I85PREP
⌘ K
Cisco 300-715 SISE study materials
Cisco 300-715 SISE study resources

Cisco 300-715 SISE practice questions

One question at a time. Build your Cisco 300-715 SISE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Identity Management and Secure Access

An administrator is deploying a Cisco ISE node that will act as the primary policy service node in a distributed deployment. Which role must be assigned to this node so that it can evaluate policy and serve as the source of truth for the policy database?

  1. Secondary Policy Administration Node
  2. Primary Policy Administration Node Correct answer.
  3. Policy Service Node only
  4. Standalone node with no persona enabled

Explanation

In a distributed ISE deployment, the Primary Policy Administration Node (PAN) holds the master copy of the configuration and policy database and replicates it to the Secondary PAN. Only a PAN role provides the authoritative policy configuration that other nodes consume.

Question 2Identity Management and Secure Access

Which protocol does Cisco ISE use to communicate with a Microsoft Active Directory domain controller for user authentication and group retrieval?

  1. LDAP
  2. TACACS+
  3. RADIUS
  4. Kerberos Correct answer.

Explanation

ISE joins the AD domain and authenticates users against domain controllers using Kerberos, while group membership is retrieved through LDAP queries or the ISE AD agent. RADIUS and TACACS+ are used for network device AAA, not directory authentication.

Question 3Identity Management and Secure Access

A security team wants guest users to self-register through a web portal and receive sponsored access without an administrator creating accounts manually. Which ISE feature should be configured?

  1. Device administration TACACS+ policy
  2. Endpoint posture assessment
  3. Guest portal with self-registration and sponsor approval Correct answer.
  4. Profiler feed service

Explanation

The guest portal supports self-registration, and sponsor approval workflows let a designated sponsor approve guest accounts before access is granted. Profiling and posture address endpoint classification and compliance rather than guest onboarding.

Question 4Identity Management and Secure Access

Which statement describes the purpose of an identity source sequence in Cisco ISE?

  1. It specifies the RADIUS shared secret used between switches and ISE
  2. It determines which certificate authority signs the ISE admin certificate
  3. It maps endpoints to endpoint profiling policies
  4. It defines the order in which identity stores are queried during authentication Correct answer.

Explanation

An identity source sequence lists identity stores in priority order and defines how ISE behaves if a store is unavailable, such as continuing to the next store. It controls authentication lookup order rather than secrets, certificates, or profiling.

Question 5Identity Management and Secure Access

An engineer needs to grant a network operations group read-only access to ISE reports while preventing configuration changes. Which ISE capability enforces this?

  1. Endpoint posture remediation
  2. Profiler CoA actions
  3. Role-based access control with admin groups Correct answer.
  4. External RADIUS accounting

Explanation

ISE administrative RBAC assigns administrators to admin groups whose permissions determine which menus and actions they can use. Assigning the group read-only report permissions limits the user to viewing reports without configuration rights.

Question 6Identity Management and Secure Access

Which certificate is used by Cisco ISE to prove its identity to endpoints during an EAP-TLS authentication exchange?

  1. The endpoint's client certificate
  2. The ISE EAP certificate Correct answer.
  3. The ISE admin certificate
  4. The sponsor portal certificate

Explanation

During EAP-TLS, the server presents its EAP certificate so the supplicant can validate the ISE identity. The endpoint presents its own client certificate separately to authenticate to ISE.

Question 7Identity Management and Secure Access

A company wants wireless users authenticated by Active Directory but also wants a local ISE identity store to be checked if AD is unreachable. How should the identity source sequence be configured?

  1. Place the local store first and AD second with no fallback
  2. Configure a separate policy set for each store with no sequence
  3. Place AD first and the local store second, enabling fallback to the next store Correct answer.
  4. Use only the internal admin store for all wireless authentications

Explanation

An identity source sequence evaluates stores in listed order, so placing AD first and the local store second with fallback enabled checks AD first and then the local store if AD fails. This preserves AD as the primary source while providing resilience.

