Cisco CCNP Security SISE — Implementing and Configuring Cisco Identity Services Engine (300-715)

Question 1

A network administrator is deploying BYOD onboarding with the ISE internal CA. Corporate policy requires that only endpoints already listed in a specific ISE endpoint identity group be permitted to complete certificate provisioning, while all other personal devices are silently denied enrollment. Which ISE configuration approach best enforces this allow-list requirement during the BYOD flow?

Accepted Answer

Create an authorization rule that matches the pre-approved endpoint identity group before the BYOD provisioning rule, and deny access for endpoints that do not match

Answer

Enable the Blocked List endpoint identity group and add all unapproved MAC addresses to it manually

Answer

Configure the native supplicant profile to reject certificates issued to devices not in Active Directory

Answer

Set the internal CA certificate template lifetime to zero for all non-corporate endpoints

Question 2

A network engineer is designing BYOD onboarding for a Cisco WLC deployment. The requirement is that employees first associate to an open (or PSK) provisioning SSID to register their device and download the native supplicant profile and certificate, then move to a secure 802.1X SSID for production access. Which BYOD deployment model does this describe, and what must the WLC configuration include to support the transition?

Accepted Answer

Dual-SSID model; the open/PSK SSID must have MAC filtering enabled with the RADIUS NAC/ISE NAC state and an ISE-referenced redirect ACL to send users to the BYOD portal

Answer

Single-SSID model; the WLC must be configured with an override for the redirect ACL so the same SSID re-authenticates the endpoint after provisioning

Answer

Single-SSID model; the WLC must disable CoA so the client stays on the provisioning SSID until the certificate installs

Answer

Dual-SSID model; both SSIDs must be configured for 802.1X with EAP-TLS so the endpoint never needs to be redirected to a portal

Question 3

A network engineer is preparing ISE to issue certificates to BYOD endpoints using the ISE internal CA. During validation, the engineer notices that the certificates presented to onboarded endpoints must chain to a trusted root. To ensure the internal CA can sign endpoint certificates while maintaining a proper trust chain in a distributed deployment, which statement correctly describes how the ISE internal CA hierarchy is structured?

Accepted Answer

The Primary PAN acts as the Root CA, and each PSN operates as a subordinate CA that signs endpoint certificates issued to devices it services.

Answer

Each PSN generates its own self-signed Root CA that independently signs endpoint certificates without any relationship to the PAN.

Answer

The internal CA can only issue endpoint certificates from the Primary PAN, so all onboarding traffic must be redirected to the PAN.

Answer

An external enterprise Root CA must sign all ISE node certificates before the internal CA can issue any BYOD endpoint certificates.

Question 4

A network administrator is preparing Cisco ISE to issue certificates to employee-owned devices during BYOD onboarding using the ISE internal CA. When configuring the certificate template that will be bound to the BYOD portal's provisioning flow, which combination of settings must the administrator define within the certificate template itself?

Accepted Answer

The subject name (CN) source, subject alternative name (SAN), key size, and certificate validity period

Answer

The SCEP RA profile URL and the WLC RADIUS shared secret

Answer

The EAP-TLS authentication protocol and the certificate authentication profile mapping

Answer

The authorization profile ACL and the redirect ACL name pushed to the switch

Question 5

A network administrator has deployed BYOD onboarding using the ISE internal CA to issue certificates to employee devices. After several months, a security team requirement mandates that ISE must validate the revocation status of endpoint certificates in real time during EAP-TLS authentication, rather than relying on periodically downloaded lists. Which mechanism should the administrator configure in the certificate authentication settings to meet this requirement with the ISE internal CA?

Accepted Answer

Enable OCSP services and configure the internal CA OCSP responder in the certificate authentication profile

Answer

Import a static CRL file from the internal CA into the trusted certificates store

Answer

Increase the CRL download interval to once every 24 hours for the internal CA certificate

Answer

Enable SCEP proxy validation on the RADIUS authentication policy

Question 6

An engineer configures BYOD onboarding using the ISE internal CA. During EAP-TLS authentication after onboarding, employee endpoints that received a certificate from the ISE internal CA fail with a 'certificate chain could not be validated' error on the PSN. The endpoint certificate itself is valid and not expired. What must the engineer verify to resolve the trust validation failure?

Accepted Answer

The ISE internal CA root and node (endpoint) subordinate CA certificates are present in the Trusted Certificates Store with 'Trust for client authentication and Syslog' enabled

Answer

The endpoint certificate template uses a 1024-bit key size to remain compatible with legacy supplicants

Answer

The SCEP RA profile points to an external Microsoft CA instead of the ISE internal CA

Answer

The guest portal FQDN matches the certificate CN presented during web redirection

Question 7

A user calls the help desk reporting that a personal tablet they previously onboarded through BYOD has been lost. The security team wants the user to be able to immediately prevent that specific device from accessing the network without waiting for an administrator, while other registered devices belonging to that same user continue working normally. Which ISE capability should the user be directed to use?

