apple-device to Apple-iPhone, the change in profiling status triggers a Change of Authorization to re-evaluate access rights.
Why the other options are wrong
- A. Addition to My Devices Portal is a user enrollment action, not a CoA trigger for profile-based ReAuth.
- B. Marking an endpoint as lost in My Devices Portal is a user management event, not a profiling change trigger.
- C. Updating of endpoint dACL is an authorization policy change but does not inherently trigger CoA for ReAuth profiles.
Question 36
An engineer is configuring 802.1X and is testing out their policy sets. After authentication, some endpoints are given an access-reject message but are still allowed onto the network. What is causing this issue to occur?
Show answer and explanation
Correct answer: D. The switch port is configured with authentication open.
When a switch port is configured with 'authentication open', it allows devices to access the network even if they fail 802.1X authentication or receive an access-reject message. This configuration permits unauthenticated access as a fallback, which explains why endpoints receive reject messages but still gain network access. This is a common troubleshooting scenario where the port's open authentication mode overrides the authentication policy decisions.
Why the other options are wrong
- A. Trusted security group tags are part of TrustSec authorization and do not cause access-reject messages to be bypassed.
- B. A dACL allowing access would be applied after successful authorization, not when receiving an access-reject message.
- C. The 'server dead' action only applies when the authentication server becomes unreachable, not during normal authentication reject scenarios.
Question 37
Which are two characteristics of TACACS+? (Choose two.)
Show answer and explanation
Correct answer: A, E. It separates authorization and authentication functions; It uses TCP port 49.
TACACS+ separates authorization and authentication into distinct functions, allowing more granular control over the authentication and authorization processes. TACACS+ uses TCP port 49 for communication, providing reliable connection-oriented transport. These architectural features distinguish TACACS+ from RADIUS and enable its advanced device administration capabilities.
Why the other options are wrong
- B. TACACS+ separates rather than combines authorization and authentication functions.
- C. TACACS+ uses TCP port 49, not UDP port 49.
- D. TACACS+ encrypts the entire payload, not just the password.
Question 38
Which three default endpoint identity groups does Cisco ISE create? (Choose three.)
Show answer and explanation
Correct answer: B, C, D. unknown; block list; profiled
Cisco ISE creates three default endpoint identity groups automatically: unknown (for unidentified endpoints), block list (for endpoints that should be blocked), and profiled (for endpoints that have been successfully profiled and classified). The 'endpoint' and 'allow list' are not default identity groups created by ISE.
Why the other options are wrong
- A. Endpoint is not one of the three default identity groups created by ISE.
- E. Allow list is not a default endpoint identity group in Cisco ISE.
Question 39
An engineer is implementing Cisco ISE and needs to configure 802.1X. The port settings are configured for port-based authentication. Which command should be used to complete this configuration?
Show answer and explanation
Correct answer: B. dot1x system-auth-control
The command dot1x system-auth-control globally enables 802.1X authentication on a switch and is essential to complete the 802.1X configuration when port settings are already configured for port-based authentication. This command activates the 802.1X authentication mechanism system-wide.
Why the other options are wrong
- A. The aaa authentication dot1x command is used for AAA configuration but does not specifically complete 802.1X port-based authentication setup.
- C. The authentication port-control auto command is applied at the interface level and is not the system-level command needed to complete 802.1X configuration.
- D. The dot1x pae authenticator command configures the PAE role but is not the primary command for completing 802.1X setup when ports are already configured.
Question 40
A Cisco ISE server sends a CoA to a NAD after a user logs in successfully using CWA. Which action does the CoA perform?
Show answer and explanation
Correct answer: C. It triggers the NAD to reauthenticate the client.
In Central Web Authentication, once the user logs in on the ISE portal, ISE sends a CoA reauthenticate to the NAD. The NAD reauthenticates the session and ISE matches it to a new authorization rule that returns the post-login permissions.
Why the other options are wrong
- A. A CoA terminate would drop the session, which is not the standard CWA flow.
- B. The CoA does not carry a downloadable ACL; any new ACL is returned during the reauthentication.
- D. The CoA itself does not carry new permissions; they arrive when the NAD reauthenticates the client.
Question 41
An engineer is using the low-impact mode for a phased deployment of Cisco ISE and is trying to connect to the network prior to authentication. Which access will be denied in this deployment?
Show answer and explanation
Correct answer: D. HTTP
In low-impact mode for phased ISE deployment, HTTP access is denied to unauthenticated endpoints. This forces users to authenticate before gaining full network access, while allowing essential services like DNS and DHCP for device communication and IP address assignment to function before authentication occurs.
Why the other options are wrong
- A. DNS is allowed in low-impact mode to enable endpoint communication and name resolution.
- B. DHCP is allowed to enable endpoints to obtain IP addresses before authentication.
- C. EAP is the authentication protocol itself and is required to initiate the authentication process.
Question 42
Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?
Show answer and explanation
Correct answer: D. idle-timeout
The idle-timeout RADIUS attribute is used to dynamically assign the inactivity timer for MAB users from the Cisco ISE node. This attribute specifies how long a session can remain inactive before the user is disconnected.
Why the other options are wrong
- A. session-timeout specifies the maximum total session duration, not the inactivity timer.
- B. termination-action determines what happens when a session expires, not the inactivity timeout value.
- C. radius-server timeout is a device-level configuration for RADIUS communication timeouts, not a RADIUS attribute for inactivity timers.
Question 43
An organization is hosting a conference and must make guest accounts for several of the speakers attending. The conference ended two days early but the guest accounts are still being used to access the network. What must be configured to correct this?
Show answer and explanation
Correct answer: D. Navigate to the Sponsor Portal and suspend the guest accounts.
The Sponsor Portal allows sponsors to manage guest accounts they have created, including the ability to suspend accounts when they are no longer needed. Suspending accounts immediately stops access while maintaining records for audit purposes. Deleting accounts removes historical records needed for compliance. Authorization rules deny access based on policy conditions but do not actively revoke existing sessions or prevent ongoing use of active accounts.
Why the other options are wrong
- A. Creating an authorization rule denying sponsored guest access would apply to all sponsored guests, not just those specific accounts.
- B. Denying guest access broadly would affect all guests rather than targeting the specific accounts that should be revoked.
- C. Manually deleting accounts removes audit trails and records needed for compliance tracking.
Question 44
An administrator is trying to collect metadata information about the traffic going across the network to gain added visibility into the hosts. This information will be used to create profiling policies for devices using Cisco ISE so that network access policies can be used. What must be done to accomplish this task?
Show answer and explanation
Correct answer: B. Configure NetFlow to be sent to the Cisco ISE appliance.