Question 8Identity Management and Secure Access

An administrator joins ISE to Active Directory and wants only members of a specific AD group to receive full network access. Where is the group membership evaluated?

  1. In the RADIUS shared secret configuration
  2. In the authorization policy using an AD group condition Correct answer.
  3. In the endpoint profiling probe configuration
  4. In the certificate revocation list

Explanation

After authentication, ISE can evaluate AD group membership as a condition in the authorization policy to assign the appropriate authorization result. Group retrieval depends on the AD join and configured group lookups, but the decision itself is made in authorization policy.

Question 9Identity Management and Secure Access

A guest deployment requires that visitors accept an acceptable use policy before gaining network access. Which guest portal configuration enforces this?

  1. Setting the CoA port on the NAD
  2. Enabling the profiler feed update
  3. Configuring TACACS+ command authorization
  4. Requiring login page AUP acceptance Correct answer.

Explanation

The guest portal can present an acceptable use policy that users must accept before the portal grants access. This is a portal-level setting independent of profiling, device administration, or CoA behavior.

Question 10Identity Management and Secure Access

Which condition type is evaluated during authentication rather than authorization in an ISE policy?

  1. User identity store result Correct answer.
  2. Device type from profiling
  3. Endpoint posture status
  4. AD group membership

Explanation

Authentication policy evaluates identity and the result of the identity store lookup, such as whether the user was successfully authenticated. AD group membership, posture status, and profiled device type are typically evaluated in authorization policy.

Question 11Identity Management and Secure Access

An organization wants ISE to authenticate users against an external LDAP directory that is not Active Directory. Which identity store type should be configured?

  1. Internal guest store
  2. Generic LDAP identity store Correct answer.
  3. RADIUS proxy store
  4. Certificate authentication profile

Explanation

ISE supports generic LDAP identity stores for directories other than Active Directory, allowing bind-based authentication and attribute or group retrieval. Internal stores and certificate profiles serve different purposes.

Question 12Identity Management and Secure Access

A network administrator wants to restrict which commands a junior operator can run on a router after TACACS+ authentication succeeds. Which ISE feature provides this control?

  1. Guest portal sponsor approval
  2. Profiler CoA exception actions
  3. Authorization policy with command sets Correct answer.
  4. Endpoint posture remediation

Explanation

For device administration, ISE uses TACACS+ authorization policy with command sets to permit or deny specific commands after authentication. This is distinct from guest, posture, and profiling features that apply to network access sessions.

Question 13Identity Management and Secure Access

An engineer needs ISE to assign a different authorization result when a user authenticates from a corporate-managed laptop versus a personally owned device. Which combination best supports this?

  1. TACACS+ command sets plus admin RBAC
  2. Certificate authentication plus endpoint profiling conditions Correct answer.
  3. Guest sponsor approval plus AUP acceptance
  4. RADIUS accounting plus CoA port changes

Explanation

Certificate-based authentication can confirm device identity, and profiling conditions classify the endpoint so authorization policy can distinguish managed from unmanaged devices. The other options address guest onboarding, device administration, or session accounting rather than endpoint differentiation.

Question 14Identity Management and Secure Access

Which statement accurately describes the behavior of an identity source sequence when the first store is reachable but the user is not found there?

  1. ISE immediately rejects the authentication without checking other stores
  2. ISE creates a local account automatically
  3. ISE continues to the next store in the sequence Correct answer.
  4. ISE disables the first store permanently

Explanation

If a store is reachable but the user is not found, ISE proceeds to the next store in the sequence according to the configured behavior. Rejection occurs only when all applicable stores fail or when the sequence is configured to stop.

Question 15Identity Management and Secure Access

A company requires that only devices presenting a valid corporate certificate and belonging to the finance AD group receive full access. Which policy structure supports this requirement?

  1. Authorization policy matching certificate profile only, with no authentication policy
  2. Guest portal with sponsor approval for finance users
  3. Authentication policy matching certificate profile, then authorization policy matching AD group Correct answer.
  4. TACACS+ authorization with command sets for finance devices

Explanation

Certificate validation occurs during authentication, and AD group membership is evaluated in authorization after identity is established. Combining both in the correct policy stages enforces the dual requirement.