Accepted Answer

The My Devices Portal, where the user marks the device as Lost to block it

Answer

The BYOD (Native Supplicant Provisioning) Portal to re-provision the device

Answer

The Sponsor Portal to suspend the associated guest account

Answer

The Client Provisioning Policy to remove the device certificate template

Question 8

A network engineer is defining the ISE internal CA certificate template used to issue certificates to endpoints during BYOD onboarding. The engineer wants the issued certificates to be usable for 802.1X EAP-TLS authentication where the endpoint acts as the client presenting its certificate to ISE. Which Extended Key Usage (EKU) value must be included in the certificate template so the issued endpoint certificates are valid for this purpose?

Accepted Answer

Client Authentication (1.3.6.1.5.5.7.3.2)

Answer

Server Authentication (1.3.6.1.5.5.7.3.1)

Answer

OCSP Signing (1.3.6.1.5.5.7.3.9)

Answer

Code Signing (1.3.6.1.5.5.7.3.3)

Question 9

A network engineer is building a BYOD flow in Cisco ISE for a corporate wireless network. Employees using Windows laptops, macOS laptops, Android phones, and iOS devices must all be able to onboard through the same single-SSID flow. During testing, Android users report that after registering they are prompted to install an app, while Windows users receive a downloadable executable. The engineer wants to understand which ISE component determines the platform-specific onboarding logic (which files, wizards, and profiles are delivered per operating system). Which ISE configuration element is responsible for this behavior?

Accepted Answer

The Native Supplicant Profile referenced by the client provisioning policy, matched per operating system

Answer

The BYOD portal's authentication settings under the guest access configuration

Answer

The certificate template assigned in the internal CA settings

Answer

The authorization profile web redirection ACL applied on the WLC

Question 10

A network architect is documenting the BYOD onboarding options for a new wireless deployment before implementation. Management wants to minimize the number of SSIDs broadcast in the environment while still allowing employees to onboard personal devices and receive certificates from the ISE internal CA. Which BYOD onboarding approach should the architect recommend to satisfy this requirement?

Accepted Answer

Single-SSID onboarding, where the same 802.1X SSID is used for both provisioning and secured access, with a CoA moving the device to full access after certificate enrollment

Answer

Dual-SSID onboarding, using an open SSID for provisioning and a separate 802.1X SSID for secured access after enrollment

Answer

Local Web Authentication on a dedicated guest SSID that redirects to the BYOD portal for certificate download

Answer

MAB-based onboarding on an open SSID that statically assigns the endpoint to a registered identity group

Question 11

A network engineer is finalizing BYOD onboarding for a corporate campus. Windows and macOS laptops must be provisioned with a certificate and a configured 802.1X supplicant for the secure SSID. During testing, users report that after clicking the onboarding link, they are prompted to download and run a temporary application that configures the device and then does not remain installed. The engineer wants to confirm what component performs this one-time provisioning on the endpoint. Which ISE component is responsible for this behavior?

Accepted Answer

Cisco Network Setup Assistant (NSA), a temporary agent launched from the BYOD portal that provisions the certificate and supplicant, then exits

Answer

Cisco AnyConnect ISE Posture module, which stays resident to continuously evaluate device compliance

Answer

The Native Supplicant Profile installed directly by ISE without any client-side helper application

Answer

Cisco AnyConnect NAM (Network Access Manager), permanently installed to manage 802.1X profiles

Question 12

A network engineer is enabling single-SSID equivalent BYOD onboarding on a Cisco Catalyst switch for wired employees who must be redirected to the ISE BYOD portal to run the Native Supplicant Provisioning wizard. After the initial 802.1X/EAP authentication succeeds, ISE returns an authorization result containing a redirect URL and the name of a redirect ACL, but clients open a browser and never see the ISE portal. Which switch-side configuration element is most likely missing and required for the redirection to function?

Accepted Answer

The HTTP and HTTPS servers must be enabled on the switch with 'ip http server' and 'ip http secure-server'

Answer

A dynamic VLAN assignment must be configured so onboarding traffic is placed in a provisioning VLAN

Answer

The switch must be configured as an SXP speaker to propagate the endpoint SGT to ISE

Answer

A per-user downloadable ACL (dACL) must be manually defined in the switch running configuration

Question 13

During BYOD single-SSID onboarding on a Cisco WLC, an employee named jsmith authenticates with PEAP-MSCHAPv2, is redirected to the BYOD portal, and the native supplicant provisioning installs a certificate issued by the ISE internal CA. The security team wants ISE authorization policies to later match this endpoint to the specific user who onboarded it. Which endpoint certificate attribute is populated by default during ISE internal CA enrollment to enable this correlation?

Accepted Answer

The certificate Subject Common Name (CN) is set to the authenticated username (jsmith), and ISE links the certificate serial number to the endpoint's registered owner.

Answer

The certificate Subject Alternative Name (SAN) is populated with the WLC management IP so ISE can match the network device.

Answer

The certificate Organizational Unit (OU) is set to the endpoint MAC address only, with no reference to the onboarding user.

Answer

The certificate CN is set to the ISE internal CA hostname, and ownership is tracked solely by the RADIUS Calling-Station-ID.

