UUS Practice Tests⌕ Search
IT Certifications · 300-715 SISE

Cisco Implementing and Configuring Cisco Identity Services Engine Exam Practice Test

The 300-715 SISE practice page covers Cisco Identity Services Engine (ISE) administration for network access control. The available questions sample certificate trust, identity source selection, endpoint profiling, guest access, TACACS+ device administration, and authorization actions such as downloadable ACLs and Change of Authorization (CoA).

Exam overview

Exam providerCisco
Exam code300-715 SISE
CategoryIT Certifications

About the Cisco Implementing and Configuring Cisco Identity Services Engine Exam

ISE administrators connect identity and device context to network access decisions. Relevant work includes configuring trusted certificates for certificate-based authentication, selecting identity source sequences, and using endpoint profiling to classify devices. Guest portals support visitor access workflows, while TACACS+ policies control administrative access to network devices. Authorization results can apply downloadable ACLs, and CoA messages let network devices update an active session’s authorization. Operational questions also touch deployment configuration backups, synchronized clocks for consistent event records, and preparing a policy service node for maintenance. These scenarios call for understanding how ISE components and network devices interact, then choosing configurations or operational actions that match the access or administration goal.

Sample Practice Questions

Review a selection from this exam's published US Practice Tests practice bank.

Question 1

An organization wants to use certificate-based authentication and needs ISE to recognize a certificate issued by its private enterprise CA. What should be added to ISE's trusted certificate store?

  1. AThe issuing CA certificate chain
  2. BThe endpoint's RADIUS accounting record
  3. CA DHCP scope option for the CA
  4. DThe network device's SNMP community string
Show answerCorrect answer: A

ISE must trust the CA that issued the endpoint certificate, which generally means importing the relevant CA certificate or chain into the appropriate trust store. Accounting records, DHCP options, and SNMP credentials do not establish certificate trust.

Question 2

An administrator is preparing a scheduled maintenance window and wants to prevent users from being directed to a node undergoing planned work. Which operational action is commonly used before taking a policy service node out of service?

  1. ADrain or remove the node from the relevant load-balancing pool
  2. BDelete the node's certificate authority trust list
  3. CDisable DNS resolution for the entire deployment
  4. DRemove all endpoint identity groups
Show answerCorrect answer: A

Draining a node from a load-balancing pool helps stop new requests from being sent to it while existing sessions are handled according to the environment's design. The other actions are unrelated and could disrupt broader services.

Question 3

Which statement describes the purpose of a Cisco ISE deployment configuration backup?

  1. AIt records live packet captures from every policy service node
  2. BIt preserves configuration data so it can be restored if needed
  3. CIt automatically upgrades all registered network devices
  4. DIt replaces the need to synchronize clocks across ISE nodes
Show answerCorrect answer: B

A configuration backup preserves ISE configuration information for recovery or migration. It is not a packet-capture archive, device-upgrade mechanism, or substitute for time synchronization.

Question 4

Why should clocks be synchronized across Cisco ISE nodes and relevant network devices?

  1. ATo make RADIUS packets use fewer attributes
  2. BTo support consistent event timestamps and reliable certificate validity checks
  3. CTo ensure every endpoint receives the same IP address
  4. DTo prevent policy sets from being edited concurrently
Show answerCorrect answer: B

Consistent time supports useful event correlation across systems, and accurate time is important when validating certificate validity periods. Network time synchronization does not alter addressing or policy editing behavior.

Question 5

What is the primary function of a Cisco ISE TACACS+ device administration policy?

  1. AControl administrative access to network devices and apply command authorization
  2. BIssue certificates to endpoints joining a wired network
  3. CAssign VLANs to guest wireless clients
  4. DDiscover endpoint operating systems from DHCP traffic
Show answerCorrect answer: A

TACACS+ device administration policies can authenticate administrators and determine authorization, including command-level permissions, for supported network devices.

Question 6

What does a Cisco ISE authorization change of authorization (CoA) message allow a network device to do?

  1. AApply an updated authorization decision to an existing session without waiting for a new connection
  2. BReplace the endpoint's installed operating system
  3. CChange the identity store password used for authentication
  4. DReplicate ISE configuration to another node
Show answerCorrect answer: A

CoA lets ISE request a change to an already-established session, such as reauthentication or applying updated access treatment, when the network device supports the relevant CoA behavior.

Question 7

Which statement best describes the purpose of a downloadable ACL in an ISE authorization result?

  1. AIt supplies per-session traffic filtering rules that a supported network device can enforce
  2. BIt defines the list of identity stores used during authentication
  3. CIt establishes the TLS trust relationship between ISE nodes
  4. DIt determines how long endpoint profiling data is retained
Show answerCorrect answer: A

A downloadable ACL (dACL) provides traffic filtering rules associated with an authorized session. A supported network device enforces those rules, allowing access restrictions to be applied without relying solely on a preconfigured port ACL.

How to use this practice test

Access is free. The bank contains 50 published questions, and each practice session presents up to 20 random questions. Use the scenarios to test your understanding of ISE authentication, authorization, administration, and operations; review the results after the session to identify concepts that need closer attention.

Preparation tips

  • Trace a certificate-based authentication scenario and identify why the issuing enterprise CA must be trusted by ISE.
  • Compare identity source sequences with endpoint profiling: one determines where identity lookup occurs, while the other helps classify connected devices.
  • Work through authorization outcomes involving downloadable ACLs and CoA, noting what the network device changes in an active session.
  • Distinguish guest portal access from TACACS+ device administration by identifying the users and resources each policy serves.
  • Review operational scenarios involving configuration backups, clock synchronization, and taking a policy service node out of service.
Official sourceOfficial exam page ↗