Web Auth and Guest Services — 300-715 Practice Quiz

Question 1

A network engineer is deploying Central Web Authentication (CWA) on a Catalyst switch running IOS. Endpoints authenticate via MAB, and ISE returns an authorization result containing a redirect URL and a redirect ACL. However, after connecting, test endpoints receive an IP address but the browser never displays the ISE guest portal — the redirection simply times out. RADIUS accounting and the CoA are confirmed working. Which switch configuration step is most likely missing and required for the redirect to function?

Accepted Answer

Enable the HTTP and HTTPS server on the switch with 'ip http server' and 'ip http secure-server'

Answer

Configure 'authentication open' on the access interface to allow traffic before authorization

Answer

Add a static route pointing to the ISE PSN so the switch can reach the guest portal

Answer

Change the authentication order to place dot1x before MAB on the interface

Question 2

A network engineer is building a guest access solution on Cisco ISE. When an unauthenticated endpoint connects to the guest SSID, the switch/WLC must redirect the user's browser to the ISE guest portal for self-registration. The engineer is configuring the authorization profile that will be returned for these initial guest connections. Which combination of settings must the authorization profile contain to force the browser redirection to the ISE guest portal?

Accepted Answer

A redirect ACL name (defined locally on the NAD) referenced in the Web Redirection setting pointing to the guest portal

Answer

A downloadable ACL (dACL) that permits all traffic plus a VLAN assignment matching the guest VLAN

Answer

A RADIUS Change of Authorization (CoA) type of 'Reauth' with a Security Group Tag assigned

Answer

An Airespace ACL and a Filter-ID attribute referencing the ISE self-registration policy set

Question 3

A network engineer deploys Central Web Authentication (CWA) for guests on a Cisco Catalyst switch integrated with ISE. After a guest successfully authenticates on the guest portal, ISE must instruct the switch to remove the pre-auth redirect and apply the final guest DACL without disconnecting the endpoint's link. Which mechanism must be configured on the switch and used by ISE to accomplish this transition?

Accepted Answer

RADIUS Change of Authorization (CoA) with re-authenticate, requiring 'aaa server radius dynamic-author' on the switch

Answer

A SNMP trap sent from ISE to the switch triggering an interface bounce

Answer

RADIUS accounting interim updates that push the new DACL every 60 seconds

Answer

A session timeout on the pre-auth authorization profile that forces the endpoint to re-authenticate via 802.1X

Question 4

A network engineer is deploying Central Web Authentication (CWA) for guest wireless users on a remote-site Cisco WLC where the APs operate in FlexConnect mode with local switching. Wired traffic from these APs does not traverse the WLC. Guests connect to an open SSID, associate via MAB, and are supposed to be redirected to the ISE guest portal. However, users associate but never receive the redirect. What must the engineer configure on the WLC to make the CWA redirection work in this FlexConnect local-switching scenario?

Accepted Answer

Define the redirect ACL as a FlexConnect ACL and apply it to the AP group or flex profile so it is pushed to the local switching APs

Answer

Configure the redirect ACL only as a standard named ACL on the WLC controller and reference it in the ISE authorization profile

Answer

Disable AAA override on the WLAN so the WLC applies the redirect locally instead of relying on ISE

Answer

Change the APs from FlexConnect to local mode so the WLC can enforce the redirect ACL centrally

Question 5

A network engineer configured Central Web Authentication (CWA) on ISE for wireless guests. When guests connect and are redirected to the guest portal, their browsers display a certificate warning stating the certificate name does not match the site. The engineer confirmed the WLC redirect is working and the portal loads after the guest clicks past the warning. What is the BEST way to eliminate the certificate warning?

Accepted Answer

Configure the guest portal to use the ISE portal FQDN and bind a certificate whose Subject/SAN matches that FQDN, then ensure DNS resolves the FQDN to the PSN

Answer

Disable HTTPS on the guest portal and serve it over HTTP so no certificate is validated

Answer

Enable the default self-signed certificate on the WLC and export it to the guest devices

Answer

Change the portal authentication method to a local WebAuth flow on the WLC instead of CWA

Question 6

A retail company runs a self-registered guest portal on ISE. Compliance requires that returning guests must re-accept the Acceptable Use Policy (AUP) every single time they log in through the portal, rather than only on their first login. Which portal setting should the administrator configure to meet this requirement?

