Cisco SISE 300-715 Practice Questions with Explanations

Correct answer: D

Cisco ISE nodes can assume three personas: administration (handles policy configuration and management), policy service (evaluates authentication and authorization), and gatekeeping (enforces network access policies at network edge devices). These three personas represent the complete set of functional roles available in ISE deployments.

Why the other options are wrong:

• A. Monitoring is not a separate persona; monitoring functions are integrated into the administration persona.
• B. Gatekeeping is a persona, but monitoring is not a distinct persona in ISE architecture.
• C. Monitoring is not a separate ISE persona; policy service and gatekeeping are the two non-administration personas.

Correct answer: D

When a secondary node is deregistered from a two-node distributed deployment, the primary node transitions to standalone mode. This is the expected behavior for maintaining ISE functionality when a secondary node is removed from the deployment.

Why the other options are wrong:

• A. The secondary node does not restart when deregistered; it is removed from the deployment.
• B. The primary node does not restart during secondary deregistration; it transitions to standalone mode.
• C. Both nodes do not restart; the secondary is deregistered and the primary becomes standalone.

Correct answer: B

Cisco AnyConnect NAM (Network Access Manager) supplicant and Cisco Identity Service Engine server are the components capable of supporting EAP-CHAINING. This feature allows multiple EAP methods to be chained together in a single authentication exchange, and only these specific Cisco products provide this functionality.

Why the other options are wrong:

• A. Cisco Secure Services Client does not support EAP-CHAINING; Cisco Access Control Server is not the correct server component.
• C. Cisco Access Control Server does not support EAP-CHAINING; ISE is the correct server for this feature.
• D. Windows Native Supplicant does not support EAP-CHAINING; while ISE is correct, the supplicant component is incorrect.

Correct answer: D

Feed Service requires Cisco ISE to have Internet access to download feed updates from Cisco servers. This internet connectivity is essential for ISE to retrieve threat intelligence, malware feeds, and other dynamic security data used by the system.

Why the other options are wrong:

• A. TCP port 8080 is not the requirement; feed updates are typically downloaded over HTTPS on port 443.
• B. Feed Service accesses external Cisco servers, not an internal server, for updates.
• C. A base license is not sufficient; specific licensing or subscriptions may be required, but internet access is the primary technical requirement.

Correct answer: B

The Security Group Tag Exchange Protocol (SXP) is the method for transporting security group tags throughout the network. SXP allows ISE to propagate SGT information to network devices that may not have direct ISE connectivity, enabling consistent policy enforcement across the infrastructure.

Why the other options are wrong:

• A. Embedding SGT in the 802.1Q header is not the standard method; SXP is the protocol used for SGT exchange.
• C. 802.1AE is a link security standard and is not the mechanism for SGT transport.
• D. Embedding SGT in the IP header is not how ISE propagates security group tags; SXP is the dedicated protocol.

Correct answer: A

The Monitoring and Troubleshooting persona requires the largest storage allocation in a distributed virtual ISE deployment. This persona generates and stores extensive logging, reporting, and troubleshooting data from all other nodes, making it storage-intensive.

Why the other options are wrong:

• B. Policy Services requires significant resources but less storage than the Monitoring node due to less data retention needs.
• C. Primary Administration handles policy configuration but does not store the volume of logs that Monitoring does.
• D. Platform Exchange Grid is not a recognized ISE persona; the three personas are Administration, Policy Service, and Monitoring.

Correct answer: C

Security Group Tags (SGT) are Cisco's solution for enforcing access control based on special tags without requiring network redesign. SGTs enable scalable, identity-based access control that works across the network infrastructure by tagging traffic and applying policies based on those tags. RBAC is role-based access control for administrative functions, dACL is dynamic ACL which requires network reconfiguration, and VLAN segmentation requires network redesign.

Why the other options are wrong:

• A. RBAC controls administrative access, not data plane traffic filtering based on tags.
• B. dACL requires network reconfiguration and doesn't use special tags natively.
• D. VLAN segmentation requires network redesign, which the requirement explicitly avoids.

Correct answer: D

The 'cts role-based enforcement' command enables role-based access control enforcement on a routed interface using security group tags. This command configures the device to filter traffic based on security policies that reference SGTs. The other commands relate to policy priority, caching, and authorization lists, which do not directly enable SGT- based filtering on an interface.

