Cisco CCNP 300-715 SISE Practice Exam

Cisco Certified Specialist - Security Identity Management Implementation 300-715

The Cisco CCNP 300-715 SISE certification validates skills in implementing and configuring Cisco Identity Services Engine. The exam covers architecture and deployment, policy enforcement, web auth and guest services, profiler, BYOD, endpoint compliance, and network access device administration. Candidates demonstrate knowledge of ISE personas, Active Directory and LDAP identity stores, wired and wireless 802.1X with IBNS 2.0, MAB, TrustSec, authorization policies, guest and sponsor portals, profiling probes and CoA, BYOD onboarding, posture services, and TACACS+ device administration. The exam consists of 100 questions over 90 minutes, with an 80% passing score.

Exam version: v1.2

867 questions in the bank

Question bank updated 30/10/2026: questions, answers, explanations and chapters.

Certification Overview

Exam name: CCNP 300-715 SISE
Vendor: Cisco
Exam code: 300-715
Duration: 90 minutes
Total questions: about 100
Our practice exam pass mark: 80%

Who Should Take This Exam?

Security Engineer, Network Security Engineer, ISE Administrator, Network Administrator, Systems Engineer, SOC Analyst, Security Consultant, Network Architect

Prerequisites

No formal prerequisite. Cisco recommends three to five years of networking and security experience, with hands-on work deploying and operating Cisco Identity Services Engine. Passing this exam with the SCOR 350-701 core exam earns CCNP Security.

Topics Covered

Architecture and Deployment
Policy Enforcement
Web Auth and Guest Services
Profiler
BYOD
Endpoint Compliance
Network Access Device Administration

Question Types

Multiple Choice (Single Answer)
Multiple Choice (Multiple Answers)
Drag and Drop
Scenario-Based

CCNP 300-715 SISE Practice Questions

Our question bank contains 867+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With full access, you get unlimited practice exams with randomized questions from our full question bank.

Architecture and Deployment

In a deployment, how is redundancy for policy service nodes established?

A. by enabling VIP
B. by utilizing RADIUS server list on the NAD
C. by creating a node group Correct answer
D. by deploying both primary and secondary node

Grouping policy service nodes into a node group is how Cisco ISE provides redundancy for them, since a node group lets PSNs share session state so a failed member's sessions can fail over. Enabling a VIP, using a RADIUS server list on the NAD, or simply deploying a primary and secondary node don't provide this PSN-level redundancy mechanism.

What happens in a two-node Cisco ISE distributed deployment if the secondary node is deregistered?

A. The primary node restarts
B. The secondary node restarts. Correct answer
C. The primary node becomes standalone
D. Both nodes restart.

When a secondary node is deregistered from a two-node Cisco ISE deployment, only that node is affected: its application server restarts and the node reverts to a standalone configuration, and replication from the primary stops. The primary node is not restarted and retains its primary PAN role, continuing to operate as a now single-node deployment. It does not become standalone as a result of deregistration, and the two nodes do not both restart.

Based on the exhibit, ISE1 and ISE2 run the Administration and Monitoring personas, and ISE3 through ISE6 run the Policy Service persona. PC1 authenticated through ISE3, and SW1 accepts CoA from every Policy Service node. ISE3 then fails. Which node can issue a CoA for the PC1 session?

A. ISE4 Correct answer
B. ISE6
C. ISE5
D. ISE1

Option A is correct because ISE4 sits in the same node group as ISE3, so it can issue the CoA when ISE3 fails. ISE5 and ISE6 are in the other node group and ISE1 is an administration node.

Policy Enforcement

Which interface-level command is needed to turn on 802 1X authentication?

A. Dot1x pae authenticator Correct answer
B. dot1x system-auth-control
C. authentication host-mode single-host
D. aaa server radius dynamic-author

The 'dot1x pae authenticator' interface command configures the port to act as an 802.1X authenticator, which is what actually turns on 802.1X authentication at the interface level. 'dot1x system-auth-control' is a global command, 'authentication host-mode single-host' just sets host mode after 802.1X is already enabled, and the RADIUS dynamic-author command relates to CoA, not enabling 802.1X itself.