Accepted Answer

Set the AUP display option to 'On every login' under the Acceptable Use Policy Page Settings

Answer

Set the AUP display option to 'On first login only' under the Acceptable Use Policy Page Settings

Answer

Enable 'Require an access code' on the Login Page Settings so the AUP re-displays

Answer

Configure a Time Profile that expires the guest account after each session to force AUP re-acceptance

Question 7

A network engineer is configuring a credentialed guest portal on ISE for a corporate lobby. Contractors who already exist in the company's Active Directory should be able to log in with their AD credentials, while short-term visitors will use sponsor-created guest accounts. Under the portal's Authentication settings, which configuration ensures both account types can authenticate through the same guest portal?

Accepted Answer

Set the portal's Identity Source Sequence to include both the Guest Users internal store and the Active Directory join point

Answer

Enable self-registration on the portal so AD users are automatically imported into the Guest Users store

Answer

Configure two separate guest portals, one bound to AD and one bound to the internal Guest Users store, and redirect based on username

Answer

Add the Active Directory join point as the only identity source and enable password-based guest login

Question 8

A network administrator has deployed a Sponsored-Guest portal on ISE PSNs that are reachable at guest.company.com. During testing, guests connecting from the CWA redirect see a browser certificate warning when the portal loads, even though a valid, CA-signed wildcard certificate for *.company.com is already installed on the PSNs. The certificate is currently tagged only for EAP Authentication and Admin usage. What must the administrator do to resolve the certificate warning on the guest portal?

Accepted Answer

Assign the Portal Group Tag used by the guest portal to the CA-signed wildcard certificate so the portal presents it during the HTTPS session

Answer

Enable the pxGrid usage role on the wildcard certificate and rebind the portal to the pxGrid interface

Answer

Import the wildcard certificate into the Trusted Certificates store on each PSN and enable 'Trust for authentication within ISE'

Answer

Change the guest portal FQDN to match the PSN node hostname so it aligns with the certificate CN

Question 9

A company operates offices in Montreal, Frankfurt, and Tokyo. The security team wants a single self-registered guest portal on ISE that automatically presents the login page, AUP, and notification text in the guest's preferred language based on their browser settings, while also displaying the corporate logo. Which ISE portal configuration approach meets this requirement with the least administrative overhead?

Accepted Answer

Configure a single guest portal and add the required language files under the Portal Page Customization language properties, enabling browser locale detection

Answer

Create three separate guest portals, one per region, and use different portal FQDNs mapped to regional PSNs

Answer

Deploy a single portal but require sponsors to manually select the guest's language when creating each account

Answer

Use the Hotspot portal type since it supports automatic multi-language rendering by default

Question 10

A retail company wants returning guests to authenticate to the guest WiFi only once per device without re-entering credentials on subsequent visits, while still requiring initial credential entry and AUP acceptance. The security team is configuring the Self-Registered Guest Portal on ISE. Which portal setting must be enabled to meet this requirement?

Accepted Answer

Enable the Device Registration setting so the endpoint MAC is added to an endpoint identity group and bypasses credential entry on return visits

Answer

Enable the Hotspot Guest flow so no credentials are ever required

Answer

Increase the guest account duration in the associated Time Profile to 365 days

Answer

Enable BYOD flow so the device is provisioned with a native supplicant profile

Question 11

A retail company uses ISE self-registered guest access. Marketing wants returning guests who registered last month to NOT have to re-register when they visit again this week, but the security team requires that stale guest endpoints be automatically removed after 30 days of inactivity to keep the endpoint database clean. As the ISE administrator, which configuration approach satisfies both requirements?

Accepted Answer

Enable an endpoint purge policy that removes GuestEndpoints inactive for 30 days, and enable device registration so returning devices within that window skip re-registration

Answer

Set the guest account time profile to expire after 30 days, which automatically deletes the registered endpoint and forces re-registration on every return visit

Answer

Configure the Hotspot portal with a 30-day AUP acceptance cache so returning devices are remembered without any endpoint purge policy

Answer

Disable endpoint purge entirely and rely on the sponsor to manually approve each returning guest to prevent stale entries

Question 12

A retail company runs a self-registered guest portal on ISE. Management complains that a single guest account username and password is being shared among many customers, allowing far more devices online than intended. The security team wants each guest account to be usable on no more than two devices at the same time, while still allowing legitimate guests to register normally. Which ISE guest portal configuration should the administrator adjust to enforce this?