Question 14

You are configuring a Cisco WLC (AireOS) to support single-SSID BYOD onboarding with ISE using the internal CA. Wireless users authenticate via 802.1X, then ISE returns a URL redirect authorization result to send new devices to the BYOD portal for native supplicant provisioning. During testing, ISE never sends the CoA and the client is never redirected to the portal even though the authorization policy matches. Which WLAN setting on the WLC must be enabled for the redirect and CoA to function?

Accepted Answer

AAA Override and RADIUS NAC (RADIUS Client Profiling / NAC State) under the WLAN Advanced settings

Answer

Fast SSID Change under the WLAN General settings

Answer

Static WEP + 802.1X Layer 2 security on the WLAN

Answer

DHCP Addr. Assignment Required under the WLAN Advanced settings

Question 15

A network engineer is configuring single-SSID BYOD onboarding on a Cisco WLC (AireOS) using ISE as the RADIUS server with the internal CA. During the provisioning phase, the WLC must redirect the corporate employee's device to the ISE BYOD portal so the Native Supplicant Provisioning wizard can be installed. Which WLC configuration element is REQUIRED on the WLC to enable ISE to enforce this redirection during authorization?

Accepted Answer

A named redirect ACL on the WLC whose name exactly matches the ACL referenced in the ISE authorization profile's web redirection setting

Answer

A local EAP profile on the WLC configured to trust the ISE internal CA certificate chain

Answer

A DNS ACL that permits only the ISE PSN FQDN and blocks all other name resolution

Answer

A pre-shared key configured on the WLAN that matches the ISE sponsor portal secret

Question 16

An engineer is configuring single-SSID BYOD onboarding on a Cisco WLC (AireOS) using ISE with its internal CA. After a user authenticates via dot1x on the corporate SSID with an unregistered device, ISE returns an authorization result that references a named ACL to steer the client to the BYOD provisioning portal. During testing, the client associates but never receives the ISE redirect to the Native Supplicant Provisioning portal, even though the WLC's RADIUS NAC/CoA settings are correct. Which action on the WLC most likely resolves the missing redirect?

Accepted Answer

Create the redirect ACL locally on the WLC with the exact name referenced by the ISE authorization profile, permitting DNS and traffic to ISE while denying other traffic to trigger redirection

Answer

Enable a downloadable ACL (dACL) on the WLC so ISE can push the full redirect ACL contents at authorization time

Answer

Disable AAA override on the WLAN so the WLC applies its default policy instead of the ISE-supplied ACL name

Answer

Configure the redirect ACL as a FlexConnect ACL only, since AireOS WLCs cannot process standard named ACLs for central redirection

Question 17

A network engineer is designing a single-SSID BYOD onboarding solution using a Cisco WLC and ISE with the internal CA. Employees connect to a WPA2-Enterprise SSID with their AD credentials via PEAP, and after registering their personal device they must transition to EAP-TLS on the SAME SSID without manually reconnecting to a different network. Which mechanism must the WLC support and ISE trigger to move the endpoint from the provisioning state to the certificate-authenticated state after the device is onboarded?

Accepted Answer

RADIUS Change of Authorization (CoA) to reauthenticate the session so the endpoint re-associates and presents its new certificate

Answer

A DHCP lease release forcing the endpoint to obtain a new IP address and reconnect to a dedicated provisioning SSID

Answer

A separate open guest SSID redirect that hands the endpoint back to the corporate SSID after enrollment

Answer

SNMP MAC notification traps from the WLC to signal ISE that the certificate has been installed

Question 18

A network engineer is deploying Central Web Authentication (CWA) on a Catalyst switch running IOS. Endpoints authenticate via MAB, and ISE returns an authorization result containing a redirect URL and a redirect ACL. However, after connecting, test endpoints receive an IP address but the browser never displays the ISE guest portal — the redirection simply times out. RADIUS accounting and the CoA are confirmed working. Which switch configuration step is most likely missing and required for the redirect to function?

Accepted Answer

Enable the HTTP and HTTPS server on the switch with 'ip http server' and 'ip http secure-server'

Answer

Configure 'authentication open' on the access interface to allow traffic before authorization

Answer

Add a static route pointing to the ISE PSN so the switch can reach the guest portal

Answer

Change the authentication order to place dot1x before MAB on the interface

Question 19

A network engineer is deploying 802.1X on wired access switches for the first time in a large enterprise. Management requires that no legitimate users lose network connectivity during the rollout, even if their supplicant is misconfigured or ISE authorization policies are incomplete. The engineer needs to observe authentication results in ISE and correct policy issues before enforcing access control. Which switchport configuration approach best meets this requirement?

Accepted Answer

Configure the port with 'authentication open' (open authentication / Monitor Mode) so traffic is permitted regardless of the 802.1X result while ISE logs authentications

Answer

Configure 'authentication port-control auto' with a restrictive default deny so unauthenticated endpoints are dropped until policy is fixed

Answer

Configure 'authentication port-control force-authorized' so the port bypasses 802.1X entirely and never sends RADIUS requests

Answer

Enable MAB only and disable dot1x on the ports so endpoints are authorized by MAC address during testing

Question 20

A network administrator joins Cisco ISE to an Active Directory domain that spans multiple sites, each with its own domain controllers. Users at a remote branch report intermittent authentication failures, and logs show ISE occasionally contacting a domain controller located across a slow WAN link in the corporate data center. Which ISE Active Directory configuration option should the administrator adjust to ensure ISE prefers domain controllers geographically closest to it?