Why the other options are wrong:

• A. cts role-based policy priority-static sets policy priority, not enforcement on interfaces.
• B. cts cache enable configures caching for performance, not enforcement mechanisms.
• C. cts authorization list defines authorization rules but doesn't enable enforcement on routed interfaces.

Correct answer: C

In a Cisco ISE split deployment model, the device admission control and network admission control (AAA authentication functions) load is split between nodes. This distribution allows scaling of authentication and authorization services across multiple Policy Service Nodes. Log collection remains centralized on monitoring nodes, not split.

Why the other options are wrong:

• A. Log collection is centralized on the Monitoring and Troubleshooting persona, not split between nodes.
• B. Device admission is part of network admission control, making this option less precise than C.
• D. Network admission is the correct concept, but AAA more specifically describes the authentication services being split.

Correct answer: B

When two Cisco ISE nodes are configured in an environment, the deployment mode is 'distributed.' This configuration allows one node to serve as the Primary Administration Node (PAN) and Policy Service Node (PSN) while the second node functions as a secondary PSN, distributing the policy service load. Standalone refers to a single node, standard is not a recognized ISE deployment term, and active typically describes node status within a distributed setup.

Why the other options are wrong:

• A. Standalone applies to a single-node deployment, not two nodes.
• C. Standard is not an official Cisco ISE deployment mode designation.
• D. Active describes the operational status of a node, not the overall deployment architecture.

Correct answer: C

Supplicant profile distribution to endpoints originates from the Policy Service (PS) persona in Cisco ISE. The Policy Service persona is responsible for policy enforcement and pushing configuration profiles to network devices and endpoints. The administration persona handles management functions, the authentication persona processes authentication requests, and monitoring handles analytics.

Why the other options are wrong:

• A. The administration persona manages ISE configuration and user access, not endpoint supplicant distribution.
• B. The authentication persona processes authentication requests but doesn't push profiles to endpoints.
• D. The monitoring persona collects and reports on events and alarms, not distributes supplicant profiles.

Correct answer: C

A fully distributed Cisco ISE deployment places all personas on their own dedicated nodes. This configuration includes separate dedicated nodes for the Primary Administration Node (PAN), Policy Service Nodes (PSN), and Monitoring and Troubleshooting (MnT) nodes, providing maximum scalability and performance separation. Any shared persona configuration represents a less-distributed model.

Why the other options are wrong:

• A. Placing PAN and MnT together on one node while PSNs are separate is not a fully distributed model.
• B. All personas sharing the same node defines a standalone deployment, not distributed.
• D. Combining PAN and PSN on one node contradicts the principle of full distribution across dedicated nodes.

Correct answer: C

Low-impact mode for 802.1X provides open authentication on switch ports while allowing traffic from non-authenticated devices, making it transparent to users. Once authenticated devices connect, they receive restricted access based on policy. This allows strong security for authenticated users while maintaining open access for non-authenticated endpoints. Closed mode denies non-authenticated traffic, high-impact mode impacts user experience, and open mode provides no security enforcement.

Why the other options are wrong:

• A. Closed mode denies all non-authenticated traffic, which contradicts the open authentication requirement.
• B. High-impact mode requires devices to authenticate before network access, reducing transparency.
• D. Open mode provides no enforcement mechanism and lacks the security requirement for authenticated devices.

Correct answer: A

When scaling from pilot to production, enabling the endpoint attribute filter minimizes the data replicated between Cisco ISE nodes. This filter prevents unnecessary endpoint attributes from being replicated across the cluster, significantly reducing JVM memory utilization and network traffic. Profiling policies and feed updates affect profiling performance but not replication, and reauthentication intervals don't address replication overhead.

Why the other options are wrong:

• B. Reviewing profiling policies addresses accuracy but not the replication load causing memory degradation.
• C. Updating the profiler feed improves endpoint profiling but doesn't reduce replication- related memory consumption.
• D. Changing reauthentication intervals affects session management frequency, not replication data volume.

Correct answer: B

A Certificate Signing Request (CSR) is the standard mechanism used to provide certificate information to a Certificate Authority. The CSR contains the appliance's public key and identifying information such as hostname, organization, and country, which the CA needs to sign and issue a valid certificate. Generating the CSR is the prerequisite step before the CA can sign the certificate.