Question 16Identity Management and Secure Access

An administrator wants to use Microsoft AD for authentication but needs ISE to retrieve group membership without joining every domain controller. Which approach is most appropriate?

  1. Enable the profiler feed service to import AD groups
  2. Configure an LDAP identity store pointing at each domain controller
  3. Use the ISE AD agent to retrieve group information Correct answer.
  4. Configure TACACS+ to query AD groups

Explanation

The ISE AD agent can retrieve group membership information from AD without requiring direct joins to every domain controller. It provides group resolution for authorization policy while ISE maintains the domain join for authentication.

Question 17Identity Management and Secure Access

A guest environment uses sponsor approval, and the sponsor is not a member of any admin group with guest permissions. What is the likely result when the sponsor attempts to approve a pending guest account?

  1. The guest is approved automatically after a timeout
  2. The guest portal converts the account to an employee account
  3. The sponsor can approve because sponsor approval bypasses RBAC
  4. The sponsor cannot approve because the required guest sponsor permissions are missing Correct answer.

Explanation

Sponsors must be assigned to an admin group that includes guest sponsor permissions to approve accounts. Without the appropriate RBAC permissions, the sponsor cannot complete the approval workflow.

Question 18Identity Management and Secure Access

An engineer configures an authorization policy that references an AD group condition, but the group is never matched even though the user authenticates successfully. Which underlying dependency is most likely missing?

  1. The endpoint has not completed posture assessment
  2. The AD join and group retrieval are not functioning correctly Correct answer.
  3. The guest portal AUP has not been accepted
  4. The RADIUS shared secret is incorrect

Explanation

Authorization conditions based on AD groups depend on a healthy domain join and successful group retrieval from Active Directory. If group data is unavailable, the condition cannot match even when authentication succeeds.

Question 19Identity Management and Secure Access

Which identity store type is best suited for authenticating a small set of local accounts used only for testing when no external directory is available?

  1. Active Directory join
  2. RADIUS proxy
  3. Internal identity store Correct answer.
  4. Generic LDAP store

Explanation

The internal identity store holds locally defined users and groups within ISE, which is appropriate for small test accounts or fallback users. External directories and proxies require additional infrastructure.

Question 20Identity Management and Secure Access

A security architect wants to ensure that ISE administrative access is limited to members of a specific external directory group. Which ISE feature supports this requirement?

  1. Guest sponsor approval workflow
  2. External identity source mapping for admin authentication with admin group assignment Correct answer.
  3. Posture remediation actions
  4. Endpoint profiling policy sets

Explanation

ISE can authenticate administrators against an external identity source and map them to admin groups that control permissions. This allows directory-based control over who can access the ISE administrative interface.

Question 21Policy Enforcement and Profiling

An endpoint is connected to a switch port that has been configured as an 802.1X authenticator with MAB enabled as a fallback. Which statement describes how ISE handles the endpoint when it does not respond to EAPoL identity requests?

  1. ISE drops the endpoint into a default quarantine VLAN until an administrator manually approves the device.
  2. ISE performs MAC authentication against the endpoint's MAC address and applies the result of the matching identity group policy. Correct answer.
  3. ISE ignores the endpoint entirely because MAB and 802.1X cannot be enabled on the same port.
  4. ISE sends a CoA to the switch to disable the port permanently after the EAPoL timeout expires.

Explanation

MAC Authentication Bypass lets the switch use the endpoint MAC address as the credential when the supplicant never answers EAPoL. ISE receives that MAC in a RADIUS request, looks it up in its endpoint database and identity groups, and returns an authorization result just like an 802.1X session.

Question 22Policy Enforcement and Profiling

Which ISE node persona is responsible for making the actual authorization decision and returning RADIUS attributes to network access devices?