NetFlow provides detailed metadata about network traffic flows, including source/destination IPs, ports, protocols, and bytes transferred. Sending NetFlow data to Cisco ISE enables the collection of traffic metadata necessary for creating accurate device profiling policies and endpoint visibility.
Why the other options are wrong
- A. DHCP probe provides DHCP discovery information but does not collect metadata about active traffic flows.
- C. RADIUS profiling probe captures RADIUS authentication details but does not provide the breadth of traffic metadata needed for comprehensive profiling.
- D. While SNMP can provide some device information, it is not the primary mechanism for collecting traffic metadata for profiling policies.
Question 45
While configuring Cisco TrustSec on Cisco IOS devices, the engineer must set the CTS device ID and password in order for the devices to authenticate with each other. However, after this is complete, the devices are not able to properly authenticate. What issue would cause this to happen even if the device ID and passwords are correct?
Show answer and explanation
Correct answer: A. EAP-FAST is not enabled.
Even with correct CTS device IDs and passwords, Cisco TrustSec devices cannot properly authenticate with each other if EAP-FAST is not enabled. EAP-FAST is the authentication protocol used for CTS device-to-device authentication and is a prerequisite for establishing secure CTS credentials exchange. Without EAP-FAST enabled on the devices, the authentication handshake will fail regardless of credential accuracy.
Why the other options are wrong
- B. SGT mappings define traffic policy enforcement after authentication succeeds; they do not affect the initial device authentication.
- C. Device aliases are not part of the CTS authentication mechanism; the device ID itself is used for authentication.
- D. This is not a standard CTS configuration command; the verification command is not required for device-to-device authentication.
Question 46
An administrator wants to configure network device administration and is trying to decide whether to use TACACS+ or RADIUS. A reliable protocol must be used that can check command authorization. Which protocol meets these requirements and why?
Show answer and explanation
Correct answer: C. TACACS+ because it runs over TCP.
TACACS+ runs over TCP, providing reliable ordered delivery, and includes explicit command authorization capabilities. This makes it the correct choice for network device administration where command-level authorization checking is required and reliability is critical.
Why the other options are wrong
- A. RADIUS does run over TCP in some contexts, but RADIUS is primarily a UDP-based protocol and lacks command authorization features.
- B. While RADIUS does use UDP, UDP is connectionless and unreliable, and RADIUS does not support command authorization.
- D. TACACS+ uses TCP, not UDP, making this statement incorrect.
Question 47
In which two ways can users and endpoints be classified for TrustSec? (Choose two.)
Show answer and explanation
Correct answer: A, B. VLAN; dynamic
Users and endpoints can be classified for TrustSec through two primary methods: by VLAN assignment and through dynamic classification. VLAN-based classification uses network segmentation, while dynamic classification uses real-time attributes and conditions to assign Security Group Tags based on user or endpoint characteristics.
Why the other options are wrong
- C. QoS is a traffic management mechanism, not a classification method for TrustSec.
- D. SGACL defines security policies between groups but is not a classification mechanism.
- E. SXP is a protocol for propagating Security Group Tags across network domains, not a classification method.
Question 48
An organization wants to split their Cisco ISE deployment to separate the device administration functionalities from the main deployment. For this to work, the administrator must deregister any nodes that will become a part of the new deployment, but the button for this option is grayed out. Which configuration is causing this behavior?
Show answer and explanation
Correct answer: D. One of the nodes is the Primary PAN.
The Primary PAN (Policy Administration Node) cannot be deregistered from the deployment because it is the central administration point for the entire ISE infrastructure. The deregister button is grayed out when a node holds the Primary PAN role, as removing it would compromise the entire deployment's administration capabilities.
Why the other options are wrong
- A. Active synchronization between nodes does not prevent deregistration.
- B. PAN auto failover configuration does not block the deregister function.
- C. An active PSN can be deregistered; only the Primary PAN cannot be removed.
Question 49
An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network. Which node should be used to accomplish this task?
Show answer and explanation
Correct answer: A. policy service
In a distributed Cisco ISE deployment, the Policy Service node is responsible for configuring and managing network probes that collect endpoint attributes from the network. The policy service node hosts the probe configuration settings and coordinates attribute collection across the deployment.
Why the other options are wrong
- B. The monitoring node is focused on collecting and analyzing ISE system metrics and logs, not endpoint attribute probes.
- C. The primary policy administrator manages policies but probe configuration is delegated to policy service nodes.
- D. pxGrid is a framework for sharing information between ISE and third-party systems, not for configuring local probes.
Question 50
What should be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?
Show answer and explanation
Correct answer: A. continue
The continue action should be configured in the Cisco ISE authentication policy for unknown MAC addresses. This allows the authentication process to proceed to the next policy condition rather than immediately rejecting the unknown device, enabling fallback authentication mechanisms like guest access to function properly.
Why the other options are wrong
- B. Pass is not a standard authentication policy action in Cisco ISE for handling unknown identities.
- C. Drop would terminate the connection silently, preventing any alternative authentication attempts.
- D. Reject would explicitly deny access for unknown MAC addresses without allowing alternate authentication paths like guest access.
Question 51
When planning for the deployment of Cisco ISE, an organization's security policy dictates that they must use network access authentication via RADIUS. It also states that the deployment needs to provide an adequate amount of security and visibility for the hosts on the network. Why should the engineer configure MAB in this situation?
Show answer and explanation
Correct answer: D. The devices in the network do not have a supplicant.
MAC Authentication Bypass (MAB) should be configured when devices on the network do not have a supplicant installed. Since the organization requires RADIUS-based network access authentication and needs visibility for all hosts, MAB provides a fallback authentication method for devices that cannot perform 802.1X authentication due to lacking supplicant software. This ensures all devices can be authenticated and managed by Cisco ISE.
Why the other options are wrong
- A. Modern Cisco switches support multiple authentication methods including 802.1X, so MAB is not required due to switch limitations.
- B. MAB is weaker than other authentication methods like 802.1X with EAP, not the strongest form available.
- C. MAB performs device authentication based on MAC address, not user authentication.
Question 52
An administrator made changes in Cisco ISE and needs to apply new permissions for endpoints that have already been authenticated by sending a CoA packet to the network devices. Which IOS command must be configured on the devices to accomplish this goal?
Show answer and explanation
Correct answer: A. aaa server radius dynamic-author
The command 'aaa server radius dynamic-author' must be configured on IOS devices to enable the reception and processing of Change of Authorization (CoA) packets from Cisco ISE. This configuration allows ISE to dynamically modify access policies for already-authenticated endpoints by sending CoA messages to the network device.
Why the other options are wrong
- B. The 'authentication command bounce-port' command does not exist for enabling CoA processing.
- C. The 'authentication command disable-port' command does not enable CoA functionality.