Why the other options are wrong:

• A. Installing root and intermediate CAs happens after obtaining the signed certificate, not before.
• C. Downloading the CA server certificate is done to validate the CA's identity, not to provide information to the CA.
• D. Downloading the intermediate server certificate occurs after certificate signing is complete.

Correct answer: B

In Cisco ISE, the Device Type field is used to classify network devices and assign them to network device groups for policy purposes. By changing the device type to 'Medical Switch', the device will be placed in the appropriate network device group, allowing policies to be applied separately to endpoints connecting through medical building switches.

Why the other options are wrong:

• A. Device profile is not the mechanism for assigning devices to network device groups in ISE.
• C. Device location is a geographical identifier and does not control network device group assignment.
• D. Model name is a descriptive field for the physical device model and does not affect policy grouping.

Correct answer: D

The Primary PAN (Policy Administration Node) cannot be deregistered from the deployment because it is the central administration point for the entire ISE infrastructure. The deregister button is grayed out when a node holds the Primary PAN role, as removing it would compromise the entire deployment's administration capabilities.

Why the other options are wrong:

• A. Active synchronization between nodes does not prevent deregistration.
• B. PAN auto failover configuration does not block the deregister function.
• C. An active PSN can be deregistered; only the Primary PAN cannot be removed.

Correct answer: C

The Monitor persona in Cisco ISE is responsible for collecting, processing, and reporting session and event information across the deployment. To share session information via syslog with external receivers, the Monitor persona must be configured on nodes that will send this data to the syslog receivers.

Why the other options are wrong:

• A. The admin persona manages administrative tasks, not session logging.
• B. Policy Services persona handles authentication and authorization, not syslog reporting.
• D. pxGrid is used for sharing context and metadata between ISE and other platforms, not for syslog transmission.

Correct answer: C

In a medium-sized Cisco ISE deployment, the maximum number of Policy Services Node (PSN) nodes supported is five. This sizing guideline is based on Cisco's documented deployment architecture and performance specifications for medium-tier implementations.

Why the other options are wrong:

• A. Two PSN nodes is insufficient for medium-sized deployments requiring high availability.
• B. Three PSN nodes is below the maximum capacity for medium deployments.
• D. Eight PSN nodes exceeds the medium deployment limit and applies to larger deployments.

Correct answer: D

Policy Services Node redundancy is achieved by configuring Network Access Devices (NADs) with a RADIUS server list containing multiple PSN nodes. When a NAD is configured with a list of RADIUS servers, it can failover to alternative PSN nodes if the primary node becomes unavailable, ensuring continuous authentication and authorization services.

Why the other options are wrong:

• A. Node groups are used for administrative organization, not for achieving PSN redundancy.
• B. ISE uses a Primary/Secondary architecture for PAN, not for PSN redundancy.
• C. VIP (Virtual IP) is a load balancing mechanism but is not the primary method for PSN redundancy; NAD server lists are the standard approach.

Correct answer: B

Cisco ISE uses the Security Identifier (SID) to resolve ambiguous Active Directory group names. The SID is a unique identifier assigned by Active Directory to every user, group, and computer account, ensuring that groups with identical names in different domains or contexts can be properly distinguished and resolved.

Why the other options are wrong:

• A. MIB (Management Information Base) is used for SNMP network management, not Active Directory group resolution.
• C. MAB (MAC Authentication Bypass) is an authentication method for devices without 802.1X support, not a mechanism for resolving group names.
• D. TGT (Ticket Granting Ticket) is a Kerberos authentication component, not used for resolving ambiguous Active Directory group names.

Correct answer: B

Both Join and Leave operations require the ability to search Active Directory to determine whether a Cisco ISE machine account already exists in the domain. This is a prerequisite step for both operations-Join needs to check before creating, and Leave needs to verify what exists before removing.

Why the other options are wrong:

• A. Removing the machine account is only part of the Leave operation, not a common permission for both Join and Leave.
• C. Setting attributes on the machine account is specific to the Join operation, not common to both operations.
• D. Creating a machine account is only required for the Join operation when the account does not exist, not for Leave operations.

