Exam 300-715 topic 1 question 163 discussion

The "Network_Access_Authentication_Passed" condition should not be satisfied as we are using the Authentication Policy condition as "If user not found, continue". If this condition is not hit, the order will of the Authorization Policy will never matter I agree with cris711 for correct answer to be C

Why not C? How any unauthenticated endpoint will authenticate with these two rules, regardless of their order?

For me the answer is A. B and C are not true, and D is not also right the Guest_Flow condition is not used for give access to the webportal. A is true because the Network_Access_Authentication_Passed attribute is the default condition for network access, so the first policy is saying if authentication is ok the client is going to be redirected. After that the client is going to be authenticated again the MAB authentication will be successful again, so this means that the user will be again redirected to the portal because is gonna match always the firts policy. What we must do is change the order of the policies. After that the user is gonna to authenticate then the CoA will be sent and another process for authentication will occur. After that this time the policy that will be hit is the Guest Portal, that means if you have done a Guest_Flow correctly then permitaccess

the lines are in the wrong order. The initial flow is MAB - not guest flow - https://community.cisco.com/t5/security-knowledge-base/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475#toc-hId-1320686318 Guest flow only starts as soon as the user enters his credentials

Have a look at the screenshot under the "Create an Authorization Policy" subsection. https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html#anc6

D is correct. The wrong results are set to the rules.

A for sure. Order is very important here as the device will keep looping into the redirection rule which is hit first.

While A could be right I believe D is a better, more accurate answer. The Guest_Flow needs to be tied to the Guest Portal which is called out in the Results Profile Cisco_WebAuth.