- D. The 'aaa nas port extended' command is for NAS port reporting and does not enable CoA processing.
Question 53
A network engineer has been tasked with enabling a switch to support standard web authentication for Cisco ISE. This must include the ability to provision for URL redirection on authentication. Which two commands must be entered to meet this requirement? (Choose two.)
Show answer and explanation
Correct answer: A, C. ip http secure-server; ip http server
To enable standard web authentication with URL redirection on a Cisco switch for ISE, two commands are required: `ip http server` enables the HTTP server for web authentication portal access, and `ip http secure-server` enables HTTPS for secure web authentication sessions. These commands together provide both the basic HTTP service and secure HTTPS encryption necessary for safe web-based authentication and subsequent URL redirection. IP http authentication and redirection are not standalone commands that provide the required functionality.
Why the other options are wrong
- B. IP http authentication is not a valid command for enabling web authentication on switches.
- D. IP http redirection is not a valid command; redirection is handled through ISE configuration, not switch HTTP commands.
- E. IP http secure-authentication is not a valid command for switch configuration.
Question 54
An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened. From which Cisco ISE persona should this traffic be originating?
Show answer and explanation
Correct answer: C. policy service
Supplicant profile distribution to endpoints originates from the Policy Service (PS) persona in Cisco ISE. The Policy Service persona is responsible for policy enforcement and pushing configuration profiles to network devices and endpoints. The administration persona handles management functions, the authentication persona processes authentication requests, and monitoring handles analytics.
Why the other options are wrong
- A. The administration persona manages ISE configuration and user access, not endpoint supplicant distribution.
- B. The authentication persona processes authentication requests but doesn't push profiles to endpoints.
- D. The monitoring persona collects and reports on events and alarms, not distributes supplicant profiles.
Question 55
Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?
Show answer and explanation
Correct answer: D. AAA override
AAA override is the advanced WLAN option that must be enabled on an AireOS controller to trigger Central Web Authentication for wireless users. This setting allows the controller to override standard AAA responses and redirect users to the web authentication portal.
Why the other options are wrong
- A. DHCP server configuration is separate from CWA enablement.
- B. Override Interface ACL is used for ACL application, not CWA triggering.
- C. Static IP tunneling is a tunnel configuration option unrelated to CWA.
Question 56
Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?
Show answer and explanation
Correct answer: B. unknown
Endpoints that do not match any profile in Cisco ISE become members of the 'Unknown' identity group by default. This is the catch-all category for unidentified or unclassified devices that have not been profiled into any other endpoint identity group.
Why the other options are wrong
- A. Block list is not a default identity group; it is a manual exclusion mechanism.
- C. Allow list is not a default identity group; it is a whitelisting mechanism.
- D. Profiled is not a valid endpoint identity group name.
- E. Endpoint is not a default identity group designation in Cisco ISE.
Question 57
Which configuration is required in the Cisco ISE authentication policy to allow Central Web Authentication?
Show answer and explanation
Correct answer: A. MAB and if user not found, continue
MAB (MAC Authentication Bypass) with 'if user not found, continue' is the required authentication policy configuration in Cisco ISE to enable Central Web Authentication. This allows devices to be initially authenticated via their MAC address, and if no matching user is found, the authentication continues to redirect the device to the web portal for credential entry.
Why the other options are wrong
- B. Using 'if authentication failed, continue' would bypass the entire authentication attempt rather than enabling CWA.
- C. Dot1x is used for 802.1X authentication, not the primary method for CWA gateway flows.
- D. Dot1x with 'if user not found, continue' does not align with CWA policy requirements.
Question 58
Which type of identity store allows for creating single-use access credentials in Cisco ISE?
Show answer and explanation
Correct answer: D. RSA SecurID
RSA SecurID is a token-based authentication system that generates single-use, time-based credentials. This identity store type is specifically designed to support one-time passwords and temporary access credentials, making it the ideal choice for creating single-use access credentials in Cisco ISE.
Why the other options are wrong
- A. OpenLDAP stores user credentials in a directory but does not natively support single-use temporary credentials.
- B. Local identity store uses stored usernames and passwords that are reusable, not single-use.
- C. PKI uses certificates for authentication but does not create single-use credentials in the traditional sense.
Question 59
An engineer needs to configure Cisco ISE Profiling Services to authorize network access for IP speakers that require access to the intercom system. This traffic needs to be identified if the ToS bit is set to 5 and the destination IP address is the intercom system. What must be configured to accomplish this goal?
Show answer and explanation
Correct answer: B. NETFLOW
NetFlow is the technology used by Cisco ISE to collect and analyze network traffic metadata, including ToS bits and IP addresses. By configuring NetFlow on network devices, the ISE profiling service can identify traffic based on specific Layer 3 characteristics like ToS values and destination IP addresses, enabling precise identification of IP speakers communicating with the intercom system.
Why the other options are wrong
- A. NMAP is a network scanning tool used for host discovery and port scanning, not for ongoing traffic analysis and profiling.
- C. pxGrid is used for sharing context and identity information between Cisco products, not for analyzing individual packet characteristics like ToS bits.
- D. RADIUS is an authentication protocol and cannot inspect or profile traffic based on ToS bits and destination addresses.
Question 60
An engineer is configuring static SGT classification. Which configuration should be used when authentication is disabled and third-party switches are in use?
Show answer and explanation
Correct answer: A. VLAN to SGT mapping
VLAN to SGT mapping is the appropriate configuration for static Security Group Tag classification when authentication is disabled and third-party switches are in use. This method classifies devices based on their VLAN membership, which works independently of authentication status and is compatible with non-Cisco network infrastructure.
Why the other options are wrong
- B. IP Address to SGT mapping requires authentication or continuous monitoring, which is not suitable when authentication is disabled.
- C. L3IF (Layer 3 Interface) to SGT mapping requires Cisco infrastructure support and would not work reliably with third-party switches.
- D. Subnet to SGT mapping also relies on authentication or active monitoring mechanisms not available when authentication is disabled.
Question 61
What must be configured on the WLC to configure Central Web Authentication using Cisco ISE and a WLC?
Show answer and explanation
Correct answer: D. Set the NAC State option to RADIUS NAC.
Central Web Authentication via Cisco ISE on a WLC requires configuring the NAC State option to RADIUS NAC. This enables the WLC to communicate with ISE for authentication and authorization decisions, allowing dynamic VLAN assignment and access control based on ISE policies.
Why the other options are wrong
- A. The ip access-group webauth command is not a valid WLC configuration command for central web authentication setup.
- B. The radius-server vsa send authentication command is not the primary configuration needed; RADIUS NAC state must be enabled first.