Correct answer: B

The dot1x pae authenticator command is the interface-level command needed to enable 802.1X authentication on a switch port. This command configures the port to function as an authenticator in the 802.1X exchange, allowing it to enforce port-based access control.

Why the other options are wrong:

• A. dot1x system-auth-control is a global command that enables 802.1X system-wide, not an interface-level command.
• C. aaa server radius dynamic-author configures RADIUS dynamic authorization, not 802.1X authentication on an interface.
• D. authentication host-mode single-host controls how many hosts can authenticate on a port, not the enabling of 802.1X itself.

Correct answer: D

The idle-timeout RADIUS attribute is used to dynamically assign the inactivity timer for MAB users from the Cisco ISE node. This attribute specifies how long a session can remain inactive before the user is disconnected.

Why the other options are wrong:

• A. session-timeout specifies the maximum total session duration, not the inactivity timer.
• B. termination-action determines what happens when a session expires, not the inactivity timeout value.
• C. radius-server timeout is a device-level configuration for RADIUS communication timeouts, not a RADIUS attribute for inactivity timers.

Correct answer: A

The dot1x system-auth-control command globally enables 802.1X on a network access device. This is a prerequisite global command that must be configured before 802.1X can be used on individual interfaces.

Why the other options are wrong:

• B. This describes the opposite of what the command does; dot1x system-auth-control enables tracking, not disables it.
• C. dot1x system-auth-control is a global command, not an interface-level command; enabling 802.1X on specific interfaces requires additional interface-level commands.
• D. While the command does enable session tracking, the primary purpose is global enablement of 802.1X, making option A more accurate.

Correct answer: A

The continue action should be configured in the Cisco ISE authentication policy for unknown MAC addresses. This allows the authentication process to proceed to the next policy condition rather than immediately rejecting the unknown device, enabling fallback authentication mechanisms like guest access to function properly.

Why the other options are wrong:

• B. Pass is not a standard authentication policy action in Cisco ISE for handling unknown identities.
• C. Drop would terminate the connection silently, preventing any alternative authentication attempts.
• D. Reject would explicitly deny access for unknown MAC addresses without allowing alternate authentication paths like guest access.

Correct answer: B

The show authentication sessions command displays all active 802.1X and MAB sessions on a Cisco Catalyst switch. This command provides comprehensive information about all authenticated sessions without requiring specific interface specification, though interfaces can be specified for filtered output.

Why the other options are wrong:

• A. The output parameter does not exist in the standard syntax; the correct command is show authentication sessions with optional interface or details parameters.
• C. Output is not a valid parameter for the show authentication sessions command.
• D. While this command can display sessions for a specific interface, it does not display all active sessions across all ports; the base command without interface specification is needed for that.

Correct answer: A

The exhibit displays detailed 802.1X authentication session information including the MAC address (000e.84af.59af), interface (GigabitEthernet2/0/36), authorization status, and authentication method details. To view this specific troubleshooting output in Cisco switch CLI, the command 'show authentication sessions mac 000e.84af.59af details' is used to retrieve comprehensive session information for a particular MAC address. The 'details' keyword provides the extended output matching the exhibit content.

Why the other options are wrong:

• B. show authentication registrations displays registered supplicant information, not active session details for a specific MAC address.
• C. show authentication interface gigabitethernet2/0/36 displays interface-level authentication summary, not the detailed session information shown in the exhibit.
• D. show authentication sessions method filters by authentication method but does not provide the detailed per-MAC-address session information displayed in the exhibit.

Correct answer: B

Authorization profiles in Cisco ISE contain posture conditions and compliance checks that enable endpoint vulnerability scanning. These profiles define what security requirements an endpoint must meet, including vulnerability assessments through posture policies, allowing ISE to scan endpoints for vulnerabilities as part of the authorization process.

Why the other options are wrong:

• A. Authentication policies handle user identity verification, not vulnerability scanning.
• C. Authentication profiles relate to credential validation methods, not vulnerability assessment.
• D. Authorization policies define rule logic but vulnerability scanning capability is implemented through authorization profiles.

Correct answer: C

When authenticating against Active Directory, the binary comparison function compares the user-presented password hash with the hash stored in Active Directory. This is the standard authentication mechanism where passwords are hashed and compared rather than transmitting plaintext passwords across the network.