Accepted Answer

Enable the DC failover and use only these DCs / allowed domain controllers list, restricting ISE to local site domain controllers

Answer

Increase the Active Directory authentication request timeout under the Advanced Settings tab

Answer

Add a secondary AD join point for the remote branch domain and reorder the identity store sequence

Answer

Configure Machine Access Restriction (MAR) with a longer cache expiration for the branch users

Question 21

An ISE administrator has successfully joined ISE to an Active Directory domain and can authenticate domain users. However, when building an authorization policy, the administrator cannot select any AD security groups from the external group dropdown, and the condition list is empty. Authentication against AD works correctly. What must the administrator do to make AD groups available for use in authorization conditions?

Accepted Answer

Retrieve the desired groups from the AD join point's Groups tab so they are added to ISE and become available in policy conditions

Answer

Enable the Machine Access Restriction (MAR) feature on the AD join point to expose group membership

Answer

Create an Identity Source Sequence that includes the AD join point before groups can be referenced

Answer

Change the AD join point's authentication protocol to EAP-TLS so certificate groups are populated

Question 22

A security engineer integrates Cisco ISE with two separate Active Directory forests that have no trust relationship between them: 'corp.example.com' for employees and 'contractor.example.net' for contract staff. Both forests must be usable as identity sources for 802.1X authentication. The engineer wants ISE to try each directory in a defined order and stop at the first that can authenticate the user. Which ISE configuration meets this requirement?

Accepted Answer

Create two separate AD join points and reference them together in an Identity Source Sequence used by the authentication policy

Answer

Join ISE to only the corp.example.com forest and configure a one-way external trust so contractor accounts resolve through it

Answer

Configure a single AD join point and add both forests as additional domains under the same Active Directory scope

Answer

Use an LDAP identity store pointed at a global catalog server that indexes both forests simultaneously

Question 23

An administrator is deploying EAP-TLS for corporate laptops. Users present certificates where the Subject Alternative Name (SAN) contains the user's UPN, but the Subject Common Name (CN) field is blank. Authentication is failing during the identity lookup against Active Directory. What must the administrator configure so ISE extracts the correct principal name from the certificate for the AD lookup?

Accepted Answer

Create a Certificate Authentication Profile that uses the SAN attribute as the Principal Username and reference it in the Identity Source of the authentication policy

Answer

Enable Certificate Authority Chain validation on the trusted certificate store so the CN is populated automatically

Answer

Configure an Authorization Profile that maps the SAN to a downloadable ACL for the AD group

Answer

Add the client certificate template to the External RADIUS Server sequence used by the PSN

Question 24

A network administrator configures an ISE authentication policy for a dot1x-based wired deployment. Contractors authenticate using EAP-TLS certificates stored in an LDAP directory, while full-time employees authenticate using PEAP-MSCHAPv2 credentials in Active Directory. Both user types hit the same authentication policy rule. The administrator wants ISE to first attempt to validate the user against Active Directory, and if the user is not found there, fall through and check the LDAP store before rejecting the request. Which configuration achieves this behavior?

Accepted Answer

Reference an Identity Source Sequence in the authentication rule that lists Active Directory first and LDAP second, with the advanced option to continue searching when a user is not found in the current store

Answer

Create two separate authentication policy rules, one pointing to Active Directory and one to LDAP, and rely on ISE to merge the results automatically

Answer

Set the authentication rule's identity source to Internal Users and add Active Directory and LDAP as external authorization sources

Answer

Configure Active Directory as the identity source and enable the LDAP store as a certificate authentication profile fallback within the AD join point

Question 25

A network engineer is building an authorization profile in ISE for corporate wireless users who should be placed into a dynamic VLAN. The switching and wireless team have standardized on referencing VLANs by name (CORP_DATA) rather than by ID number across all access devices. Which combination of RADIUS attributes must the authorization profile return so that the NAD assigns the client to the correct VLAN by name?

Accepted Answer

Tunnel-Type=VLAN(13), Tunnel-Medium-Type=802(6), and Tunnel-Private-Group-ID=CORP_DATA

Answer

Only Tunnel-Private-Group-ID=CORP_DATA, since the NAD infers the tunnel type automatically

Answer

Filter-Id=CORP_DATA plus Tunnel-Medium-Type=802(6)

Answer

Tunnel-Type=GRE(10), Tunnel-Medium-Type=IP(1), and Tunnel-Private-Group-ID=CORP_DATA

Question 26

A network engineer is deploying 802.1X on access switches that connect both IP phones and PCs on the same port using multi-domain authentication (MDA). The Cisco IP phones authenticate successfully via MAB against ISE, but they fail to gain access to the voice VLAN even though the correct VLAN is being assigned. In the ISE authorization profile applied to the phones, which setting must be enabled so the switch permits the endpoint into the voice domain?