- C. SNMP NAC is used for posture assessment, not for the core central web authentication mechanism with ISE.
Question 62
An administrator needs to allow guest devices to connect to a private network without requiring usernames and passwords. Which two features must be configured to allow for this? (Choose two.)
Show answer and explanation
Correct answer: B, E. device registration WebAuth; hotspot guest portal
Device registration WebAuth allows guest devices to register without credentials through a web portal, while the hotspot guest portal provides the web-based authentication interface that guests interact with. Together, these features enable credential-free network access for guest devices on a private network.
Why the other options are wrong
- A. Central WebAuth is for authenticating users across multiple access points but still requires user credentials.
- C. Local WebAuth authenticates users locally but requires username and password entry.
- D. The self-registered guest portal requires guests to create accounts with credentials, not credential-free access.
Question 63
A network engineer needs to deploy 802.1x using Cisco ISE in a wired network environment where thin clients download their system image upon bootup using PXE. For which mode must the switch ports be configured?
Show answer and explanation
Correct answer: D. low-impact
Low-impact mode is the correct switch port configuration for environments where devices like thin clients perform PXE boot before authentication can occur. This mode allows pre-authentication network access for DHCP and PXE operations while still enforcing 802.1X authentication, preventing authentication failures during system boot.
Why the other options are wrong
- A. Closed mode denies all traffic until authentication succeeds, which would block PXE boot operations.
- B. Restricted mode allows only limited traffic but does not specifically accommodate PXE boot requirements.
- C. Monitor mode is used for passive monitoring without enforcing access control.
Question 64
Which two endpoint compliance statuses are possible? (Choose two.)
Show answer and explanation
Correct answer: A, C. compliant; unknown
Cisco ISE posture checks return two primary compliance statuses: compliant indicates the endpoint meets all security requirements, and unknown indicates the compliance status cannot be determined due to missing checks or agent communication issues. These are the standard states in the ISE posture framework.
Why the other options are wrong
- B. Valid is not a compliance status in Cisco ISE posture; it may relate to certificate validity but not endpoint compliance.
- D. Known is not a compliance status designation in ISE posture reporting.
- E. Invalid is not a standard compliance status; non-compliant endpoints are marked as compliant or unknown.
Question 65
A network administrator notices that after a company-wide shut down, many users cannot connect their laptops to the corporate SSID. What must be done to permit access in a timely manner?
Show answer and explanation
Correct answer: B. Allow authentication for expired certificates within the EAP-TLS section under the allowed protocols.
When users cannot connect after a company-wide shutdown, the most likely cause is expired certificates used in EAP-TLS authentication. The timely solution is to allow authentication with expired certificates temporarily within the EAP-TLS allowed protocols section, permitting users to connect and receive updated certificates. This avoids the delays associated with manual certificate management and system revocation processes.
Why the other options are wrong
- A. Guest authentication and web redirect does not address the underlying certificate expiration issue preventing 802.1X connection.
- C. While certificate renewal is necessary long-term, manually revoking and issuing certificates on each system is not timely for many users.
- D. Redirecting users through secondary ISE nodes does not solve the certificate expiration problem preventing authentication.
Question 66
An administrator is adding network devices for a new medical building into Cisco ISE. These devices must be in a network device group that is identifying them as `Medical Switch` so that the policies can be made separately for the endpoints connecting through them. Which configuration item must be changed in the network device within Cisco ISE to accomplish this goal?
Show answer and explanation
Correct answer: B. Change the device type to Medical Switch.
In Cisco ISE, the Device Type field is used to classify network devices and assign them to network device groups for policy purposes. By changing the device type to 'Medical Switch', the device will be placed in the appropriate network device group, allowing policies to be applied separately to endpoints connecting through medical building switches.
Why the other options are wrong
- A. Device profile is not the mechanism for assigning devices to network device groups in ISE.
- C. Device location is a geographical identifier and does not control network device group assignment.
- D. Model name is a descriptive field for the physical device model and does not affect policy grouping.
Question 67
Which interface-level command is needed to turn on 802.1X authentication?
Show answer and explanation
Correct answer: B. dot1x pae authenticator
The dot1x pae authenticator command is the interface-level command needed to enable 802.1X authentication on a switch port. This command configures the port to function as an authenticator in the 802.1X exchange, allowing it to enforce port-based access control.
Why the other options are wrong
- A. dot1x system-auth-control is a global command that enables 802.1X system-wide, not an interface-level command.
- C. aaa server radius dynamic-author configures RADIUS dynamic authorization, not 802.1X authentication on an interface.
- D. authentication host-mode single-host controls how many hosts can authenticate on a port, not the enabling of 802.1X itself.
Question 68
MacOS users are complaining about having to read through wordy instructions when remediating their workstations to gain access to the network. Which alternate method should be used to tell users how to remediate?
Show answer and explanation
Correct answer: B. executable
When users need to remediate their workstations, providing an executable file allows them to automatically resolve compliance issues rather than reading lengthy text instructions. This is particularly beneficial for macOS users as it provides a streamlined, user-friendly remediation experience that executes fixes programmatically.
Why the other options are wrong
- A. File distribution is a mechanism but does not specifically address the problem of wordy instructions.
- C. Message text would perpetuate the problem of users having to read wordy instructions.
- D. URL links would direct users to web pages with instructions, still requiring them to read and manually remediate.
Question 69
An employee logs on to the My Devices portal and marks a currently on-boarded device as `Lost`. Which two actions occur within Cisco ISE as a result of this action? (Choose two.)
Show answer and explanation
Correct answer: A, C. BYOD Registration status is updated to No; The device access has been denied.
When an employee marks a device as Lost in the My Devices portal, two actions occur: the BYOD Registration status is updated to No (indicating the device is no longer registered and authorized), and device access has been denied (the device is immediately blocked from network access). Updating to Unknown is not used for lost devices, certificates are typically revoked (not retained), and the status is marked as Lost rather than Stolen unless explicitly reported to authorities.
Why the other options are wrong
- B. The registration status changes to No, not Unknown, to definitively deny access.
- E. The device status is updated to Lost, not Stolen, unless the employee explicitly reports it to law enforcement.
Question 70
Which two fields are available when creating an endpoint on the context visibility page of Cisco ISE? (Choose two.)
Show answer and explanation
Correct answer: C, D. Policy Assignment; Identity Group Assignment
When creating an endpoint on the context visibility page in Cisco ISE, the available fields include Policy Assignment and Identity Group Assignment. These fields allow administrators to directly assign endpoints to specific policies and identity groups for management and enforcement purposes.
Why the other options are wrong
- A. Security Group Tag assignment is not a field available during endpoint creation on the context visibility page.
- B. Endpoint Family is not a configurable field when creating endpoints in the context visibility interface.
