Cisco 300-715: Implementing and Configuring Cisco Identity Services Engine (SISE) v1.2

Last checked November 10, 2026 against the official Cisco exam page.

1. Question 1Policy Enforcement

   A company wants wired users to sign in with their Active Directory passwords through 802.1X. The switches and policy sets are ready, but Active Directory cannot yet be used as an identity store in ISE. Which step must be completed first?

   1. AJoin the ISE node to the Active Directory domain
   2. BCreate a certificate authentication profile for the domain
   3. CEnable MAC Authentication Bypass on every switch port
   4. DImport every directory user into the ISE internal users store
   Show answer and explanationHide answer

   Correct answer: A

   ISE must join the Active Directory domain before the AD identity store can validate passwords and retrieve group data. Importing users creates copies rather than using the directory, a certificate authentication profile is for certificate-based login, and MAB authenticates devices by MAC address rather than user passwords.

2. Question 2Web Auth and Guest Services

   A retail chain uses central web authentication for guest Wi-Fi. A visitor's device is first redirected to the ISE guest portal. After the visitor signs in, the device must gain full network access without reconnecting. What does ISE send to the network device to make this happen?

   1. AA new DHCP lease that replaces the address the visitor first received
   2. BA RADIUS Access-Reject that tears down the port for this visitor
   3. CA Change of Authorization request that re-evaluates the session
   4. DA TACACS+ command authorization request for the portal web session
   Show answer and explanationHide answer

   Correct answer: C

   In central web authentication, ISE sends a Change of Authorization after the guest completes the portal so the network device applies the final authorization without a reconnect. A DHCP lease change does not alter ISE authorization, an Access-Reject would deny the session, and TACACS+ authorization is for administrators of network devices.

3. Question 3Profiler

   An ISE administrator wants to identify printers and IP phones as they request addresses, using the attributes those endpoints send in DHCP traffic. Which profiler probe supplies these attributes?

   1. ASNMP trap probe, which receives link-state notifications from switches
   2. BDHCP probe, which reads attributes from DHCP request packets
   3. CNetFlow probe, which summarises traffic flows between hosts
   4. DActive Directory probe, which reads group membership from the domain
   Show answer and explanationHide answer

   Correct answer: B

   The DHCP probe collects attributes that endpoints include in DHCP requests, which helps profile devices such as printers and phones. The SNMP trap, NetFlow and Active Directory probes gather link-state, flow and group data rather than DHCP request content.

4. Question 4BYOD

   An employee connects a personal laptop to the corporate SSID, which has a BYOD onboarding policy. The laptop is redirected to a portal where the employee registers the device, and then the Native Supplicant Profile is applied. What is the purpose of this redirect?

   1. ATo scan the laptop for missing operating system patches before access
   2. BTo grant temporary guest access until a manager approves the device
   3. CTo register the device and install supplicant settings and its certificate
   4. DTo replace the employee's directory password with a one-time sign-in code
   Show answer and explanationHide answer

   Correct answer: C

   The BYOD redirect sends the employee to onboarding, where the device is registered and the native supplicant profile configures the supplicant and installs the certificate needed for EAP-TLS. Patch scanning belongs to posture, guest access is a different flow, and onboarding does not replace the directory password.

5. Question 5Architecture and Deployment

   A company runs a single Cisco ISE node that carries every persona. Growth in switch and wireless traffic has slowed RADIUS authentication, so the team adds a second node that will only process authentication requests from network devices. Which persona should be enabled on the new node?

   1. AMonitoring, for collecting logs and generating reports
   2. BPolicy Service, for RADIUS and TACACS+ request processing
   3. CAdministration, for the web GUI and configuration API
   4. DMonitoring, for enforcing authorization results on each switch port
   Show answer and explanationHide answer

   Correct answer: B

   The Policy Service persona handles RADIUS and TACACS+ requests and makes authentication and authorization decisions, so adding Policy Service nodes scales access processing. Administration provides the GUI and configuration API, and Monitoring collects logs and reports, so the last option wrongly gives Monitoring an enforcement role.