Accepted Answer

The 'Voice Domain Permission' checkbox, which sends the device-traffic-class=voice VSA to the switch

Answer

The 'Web Redirection' option set to Client Provisioning (Posture)

Answer

A downloadable ACL (dACL) permitting UDP RTP ports 16384-32767

Answer

The 'Reauthentication' timer set with a maintain-connectivity option

Question 27

An ISE administrator has built an authorization policy set for wired 802.1X. The policy set contains these rules in order: (1) 'Employee_Full' matches AD group 'Domain Users' and permits full access, (2) 'Contractor_Limited' matches AD group 'Contractors' and applies a restricted dACL. A user who is a member of both 'Domain Users' and 'Contractors' in Active Directory authenticates successfully. The administrator expects this user to receive the restricted contractor access but instead sees full access being granted. What is the cause of this behavior, and how should it be corrected?

Accepted Answer

Authorization rules are evaluated top-down and the first match wins; move the 'Contractor_Limited' rule above 'Employee_Full' so the more specific match is evaluated first.

Answer

ISE merges all matching authorization results, so the administrator must remove the full-access permission from the 'Employee_Full' profile.

Answer

The default authorization rule is overriding both rules; disable the default rule to allow the specific rules to apply.

Answer

AD group membership cannot be used in authorization conditions; the administrator must convert the rules to use identity groups instead.

Question 28

A network administrator is building an authorization profile in Cisco ISE for corporate laptops that authenticate via 802.1X. Security policy requires that each authenticated session be re-validated every 2 hours without disconnecting the endpoint if it is still active, and the timer value must be pushed to the switch as part of the RADIUS Access-Accept. Which configuration in the authorization profile accomplishes this requirement?

Accepted Answer

Enable the Reauthentication setting under Common Tasks, set the timer to 7200 seconds, and choose the RADIUS-Request maintain connectivity option

Answer

Configure a DACL that permits traffic for 7200 seconds and attach it to the authorization profile

Answer

Set the Session Timeout attribute to 7200 seconds with the Termination-Action set to Default

Answer

Enable MACsec policy with a 7200-second SAK rekey interval under the authorization profile

Question 29

A network engineer is building a guest access solution on Cisco ISE. When an unauthenticated endpoint connects to the guest SSID, the switch/WLC must redirect the user's browser to the ISE guest portal for self-registration. The engineer is configuring the authorization profile that will be returned for these initial guest connections. Which combination of settings must the authorization profile contain to force the browser redirection to the ISE guest portal?

Accepted Answer

A redirect ACL name (defined locally on the NAD) referenced in the Web Redirection setting pointing to the guest portal

Answer

A downloadable ACL (dACL) that permits all traffic plus a VLAN assignment matching the guest VLAN

Answer

A RADIUS Change of Authorization (CoA) type of 'Reauth' with a Security Group Tag assigned

Answer

An Airespace ACL and a Filter-ID attribute referencing the ISE self-registration policy set

Question 30

An employee reports that their personal tablet, previously onboarded through the BYOD flow, has been lost. The security team wants to immediately prevent that specific device from gaining network access via its issued certificate, while allowing the employee to re-register a replacement device. Which ISE action accomplishes this?

Accepted Answer

Add the endpoint to the Blocklist identity group so the BYOD authorization policy denies it and redirects it to the Blocked List portal

Answer

Delete the employee's user account from Active Directory to revoke all device certificates

Answer

Disable the internal CA and reissue new certificates to all onboarded endpoints

Answer

Change the BYOD portal to require sponsor approval for all future device registrations

Question 31

A company wants employees to onboard their personal devices for secure network access. When users connect to the corporate SSID and authenticate, they should be redirected to a portal that guides them through installing a supplicant configuration and issuing a certificate to the device, after which they gain full access. Which ISE portal type must the administrator configure to accomplish this device onboarding workflow?

Accepted Answer

BYOD portal with Native Supplicant Provisioning

Answer

Hotspot Guest portal

Answer

Sponsor portal

Answer

Self-Registered Guest portal

Question 32

A network engineer deploys Central Web Authentication (CWA) for guests on a Cisco Catalyst switch integrated with ISE. After a guest successfully authenticates on the guest portal, ISE must instruct the switch to remove the pre-auth redirect and apply the final guest DACL without disconnecting the endpoint's link. Which mechanism must be configured on the switch and used by ISE to accomplish this transition?

Accepted Answer

RADIUS Change of Authorization (CoA) with re-authenticate, requiring 'aaa server radius dynamic-author' on the switch

Answer

A SNMP trap sent from ISE to the switch triggering an interface bounce

Answer

RADIUS accounting interim updates that push the new DACL every 60 seconds

Answer

A session timeout on the pre-auth authorization profile that forces the endpoint to re-authenticate via 802.1X

Question 33

A network engineer is deploying Central Web Authentication (CWA) for guest wireless users on a remote-site Cisco WLC where the APs operate in FlexConnect mode with local switching. Wired traffic from these APs does not traverse the WLC. Guests connect to an open SSID, associate via MAB, and are supposed to be redirected to the ISE guest portal. However, users associate but never receive the redirect. What must the engineer configure on the WLC to make the CWA redirection work in this FlexConnect local-switching scenario?