- E. IP Address is assigned to endpoints but is not a selectable field when creating endpoints in context visibility.
Question 71
An administrator is configuring Cisco ISE to authenticate users logging into network devices using TACACS+. The administrator is not seeing any of the authentication in the TACACS+ live logs. Which action ensures the users are able to log into the network devices?
Show answer and explanation
Correct answer: A. Enable the device administration service in the PSN persona.
To enable TACACS+ authentication for device administration in Cisco ISE, the device administration service must be enabled on the PSN (Policy Service Node) persona. The PSN is responsible for processing authentication and authorization requests for device admin access, whereas the Administration persona handles ISE system administration tasks. Without enabling this service on the PSN, TACACS+ authentication requests will not be processed.
Why the other options are wrong
- B. The Administration persona handles ISE administrative access, not device administration authentication services.
- C. Session services relate to user session management, not device administration TACACS+ processing.
- D. Service sessions on the PSN does not address the specific requirement for device administration service.
Question 72
What are the minimum requirements for deploying the Automatic Failover feature on Administration nodes in a distributed Cisco ISE deployment?
Show answer and explanation
Correct answer: D. a primary and secondary PAN and a health check node for the Primary PAN
Automatic Failover for Administration nodes requires a primary and secondary PAN with at least one health check node dedicated to monitoring the Primary PAN. This configuration allows the system to detect failures and automatically promote the secondary if the primary fails.
Why the other options are wrong
- A. A health check node must exist for the Primary PAN, not just the Secondary PAN.
- B. Health check nodes are required for Automatic Failover to function properly.
- C. Only one health check node is required for the Primary PAN, not a pair of health check nodes.
Question 73
A user is attempting to register a BYOD device to the Cisco ISE deployment, but needs to use the onboarding policy to request a digital certificate and provision the endpoint. What must be configured to accomplish this task?
Show answer and explanation
Correct answer: C. A native supplicant provisioning policy to redirect them to the BYOD portal for onboarding.
BYOD onboarding in Cisco ISE uses a native supplicant provisioning policy under client provisioning. It delivers the Network Setup Assistant and supplicant profile, which requests the digital certificate through the ISE SCEP proxy and provisions the endpoint for EAP-TLS.
Why the other options are wrong
- A. There is no separate BYOD flow setting that provisions an endpoint before registration; the native supplicant provisioning policy is what drives certificate enrollment.
- B. The posture provisioning policy supplies the posture agent for compliance checks, not the certificate and supplicant profile needed for BYOD onboarding.
- D. AnyConnect provisioning installs the AnyConnect client, which is not required to request a certificate and onboard a BYOD device.
Question 74
An organization wants to standardize the 802.1X configuration on their switches and remove static ACLs on the switch ports while allowing Cisco ISE to communicate to the switch what access to provide. What must be configured to accomplish this task?
Show answer and explanation
Correct answer: A. dynamic access list within the authorization profile
Dynamic access lists within the authorization profile allow Cisco ISE to dynamically push access control policies to the switch without requiring static ACLs on switch ports. ISE communicates the appropriate network access permissions through RADIUS attribute replies, enabling the switch to apply access controls based on ISE's real-time authorization decisions rather than static port configurations.
Why the other options are wrong
- B. Extended access lists are static configurations on the switch and do not remove the need for static ACLs.
- C. Security Group Tags are used for traffic segmentation but do not replace static ACLs for port-level access control.
- D. Port security based on client information does not provide the dynamic authorization capabilities needed to replace static ACLs.
Question 75
A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group. Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?
Show answer and explanation
Correct answer: B. Create and manage guest user accounts.
Guest sponsors, such as a front desk receptionist, can create and manage guest user accounts through the Cisco ISE Guest Sponsor Portal. This is the primary function of sponsor accounts, to allow designated personnel to provision temporary guest access without requiring full ISE administrative privileges.
Why the other options are wrong
- A. Tracking guest user activities is an administrative function, not a sponsor portal capability.
- C. Configuring authorization settings requires full ISE administration access, not available to sponsors.
- D. Authenticating guests is performed by ISE and network devices, not by sponsors through the portal.
Question 76
During a 802.1X deployment, an engineer must identify failed authentications without causing problems for the connected endpoint. Which command will successfully achieve this?
Show answer and explanation
Correct answer: A. authentication open
The 'authentication open' command on a switch port allows endpoints to authenticate via 802.1X while permitting network access even if authentication fails, enabling the engineer to identify failed authentications without blocking the endpoint from the network.
Why the other options are wrong
- B. The 'dot1x pae authenticator' command configures the port as an authenticator but does not control behavior upon authentication failure.
- C. The 'authentication port-control auto' command enables 802.1X but defaults to denying access on failed authentication, which would cause problems for the endpoint.
- D. The 'dot1x system-auth-control' command globally enables 802.1X on the switch but does not control per-port behavior on authentication failure.
Question 77
What is a restriction of a standalone Cisco ISE node deployment?
Show answer and explanation
Correct answer: C. Personas are enabled by default and cannot be edited on the node.
In a standalone Cisco ISE node deployment, all personas (PAN, MnT, and PSN) are enabled by default and cannot be individually disabled or edited. This is a fundamental restriction of standalone mode, where the node runs with all services automatically enabled.
Why the other options are wrong
- A. In standalone mode, it is not possible to disable individual personas such as Policy Service.
- B. The domain name of a standalone ISE node can be changed after installation through administrative configuration.
- D. The hostname of a standalone ISE node can be changed after installation, though it requires careful reconfiguration of certificates.
Question 78
An administrator is configuring RADIUS on a Cisco switch with a key set to Cisc407294634 but is receiving the error `Authentication failed: 22040 Wrong password or invalid shared secret.` What must be done to address this issue?
Show answer and explanation
Correct answer: C. Validate that the key is correct on both the Cisco switch as well as Cisco ISE.
The error 'Wrong password or invalid shared secret' indicates a mismatch between the shared secret configured on the switch and the shared secret configured in Cisco ISE. The shared secret must be identical on both the network device (NAD) and the RADIUS server for authentication to succeed. Validating that both the switch and Cisco ISE have the exact same key is the fundamental troubleshooting step required.
Why the other options are wrong
- A. Simply adding the device as a NAD does not resolve the shared secret mismatch issue.
- B. The key must be configured on both the switch and Cisco ISE, not moved from the switch to ISE only.
- D. The key length 'Cisc407294634' is 13 characters, which is valid; key length is not the issue here.
Question 79
An administrator is migrating device administration access to Cisco ISE from the legacy TACACS+ solution that used only privilege 1 and 15 access levels. The organization requires more granular controls of the privileges and wants to customize access levels 2-5 to correspond with different roles and access needs. Besides defining a new shell profile in Cisco ISE, what must be done to accomplish this configuration?