  1. The policy service node Correct answer.
  2. The administration node
  3. The pxGrid node
  4. The monitoring node

Explanation

Policy service nodes run the policy sets and authorization profiles that produce RADIUS replies for network devices. The admin persona hosts the GUI and configuration database, while monitoring handles logging and reporting.

Question 23Policy Enforcement and Profiling

A profiling policy needs to identify devices by reading the HTTP User-Agent string from traffic. Which probe must be enabled on the switch port for ISE to receive that information?

  1. NetFlow export to the monitoring node
  2. DHCP snooping with option 82 insertion
  3. SNMP polling of the ARP table
  4. Device sensor feeding RADIUS accounting Correct answer.

Explanation

The device sensor feature on Cisco switches collects CDP, LLDP, DHCP, and HTTP data and forwards it in RADIUS accounting packets to ISE. HTTP User-Agent is only visible to ISE when that sensor data is delivered.

Question 24Policy Enforcement and Profiling

An administrator wants a device that matches a custom profiler condition to be placed into a specific identity group automatically. Which configuration element accomplishes this?

  1. A profiling policy with an associated identity group Correct answer.
  2. A guest portal with a self-registration flow
  3. A policy set with a matching condition on EndpointProfile
  4. An authorization profile with a VLAN attribute

Explanation

Profiling policies map matched endpoints into identity groups, and those groups can then be referenced in authorization rules. This is how profiling feeds into enforcement without any manual assignment.

Question 25Policy Enforcement and Profiling

A network access device is configured to send RADIUS accounting but no CoA support. Which enforcement limitation does this create?

  1. ISE cannot authenticate the endpoint at all.
  2. ISE cannot change the session's authorization mid-stream. Correct answer.
  3. ISE cannot log the session start and stop records.
  4. ISE cannot apply downloadable ACLs to the session.

Explanation

Change of Authorization is the mechanism ISE uses to push updated authorization to an already-connected session. Without CoA support on the NAD, a reauthorization triggered by a profiling change cannot be enforced until the session reconnects.

Question 26Policy Enforcement and Profiling

Which condition type in an authorization policy allows matching on the result of endpoint profiling?

  1. EndPointPolicy
  2. NetworkDevice
  3. Endpoints:EndPointProfile Correct answer.
  4. Radius:Service-Type

Explanation

The EndPointProfile dictionary exposes the profiled identity group and profile name so authorization rules can act on them. This lets a policy differentiate, for example, profiled IP phones from profiled workstations.

Question 27Policy Enforcement and Profiling

A company wants wired users to be authenticated by 802.1X, but wants to avoid deploying certificates to every workstation. Which EAP method inside an EAP-TLS outer tunnel meets this requirement while still protecting user credentials?

  1. PEAP-MSCHAPv2 Correct answer.
  2. EAP-TLS
  3. EAP-FAST with anonymous provisioning
  4. LEAP

Explanation

PEAP establishes a server-authenticated TLS tunnel and then runs an inner MSCHAPv2 exchange, so only the server needs a certificate. EAP-TLS requires client certificates on every supplicant, which conflicts with the stated constraint.

Question 28Policy Enforcement and Profiling

Which statement correctly describes the role of the posture service in an ISE deployment?

  1. It replicates the configuration database between nodes.
  2. It terminates VPN tunnels from remote endpoints.
  3. It evaluates endpoint compliance and returns a posture status used in authorization. Correct answer.
  4. It assigns VLANs to endpoints based on their MAC address vendor.

Explanation

The posture service collects posture data from the AnyConnect or NAC agent and compares it against posture conditions and requirements. The resulting compliant or noncompliant status is then consumed by authorization policy.

Question 29Policy Enforcement and Profiling

A posture policy requires that endpoints have antivirus definitions no older than seven days. Which posture element expresses this requirement?

  1. An authorization profile returning a redirect URL
  2. A client provisioning resource for the antivirus installer
  3. A profiler condition matching the antivirus vendor
  4. A posture condition comparing the antivirus definition age Correct answer.