Accepted Answer

Set the 'Maximum simultaneous logins' value in the guest type assigned to the portal

Answer

Reduce the account expiration in the associated time profile so accounts expire sooner

Answer

Enable sponsor approval for all self-registered guest accounts

Answer

Configure a purchased-endpoint-based device registration limit on the hotspot portal

Question 13

A retail company has deployed a self-registered guest portal on Cisco ISE. After guests successfully authenticate, the marketing team wants every guest browser to be automatically redirected to the company's promotional landing page (https://promo.retailco.com) rather than back to the URL the guest originally requested. Which guest portal setting must the administrator configure to achieve this behavior?

Accepted Answer

Under Authentication Success Settings, select 'Redirect to the following URL' and enter the promotional landing page address

Answer

Under the portal's Login Page Settings, enable 'Allow guests to change their password'

Answer

Under Portal Settings, change the 'Authentication method' to the sponsor identity source sequence

Answer

Under the Acceptable Use Policy settings, enable 'On first login only' and paste the URL into the AUP text

Question 14

A retail company deploys a self-registered guest portal on ISE. Management requires that guests create their own accounts, but no guest should be able to access the internet until an employee reviews and approves the account. Additionally, the approving employee must be able to see the guest's company name and reason for visit when deciding whether to approve. Which combination of portal settings satisfies all requirements?

Accepted Answer

Enable 'Require self-registered guests to be approved' and add 'Company' and 'Reason for visit' as custom fields on the self-registration page

Answer

Enable 'Allow guests to create their own accounts' only, and rely on the default Time Profile to hold access until expiration

Answer

Configure a Hotspot portal with an AUP and add custom registration fields for 'Company' and 'Reason for visit'

Answer

Enable device registration on the portal and set the endpoint purge policy to require sponsor review before purge

Question 15

A retail company uses ISE self-registered guest access. Management requires that guest accounts automatically become inactive exactly 8 hours after the guest's FIRST successful login, regardless of when the account was created earlier in the day. Which guest Time Profile setting should the administrator configure to meet this requirement?

Accepted Answer

Set the Account Type to 'From first login' with a maximum account duration of 8 hours

Answer

Set the Account Type to 'From creation' with a duration of 8 hours

Answer

Configure a Time Restriction that allows access only during an 8-hour daily window

Answer

Set the endpoint purge policy to remove guest endpoints after 8 hours of inactivity

Question 16

A network engineer deploys Central Web Authentication with a Cisco WLC. After a guest successfully authenticates on the ISE guest portal, the authorization result assigns the endpoint to a different VLAN than the one used during the redirect. Users report that after login, their browsers hang and their sessions eventually time out because the client keeps its original IP address, which is no longer valid on the new VLAN. Which guest portal setting should the engineer enable to resolve this issue?

Accepted Answer

Enable the VLAN DHCP Release option in the guest portal settings

Answer

Increase the guest portal session timeout value to allow the client more time to authenticate

Answer

Disable the Acceptable Use Policy so the redirect completes faster

Answer

Configure a static IP address pool on the WLC for the guest VLAN

Question 17

A retail company uses ISE self-registered guest access. Security requires that guest accounts remain valid only during a visitor's stay and that the sponsor be able to immediately terminate active guest sessions when a visitor leaves early. Which sponsor portal capability must be enabled in the sponsor group settings to meet the requirement of immediately terminating an active guest's network access?

Accepted Answer

Grant the sponsor group the permission to suspend and reinstate guest accounts, which triggers a CoA to disconnect the active session

Answer

Configure a shorter Time Profile so the guest account expires at the end of the day

Answer

Enable the endpoint purge policy to delete the endpoint after 30 days of inactivity

Answer

Set the guest type maximum simultaneous logins to 1 so only one session is active

Question 18

A retail company wants sponsors to create guest accounts at the front desk, but management requires that guest credentials be delivered directly to each visitor's mobile phone rather than being displayed on the sponsor's screen or printed. The sponsor portal is already functional. Which configuration in ISE enables this delivery method?

Accepted Answer

Enable SMS notification on the guest type and configure an SMS gateway (SMTP-to-SMS or supported provider) under Guest Access settings

Answer

Enable device registration on the sponsor portal so guests self-provision credentials on their phones

Answer

Configure a Hotspot guest portal with an AUP so no credentials need to be transmitted

Answer

Set the sponsor portal authentication source to the internal SMS identity store

Question 19

A retail company wants to provide visitors with immediate Internet access from their store WLAN. Business requirements state that guests must NOT be asked to register or enter any username and password, but they MUST accept an Acceptable Use Policy before browsing. Which ISE guest portal type should the administrator deploy to satisfy these requirements?

Accepted Answer

Hotspot Guest Portal

Answer

Self-Registered Guest Portal

Answer

More 300-715 practice