-Which permission is common to the Active Directory Join and Leave operations?

A. Create a Cisco ISE machine account in the domain if the machine account does not already exist
B. Remove the Cisco ISE machine account from the domain
C. Set attributes on the Cisco ISE machine account
D. Search Active Directory to see if a Cisco ISE machine account already exsts. Correct answer

Both joining and leaving an Active Directory domain require searching AD first to check whether a Cisco ISE machine account already exists there. Creating a new account, removing an existing one, and setting account attributes are actions specific to join or leave individually, not something both operations share.

Using the exhibit, ISE1 authenticates PC1 on the Corp-WiFi WLAN and returns VLAN 30 in the authorization result. PC1 nevertheless receives an address from VLAN 10, the interface configured on the WLAN. Which WLC1 WLAN setting must be enabled so the ISE-assigned VLAN is applied?

A. Client exclusion
B. RADIUS accounting
C. AAA Override Correct answer
D. NAC State: ISE NAC

Option C is correct because AAA Override lets the VLAN returned by ISE replace the WLAN interface. Client exclusion, accounting and NAC state do not apply the returned VLAN.

Web Auth and Guest Services

A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group. Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?

A. Keep track of guest user activities
B. Configure authorization settings for guest users
C. Create and manage guest user accounts Correct answer
D. Authenticate guest users to Cisco ISE

A sponsor's guest portal role lets them create and manage guest user accounts on behalf of visitors. Tracking guest activity, configuring authorization settings, and authenticating guests to ISE are administrative or system functions outside what the Sponsor Portal role is meant to expose.

Which two methods should a sponsor select to create bulk guest accounts from the sponsor portal?

A. Random Correct answer
B. Monthly
C. Daily
D. Imported Correct answer
E. Known

Random and Imported are the two methods a sponsor can use to create bulk guest accounts from the sponsor portal -- generating random credentials or importing a prepared list. 'Monthly', 'Daily', and 'Known' aren't real bulk-creation method options in the portal.

-What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?

A. Cisco-av-pair Correct answer
B. Class attribute
C. Event
D. State attribute

The Cisco-av-pair RADIUS attribute is what carries the redirect ACL name configured in the authorization profile back to the Cisco WLC. The Class and State attributes carry session-tracking data, not the redirect ACL itself, and 'Event' isn't a RADIUS attribute at all.

Profiler

-Which use case validates a change of authorization?

A. An authenticated, wired EAP-capable endpoint is discovered
B. An endpoint profiling policy is changed for authorization policy. Correct answer
C. An endpoint that is disconnected from the network is discovered
D. Endpoints are created through device registration for the guests

A change of authorization is properly triggered when an endpoint's profiling policy changes and its authorization needs to be reevaluated against that new profile. Simply discovering an authenticated wired endpoint, a disconnected endpoint, or a newly registered guest device doesn't by itself constitute the kind of policy change CoA is meant to react to.

Which default endpoint identity group does an endpoint that does not match any profile in Cisco ISE become a member of?

A. Endpoints
B. unknown Correct answer
C. blocked list
D. allowed list
E. profiled

An endpoint that doesn't match any configured profile becomes a member of the default Unknown identity group. 'Blocked List', 'Profiled', and 'Allowed List' are different default groups reserved for other classification outcomes, and 'Endpoin' isn't a real group name.

Which two ports do network devices typically use for CoA?

A. 443
B. 19005
C. 8080
D. 3799 Correct answer
E. 1700 Correct answer

3799 and 1700 are the two UDP ports network devices commonly use for RADIUS Change of Authorization (CoA) requests. 443, 8080, and 19005 aren't the ports used for this purpose.