Accepted Answer

Define the redirect ACL as a FlexConnect ACL and apply it to the AP group or flex profile so it is pushed to the local switching APs

Answer

Configure the redirect ACL only as a standard named ACL on the WLC controller and reference it in the ISE authorization profile

Answer

Disable AAA override on the WLAN so the WLC applies the redirect locally instead of relying on ISE

Answer

Change the APs from FlexConnect to local mode so the WLC can enforce the redirect ACL centrally

Question 34

A network engineer configured Central Web Authentication (CWA) on ISE for wireless guests. When guests connect and are redirected to the guest portal, their browsers display a certificate warning stating the certificate name does not match the site. The engineer confirmed the WLC redirect is working and the portal loads after the guest clicks past the warning. What is the BEST way to eliminate the certificate warning?

Accepted Answer

Configure the guest portal to use the ISE portal FQDN and bind a certificate whose Subject/SAN matches that FQDN, then ensure DNS resolves the FQDN to the PSN

Answer

Disable HTTPS on the guest portal and serve it over HTTP so no certificate is validated

Answer

Enable the default self-signed certificate on the WLC and export it to the guest devices

Answer

Change the portal authentication method to a local WebAuth flow on the WLC instead of CWA

Question 35

A network engineer configures a downloadable ACL (dACL) in ISE to be pushed to Cisco Catalyst switches as part of an authorization profile for contractor endpoints. After saving the authorization profile, the engineer wants to ensure the switches will accept and apply the dACL without syntax errors. Which action should the engineer take within ISE before deploying the dACL to production?

Accepted Answer

Use the 'Check DACL Syntax' function under Policy > Policy Elements > Results > Authorization > Downloadable ACLs

Answer

Enable RADIUS accounting on the switch so ISE can validate the ACL against live traffic

Answer

Convert the dACL into a named ACL and manually configure it on each switch to test it

Answer

Assign the dACL to a VLAN interface in the authorization profile to verify compatibility

Question 36

A company currently runs a single standalone ISE node handling all personas for 4,500 endpoints. They plan to add a disaster-recovery site and grow to 12,000 concurrent endpoints within a year, and they want administrative and monitoring redundancy across two data centers. Which ISE deployment model should the network architect recommend to meet these requirements?

Accepted Answer

Deploy a distributed deployment with two Administration nodes (primary/secondary), two Monitoring nodes (primary/secondary), and dedicated Policy Service nodes

Answer

Keep the standalone deployment and simply increase the VM resource reservations to support more endpoints

Answer

Deploy two independent standalone nodes, one per data center, each running all personas without synchronization

Answer

Deploy a hybrid deployment with a single PAN, single MnT, and multiple PSNs across both sites

Question 37

A network administrator is configuring an authorization policy on Cisco ISE for corporate laptops that pass 802.1X EAP-TLS authentication on wired access switches. The requirement is that authenticated laptops must be placed in the corporate data VLAN and simultaneously receive a downloadable ACL (dACL) that permits only business application traffic. Which combination must be configured in the authorization profile to meet both requirements?

Accepted Answer

Set the VLAN under Common Tasks and reference a DACL Name that maps to a downloadable ACL defined in ISE

Answer

Configure only a Security Group Tag (SGT) and rely on the switch to derive both VLAN and ACL from the tag

Answer

Define a RADIUS authentication policy that pushes the VLAN and configure the dACL as a local ACL on each switch interface

Answer

Assign a Web Authentication redirect URL along with the VLAN, since the dACL is applied automatically after redirection

Question 38

An engineer is deploying wired 802.1X on Cisco Catalyst access switches. Each access port connects a Cisco IP phone with a PC daisy-chained behind it. The security policy requires that the phone authenticate in the voice domain and the PC authenticate independently in the data domain, but no more than one endpoint should ever be authorized in the data domain on a single port. Which switchport host mode meets these requirements?

Accepted Answer

multi-domain (multi-domain-authentication)

Answer

multi-auth (multiple hosts, each individually authenticated)

Answer

single-host

Answer

multi-host

Question 39

A security engineer wants Windows domain laptops to prove BOTH the machine's and the logged-in user's identity in a single EAP conversation, so that authorization can grant full access only when a corporate machine AND a valid domain user are authenticated together. Which authentication method should be configured in the ISE Allowed Protocols policy to achieve this?

Accepted Answer

TEAP with EAP chaining, referencing both machine and user authentication results in the authorization policy

Answer

PEAP with MSCHAPv2 and the 'Retrieve group membership from AD' option enabled

Answer

EAP-TLS with a single client certificate and machine authentication only

Answer

EAP-FAST with anonymous PAC provisioning and MAB fallback enabled

Question 40

A retail company runs a self-registered guest portal on ISE. Compliance requires that returning guests must re-accept the Acceptable Use Policy (AUP) every single time they log in through the portal, rather than only on their first login. Which portal setting should the administrator configure to meet this requirement?

