Free Practice Questions for the Cisco CCNP Security 300-715 Exam (2026 Updated)

Refer to the exhibit.

Which two configurations are needed on a catalyst switch for it to be added as a network access device in a Cisco ISE that is being used for 802 1X authentications? (Choose two )

Which use case validates a change of authorization?

An administrator is configuring a new profiling policy within Cisco ISE The organization has several endpoints that are the same device type and all have the same Block ID in their MAC address. The profiler does not currently have a profiling policy created to categorize these endpoints. therefore a custom profiling policy must be created Which condition must the administrator use in order to properly profile an ACME Al Connector endpoint for network access with MAC address < MAC ADDRESS > ?

Which two default endpoint identity groups does Cisco ISE create? (Choose two )

A new employee just connected their workstation to a Cisco IP phone. The network administrator wants to ensure that the Cisco IP phone remains online when the user disconnects their Workstation from the corporate network Which CoA configuration meets this requirement?

An engineer must configure a new authorization policy in Cisco ISE for wireless users. The policy must match a specific SSID name and use standard RADIUS attributes. The Wireless LAN Controller is already configured. Which RADIUS attribute must be configured to meet the requirement?

An engineer must use Cisco ISE profiler services to provide network access to Cisco IP phones that cannot support 802.1X. Cisco ISE is configured to use the access switch device sensor information — system-description and platform-type — to profile Cisco IP phones and allow access.

Which two protocols must be configured on the switch to complete the configuration? (Choose two.)

An employee must access the internet through the corporate network from a new mobile device that does not support native supplicant provisioning provided by Cisco ISE. Which portal must the employee use to provision to the device?

Drag the Cisco ISE node types from the left onto the appropriate purposes on the right.

An organization is migrating its current guest network to Cisco ISE and has 1000 guest users in the current database There are no resources to enter this information into the Cisco ISE database manually. What must be done to accomplish this task effciently?

An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened. From which Cisco ISE persona should this traffic be originating?

Which personas can a Cisco ISE node assume ' ?

What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?

A network engineer is configuring Cisco TrustSec and needs to ensure that the Security Group Tag is being transmitted between two devices Where in the Layer 2 frame should this be verified?

An engineer must deploy a WLAN that supports identity networking. The Cisco Wireless LAN Controller must be configured to apply the VLAN tag for client traffic returned by the RADIUS server. Which configuration parameter on the Cisco Wireless LAN Controller must be enabled to meet the requirement?

There are several devices on a network that are considered critical and need to be placed into the ISE database and a policy used for them. The organization does not want to use profiling. What must be done to accomplish this goal?

A network engineer must create a guest portal for wireless guests on Cisco ISE. The guest users must not be able to create accounts; however, the portal should require a username and password to connect. Which portal type must be created in Cisco ISE to meet the requirements?

What is the maximum number of PSN nodes supported in a medium-sized deployment?

A network administrator is configuring a secondary cisco ISE node from the backup configuration of the primary cisco ISE node to create a high availability pair The Cisco ISE CA certificates and keys must be manually backed up from the primary Cisco ISE and copied into the secondary Cisco ISE Which command most be issued for this to work?

What is needed to configure wireless guest access on the network?

Which advanced option within a WLAN must be enabled to trigger Central Web Authentication for Wireless users on AireOS controller?

What is a requirement for Feed Service to work?

An engineer troubleshoots a new Central Web Authentication guest WLAN on a Cisco AireOS Wireless LAN Controller. Users authenticate through a self-registration portal on Cisco ISE. Guest users report these issues:

• Users can register successfully but are redirected back to the registration page.

• If a user registers, manually disconnects the device, and then reconnects, the user can access the internet.

What must be configured on the Wireless LAN Controller?

An administrator replaced a PSN in the distributed Cisco ISE environment. When endpoints authenticate to it, the devices are not getting the right profiles or attributes and as a result, are not hitting the correct policies. This was working correctly on the previous PSN. Which action must be taken to ensure the endpoints get identified?

An engineer is deploying Cisco ISE in a network that contains an existing Cisco Secure Firewall ASA. The customer requested that Cisco TrustSec be configured so that Cisco ISE and the firewall can share SGT information.

Which protocol must be configured on Cisco ISE to meet the requirement?

Which two default guest portals are available with Cisco ISE? (Choose two.)

An engineer deploys Cisco ISE and must configure Active Directory to then use information from Active Directory in an authorization policy. Which two components must be configured, in addition to Active Directory groups, to achieve this goat? (Choose two )

A Cisco ISE engineer is creating a certificate authentication profile to be used with machine authentication for the network. The engineer wants to be able to compare the user-presented certificate with a certificate stored in Active Directory. What must be done to accomplish this?

An administrator is configuring a Cisco WLC for web authentication Which two client profiling methods are enabled by default if the Apply Cisco ISE Default Settings check box has been selected ' ? (Choose two.)

