Free SISE Practice Questions

Question 1

A label printer authenticates by MAB and belongs to WarehousePrinters. Its ISE policy set contains these ordinary authorization rules, evaluated in the order shown; no exception rules apply:
1. MAB → FullAccess, permitting all IP traffic
2. MAB AND WarehousePrinters → PrintOnly, permitting DNS and approved printing flows
3. All other requests → DenyAccess
The printer receives FullAccess. At the next authorization evaluation, what change will select PrintOnly for these printers while preserving the treatment of other MAB endpoints?

Accepted Answer

Move rule 2 above rule 1, keeping both rules' conditions.

Answer

Shorten the printer's reauthentication interval.

Answer

Tighten the ACL returned by the PrintOnly profile.

Answer

Check Internal Endpoints first in the MAB identity sequence.

Question 2

After an EAP server certificate change, newly onboarded personal laptops connect to the corporate WLAN, but older BYOD laptops fail. Affected laptops reject the approved new root CA; a capture confirms that the PSN supplies all required intermediate certificates. The expected server name and validity dates are correct. The laptops' client certificates and private keys remain valid, and ISE trusts their issuer. Where does the repair belong?

Accepted Answer

Update the affected laptops' EAP trust configuration with the approved CA chain.

Answer

Import the new EAP server issuer into ISE's client-certificate trust store.

Answer

Reissue the affected laptops' client certificates under their existing CA.

Answer

Change ISE's certificate identity extraction from the subject to the SAN.

Question 3

A guest successfully signs in through ISE central web authentication, yet the NAD keeps the initial redirect authorization. The account is valid. ISE records a CoA timeout, followed by no new RADIUS Access-Request. Manually reauthenticating that session immediately produces the intended GuestInternet profile. These results isolate the fault to which part of the flow?

Accepted Answer

The PSN-to-NAD CoA path and the NAD's dynamic-authorization settings.

Answer

The authorization profile returned after successful guest reauthentication.

Answer

The guest identity source selected for the successful portal login.

Answer

The authentication protocol allowed for the initial MAB exchange.

Question 4

An ISE 3.4 PSN VM has the 24 vCPUs and 32 GB of RAM required for its selected SNS 3715-equivalent size. Authentication slows when neighboring VMs become busy. ESXi telemetry shows CPU contention and memory reclamation affecting the PSN; its CPU and memory reservations are both zero. Network, DNS, and AD response times are normal. Select the infrastructure correction supported by this evidence.

Accepted Answer

Reserve the required CPU and RAM on a host with adequate capacity.

Answer

Double the allocated vCPU count while retaining zero resource reservations.

Answer

Increase RADIUS retry timers to tolerate delays during host contention.

Answer

Increase the virtual disk allocation to provide more storage capacity.

Question 5

A profiling-policy test evaluates an endpoint against two enabled, administrator-created root profiles:
• Office-Printer: minimum certainty factor 70; matching rules contribute 20 and 30.
• Generic-Printer: minimum certainty factor 35; one matching rule contributes 45.
No other rules or profiles match, and neither profile has a parent. How should the endpoint be classified?

Accepted Answer

Generic-Printer: 45 exceeds its minimum; Office-Printer's 50 falls short.

Answer

Office-Printer: its total of 50 is the higher raw score.

Answer

Both profiles: each has evidence from at least one matching rule.

Answer

Neither profile: the higher minimum of 70 governs the comparison.

Question 6

An IOS XE switch requests TACACS+ authorization for reload with no arguments and for show running-config. The operator has privilege 15. ISE selects both command sets below:

Operations: reload → Deny; show with argument ^running-config$ → Permit.
Maintenance: reload → Permit; show with argument ^running-config$ → Deny Always.

Neither set permits unlisted commands. Predict the two authorization results.

Accepted Answer

reload: Permit; show running-config: Deny.

Answer

reload: Permit; show running-config: Permit.

Answer

reload: Deny; show running-config: Deny.

Answer

reload: Deny; show running-config: Permit.

Question 7

Three workstations share a Catalyst access port through a downstream device that forwards their 802.1X exchanges. Before authentication, ordinary IP access must be limited to DHCP and DNS. Each workstation must then authenticate separately and receive its own authorization; one successful login must not admit the others. Which deployment-mode and host-mode pairing satisfies both requirements?

Accepted Answer

Low-impact mode with multi-auth authentication

Answer

Monitor mode with multi-auth authentication

Answer

Low-impact mode with multi-domain authentication

Answer

Closed mode with multi-host authentication

Question 8

A Windows pilot in the ISE Posture Work Center assigns three requirements:
• Firewall enabled - Mandatory: passes.
• Approved backup utility installed - Optional: fails; the user chooses to continue without remediating it.
• Disk encrypted - Audit: fails.
Assessment completes, and no other requirements apply. Authorization maps Compliant to CorporateAccess, Noncompliant to RemediationOnly, and Unknown to ClientProvisioning. Which status and access result should follow?

Accepted Answer

Compliant → CorporateAccess; every mandatory requirement has passed.

Answer

Unknown → ClientProvisioning; skipping the optional check leaves assessment unfinished.

Answer

Noncompliant → RemediationOnly; the failed audit check prevents compliance.

Answer

Noncompliant → RemediationOnly; only one of the three checks has passed.

Question 9

Security confirms that a stolen BYOD laptop is still connected to the corporate WLAN. An administrator marks it Stolen: its ISE-issued endpoint certificate is revoked and it enters Blocked List. A top-priority authorization rule denies that group, but the resulting session-termination request has failed and the WLC is still forwarding traffic under the earlier authorization. What must be done now to contain this connection?

Accepted Answer

Terminate the laptop's active session on the WLC.

Answer

Wait for revocation checking at the next scheduled authentication.

Answer

Delete the laptop's endpoint record from the ISE database.

Answer

Disable the employee's account in the corporate directory.

Question 10

At a reception shift handover, one sponsor can extend guests they created but cannot manage a colleague's active guest account. Both sponsors belong only to Reception; HR sponsors belong to a separate group. Extension permission is already enabled. Reception staff need to cover each other's guests without administering HR's accounts. How should Reception's management scope change?

Accepted Answer

Allow management of accounts created by members of its sponsor group.

Answer

Increase its maximum guest duration while retaining creator-only management.

Answer

Allow management of all guest accounts and filter the view by creator.

Answer

Use one guest type for Reception while retaining creator-only management.

Free SISE Practice Questions

Domain 1: Architecture and Deployment 10% of exam

Question 1

Domain 2: Policy Enforcement 25% of exam

Question 2

Question 3

Domain 3: Web Auth and Guest Services 15% of exam

Question 4

Question 5

Domain 4: Profiler 15% of exam

Question 6

Domain 5: BYOD 15% of exam

Question 7

Question 8

Domain 6: Endpoint Compliance 10% of exam

Question 9

Domain 7: Network Access Device Administration 10% of exam

Question 10

That's 10 of 1,030