Accepted Answer

Set the AUP display option to 'On every login' under the Acceptable Use Policy Page Settings

Answer

Set the AUP display option to 'On first login only' under the Acceptable Use Policy Page Settings

Answer

Enable 'Require an access code' on the Login Page Settings so the AUP re-displays

Answer

Configure a Time Profile that expires the guest account after each session to force AUP re-acceptance

Question 41

A network engineer is configuring a credentialed guest portal on ISE for a corporate lobby. Contractors who already exist in the company's Active Directory should be able to log in with their AD credentials, while short-term visitors will use sponsor-created guest accounts. Under the portal's Authentication settings, which configuration ensures both account types can authenticate through the same guest portal?

Accepted Answer

Set the portal's Identity Source Sequence to include both the Guest Users internal store and the Active Directory join point

Answer

Enable self-registration on the portal so AD users are automatically imported into the Guest Users store

Answer

Configure two separate guest portals, one bound to AD and one bound to the internal Guest Users store, and redirect based on username

Answer

Add the Active Directory join point as the only identity source and enable password-based guest login

Question 42

A network administrator has deployed a Sponsored-Guest portal on ISE PSNs that are reachable at guest.company.com. During testing, guests connecting from the CWA redirect see a browser certificate warning when the portal loads, even though a valid, CA-signed wildcard certificate for *.company.com is already installed on the PSNs. The certificate is currently tagged only for EAP Authentication and Admin usage. What must the administrator do to resolve the certificate warning on the guest portal?

Accepted Answer

Assign the Portal Group Tag used by the guest portal to the CA-signed wildcard certificate so the portal presents it during the HTTPS session

Answer

Enable the pxGrid usage role on the wildcard certificate and rebind the portal to the pxGrid interface

Answer

Import the wildcard certificate into the Trusted Certificates store on each PSN and enable 'Trust for authentication within ISE'

Answer

Change the guest portal FQDN to match the PSN node hostname so it aligns with the certificate CN

Question 43

A company operates offices in Montreal, Frankfurt, and Tokyo. The security team wants a single self-registered guest portal on ISE that automatically presents the login page, AUP, and notification text in the guest's preferred language based on their browser settings, while also displaying the corporate logo. Which ISE portal configuration approach meets this requirement with the least administrative overhead?

Accepted Answer

Configure a single guest portal and add the required language files under the Portal Page Customization language properties, enabling browser locale detection

Answer

Create three separate guest portals, one per region, and use different portal FQDNs mapped to regional PSNs

Answer

Deploy a single portal but require sponsors to manually select the guest's language when creating each account

Answer

Use the Hotspot portal type since it supports automatic multi-language rendering by default

Question 44

A retail company wants returning guests to authenticate to the guest WiFi only once per device without re-entering credentials on subsequent visits, while still requiring initial credential entry and AUP acceptance. The security team is configuring the Self-Registered Guest Portal on ISE. Which portal setting must be enabled to meet this requirement?

Accepted Answer

Enable the Device Registration setting so the endpoint MAC is added to an endpoint identity group and bypasses credential entry on return visits

Answer

Enable the Hotspot Guest flow so no credentials are ever required

Answer

Increase the guest account duration in the associated Time Profile to 365 days

Answer

Enable BYOD flow so the device is provisioned with a native supplicant profile

Question 45

A retail company uses ISE self-registered guest access. Marketing wants returning guests who registered last month to NOT have to re-register when they visit again this week, but the security team requires that stale guest endpoints be automatically removed after 30 days of inactivity to keep the endpoint database clean. As the ISE administrator, which configuration approach satisfies both requirements?

Accepted Answer

Enable an endpoint purge policy that removes GuestEndpoints inactive for 30 days, and enable device registration so returning devices within that window skip re-registration

Answer

Set the guest account time profile to expire after 30 days, which automatically deletes the registered endpoint and forces re-registration on every return visit

Answer

Configure the Hotspot portal with a 30-day AUP acceptance cache so returning devices are remembered without any endpoint purge policy

Answer

Disable endpoint purge entirely and rely on the sponsor to manually approve each returning guest to prevent stale entries

Question 46

A retail company runs a self-registered guest portal on ISE. Management complains that a single guest account username and password is being shared among many customers, allowing far more devices online than intended. The security team wants each guest account to be usable on no more than two devices at the same time, while still allowing legitimate guests to register normally. Which ISE guest portal configuration should the administrator adjust to enforce this?

Accepted Answer

Set the 'Maximum simultaneous logins' value in the guest type assigned to the portal

Answer

Reduce the account expiration in the associated time profile so accounts expire sooner

Answer

Enable sponsor approval for all self-registered guest accounts

Answer

Configure a purchased-endpoint-based device registration limit on the hotspot portal

Question 47

A retail company has deployed a self-registered guest portal on Cisco ISE. After guests successfully authenticate, the marketing team wants every guest browser to be automatically redirected to the company's promotional landing page (https://promo.retailco.com) rather than back to the URL the guest originally requested. Which guest portal setting must the administrator configure to achieve this behavior?