Why the other options are wrong:

• A. Active Directory authentication does not primarily use certificate comparison for standard password-based authentication.
• B. MS-CHAPv2 is a specific authentication protocol but not the binary comparison function used in standard AD authentication.
• D. Subject alternative names and common names are certificate fields, not password hash comparisons used in AD authentication.

Correct answer: D

When an internal user is configured with an external identity store for authentication but the administrator manually selects an internal identity store in the ISE admin portal, the authentication is redirected to the external identity source that was configured for the user. The user configuration takes precedence over the administrator's portal selection, maintaining the originally configured external authentication path.

Why the other options are wrong:

• A. Authentication is not redirected to the internal identity source; the user's configured external store takes precedence.
• B. Authentication is not automatically granted without proper validation against the configured identity source.
• C. Authentication does not fail; it redirects to the external identity source as configured for that user.

Correct answer: D

In low-impact mode for phased ISE deployment, HTTP access is denied to unauthenticated endpoints. This forces users to authenticate before gaining full network access, while allowing essential services like DNS and DHCP for device communication and IP address assignment to function before authentication occurs.

Why the other options are wrong:

• A. DNS is allowed in low-impact mode to enable endpoint communication and name resolution.
• B. DHCP is allowed to enable endpoints to obtain IP addresses before authentication.
• C. EAP is the authentication protocol itself and is required to initiate the authentication process.

Correct answer: B

The command dot1x system-auth-control globally enables 802.1X authentication on a switch and is essential to complete the 802.1X configuration when port settings are already configured for port-based authentication. This command activates the 802.1X authentication mechanism system-wide.

Why the other options are wrong:

• A. The aaa authentication dot1x command is used for AAA configuration but does not specifically complete 802.1X port-based authentication setup.
• C. The authentication port-control auto command is applied at the interface level and is not the system-level command needed to complete 802.1X configuration.
• D. The dot1x pae authenticator command configures the PAE role but is not the primary command for completing 802.1X setup when ports are already configured.

Correct answer: B

The Security Group Tag (SGT) in Cisco TrustSec is transmitted using the 802.1AE header, which is the MAC Security (MACsec) encapsulation format. This header carries the SGT information between TrustSec-capable devices at Layer 2, allowing the tag to travel with the frame through the network infrastructure.

Why the other options are wrong:

• A. The payload contains user data, not Layer 2 tagging information.
• C. The CMD field is not a standard Layer 2 frame component for SGT transmission.
• D. The 802.1Q field is used for VLAN tagging, not Cisco TrustSec SGT transmission.

Correct answer: B

EAP-TLS is the EAP method that requires endpoints to present identity certificates for mutual authentication with the authentication server. When an endpoint presents its certificate to Cisco ISE for validation, EAP-TLS provides certificate-based authentication, enabling the network to authorize device access based on validated certificates rather than user credentials.

Why the other options are wrong:

• A. EAP-TTLS uses a TLS tunnel but does not require client certificates; inner authentication can be password-based.
• C. EAP-FAST uses a Protected Access Credential (PAC) and does not require identity certificates.
• D. EAP-PEAP-MSCHAPv2 uses a TLS tunnel with password-based inner authentication, not certificate-based authentication.

Correct answer: A

Dynamic access lists within the authorization profile allow Cisco ISE to dynamically push access control policies to the switch without requiring static ACLs on switch ports. ISE communicates the appropriate network access permissions through RADIUS attribute replies, enabling the switch to apply access controls based on ISE's real-time authorization decisions rather than static port configurations.

Why the other options are wrong:

• B. Extended access lists are static configurations on the switch and do not remove the need for static ACLs.
• C. Security Group Tags are used for traffic segmentation but do not replace static ACLs for port-level access control.
• D. Port security based on client information does not provide the dynamic authorization capabilities needed to replace static ACLs.

Correct answer: A

The configuration enables 802.1X port-based authentication in multi-auth mode on a switch interface. Multi-auth mode allows multiple authenticated clients on a single port simultaneously. This scenario applies when a hub with multiple clients is connected to the switch port, as the hub acts as a single connection point but carries traffic from multiple devices behind it. Each client behind the hub can authenticate independently while sharing the same physical port. Option B is incorrect because IP phones typically use single-auth mode. Option C misrepresents the purpose of 802.1X authentication. Option D is incorrect because multi-auth mode enforces authentication rather than bypassing it.