Explanation

Posture conditions define the check that must be satisfied, such as a maximum definition age. Requirements then combine conditions with remediation actions, and policies bind requirements to endpoint groups.

Question 30Policy Enforcement and Profiling

An endpoint fails posture and is placed in a remediation VLAN. Which ISE feature allows the endpoint to reach only the remediation servers during that state?

  1. A guest sponsor approval workflow
  2. A RADIUS proxy route to another realm
  3. A pxGrid topic subscription
  4. A downloadable ACL applied in the remediation authorization profile Correct answer.

Explanation

The remediation authorization result typically returns a VLAN plus a downloadable ACL that restricts traffic to remediation resources. Once the endpoint becomes compliant, CoA reauthorizes it into the normal access state.

Question 31Policy Enforcement and Profiling

Which client provisioning option allows ISE to distribute the AnyConnect posture module and profiles to endpoints during onboarding?

  1. An SNMP trap destination
  2. A client provisioning policy with associated resources Correct answer.
  3. A TACACS+ command set
  4. A guest self-registration portal

Explanation

Client provisioning policies determine which resources, such as installers and profiles, are offered to endpoints that match the policy. This is how the posture agent and its configuration are delivered.

Question 32Policy Enforcement and Profiling

An administrator needs endpoints that authenticate with 802.1X to also be profiled using DHCP information. Which combination makes this possible?

  1. Enable posture so that the agent reports DHCP data.
  2. Configure the endpoint to send syslog to ISE.
  3. Enable DHCP snooping and rely on the switch to send DHCP data to ISE via the device sensor. Correct answer.
  4. Disable 802.1X so that MAB can collect DHCP data.

Explanation

The device sensor on the switch captures DHCP packets and forwards the relevant attributes to ISE in RADIUS accounting. Profiling and 802.1X authentication run concurrently, so no authentication method needs to be disabled.

Question 33Policy Enforcement and Profiling

Which ISE feature allows an endpoint to be reauthenticated and reauthorized automatically when its profiling result changes?

  1. Guest sponsor approval
  2. TACACS+ command authorization
  3. Certificate provisioning
  4. Profiler CoA Correct answer.

Explanation

When an endpoint's profile changes, ISE can issue a CoA to force reauthentication and reauthorization so the new profile is reflected in policy. This keeps enforcement aligned with the latest classification.

Question 34Policy Enforcement and Profiling

A policy set is configured with a condition matching a specific network device group. Which behavior results when a request arrives from a device in that group?

  1. The request is forwarded to the monitoring node for evaluation.
  2. The request is rejected because device groups are only used for logging.
  3. The request is evaluated against that policy set's authentication and authorization rules. Correct answer.
  4. The request bypasses authentication and is granted full access.

Explanation

Policy sets are evaluated top-down, and the first set whose conditions match handles the request. Network device group membership is a common condition for separating, for example, wired and wireless traffic.

Question 35Policy Enforcement and Profiling

Which statement about the default authorization policy in a new policy set is accurate?

  1. It is disabled until an administrator creates a rule.
  2. It applies only to endpoints that fail profiling.
  3. It overrides any rule that returns a deny result.
  4. It is evaluated when no earlier rule in the policy set matches. Correct answer.

Explanation

The default rule acts as a catch-all at the bottom of the authorization rule list. Its result applies to any request that did not match a preceding rule, which is why its profile should be the most restrictive safe default.

Question 36Policy Enforcement and Profiling

An administrator wants to match an authorization rule on the endpoint's operating system as reported by profiling. Which attribute is the most appropriate?

  1. NAS-Port-Type
  2. Operating-System Correct answer.
  3. Called-Station-ID
  4. Message-Authenticator

Explanation

The Operating-System attribute is populated by profiling and can be used in authorization conditions. This allows rules such as granting a specific VLAN to profiled Windows workstations.

Question 37Policy Enforcement and Profiling

Which profiling probe type requires ISE to have SNMP read access to network devices?

