T Techclick ← All lessons
Cisco · ISE 3.3 · Lesson 12 of 12

ISE interview: 20 tickets, not 20 definitions

Nobody hires “what is RADIUS?” They hire “Live Logs say 22056, walk me through it.” Twenty scenarios. Strong answers. Weak answers to avoid.

Updated 2026-08-18·22 min read·L2 primary·Quiz at end

After this page you can

The ticket

You have a CCNP Security PDF. The interviewer asks: “Unknown NAD, what now?” If you cannot do lesson 3 out loud, the cert is wallpaper.

Quick interview answer

I prove with Live Logs Failure Reason, test aaa, and show authentication sessions. I name the persona before I reboot anything.

Hero · interview desk
Interview desk with ISE live logs on a monitor
Say the command. Then say what green looks like.
Lab data · dummy only

PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.

How to answer

Direct answer → why production cares → weak trap → evidence (log field / CLI).

What to lab

  1. Distributed PAN/PSN/MnT even if nested.
  2. One switch NAD + CoA.
  3. PEAP user + MAB printer + CWA guest.
  4. One Unknown → profile → CoA.
  5. Break the secret and recover. Break AD and recover.

20 questions

Q1 · Personas

GUI up, RADIUS dead?

Direct
PSN / 1812. Not PAN.

Q2 · PAN down

Do users die?

Direct
No — last policy stays on PSN. You cannot edit.

Q3 · NAD

Unknown NAD?

Direct
Network Devices + source IP + secret.

Q4 · Sets

Your set never hits?

Direct
First-match. Move it above Default.

Q5 · PEAP

Unknown CA?

Direct
Deploy EAP CA. Do not uncheck validate.

Q6 · MAB

Printer after 802.1X?

Direct
dot1x then mab, endpoint group, tiny dACL.

Q7 · CWA

Portal never loads?

Direct
DNS in redirect ACL, portal cert, CoA.

Q8 · Profile

Stuck Unknown?

Direct
DHCP probe/helper. Do not Permit_All.

Q9 · dACL

Auth OK, SAP dead?

Direct
Read the ACE list on the session.

Q10 · Logs

First click?

Direct
Live Logs Failure Reason on MnT.

Q11 · test aaa

Where?

Direct
Switch CLI, toward the PSN.

Q12 · CoA

Why?

Direct
Re-auth after profile/guest/posture change.

Q13 · MnT vs PAN

Can MnT become PAN?

Direct
No.

Q14 · Open port

Printer jack?

Direct
MAB, not no authentication.

Q15 · Forescout

Why both?

Direct
Visibility for OT, RADIUS for users.

Q16 · Allowed protocols

PEAP missing?

Direct
Looks like AD is down. It is protocols.

Q17 · authentication open

Meaning?

Direct
Monitor mode.

Q18 · SGT

Without TrustSec?

Direct
Tag may never enforce.

Q19 · Clock skew

Symptom?

Direct
EAP-TLS / Kerberos weirdness. NTP.

Q20 · Prove

Green session?

Direct
show authentication sessions details + matching Live Log.

Weak vs strong

WeakStrong
Restart ISEWhich persona, which command
Turn off 802.1XMAB / CWA / monitor mode
Unknown permitQuarantine + probe

Practice

Speak Q1, Q5, Q10 in 90 seconds each with dummy IPs from this lab.

Traps

No dump sites. Confirm ISE 3.3 / 3.4 menu names in the live Admin Guide when the GUI moves.

Knowledge check

Judgment items. One best answer. Reasons send you back to the matching section.

Q1

GUI up, RADIUS dead. Persona?

Correct: a. Q1.
Q2

Unknown NAD first fix?

Correct: a. Q3.
Q3

Can MnT take over PAN?

Correct: a. Q13 / PDF.
Q4

Portal never loads. First ACL thought?

Correct: a. Q7.
Q5

Best proof of a good session?

Correct: a. Q20.
Q6

How to study this series?

Correct: a. Practice.

Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview

Sources

Related: ISE evidence desk · session factory · Forescout series.