BYOD

-Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

A. TCP 8909
B. TCP 8905 Correct answer
C. CUDP 1812
D. TCP 443

TCP 8905 is the port Cisco ISE uses for native supplicant provisioning (the Network Setup Assistant) on a Windows laptop. TCP 8909, UDP 1812, and TCP 443 aren't the port used for this specific provisioning function.

During BYOD flow, from where does a Microsoft Windows PC download the Network Setup Assistant?

A. Cisco App Store
B. Microsoft App Store
C. Cisco ISE directly Correct answer
D. Native OTA functionality

During the BYOD flow, a Windows PC downloads the Network Setup Assistant directly from Cisco ISE itself, rather than through an app store or native over-the-air provisioning. The Cisco and Microsoft app stores aren't involved in delivering this Windows-specific provisioning tool.

What two conditions must be met to create a single signing in Cisco ISE through a certificate provisioning portal without a certificate request?

A. Location the CSV file for the device MAC
B. Select the certificate template Correct answer
C. Choose the hashing method
D. Enter the common name Correct answer
E. Enter the IP address of the device

Issuing a single certificate through the provisioning portal without a CSR requires selecting the certificate template to use and entering the common name to identify the certificate. Locating a CSV file for a MAC address, choosing a hashing method, and entering an IP address aren't the actual required inputs for this manual single-cert flow.

Endpoint Compliance

What portal allows customization of login settings for a user to access and download the compliance module?

A. Client Profiling
B. Client Endpoint
C. Client Provisioning Correct answer
D. Client Guest

The Client Provisioning portal is where login settings for downloading the compliance module can be customized. Client Profiling, Client Endpoint, and Client Guest aren't real Cisco ISE portal names.

What two elements make up the posture requirement when setting up Cisco ISE posture?

A. updates
B. remediation actions Correct answer
C. Client Provisioning portal
D. conditions Correct answer
E. access policy

A posture requirement is built from a condition (what to check for) paired with a remediation action (what to do if the check fails). Updates and the Client Provisioning portal support the broader posture process but aren't the two elements that make up a requirement itself, and 'access policy' is a separate authorization concept.

Using the exhibit, LAP1 fails a mandatory posture requirement whose remediation is a link to the patch site on SRV1. The authorization result for noncompliant endpoints applies a DACL that permits only traffic to 10.1.10.13 and 10.1.20.5. LAP1 cannot open the patch site. What must the DACL also permit?

A. Traffic to 10.1.0.0/30
B. Traffic to 10.1.40.5 Correct answer
C. Traffic to 10.1.20.10
D. Traffic from 10.1.10.13 to LAP1

Option B is correct because the DACL permits only ISE and DNS, so it must also permit the patch site 10.1.40.5.

Network Access Device Administration

What configuration needs to align between Cisco ISE and the network access device for endpoint authentication to succeed?

A. SNMP version
B. shared secret Correct answer
C. certificate
D. profile

The shared secret configured on both Cisco ISE and the network access device has to match for RADIUS authentication exchanges between them to succeed. SNMP version, a certificate, and a profile aren't the credential that has to align for basic RADIUS authentication to work.

Refer to the exhibit. SW1 (10.20.0.2) uses ISE3 (10.1.10.13) for TACACS+ administrator authentication, and the Device Administration service is enabled on ISE3. FW1 permits only UDP 1812 and 1813 from SW1 to ISE3. Administrator logins to SW1 time out. Which FW1 rule is required?

A. Permit TCP 49 from 10.20.0.2 to 10.1.10.14
B. Permit TCP 49 from 10.1.10.13 to 10.20.0.2
C. Permit UDP 49 from 10.20.0.2 to 10.1.10.13
D. Permit TCP 49 from 10.20.0.2 to 10.1.10.13 Correct answer

Option D is correct because TACACS+ uses TCP 49 from the switch to ISE3, so FW1 must permit TCP 49 from 10.20.0.2 to 10.1.10.13.

Free Study Guide

Read the free Cisco CCNP 300-715 SISE study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.

More Cisco Practice Exams

All Cisco practice exams →

Practice with realistic mock exams to prepare for your Cisco certification.