  1. SNMP probe Correct answer.
  2. DHCP probe
  3. RADIUS probe
  4. NetFlow probe

Explanation

The SNMP probe queries network devices for information such as ARP and MAC tables, which requires configured SNMP read credentials. The other probes rely on data the NAD sends to ISE directly.

Question 38Policy Enforcement and Profiling

An endpoint matches two profiler conditions with different certainty factors. Which result does ISE apply?

  1. The condition evaluated first alphabetically determines the profile.
  2. The endpoint is assigned to every matching profile simultaneously.
  3. The endpoint is left unprofiled until the conflict is resolved.
  4. The condition with the highest certainty factor determines the profile. Correct answer.

Explanation

Certainty factors express confidence, and the profile with the highest accumulated certainty is assigned. This allows ISE to resolve overlapping matches without administrator intervention.

Question 39Policy Enforcement and Profiling

Which posture status must be met before an endpoint is placed in a fully compliant authorization state?

  1. The endpoint must be a member of the profiled workstation group.
  2. The endpoint must have completed client provisioning.
  3. The endpoint must have authenticated using EAP-TLS.
  4. The endpoint must have a valid posture assessment result of Compliant. Correct answer.

Explanation

Authorization rules typically check the posture status attribute and only grant full access when it equals Compliant. Profiling and the EAP method can inform policy but do not substitute for the posture result.

Question 40Policy Enforcement and Profiling

Which authorization profile attribute would an administrator configure to redirect a noncompliant endpoint to a remediation portal?

  1. A downloadable ACL
  2. A session timeout
  3. A VLAN assignment
  4. A redirect URL with an ACL Correct answer.

Explanation

A redirect URL combined with an ACL sends the endpoint's web traffic to the remediation portal while restricting other access. This is the standard posture remediation enforcement pattern.

Question 41Policy Enforcement and Profiling

Which statement best describes the function of a network device group in ISE policy design?

  1. It groups administrators by their RBAC role.
  2. It groups endpoints by their profiling result.
  3. It classifies network access devices so policy can be scoped by device location or type. Correct answer.
  4. It groups certificates by their issuing CA.

Explanation

Network device groups let administrators categorize NADs, for example by site or device type, and then use that category in policy set and authorization conditions. Endpoint grouping is handled by identity groups and profiling.

Question 42Policy Enforcement and Profiling

An administrator wants to verify that a newly created profiler condition is matching endpoints before enabling enforcement. Which ISE feature provides this visibility?

  1. The TACACS+ command accounting report
  2. The live logs and endpoint profiling report Correct answer.
  3. The guest sponsor audit trail
  4. The certificate authority audit log

Explanation

Live logs and profiling reports show which endpoints matched which profiles and the certainty factors involved. Reviewing them before enforcement confirms the profiler is behaving as intended.

Question 43Policy Enforcement and Profiling

Which condition would cause an endpoint to be classified as noncompliant during posture assessment?

  1. The endpoint connected through a wireless controller.
  2. The endpoint's antivirus definition file is older than the required threshold. Correct answer.
  3. The endpoint authenticated with PEAP instead of EAP-TLS.
  4. The endpoint is profiled as a Windows workstation.

Explanation

Posture conditions evaluate endpoint state such as antivirus currency, patch level, and running services. Failing any required condition makes the endpoint noncompliant regardless of how it authenticated or connected.

Question 44Policy Enforcement and Profiling

A switch port is configured with 802.1X and MAB, and a device with a known MAC address responds to EAPoL. Which authentication method does the switch use for that session?

  1. MAB, because MAB always takes precedence over 802.1X.
  2. Neither method, because the port is in a dual-mode conflict.
  3. Both methods simultaneously, with the results combined by ISE.
  4. 802.1X, because the supplicant responded before the MAB fallback timer expired. Correct answer.

Explanation

When the supplicant answers EAPoL, the switch completes 802.1X authentication and MAB is never invoked. MAB is only a fallback for endpoints that do not respond to EAPoL identity requests.

Question 45Policy Enforcement and Profiling

Which statement about the relationship between profiling and authorization is correct?