Show answer and explanation
Correct answer: D. Define the command privileges for levels 2-5 in the IOS devices.
While Cisco ISE defines the shell profiles and command sets for authorization, the actual privilege levels and their corresponding commands must be defined on the IOS devices themselves. Cisco ISE assigns privilege levels to users, but the IOS devices control what commands are available at each privilege level (2-5 in this case). Without configuring the command privileges on the IOS devices, the custom privilege levels will not function as intended.
Why the other options are wrong
- A. Privilege levels do not need to be explicitly enabled in Cisco ISE; they are configured through shell profiles.
- B. IOS devices do not have an enable/disable setting for privilege levels, they are inherently supported.
- C. Command privileges for privilege levels must be defined on the network devices, not in Cisco ISE.
Question 80
Which two methods should a sponsor select to create bulk guest accounts from the sponsor portal? (Choose two.)
Show answer and explanation
Correct answer: D, E. Imported; Random
Sponsors can create bulk guest accounts through two methods: Imported, where accounts are created from an uploaded file containing guest information, and Random, where accounts are automatically generated with randomly assigned credentials. These methods allow efficient provisioning of multiple guest accounts simultaneously.
Why the other options are wrong
- A. Known is not a bulk account creation method in the sponsor portal.
- B. Monthly is not a valid bulk creation method; it may refer to scheduling but not account creation methodology.
- C. Daily is not a bulk account creation method; it refers to scheduling frequency, not creation type.
Question 81
An administrator is troubleshooting an endpoint that is supposed to bypass 802.1X and use MAB. The endpoint is bypassing 802.1X and successfully getting network access using MAB, however the endpoint cannot communicate because it cannot obtain an IP address. What is the problem?
Show answer and explanation
Correct answer: B. The 802.1X timeout period is too long.
If the 802.1X timeout is too long, the port stays closed while the switch waits for EAP responses before falling back to MAB. By the time MAB succeeds, the endpoint's DHCP client has already given up, so the device has access but no IP address. Reducing the 802.1X timeout fixes this.
Why the other options are wrong
- A. The endpoint authenticates successfully with MAB, so the protocol is not the problem.
- C. The ISE DHCP probe is used for profiling and plays no part in the endpoint receiving an address.
- D. DHCP does not use HTTP, so an ACL blocking HTTP would not stop address assignment.
Question 82
A network engineer is configuring Cisco TrustSec and needs to ensure that the Security Group Tag is being transmitted between two devices. Where in the Layer 2 frame should this be verified?
Show answer and explanation
Correct answer: C. CMD field
With inline tagging, Cisco TrustSec carries the Security Group Tag in the Cisco Meta Data (CMD) field inserted into the Ethernet frame. Verifying the CMD field confirms the SGT is being transmitted between the devices.
Why the other options are wrong
- A. The payload carries user data, not the SGT.
- B. 802.1AE is MACsec encryption, which may protect the frame but does not itself carry the SGT.
- D. The 802.1Q field carries the VLAN tag, not the SGT.
Question 83
A network engineer needs to ensure that the access credentials are not exposed during the 802.1X authentication among components. Which two protocols should be configured to accomplish this task? (Choose two.)
Show answer and explanation
Correct answer: A, B. PEAP; EAP-TLS
PEAP (Protected EAP) and EAP-TLS are both tunneling protocols that protect credentials during 802.1X authentication. PEAP creates an encrypted TLS tunnel before transmitting credentials, while EAP-TLS uses certificate-based authentication with mutual authentication between client and server. Both prevent credential exposure by encrypting the authentication exchange. EAP-MD5 transmits credentials in cleartext, LEAP is deprecated due to security vulnerabilities, and EAP-TTLS, while secure, is less commonly preferred for this purpose in modern deployments.
Why the other options are wrong
- C. EAP-MD5 sends credentials in cleartext and provides no encryption protection.
- D. EAP-TTLS is secure but is not the standard choice alongside PEAP for this requirement.
- E. LEAP is a deprecated protocol with known security vulnerabilities and does not adequately protect credentials.
Question 84
An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE, but the devices do not change their access due to the new profile. What is the problem?
Show answer and explanation
Correct answer: A. The default profiler configuration is set to No CoA for the reauthentication setting.
When profiling is enabled in closed mode, Cisco ISE profiles endpoints but must trigger a Change of Authorization (CoA) to re-authenticate them with their new profiles. The default profiler configuration is set to 'No CoA,' which means endpoints are not re-authenticated after profiling identifies them. Enabling CoA in the profiling settings allows ISE to send re-authentication requests so endpoints receive access matching their assigned profile.
Why the other options are wrong
- B. CDP is not required for profiling to function in closed mode; profiling uses multiple probe methods.
- C. The profiler feed receiving updates is not the issue when endpoints do not change access after profiling.
- D. If profiling probes cannot gather information, endpoints would remain unprofiledyet the question states ISE assigns profiles.
Question 85
A network administrator is setting up wireless guest access and has been unsuccessful in testing client access. The endpoint is able to connect to the SSID but is unable to gain access to the guest network through the guest portal. What must be done to identify the problem?
Show answer and explanation
Correct answer: D. Use the endpoint ID to execute a session trace.
A session trace using the endpoint ID provides detailed diagnostic information about the authentication and authorization flow for that specific endpoint. This allows administrators to identify exactly where the process is failing, whether at SSID connection, DHCP, authentication, or guest portal redirection stages. Traceroute validates network connectivity but not the specific authentication flow, context visibility focuses on posture compliance status, and identity groups relate to authorization policy configuration rather than session-level diagnostics.
Why the other options are wrong
- A. Traceroute only verifies network layer connectivity and does not diagnose guest portal or authentication failures.
- B. Context visibility shows posture compliance status but does not trace the guest access authentication flow.
- C. Identity groups validate authorization rules but do not provide session-level diagnostic information needed to identify connection problems.
Question 86
What is a characteristic of the UDP protocol?
Show answer and explanation
Correct answer: C. UDP offers best-effort delivery.
UDP (User Datagram Protocol) is a connectionless protocol that provides best-effort delivery, meaning it sends packets without guaranteeing delivery, ordering, or error checking. UDP does not establish connections, monitor server status, measure performance, or provide feedback about unreachable servers, it simply sends data and does not care whether it arrives.
Why the other options are wrong
- A. UDP is connectionless and does not maintain state to detect if a server is down.
- B. UDP has no mechanism to measure latency or determine if a server is slow.
- D. UDP does not provide information about non-existent servers; it simply sends datagrams without feedback.