Why the other options are wrong:

• B. IP phones are typically authenticated in single-auth or multi-auth mode with specific voice VLAN configuration, not this general multi-auth setup.
• C. 802.1X authentication does not prevent users with hypervisors; it authenticates devices attempting network access.
• D. Multi-auth mode enforces authentication for multiple clients, it does not bypass IP phone authentication.

Correct answer: D

The current configuration uses 'multi-auth' which allows multiple authenticated endpoints on a single port. To restrict each port to only one voice and one data endpoint, the configuration must be changed to 'single-auth', which enforces a single authenticated session per port. This prevents multiple devices from simultaneously authenticating on the same interface.

Why the other options are wrong:

• A. Changing auto to manual relates to VLAN assignment behavior, not endpoint count restrictions.
• B. Changing mab to dot1x modifies the authentication method itself, not the number of allowed endpoints per port.
• C. Multi-domain allows one voice and one data endpoint by design, but single-auth is the more direct and standard solution for strictly limiting to one authenticated endpoint per port.

Correct answer: A

The `authentication host-mode multi-domain` command allows a switch port to authenticate multiple hosts across different device categories simultaneously. Specifically, it enables one device to authenticate for data traffic while another device (such as a VoIP phone) authenticates for voice traffic on the same port, supporting the common deployment model of voice phones and data devices connected to the same access port.

Why the other options are wrong:

• B. Single-host mode allows only one authenticated device per port.
• C. Multi-auth mode allows multiple hosts but does not specifically separate data and voice domains.
• D. Multi-host mode allows multiple hosts of the same type but does not provide the domain separation needed for voice and data.

Correct answer: B

MAC Authentication Bypass (MAB) enables network access for devices that do not support 802.1X authentication, such as most printers. When enabled on a port, MAB allows the switch to authenticate devices based on their MAC address if they fail to respond to 802.1X requests, providing network connectivity to non-compliant devices while maintaining security posture.

Why the other options are wrong:

• A. Change of Authorization is a RADIUS feature for dynamic policy updates, not for authenticating non-802.1X devices.
• C. TACACS authentication is used for administrative access to devices, not for endpoint network access.
• D. RADIUS authentication alone does not bypass 802.1X requirements; MAB is the specific feature needed.

Correct answer: C

When specific Active Directory groups are not visible in Cisco ISE's authorization policy conditions despite being in the same domain, it indicates that those groups have not been added to the Cisco ISE Active Directory join point configuration. ISE must be explicitly configured to recognize and import specific Active Directory groups before they can be used as policy conditions.

Why the other options are wrong:

• A. If the AD connection was failing, no groups would be visible, not just some groups.
• B. Cisco ISE can see both built-in and user-created groups when properly configured.
• D. Groups do not need to be manually typed; they should be available through the ISE interface once properly added to the AD join point.

Correct answer: C

The RADIUS probe is used to collect device information from IOS device sensors. It enables Cisco ISE to receive detailed network device telemetry and behavioral data from Cisco IOS devices configured with device sensor capabilities, allowing ISE to separate and classify traffic based on the device type and characteristics identified by the sensor data.

Why the other options are wrong:

• A. NetFlow probe collects NetFlow records for network flow analysis, not device identity information.
• B. HTTP probe monitors HTTP traffic but does not specifically interact with IOS device sensors for device identification.
• D. Network scan probe performs network scanning but is not the probe used to consume IOS device sensor data.

Correct answer: C

EAP-TLS requires each client device to present a valid digital certificate for authentication, providing certificate-based mutual authentication between the client and server. This certificate-based approach enhances security by ensuring that only authorized devices with valid certificates can authenticate, whereas EAP-MSCHAPv2 relies on username and password credentials that are more susceptible to compromise.

Why the other options are wrong:

• A. EAP-TLS uses certificates, not username and password; EAP-MSCHAPv2 uses username and password, making this statement backward.
• B. Both methods use multiple authentication mechanisms; the distinction is in the type of credential, not the number of forms.
• D. Both EAP-TLS and EAP-MSCHAPv2 use TLS tunnels to secure credential exchange; both protect credentials during transmission.