Accepted Answer

Under Authentication Success Settings, select 'Redirect to the following URL' and enter the promotional landing page address

Answer

Under the portal's Login Page Settings, enable 'Allow guests to change their password'

Answer

Under Portal Settings, change the 'Authentication method' to the sponsor identity source sequence

Answer

Under the Acceptable Use Policy settings, enable 'On first login only' and paste the URL into the AUP text

Question 48

A retail company deploys a self-registered guest portal on ISE. Management requires that guests create their own accounts, but no guest should be able to access the internet until an employee reviews and approves the account. Additionally, the approving employee must be able to see the guest's company name and reason for visit when deciding whether to approve. Which combination of portal settings satisfies all requirements?

Accepted Answer

Enable 'Require self-registered guests to be approved' and add 'Company' and 'Reason for visit' as custom fields on the self-registration page

Answer

Enable 'Allow guests to create their own accounts' only, and rely on the default Time Profile to hold access until expiration

Answer

Configure a Hotspot portal with an AUP and add custom registration fields for 'Company' and 'Reason for visit'

Answer

Enable device registration on the portal and set the endpoint purge policy to require sponsor review before purge

Question 49

A retail company uses ISE self-registered guest access. Management requires that guest accounts automatically become inactive exactly 8 hours after the guest's FIRST successful login, regardless of when the account was created earlier in the day. Which guest Time Profile setting should the administrator configure to meet this requirement?

Accepted Answer

Set the Account Type to 'From first login' with a maximum account duration of 8 hours

Answer

Set the Account Type to 'From creation' with a duration of 8 hours

Answer

Configure a Time Restriction that allows access only during an 8-hour daily window

Answer

Set the endpoint purge policy to remove guest endpoints after 8 hours of inactivity

Question 50

A network engineer deploys Central Web Authentication with a Cisco WLC. After a guest successfully authenticates on the ISE guest portal, the authorization result assigns the endpoint to a different VLAN than the one used during the redirect. Users report that after login, their browsers hang and their sessions eventually time out because the client keeps its original IP address, which is no longer valid on the new VLAN. Which guest portal setting should the engineer enable to resolve this issue?

Accepted Answer

Enable the VLAN DHCP Release option in the guest portal settings

Answer

Increase the guest portal session timeout value to allow the client more time to authenticate

Answer

Disable the Acceptable Use Policy so the redirect completes faster

Answer

Configure a static IP address pool on the WLC for the guest VLAN

Question 51

A retail company uses ISE self-registered guest access. Security requires that guest accounts remain valid only during a visitor's stay and that the sponsor be able to immediately terminate active guest sessions when a visitor leaves early. Which sponsor portal capability must be enabled in the sponsor group settings to meet the requirement of immediately terminating an active guest's network access?

Accepted Answer

Grant the sponsor group the permission to suspend and reinstate guest accounts, which triggers a CoA to disconnect the active session

Answer

Configure a shorter Time Profile so the guest account expires at the end of the day

Answer

Enable the endpoint purge policy to delete the endpoint after 30 days of inactivity

Answer

Set the guest type maximum simultaneous logins to 1 so only one session is active

Question 52

A retail company wants sponsors to create guest accounts at the front desk, but management requires that guest credentials be delivered directly to each visitor's mobile phone rather than being displayed on the sponsor's screen or printed. The sponsor portal is already functional. Which configuration in ISE enables this delivery method?

Accepted Answer

Enable SMS notification on the guest type and configure an SMS gateway (SMTP-to-SMS or supported provider) under Guest Access settings

Answer

Enable device registration on the sponsor portal so guests self-provision credentials on their phones

Answer

Configure a Hotspot guest portal with an AUP so no credentials need to be transmitted

Answer

Set the sponsor portal authentication source to the internal SMS identity store

Question 53

A retail company wants to provide visitors with immediate Internet access from their store WLAN. Business requirements state that guests must NOT be asked to register or enter any username and password, but they MUST accept an Acceptable Use Policy before browsing. Which ISE guest portal type should the administrator deploy to satisfy these requirements?

Accepted Answer

Hotspot Guest Portal

Answer

Self-Registered Guest Portal

Answer

Exam domain	Exam weight	Practice
Architecture and Deployment	10%	Practice this topic
Policy Enforcement	25%	Practice this topic
Web Auth and Guest Services	15%	Practice this topic
Profiler	15%	Practice this topic
BYOD	15%	Practice this topic
Endpoint Compliance	10%	Practice this topic
Network Access Device Administration	10%	Practice this topic

Cisco CCNP Security SISE — Implementing and Configuring Cisco Identity Services Engine (300-715) (300-715) practice exam & study guide

Start studying 300-715

All 300-715 study resources

300-715 exam domains

Sample 300-715 questions

Key 300-715 terms

300-715 frequently asked questions

Architecture and Deployment (10%)

Policy Enforcement (25%)

Web Auth and Guest Services (15%)

Profiler (15%)

BYOD (15%)

Endpoint Compliance (10%)

Network Access Device Administration (10%)