  1. Profiling results are only used for reporting and cannot affect access.
  2. Profiling replaces authentication and grants access without credentials.
  3. Profiling must be disabled when posture is enabled.
  4. Profiling results can be used as authorization conditions to tailor access. Correct answer.

Explanation

Profiling enriches the context available to authorization policy, allowing rules to differentiate device types. It does not replace authentication, and it works alongside posture rather than conflicting with it.

Question 46Policy Enforcement and Profiling

In a Cisco ISE authorization policy, which condition type lets a rule match on a value that the profiling service has assigned to the endpoint?

  1. Device Type
  2. Network Access
  3. IdentityGroup
  4. EndPointProfiled Correct answer.

Explanation

The EndPointProfiled condition type compares the endpoint's profiler-assigned identity against a named profile such as Cisco-IP-Phone, so authorization can be driven by profiling results. Network Access conditions match on protocol or RADIUS attributes, and IdentityGroup matches the identity store group of the user or host. Device Type is a profiler attribute used inside profiler conditions, not a separate authorization condition type.

Question 47Policy Enforcement and Profiling

An administrator wants to see which endpoints a new profiler policy would classify before any authorization rules reference that profile. Which approach satisfies this requirement?

  1. Assign the profile manually to every endpoint and then enable the policy
  2. Enable posture enforcement on the policy set so endpoints report their identity
  3. Run the profiler policy in monitor mode and review the endpoints listed under that profile in the profiler reports Correct answer.
  4. Delete the default authorization rule so that no enforcement can occur while testing

Explanation

Profiler policies can be enabled in a monitoring-only state so ISE evaluates and records matches without the profile being used for enforcement decisions. Reviewing the profiler reports confirms which endpoints would be classified before authorization rules depend on the result. Deleting authorization rules or enabling posture does not validate profiler matching and adds risk.

Question 48Policy Enforcement and Profiling

A policy set contains an authorization policy whose rules all fail to match, and no default rule has been modified. What is the outcome for the request?

  1. The request is denied because no rule matched
  2. The request is authorized by the default rule with a permit access result Correct answer.
  3. The request is dropped at the switch because authorization failed
  4. The request is reauthenticated until a rule matches

Explanation

Every authorization policy includes a default rule that is evaluated when no earlier rule matches, and by default it returns a permit access result. An unmatched request is therefore still authorized rather than denied. The switch does not drop the session simply because no specific rule matched, and ISE does not loop reauthentication waiting for a match.

Question 49Policy Enforcement and Profiling

Which statement describes how an authorization profile is used during policy evaluation?

  1. It determines which profiler probes are enabled on a network device
  2. It defines the ordered conditions that a request must satisfy to match a rule
  3. It stores the list of MAC addresses that are exempt from authentication
  4. It supplies the RADIUS attributes and result that ISE returns when a rule matches Correct answer.

Explanation

An authorization profile is a reusable container of attributes, such as a VLAN, dACL name, or SGT value, that ISE returns to the network device when the associated rule matches. Rules reference profiles rather than embedding attributes directly. Conditions belong to the rule itself, and profiler probe configuration is separate from authorization profiles.

Question 50Policy Enforcement and Profiling

A company wants wireless guest users placed in a guest VLAN while corporate wireless users receive a dACL. Both user groups authenticate through the same policy set. Which design achieves this with the least administrative overhead?

  1. Create two authorization profiles and two authorization rules that match on identity group membership Correct answer.
  2. Create one authorization rule with no conditions and rely on the switch to choose the VLAN
  3. Create one authorization profile containing both the guest VLAN and the dACL and apply it to all users
  4. Create two policy sets, one per user group, each with a single authorization rule

Explanation

Separate authorization profiles let each outcome carry only the attributes appropriate for that user population, and rules that match on identity group select the correct profile. This keeps the logic inside a single policy set and avoids duplicating policy sets. Combining a VLAN and dACL in one profile would apply both to every user, and a conditionless rule cannot differentiate the groups.