Question 87
A network administrator must use Cisco ISE to check whether endpoints have the correct version of antivirus installed. Which action must be taken to allow this capability?
Show answer and explanation
Correct answer: D. Create a Cisco AnyConnect configuration within Cisco ISE for the Compliance Module and associated configuration files.
To check whether endpoints have the correct version of antivirus installed, a Cisco AnyConnect configuration must be created within Cisco ISE that includes the Compliance Module and its associated configuration files. The Compliance Module collects detailed endpoint posture information, including antivirus status and versions, and reports it back to ISE for evaluation.
Why the other options are wrong
- A. The Network Visibility Module is for network monitoring, not for antivirus version verification.
- B. HostScan is not the primary mechanism for antivirus checking; AnyConnect Compliance Module is the standard approach.
- C. Native supplicants are for network authentication, not for antivirus posture checking.
Question 88
An engineer is configuring Cisco ISE and needs to dynamically identify the network endpoints and ensure that endpoint access is protected. Which service should be used to accomplish this task?
Show answer and explanation
Correct answer: B. profiling
The profiling service in Cisco ISE is designed to dynamically identify and classify network endpoints based on their behavior, attributes, and traffic patterns. Profiling collects endpoint information and assigns endpoints to identity groups, enabling dynamic access control based on endpoint type and risk level.
Why the other options are wrong
- A. Guest access provides temporary network access for visitors, not dynamic endpoint identification.
- C. Posture assessment checks endpoint compliance with security policies but does not identify endpoint types.
- D. Client provisioning delivers software and configurations to endpoints rather than identifying them.
Question 89
There are several devices on a network that are considered critical and need to be placed into the ISE database and a policy used for them. The organization does not want to use profiling. What must be done to accomplish this goal?
Show answer and explanation
Correct answer: A. Enter the MAC address in the correct Endpoint Identity Group.
MAC addresses uniquely identify endpoints at Layer 2 and remain constant regardless of IP changes. Entering critical device MAC addresses directly into the appropriate Endpoint Identity Group in Cisco ISE allows for static device identification and policy application without relying on dynamic profiling.
Why the other options are wrong
- B. IP addresses are dynamic and can change, making them unreliable for permanent endpoint identification in a database.
- C. Logical Profiles are used for profiling-based categorization, but the requirement explicitly states profiling should not be used.
- D. While MAC addresses are correct, Logical Profiles are associated with profiling mechanisms, which the organization wants to avoid.
Question 90
Which two Cisco ISE deployment models require two nodes configured with dedicated PAN and MnT personas? (Choose two.)
Show answer and explanation
Correct answer: A, C. seven PSN nodes with one PxGrid node; five PSN nodes with one PxGrid node
Cisco ISE deployment models with seven PSN nodes and one PxGrid node (option A) and five PSN nodes with one PxGrid node (option C) both require dedicated two-node PAN and MnT configurations. These larger deployments necessitate dedicated primary and secondary PAN/MnT nodes to handle the scale and provide redundancy, whereas smaller deployments can use a single node for multiple personas.
Why the other options are wrong
- B. Two PSN nodes with one PxGrid node is a smaller deployment that does not require dedicated PAN and MnT personas.
- D. Six PSN nodes alone does not specify the required PAN/MnT configuration model.
- E. Three PSN nodes is considered a smaller deployment that does not require dedicated two-node PAN and MnT personas.
Question 91
During BYOD flow, where does a Microsoft Windows PC download the Network Setup Assistant?
Show answer and explanation
Correct answer: C. Cisco ISE directly
During the BYOD flow, a Microsoft Windows PC downloads the Network Setup Assistant directly from the Cisco ISE appliance. This ensures the endpoint receives the correct provisioning and enrollment tool tailored to the ISE deployment's specific configuration and policies.
Why the other options are wrong
- A. The Microsoft App Store does not host Cisco's Network Setup Assistant.
- B. There is no Cisco App Store; Cisco provides the tool directly from ISE.
- D. Native OTA (Over-The-Air) functionality is not the delivery mechanism for the Network Setup Assistant in BYOD flows.
Question 92
An administrator is configuring sponsored guest access using Cisco ISE. Access must be restricted to the sponsor portal to ensure that only necessary employees can issue sponsored accounts, and employees must be classified to do so. What must be done to accomplish this task?
Show answer and explanation
Correct answer: A. Modify the sponsor groups assigned to reflect the desired user groups.
In Cisco ISE, who may log in to the sponsor portal is controlled by sponsor group membership. Each sponsor group lists the internal or AD user groups whose members become sponsors, so editing those member groups limits sponsor portal access to the right employees.
Why the other options are wrong
- B. Cisco ISE has no identity-based access list for controlling sponsor portal logins; sponsor eligibility comes from sponsor group membership.
- C. The sponsor portal settings do not decide which employees are sponsors; that is decided by the user groups mapped to sponsor groups.
- D. The Guest Flow condition is used in authorization rules for guests who have completed the guest portal flow, not for classifying employee sponsors.
Question 93
What is the deployment mode when two Cisco ISE nodes are configured in an environment?
Show answer and explanation
Correct answer: B. distributed
When two Cisco ISE nodes are configured in an environment, the deployment mode is 'distributed.' This configuration allows one node to serve as the Primary Administration Node (PAN) and Policy Service Node (PSN) while the second node functions as a secondary PSN, distributing the policy service load. Standalone refers to a single node, standard is not a recognized ISE deployment term, and active typically describes node status within a distributed setup.
Why the other options are wrong
- A. Standalone applies to a single-node deployment, not two nodes.
- C. Standard is not an official Cisco ISE deployment mode designation.
- D. Active describes the operational status of a node, not the overall deployment architecture.
Question 94
In a Cisco ISE split deployment model, which load is split between the nodes?
Show answer and explanation
Correct answer: C. AAA
In a Cisco ISE split deployment model, the device admission control and network admission control (AAA authentication functions) load is split between nodes. This distribution allows scaling of authentication and authorization services across multiple Policy Service Nodes. Log collection remains centralized on monitoring nodes, not split.
Why the other options are wrong
- A. Log collection is centralized on the Monitoring and Troubleshooting persona, not split between nodes.
- B. Device admission is part of network admission control, making this option less precise than C.
- D. Network admission is the correct concept, but AAA more specifically describes the authentication services being split.
Question 95
A new employee just connected their workstation to a Cisco IP phone. The network administrator wants to ensure that the Cisco IP phone remains online when the user disconnects their workstation from the corporate network. Which CoA configuration meets this requirement?
Show answer and explanation
Correct answer: C. No CoA
The 'No CoA' configuration ensures that when a profile change is detected (such as when the workstation disconnects but the IP phone remains), no Change of Authorization message is sent that would affect the port. This prevents the NAD from bouncing the port or terminating the session, allowing the IP phone to remain online independently of the workstation.