A network engineer is configuring guest access and notices that when a guest user registers a second device for access, the first device loses access What must be done to ensure that both devices for a particular user are able to access the guest network simultaneously?

A network administrator must configure Cisco SE Personas in the company to share session information via syslog. Which Cisco ISE personas must be added to syslog receivers to accomplish this goal?

A network engineer must enable a profiling probe. The profiling must take details through the Active Directory. Where in the Cisco ISE interface would the engineer enable the probe?

What must match between Cisco ISE and the network access device to successfully authenticate endpoints?

Which two responses from the RADIUS server to NAS are valid during the authentication process? (Choose two)

What is a valid guest portal type?

An engineer is using the low-impact mode for a phased deployment of Cisco ISE and is trying to connect to the network prior to authentication. Which access will be denied in this?

An engineer is enabling a newly configured wireless SSID for tablets and needs visibility into which other types of devices are connecting to it. What must be done on the Cisco WLC to provide this information to Cisco ISE9

Which configuration is required in the Cisco ISE authentication policy to allow Central Web Authentication?

Refer to the exhibit. In which scenario does this switch configuration apply?

An administrator must restrict access to the IP address of an application based on the browser version of the endpoint. Cisco ISE profiling services and guest portal access must be configured to capture the user-agent information of the endpoint from a Cisco switch using the Device Sensor feature. These configurations were performed:

• Added the switch to Cisco ISE

• Configured Device Sensor on the switch

• Enabled Cisco ISE portal access

• Configured the endpoint to connect to the Cisco ISE portal

Which type of probe must be enabled next to complete the configuration?

A network engineer needs to ensure that the access credentials are not exposed during the 802.1x authentication among components. Which two protocols should complete this task?

A policy is being created in order to provide device administration access to the switches on a network. There is a requirement to ensure that if the session is not actively being used, after 10 minutes, it will be disconnected. Which task must be configured in order to meet this requirement?

An adminístrator is migrating device administration access to Cisco ISE from the legacy TACACS+ solution that used only privilege 1 and 15 access levels. The organization requires more granular controls of the privileges and wants to customize access levels 2-5 to correspond with different roles and access needs. Besides defining a new shell profile in Cisco ISE. what must be done to accomplish this configuration?

What does a fully distributed Cisco ISE deployment include?

An organization wants to enable web-based guest access for both employees and visitors The goal is to use a single portal for both user types Which two authentication methods should be used to meet this requirement? (Choose two )

Refer to the exhibit.

An organization recently implemented network device administration using Cisco ISE. Upon testing the ability to access all of the required devices, a user in the Cisco ISE group IT Admins is attempting to login to a device in their organization ' s finance department but is unable to. What is the problem?

An engineer is implementing network access control using Cisco ISE and needs to separate the traffic based on the network device ID and use the IOS device sensor capability. Which probe must be used to accomplish this task?

Which two features must be used on Cisco ISE to enable the TACACS. feature? (Choose two)

An engineer is deploying a new Cisco ISE environment for a company. The company wants the deployment to use TACACS+. The engineer verifies that Cisco ISE has a Device Administration license. What must be configured to enable TACACS+ operations?

An engineer must organize endpoints in a Cisco ISE identity management store to improve the operational management of IP phone endpoints. The endpoints must meet these requirements:

• classify endpoints for finance, sales, and marketing departments

• tag each endpoint as profiled

Which action organizes the endpoints?

What should be considered when configuring certificates for BYOD?

An endpoint certificate is mandatory for the Cisco ISE BYOD

Which CLI command must be configured on the switchport to immediately run the MAB process if a non-802.1X capable endpoint connects to the port?

An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the endpoints on the network. Which node should be used to accomplish this task?

Which default " guest type " is included with Cisco ISE?

Which two external identity stores support EAP-TLS and PEAP-TLS? (Choose two.)

What must be configured on the WLC to configure Central Web Authentication using Cisco ISE and a WLC?

Which port does Cisco ISE use for native supplicant provisioning of a Windows laptop?

Which Cisco ISE deployment model provides redundancy by having every node in the deployment configured with the Administration. Policy Service, and Monitoring personas to protect from a complete node failure?

An engineer is configuring 802.1X and wants it to be transparent from the users ' point of view. The implementation should provide open authentication on the switch ports while providing strong levels of security for non-authenticated devices. Which deployment mode should be used to achieve this?

An engineer must use Cisco ISE to provide network access to endpoints that cannot support 802.1X. The endpoint MAC addresses must be allowlisted by configuring an endpoint identity group. These configurations were performed:

• configured an identity group named allowlist

• configured the endpoints to use the MAC address of incompatible 802.1X devices

• added the endpoints to the allowlist identity group

• configured an authentication policy for MAB users

What must be configured?

An engineer is configuring ISE for network device administration and has devices that support both protocols. What are two benefits of choosing TACACS+ over RADUs for these devices? (Choose two.)

