# ISE interview: 20 tickets, not 20 definitions

Source: https://ai.techclick.in/blog_cisco_ise_interview_20_questions
Markdown: https://ai.techclick.in/blog_cisco_ise_interview_20_questions.md
Publisher: Techclick Infosec Pvt Ltd

20 ISE interview scenarios with strong answers mapped to this series. No trivia stems.

## The ticket

 You have a CCNP Security PDF. The interviewer asks: “Unknown NAD, what now?” If you cannot do lesson 3 out loud, the cert is wallpaper.

  Quick interview answer

 I prove with Live Logs Failure Reason,  test aaa , and  show authentication sessions . I name the persona before I reboot anything.

  Hero · interview desk

 Say the command. Then say what green looks like.
  Lab data · dummy only
 PAN  ise-pan   10.10.10.20  · PSN  ise-psn1   10.10.10.21  · MnT  ise-mnt   10.10.10.22  · NAD  sw-access-01   10.10.10.2  · AD  dc01   10.20.30.10  · Priya  10.20.30.80   TECHCLICK\priya.hr  · printer  10.20.30.60 . Not a live customer.

## How to answer

 Direct answer → why production cares → weak trap → evidence (log field / CLI).

## What to lab

- Distributed PAN/PSN/MnT even if nested.

- One switch NAD + CoA.

- PEAP user + MAB printer + CWA guest.

- One Unknown → profile → CoA.

- Break the secret and recover. Break AD and recover.

## 20 questions

### Q1 · Personas

 GUI up, RADIUS dead?

  Direct
PSN / 1812. Not PAN.

### Q2 · PAN down

 Do users die?

  Direct
No — last policy stays on PSN. You cannot edit.

### Q3 · NAD

 Unknown NAD?

  Direct
Network Devices + source IP + secret.

### Q4 · Sets

 Your set never hits?

  Direct
First-match. Move it above Default.

### Q5 · PEAP

 Unknown CA?

  Direct
Deploy EAP CA. Do not uncheck validate.

### Q6 · MAB

 Printer after 802.1X?

  Direct
dot1x then mab, endpoint group, tiny dACL.

### Q7 · CWA

 Portal never loads?

  Direct
DNS in redirect ACL, portal cert, CoA.

### Q8 · Profile

 Stuck Unknown?

  Direct
DHCP probe/helper. Do not Permit_All.

### Q9 · dACL

 Auth OK, SAP dead?

  Direct
Read the ACE list on the session.

### Q10 · Logs

 First click?

  Direct
Live Logs Failure Reason on MnT.

### Q11 · test aaa

 Where?

  Direct
Switch CLI, toward the PSN.

### Q12 · CoA

 Why?

  Direct
Re-auth after profile/guest/posture change.

### Q13 · MnT vs PAN

 Can MnT become PAN?

  Direct
No.

### Q14 · Open port

 Printer jack?

  Direct
MAB, not  no authentication .

### Q15 · Forescout

 Why both?

  Direct
Visibility for OT, RADIUS for users.

### Q16 · Allowed protocols

 PEAP missing?

  Direct
Looks like AD is down. It is protocols.

### Q17 · authentication open

 Meaning?

  Direct
Monitor mode.

### Q18 · SGT

 Without TrustSec?

  Direct
Tag may never enforce.

### Q19 · Clock skew

 Symptom?

  Direct
EAP-TLS / Kerberos weirdness. NTP.

### Q20 · Prove

 Green session?

  Direct
 show authentication sessions details  + matching Live Log.

## Weak vs strong

   Weak  Strong

  Restart ISE  Which persona, which command
  Turn off 802.1X  MAB / CWA / monitor mode
  Unknown permit  Quarantine + probe

## Practice

 Speak Q1, Q5, Q10 in 90 seconds each with dummy IPs from this lab.

## Traps

 No dump sites. Confirm ISE 3.3 / 3.4 menu names in the live Admin Guide when the GUI moves.

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       GUI up, RADIUS dead. Persona?

           PSN
           Only MnT
           Only pxGrid
           AD

       Correct:  a . Q1.

       Q2
       Unknown NAD first fix?

           Network Devices + source IP + secret
           Delete all sets
           Disable AD
           Reimage printers

       Correct:  a . Q3.

       Q3
       Can MnT take over PAN?

           No
           Yes always
           Only on Fridays
           Via MAB

       Correct:  a . Q13 / PDF.

       Q4
       Portal never loads. First ACL thought?

           DNS in redirect ACL
           Permit ip any any on HR
           Remove CoA forever
           Turn off PSN

       Correct:  a . Q7.

       Q5
       Best proof of a good session?

           show authentication sessions details + Live Log
           A reboot
           Ping 8.8.8.8 only
           The Admin wallpaper

       Correct:  a . Q20.

       Q6
       How to study this series?

           Speak three tickets with dummy IPs
           Only memorize dumps
           Skip Live Logs
           Brand rants

       Correct:  a . Practice.

       Check answers
       Reset

  Cisco ISE class series:   Personas  ·  First day  ·  NAD + RADIUS  ·  Policy sets  ·  Wired 802.1X  ·  MAB  ·  CWA / guest  ·  Profiling  ·  dACL vs VLAN  ·  Live logs  ·  vs Forescout  ·  Interview

## Sources

- This ISE series lessons 1–11.
- ISE 3.3 Admin + Deployment guides.
- Lab PDF Cisco ISE Identity-Based Network Access Control.

 Related:  ISE evidence desk  ·  session factory  ·  Forescout series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt