[Q39-Q59] 300-715 Certification – The Ultimate Guide [Updated 2026]

Rate this post

300-715 Certification – The Ultimate Guide [Updated 2026]

300-715 Practice Exam and Study Guides – Verified By TrainingQuiz

Cisco 300-715 Exam Syllabus Topics:

Section	Objectives
Topic 1: Profiling Services	– Profiling policies and conditions – Endpoint profiling and probes
Topic 2: Policy Enforcement	– Policy sets and conditions – Authentication and authorization policies
Topic 3: Bring Your Own Device (BYOD)	– Certificate provisioning – Device onboarding workflows
Topic 4: pxGrid and External Integration	– Third-party integrations – pxGrid architecture
Topic 5: Cisco ISE Architecture and Deployment	– Deployment planning and scalability – Node roles and deployment models
Topic 6: Web Authentication and Guest Access	– Guest lifecycle management – CWA (Central Web Authentication)
Topic 7: Monitoring, Logging, and Troubleshooting	– Logging and reports – Troubleshooting authentication and policy issues
Topic 8: Posture Services	– Remediation and enforcement actions – Posture agents and compliance checks

Q39. Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.

Explanation

Monitoring = provides advanced monitoring and troubleshooting tools that you can use to effectively manage your network and resources Policy Service = provides network access, posture, guest access, client provisioning, and profiling services.
This persona evaluates the policies and makes all the decisions.
Administration = manages all system-related configuration and configurations that relate to functionality such as authentication, authorization, auditing, and so on pxGrid = shares context-sensitive information from Cisco ISE to subscribers
https://www.cisco.com/c/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide

Q40. An engineer is assigned to enhance security across the campus network. The task is to enable MAB across all access switches in the network. Which command must be entered on the switch to enable MAB?

Switch(config)# authentication port-control auto

Switch(config)# mab

Switch# authentication port-control auto

Switch(config-if)# mab

The MAC Authentication Bypass (MAB) feature allows devices that do not support 802.1X (such as legacy or IoT devices) to be authenticated based on their MAC address. To enable MAB on an access switch port, the mabcommand must be entered in interface configuration mode.
This enables MAB on the specific interface. When a device connects to the port, the switch checks its MAC address against the Cisco ISE or RADIUS server for authentication.

Q41. A network administrator is setting up wireless guest access and has been unsuccessful in testing client access.
The endpoint is able to connect to the SSID but is unable to grant access to the guest network through the guest portal. What must be done to identify the problem?

Use context visibility to verify posture status.

Use the endpoint ID to execute a session trace.

Use the identity group to validate the authorization rules.

Use traceroute to ensure connectivity.

Explanation
https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide

Q42. Which command displays all 802.1X/MAB sessions that are active on the switch ports of a Cisco Catalyst switch?

show authentication sessions interface Gi1/0/x output

show authentication sessions

show authentication sessions output

show authentication sessions interface Gi 1/0/x

Section: Policy Enforcement
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-xe-3se-3850-cr-book/sec-s1- xe-3se-3850-cr-book_chapter_01.html#wp3404908137

Q43. An employee logs on to the My Devices portal and marks a currently on-boarded device as ‘Lost’.
Which two actions occur within Cisco ISE as a result oí this action? (Choose two)

Certificates provisioned to the device are not revoked

BYOD Registration status is updated to No

The device access has been denied

BYOD Registration status is updated to Unknown.

The device status is updated to Stolen

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01111.html

Q44. A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed interface.
Which command should be used to accomplish this task?

cts role-based policy priority-static

cts cache enable

cts authorization list

cts role-based enforcement

Section: Architecture and Deployment

Q45. An employee logs on to the My Devices portal and marks a currently on-boarded device as ‘Lost’.
Which two actions occur within Cisco ISE as a result of this action? (Choose two)

Certificates provisioned to the device are not revoked

BYOD Registration status is updated to No

The device access has been denied

BYOD Registration status is updated to Unknown.

The device status is updated to Stolen

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22
/b_ise_admin_guide_22_chapter_01111.html

Q46. An organization wants to standardize the 802 1X configuration on their switches and remove static ACLs on the switch ports while allowing Cisco ISE to communicate to the switch what access to provide What must be configured to accomplish this task?

security group tag within the authorization policy

extended access-list on the switch for the client

port security on the switch based on the client’s information

dynamic access list within the authorization profile

Reference:
https://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_sga_pol.html#

Q47.

Refer to the exhibit. An engineer must configure BYOD in Cisco ISE. A single SSID must be used to allow BYOD devices to connect to the network. These configurations have been performed on Wireless LAN Controller already:
RADIUS server
BYOD-Dot1x SSID
Which two configurations must be done in Cisco ISE to meet the requirement? (Choose two.)

FlexConnect ACL

External identity source

Authentication policy

Redirect ACL

Profiling policy

Q48. Which two values are compared by the binary comparison (unction in authentication that is based on Active Directory?

subject alternative name and the common name

MS-CHAPv2 provided machine credentials and credentials stored in Active Directory

user-presented password hash and a hash stored in Active Directory

user-presented certificate and a certificate stored in Active Directory

Basic certificate checking does not require an identity source. If you want binary comparison checking for the certificates, you must select an identity source. If you select Active Directory as an identity source, subject and common name and subject alternative name (all values) can be used to look up a user. https://www.cisco.
com/c/en/us/td/docs/security/ise/1-3/admin_guide/b_ise_admin_guide_13/
b_ise_admin_guide_sample_chapter_01110.html

Q49. A network administrator has just added a front desk receptionist account to the Cisco ISE Guest Service sponsor group.
Using the Cisco ISE Guest Sponsor Portal, which guest services can the receptionist provide?

Keep track of guest user activities.

Create and manage guest user accounts.

Configure authorization settings for guest users.

Authenticate guest users to Cisco ISE.

Section: Web Auth and Guest Services

Q50. An engineer is configuring 802.1X and wants it to be transparent from the users’ point of view. The implementation should provide open authentication on the switch ports while providing strong levels of security for non-authenticated devices. Which deployment mode should be used to achieve this?

closed

low-impact

open

high-impact

https://www.lookingpoint.com/blog/cisco-ise-wired-802.1x-deployment-monitormode#:~:text=Low%
20impact%20mode%20works%20similar,DHCP%2C%20PXE%20boot%2C%20etc.

Q51. A network engineer must configure a centralized Cisco ISE solution for wireless guest access with users in different time zones. The guest account activation time must be independent of the user time zone, and the guest account must be enabled automatically when the user self-registers on the guest portal. Which option in the time profile settings must be selected to meet the requirement?

Select FromFirstLogin from the Account Type dropdown.

Select FromCreation from the Account Type dropdown.

Set the Maximum Account Duration to 1 Day.

Set the Duration field to 24:00:00.

Q52. An employee logs on to the My Devices portal and marks a currently on-boarded device as ‘Lost’.
Which two actions occur within Cisco ISE as a result or this action? (Choose two)

Certificates provisioned to the device are not revoked

BYOD Registration status is updated to No

The device access has been denied

BYOD Registration status is updated to Unknown.

The device status is updated to Stolen

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01111.html

Q53. A company manager is hosting a conference. Conference participants must connect to an open guest SSID and only use a preassigned code that they enter into the guest portal prior to gaining access to the network. How should the manager configure Cisco ISE to accomplish this goal?

Create entries in the guest identity group for all participants.

Create an access code to be entered in the AUP page.

Create logins for each participant to give them sponsored access.

Create a registration code to be entered on the portal splash page.

Access code: Optional. Applies to guests using the Hotspot Guest and Credentialed Guest portals. An access code is primarily a locally known code that is given to physically present guests (either visually via a whiteboard or verbally by a lobby ambassador). It would not be known and used by someone outside the premises to gain access to the network. If the Access code setting is enabled:
*** Sponsored guests are prompted to enter it on the Login page (along with a username and password).
*** Guests using the Hotspot Guest portal are prompted to enter it on the Acceptable Use Policy (AUP) page.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-
6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_guest.html#concept_BAD85F54F1B94
04B9913DC050D8D5B1D

Q54. A network administrator must restrict sponsor account privileges for managing guest accounts on Cisco ISE for a new account that is being created. Sponsor groups currently exist for each business unit. The new sponsor that is being added must be restricted to only managing guest accounts created by sponsors from the same sponsor group. In which group must the new sponsor account be configured?

GROUP_ACCOUNTS

OWN_ACCOUNTS

ALL_ ACCOUNTS

ALL_EMPLOYEES

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215931-ise-guest- account-management.html

Q55. Which personas can a Cisco ISE node assume’?

policy service, gatekeeping, and monitoring

administration, policy service, and monitoring

administration, policy service, gatekeeping

administration, monitoring, and gatekeeping

Reference:
https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html The persona or personas of a node determine the services provided by a node. An ISE node can assume any or all of the following personas: Administration, Policy Service, and Monitoring. The menu options that are available through the administrative user interface are dependent on the role and personas that an ISE node assumes. See Cisco ISE Nodes and Available Menu Options for more information.

Q56. A network engineer must enforce access control using special tags, without re-engineering the network design. Which feature should be configured to achieve this in a scalable manner?

SGT

dACL

VLAN

RBAC

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/trustsec/branch- segmentation.pdf

Q57. Drag and drop the configuration steps from the left into the sequence on the right to install two Cisco ISE nodes in a distributed deployment.

Q58. A user is attempting to register a BYOD device to the Cisco ISE deployment but needs to use the onboarding policy to request a digital certificate and provision the endpoint. What must be configured to accomplish this task?

The BYOD flow to ensure that the endpoint is provisioned prior to registering.

The Cisco Secure Client provisioning policy to provision the endpoint for onboarding.

A native supplicant provisioning policy to redirect the user to the BYOD portal for onboarding.

The posture provisioning policy to give the endpoint the required components prior to registering.

Q59. An engineer wants to preselect AD groups to be used in the access policy after integrating Cisco ISE with an active directory. Which configuration steps must the engineer take to assign groups to the AD on the identity management page?

external identity sources > active directory > groups

user identity groups > groups

external identity sources > groups > active directory

groups > user identity groups

Loading …