An organization has a fully distributed Cisco ISE deployment When implementing probes, an administrator must scan for unknown endpoints to learn the IP-to-MAC address bindings. The scan is complete on one FPSN. but the information is not available on the others. What must be done to make the information available?

An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port. Which command should be used to accomplish this task?

Which nodes are supported in a distributed Cisco ISE deployment?

What is used by the Certificate Authority to issue a certificate to an endpoint?

Which two external identity stores are supported by Cisco ISE for password types? (Choose two.)

What is the deployment mode when two Cisco ISE nodes are configured in an environment?

An engineer tests Cisco ISE posture services on the network and must configure the compliance module to automatically download and install on endpoints Which action accomplishes this task for VPN users?

An engineer is configuring sponsored guest access and needs to limit each sponsored guest to a maximum of two devices. There are other guest services in production that rely on the default guest types. How should this configuration change be made without disrupting the other guest services currently offering three or more guest devices per user?

Which media type must be used for zero-touch provisioning on a Cisco ISE hardware appliance?

An administrator must configure Cisco ISE to distribute Cisco Secure Client to Windows systems. The solution must meet these requirements:

• Users must install Cisco Secure Client before connecting to the network.

• Endpoints that do not have Cisco Secure Client installed must be redirected to the Client Provisioning Portal.

These configurations were performed:

• Enabled client provisioning

• Uploaded the Cisco Secure Client package

• Downloaded the Cisco Secure Client compliance module

• Created a native supplicant profile

• Created the Cisco Secure Client configuration

• Created the Client Provisioning Portal

• Created an authorization profile for client provisioning

• Configured authorization policies

Which two actions must be performed in Cisco ISE to distribute Cisco Secure Client and complete the configuration? (Choose two.)

An engineer is working with a distributed deployment of Cisco ISE and needs to configure various network probes to collect a set of attributes from the used to accomplish this task?

What service can be enabled on the Cisco ISE node to identity the types of devices connecting to a network?

A network engineer is in the predeployment discovery phase o! a Cisco ISE deployment and must discover the network. There is an existing network management system in the network. Which type of probe must be configured to gather the information?

Which two endpoint compliance statuses are possible? (Choose two.)

What sends the redirect ACL that is configured in the authorization profile back to the Cisco WLC?

Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two).

Which action must be taken before configuring the Secure Client Agent profile when creating the Secure Client configuration for ISE posture services?

A company is attempting to improve their BYOD policies and restrict access based on certain criteria. The company ' s subnets are organized by building. Which attribute should be used in order to gain access based on location?

Which two methods should a sponsor select to create bulk guest accounts from the sponsor portal? (Choose two )

What is a function of client provisioning?

The security team identified a rogue endpoint with MAC address 00:46:91:02:28:4A attached to the network. Which action must security engineer take within Cisco ISE to effectively

restrict network access for this endpoint?

A network administrator must use Cisco ISE to check whether endpoints have the correct version of antivirus installed Which action must be taken to allow this capability?

An engineer is configuring a posture policy for Windows 10 endpoints and wants to ensure that users in each AD group have different conditions to meet to be compliant. What must be done to accomplish this task?

Which two values are compared by the binary comparison (unction in authentication that is based on Active Directory?

An administrator must configure Cisco ISE to send CoA requests to a Cisco switch using SNMP. These configurations were already performed:

enabled SNMP on the switch

added the switch to Cisco ISE

configured a network device profile

configured the NAD port detection method

configured the operation to be performed on the switch port

configured an authorization profile

Which two configurations must be performed to send the CoA requests? (Choose two.)

A network administrator adds network access devices to Cisco ISE. After a security breach, the management team mandates that all network devices must comply with certain standards. All network devices must authenticate through Cisco ISE. Some devices use nondefault CoA ports.

What must be configured in Cisco ISE?

An organization is implementing Cisco ISE posture services and must ensure that a host-based firewall is in place on every Windows and Mac computer that attempts to access the network They have multiple vendors’ firewall applications for their devices, so the engineers creating the policies are unable to use a specific application check in order to validate the posture for this What should be done to enable this type of posture check?

Which two actions must be verified to confirm that the internet is accessible via guest access when configuring a guest portal? (Choose two.)

An engineer must use Cisco ISE to provide network access to endpoints that cannot support 802.1X. The endpoint MAC addresses must be allowlisted by configuring an endpoint identity group. These configurations were performed:

Configured an identity group named allowlist

Configured the endpoints to use the MAC address of incompatible 802.1X devices

Added the endpoints to the allowlist identity group

Configured an authentication policy for MAB users

What must be configured?

Which permission is common to the Active Directory Join and Leave operations?

An administrator is configuring RADIUS on a Cisco switch with a key set to Cisc403012128 but is receiving the error “Authentication failed: 22040 Wrong password or invalid shared secret. “what must be done to address this issue?

Which two events trigger a CoA for an endpoint when CoA is enabled globally for ReAuth? (Choose two.)