Free Implementing and Configuring Cisco Identity Services Engine Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Implementing and Configuring Cisco Identity Services Engine practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An administrator must remove the Monitoring persona from a newly installed standalone Cisco ISE 3.3 node. What must happen before the node's personas can be edited?

   1. A. Configure the node as primary, or register it as a secondary node.
   2. B. Enable the Dedicated MnT option while the node remains standalone.
   3. C. Synchronize the standalone node with its configured NTP server.
   4. D. Import an additional trusted certificate while retaining standalone status.

   Answer: A

   Explanation: Cisco states, "You cannot edit the personas or services of a standalone Cisco ISE node." The node must first become primary or secondary; NTP, certificate trust, and the Dedicated MnT option do not remove this role restriction.

   Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Deployment of Cisco ISE — Configure a Cisco ISE node

2. 2Which configuration addresses the time-synchronization prerequisite for native Active Directory integration with Cisco ISE?

   1. A. Match the LDAP search bases on all Policy Service Nodes.
   2. B. Use NTP settings to synchronize ISE and Active Directory.
   3. C. Use the same SNMP polling interval on ISE and the domain controller.
   4. D. Match the RADIUS session timeout to the domain password lifetime.

   Answer: B

   Explanation: Cisco directs administrators to "synchronize the time between the Cisco ISE" server and Active Directory using NTP. Search bases, polling intervals, and session lifetimes do not synchronize the system clocks.

   Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Asset Visibility, Prerequisites for integrating Active Directory and Cisco ISE, p. 670

3. 3In the documented CWA flow, an unknown wired guest has no 802.1X supplicant and fails the initial MAB lookup. How should authentication handling allow the guest to reach the portal?

   1. A. Drop the MAB request without sending a RADIUS response.
   2. B. Reject the MAB request and wait for the endpoint to start EAP-TLS.
   3. C. Continue to authorization and return a restricted redirect profile.
   4. D. Mark the endpoint compliant and bypass guest authentication.

   Answer: C

   Explanation: The CWA flow specifies a policy that "allows a MAB failure to continue" and returns a restricted profile with a portal redirect. Rejecting or dropping the request prevents this redirect flow; unknown identity does not establish posture compliance.

   Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Guest and Secure WiFi, NAD with Central WebAuth Process, step 2, p. 541

4. 4In a distributed Cisco ISE 3.3 deployment, on which nodes can the profiling service run?

   1. A. Nodes that assume only the Administration persona
   2. B. Nodes that assume the Policy Service persona
   3. C. Nodes that assume only the Monitoring persona
   4. D. Nodes that assume only the pxGrid persona

   Answer: B

   Explanation: Cisco states, "the profiling service runs only on Cisco ISE nodes that assume the Policy Service" persona in a distributed deployment. Administration-only, Monitoring-only, and pxGrid-only nodes are not profiling-service hosts.

   Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Asset Visibility, Configure Profiling Service in Cisco ISE Nodes, p. 818

5. 5What distinguishes dual-SSID BYOD onboarding from single-SSID onboarding in Cisco ISE?

   1. A. One SSID carries enrollment, provisioning, and secure network access.
   2. B. One SSID carries enrollment and provisioning; the other carries secure access.
   3. C. Two SSIDs both carry enrollment and secure access, selected by operating system.
   4. D. Two SSIDs separate authentication requests from authorization requests.

   Answer: B

   Explanation: Cisco states, "one provides enrollment and provisioning, and the other provides secure network access." Single SSID combines these uses. Dual SSID does not mean an OS-selected pair with identical roles or separate WLANs for authentication and authorization.

   Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Bring Your Own Device (BYOD), BYOD deployment options and status flow, p. 919

6. 6An endpoint matches an enabled posture policy, but its agent has not yet completed assessment or sent a compliance report. Which posture status can apply?

   1. A. Compliant, because the policy is enabled
   2. B. Noncompliant, because no report has arrived
   3. C. Registered, because authentication succeeded
   4. D. Unknown, because assessment has not occurred

   Answer: D

   Explanation: Cisco says unknown can apply when "posture assessment has not yet occurred for that endpoint". Policy matching alone does not prove compliance or failure; Registered is a device-registration status, not this posture outcome.

   Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Compliance, Custom Permissions for Posture, Unknown Profile, p. 1303

7. 7Which transport and default destination port does ISE use for TACACS+ device administration?

   1. A. UDP port 49
   2. B. TCP port 49
   3. C. UDP port 1812
   4. D. TCP port 1813

   Answer: B

   Explanation: Cisco specifies "TCP ports" and states, "The default TACACS port value is 49." Thus the default transport/port pair is TCP 49. UDP 49 has the wrong transport; 1812 and 1813 are not the TACACS+ default port.

   Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Device Administration, Device Administration Deployment Settings, TACACS Ports, p. 469

8. 8Where should an administrator initiate a change to the personas of a registered Cisco ISE node?

   1. A. The SSH CLI of the secondary MnT node
   2. B. The local Admin portal of an isolated PSN
   3. C. The Admin portal of the primary PAN
   4. D. The console setup utility of the registered node

   Answer: C

   Explanation: The procedure Change Node Personas and Services begins, "Log in to the primary PAN." The administrator then selects and edits the registered node under Deployment; a secondary-node console or local PSN portal is not the prescribed control point.

   Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Deployment of Cisco ISE — Change Node Personas and Services, steps 1–5

9. 9An Active Directory join point has been saved in Cisco ISE, but a selected node has not joined the domain. Which action completes that node's domain membership?

   1. A. Resave the join-point name without selecting a node.
   2. B. Restart the Monitoring service to replicate domain membership.
   3. C. Select the node in the deployment join/leave table and click Join.
   4. D. Add the domain name to a network device group and synchronize it.

   Answer: C

   Explanation: Cisco instructs, "check the check box next to the relevant Cisco ISE nodes and click Join to join the Cisco ISE node to the Active Directory domain." The next sentence confirms this remains explicit even after saving configuration. Resaving, MnT restart, and network-device grouping do not perform that domain join.

   Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Asset Visibility, Add an Active Directory join point and join a Cisco ISE node to the join point, step 5, p. 674

10. 10Which RADIUS response carries the initial url-redirect value from ISE to the NAD in the documented unknown-endpoint CWA flow?

    1. A. Access-Accept
    2. B. Access-Reject
    3. C. Accounting-Response
    4. D. Disconnect-ACK

    Answer: A

    Explanation: Cisco states that the restricted profile "returns the url-redirect value in the" profile to the NAD in an access-accept. The initial accepted restricted authorization enables redirection; rejection, accounting acknowledgement, and disconnect acknowledgement are different responses.

    Reference: Cisco Identity Services Engine Administrator Guide, Release 3.3 — Guest and Secure WiFi, NAD with Central WebAuth Process, step 4, p. 541