Correct answer: D

Central Web Authentication via Cisco ISE on a WLC requires configuring the NAC State option to RADIUS NAC. This enables the WLC to communicate with ISE for authentication and authorization decisions, allowing dynamic VLAN assignment and access control based on ISE policies.

Why the other options are wrong:

• A. The ip access-group webauth command is not a valid WLC configuration command for central web authentication setup.
• B. The radius-server vsa send authentication command is not the primary configuration needed; RADIUS NAC state must be enabled first.
• C. SNMP NAC is used for posture assessment, not for the core central web authentication mechanism with ISE.

Correct answer: A

When Cisco ISE reboots, the Active Directory join point must re-establish its connection to the AD domain. Without a connected AD join point, ISE cannot query AD group memberships for authorization policy decisions, causing AD group-based access control to fail.

Why the other options are wrong:

• B. Certificate checks are separate from AD group assignment functionality; they would not selectively break only after a reboot.
• C. Network device ports shutting down would affect overall connectivity, not just AD- specific group assignment operations.
• D. Slow DNS response time would cause delays but would not completely break AD group assignments; the system would eventually resolve.

Correct answer: C

SGACLs (Scalable Group Access Control Lists) are applied at the point where traffic exits a security domain toward another domain or untrusted network. In this topology, the egress router is the boundary device responsible for enforcing SGACLs on outbound traffic from the Cisco TrustSec domain. The egress router applies policies that control which scalable groups can communicate with external resources based on configured SGACL rules.

Why the other options are wrong:

• A. The secure server is a destination resource, not the enforcement point for SGACL policies.
• B. The host is a source device; SGACL enforcement occurs at network boundary devices, not at individual endpoints.
• D. The ingress router handles inbound traffic and would not be the primary enforcement point for SGACLs protecting outbound communication from the TrustSec domain.

Correct answer: C

To redirect a stolen laptop added to the block list endpoint identity group, network access must be allowed to port 8443, which is the HTTPS port used by the Cisco ISE guest portal and redirect mechanism. This port must be accessible in the ACL to enable the redirect to the block notification page.

Why the other options are wrong:

• A. DROP is a traffic action that would terminate connections but does not enable the redirect mechanism needed to display block policies to the endpoint.
• B. Port 8444 is not the standard ISE portal port; 8443 is the correct secure portal port.
• D. DenyAccess is a policy action that denies traffic but does not configure the mechanism for redirecting and notifying the user of the block.

Correct answer: D

The Radius Called-Station-ID attribute contains the SSID name that the device connected to and is passed by the wireless controller in RADIUS authentication requests. Using this attribute in a policy condition allows the administrator to create different access restrictions based on which SSID the device is connecting to.

Why the other options are wrong:

• A. NetworkDeviceName refers to the network device itself, not the SSID the client is connecting to.
• B. Device Type categorizes endpoint types like printers or workstations, not SSIDs.
• C. Airespace-Wlan-Id contains the WLAN ID number, not the SSID name string used for policy matching.

Correct answer: D

A registration code entered on the portal splash page is the standard method for conference guest access control. Participants receive a unique code that they enter upon connecting to the guest SSID, and ISE validates this code before granting network access, providing accountability while enabling easy guest onboarding.

Why the other options are wrong:

• A. Creating individual logins for sponsored access requires more administrative overhead and is not the simplest pre-assigned code method.
• B. Creating entries in the guest identity group does not provide the pre-assigned code mechanism that participants must enter on the portal.
• C. AUP (Acceptable Use Policy) mode displays terms and conditions, not a code entry mechanism for access control.

Correct answer: B

In a fully distributed Cisco ISE deployment, scanning probes on individual PSNs cannot share information across nodes. To ensure IP-to-MAC bindings are available on all PSNs, ISE must be configured to learn these bindings via DHCP profiling, which centralizes the learning process rather than relying on local scanning by individual nodes.

Why the other options are wrong:

• A. While RADIUS authentication does provide IP-MAC bindings, it does not solve the distributed deployment synchronization issue as effectively as DHCP profiling.
• C. Initiating scanning from the MnT node still relies on probe scanning mechanics and does not centralize binding information across distributed PSNs.
• D. Scanning from the last authenticating PSN is still localized scanning that does not propagate the bindings to other PSNs in the distributed deployment.