Selected Answer: AC https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_setup_cisco_ise.html

Correct answer is: A and C

You don't need an admin node for AD authentications, any node with the PSN role will handle it.

A and C are correct

New qns Users in an organization report problems with having to remember multiple usernames and passwords. The network administrator wants the existing Cisco ISE deployment to use an external identity source to reduce this issue. Which two requirements must be met to implement this change? (Choose two.) A. Enable IPC access over port 80. B. Ensure that the NAT address is properly configured C. Establish access to one Global Catalog server. D. Provide domain administrator access to Active Directory. E. Configure a secure LDAP connection.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_deployment.html#ID57

Selected Answer: AC The following table shows the features that are affected when the primary PAN goes down and the secondary PAN has not yet taken over. Features Name Available When Primary PAN is Down? (Yes/No) Existing or new AD user RADIUS authentication Yes Guest: AUP No Posture Yes BYOD with Internal CA No

802.1x and Posture will work without any policy. For any hotspot or redirection, it has to be configured in policy to point to the ISE server which the request is received from. so A and C are correct.

Selected Answer: AC https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_011.html#ID57

Selected Answer: AC AC are correct.!! Authentication service for 802.1X is always running on both nodes. Posture service is always running on both nodes. The service that is only active on the primary node is the service for the Guest Portal feature and the BYOD feature.

Correct. AC, see table 9 of the current doc 3.3

Selected Answer: BE The right answer is B and E. When the primary admin node is down and the secondary admin node has not been promoted, these features are available: Hotspot: If you have set up a hotspot in Cisco ISE, users will still be able to connect to the hotspot and reach the internet. BYOD: If you have configured BYOD in Cisco ISE, users will still be able to register their devices and access network resources.

A and C are the correct answers

I work with ISE every day and Posture, Hotspot can definitely work if PAN is down.

are these questions still valid?, i am planning to take the exam in a few days.

Selected Answer: AC A and C are correct. Look at the table in the following link. https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_011.html#ID57

Selected Answer: AC As per https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_011.html#ID57

Selected Answer: AC A&C, basically anything that changes the distributed policy is a no-go. New AD users are handled by AD not PAN--New Identity store would be a no-go. Posture is a session-based function on PSN.

New AD user 802.1X authentication: When a new AD user is created, Cisco ISE needs to talk with Active Directory to authenticate that user. If the primary admin node is down, this communication cannot take place and the user will not be able to authenticate with 802.1X. Posture: Posture is a feature that lets Cisco ISE assess the security posture of a device before it is allowed to access network resources. This assessment includes checking for software updates, virus signatures, and other security vulnerabilities. If the primary admin node is down, Cisco ISE cannot run posture assessments and devices will be allowed to access network resources even if they are not up to date with security patches. Guest AUP: Guest AUP is a feature that lets you create a policy that guests must agree to before they can access network resources. If the primary admin node is down, guests will not be able to agree to the Guest AUP and will not be able to access network resources.

AC are correct.!! Authentication service for 802.1X is always running on both nodes. Posture service is always running on both nodes. The service that is only active on the primary node is the service for the Guest Portal feature and the BYOD feature.

Selected Answer: AC https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/admin_guide/b_ise_admin_3_3/b_ISE_admin_33_deployment.html#reference_F347F944857548F2957076966C11C1B0 Table 10. Availability of features

Selected Answer: AC Check the Admin Guide "Availability of features"