Why the other options are wrong
- A. Reauth would trigger reauthentication of the port, potentially disconnecting the IP phone.
- B. Disconnect would terminate the session on the port, disconnecting the IP phone.
- D. Port Bounce would reset the port, disconnecting all devices connected to it including the IP phone.
Question 96
An engineer is using Cisco ISE and configuring guest services to allow wireless devices to access the network. Which action accomplishes this task?
Show answer and explanation
Correct answer: D. Create the redirect ACL on the WLC and add it to the Cisco ISE policy.
The redirect ACL must be created on the WLC (Wireless LAN Controller) and then added to the Cisco ISE policy. The WLC enforces the redirect ACL at the wireless network access point level, while the ISE policy references and applies this ACL during the guest authentication and authorization process.
Why the other options are wrong
- A. Creating the ACL on ISE alone does not allow the WLC to enforce the redirect.
- B. While the ACL is created on the WLC, it must also be referenced in the ISE policy.
- C. ISE does not create redirect ACLs; this function belongs to the WLC.
Question 97
An organization is implementing Cisco ISE posture services and must ensure that a host-based firewall is in place on every Windows and Mac computer that attempts to access the network. They have multiple vendors' firewall applications for their devices, so the engineers creating the policies are unable to use a specific application check in order to validate the posture for this. What should be done to enable this type of posture check?
Show answer and explanation
Correct answer: B. Enable the default firewall condition to check for any vendor firewall application.
Cisco ISE includes a default firewall condition that can check for the presence of any vendor's firewall application without requiring vendor-specific application checks. This built-in condition allows organizations to validate that a host-based firewall is running regardless of the vendor, enabling posture compliance across multiple firewall solutions.
Why the other options are wrong
- A. Application conditions are for checking specific applications, not for vendor-agnostic firewall detection.
- C. Compound conditions combine multiple conditions but are not the primary mechanism for vendor-agnostic firewall checking.
- D. Registry conditions check file system artifacts but are more complex and vendor-specific than using the default firewall condition.
Question 98
Which term refers to an endpoint agent that tries to join an 802.1X-enabled network?
Show answer and explanation
Correct answer: C. supplicant
A supplicant is the endpoint agent that initiates 802.1X authentication and attempts to join the network. It responds to authentication server challenges and provides credentials to gain network access.
Why the other options are wrong
- A. EAP server processes authentication requests but is not the endpoint joining the network.
- B. Authenticator is the network device enforcing 802.1X policy, not the endpoint itself.
- D. Client is generic terminology; supplicant is the specific 802.1X term for the authenticating endpoint.
Question 99
An administrator for a small network is configuring Cisco ISE to provide dynamic network access to users. Management needs Cisco ISE to not automatically trigger a CoA whenever a profile change is detected. Instead, the administrator needs to verify the new profile and manually trigger a CoA. What must be configured in the profiler to accomplish this goal?
Show answer and explanation
Correct answer: B. No CoA
The 'No CoA' option in the Cisco ISE profiler prevents automatic Change of Authorization messages from being triggered when a profile change is detected. This allows administrators to manually review profile changes and then trigger CoA actions on demand, rather than having CoA automatically apply when profiles change.
Why the other options are wrong
- A. Session Query is used to retrieve endpoint session information, not to control CoA triggering behavior.
- C. Reauth triggers reauthentication but does not prevent automatic CoA on profile changes.
- D. Port Bounce forces a port to reset but does not prevent automatic CoA triggering.
Question 100
An organization is migrating its current guest network to Cisco ISE and has 1000 guest users in the current database. There are no resources to enter this information into the Cisco ISE database manually. What must be done to accomplish this task efficiently?
Show answer and explanation
Correct answer: B. Use a CSV file to import the guest accounts.
Cisco ISE supports bulk import of guest accounts using CSV (Comma-Separated Values) files. CSV format is the standard method for importing large numbers of user records into ISE and can be processed through the administration interface. XML files require format conversion, JSON files are not the standard import format for guest accounts in ISE, and SQL linking creates database integration issues rather than efficient migration of existing guest data.
Why the other options are wrong
- A. XML files require conversion work and are not the native import format for Cisco ISE guest accounts.
- C. JSON files are not the standard format supported by Cisco ISE for guest account bulk import.
- D. Direct SQL linking is not a supported method for migrating guest accounts into Cisco ISE.
Question 101
A Cisco ISE administrator needs to ensure that guest endpoint registrations are only valid for 1 day. When testing the guest policy flow, the administrator sees that the Cisco ISE does not delete the endpoint in the GuestEndpoints identity store after 1 day and allows access to the guest network after that period. Which configuration is causing this problem?
Show answer and explanation
Correct answer: C. The Endpoint Purge Policy is set to 30 days for guest devices.
The Endpoint Purge Policy determines when guest endpoints are automatically deleted from the GuestEndpoints identity store. If this policy is set to 30 days, endpoints will not be purged until 30 days have passed, allowing guest access to continue beyond the intended 1-day validity period. The Guest Account Purge Policy applies to guest accounts, not endpoints, the Guest Portal Settings control access duration but endpoints remain in the system, and RADIUS policy affects authentication behavior rather than endpoint retention.
Why the other options are wrong
- A. The Guest Account Purge Policy removes guest accounts, not endpoints, and does not control endpoint retention timing.
- B. Guest Portal Settings define the length of access validity but do not control when endpoints are deleted from the identity store.
- D. RADIUS policy configuration affects authentication behavior and session handling, not endpoint purge timing.
Question 102
What are two differences between the RADIUS and TACACS+ protocols? (Choose two.)
Show answer and explanation
Correct answer: D, E. RADIUS combines authentication and authorization, whereas TACACS+ does not; TACACS+ uses TCP port 49, whereas RADIUS uses UDP ports 1812 and 1813.
TACACS+ uses TCP port 49 while RADIUS uses UDP ports 1812 and 1813, this is a fundamental protocol difference. Additionally, TACACS+ encrypts the entire packet payload, whereas RADIUS encrypts only the password field, leaving other packet contents in plain text. These represent key architectural differences in how the protocols handle security and transport.
Why the other options are wrong
- A. Both RADIUS and TACACS+ support multiple protocols; this distinction is not accurate.
- B. TACACS+ is actually the Cisco proprietary protocol, while RADIUS is the open standard, this is backwards.
- C. RADIUS does not encrypt all packets; only the password field is encrypted in the User-Password attribute.
That was 102 of 407.
The full Cisco 300-715 SISE pack has all 407 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 203 free as one PDF by email. Get the Half Pack →