Free Cisco 300-715 SISE Practice Questions 2026 Part3

Question #1

A network security engineer needs to configure 802.1X port authentication to allow a single host to be authenticated for data and another single host to be authenticated for voice.Which command should the engineer run on the interface to accomplish this goal?

A. authentication host-mode multi-domain

B. authentication host-mode single-host

C. authentication host-mode multi-auth

D. authentication host-mode multi-host

View answer

Correct Answer: A

Question #2

In a standalone Cisco ISE deployment, which two personas are configured on a node? (Choose two.)

A. ubscriber

B. rimary

C. dministration

D. ublisher

E. olicy service

View answer

Correct Answer: CE

Question #3

Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose two.)

A. ew AD user 802

B. otspot

C. osture

D. uest AUP

E. YOD

View answer

Correct Answer: AC

Question #4

What is an advantage of using EAP-TLS over EAP-MS-CHAPv2 for client authentication?

A. AEAP-TLS uses a username and password for authentication to enhance security, while EAP-MS-CHAPv2 does not

B. BEAP-TLS secures the exchange of credentials, while EAP-MS-CHAPv2 does not

C. CEAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not

D. DEAP-TLS uses multiple forms of authentication, while EAP-MS-CHAPv2 only uses one

View answer

Correct Answer: C

Question #5

An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened.From which Cisco ISE persona should this traffic be originating?

A. administration

B. authentication

C. policy service

D. monitoring

View answer

Correct Answer: C

Question #6

In a Cisco ISE split deployment model, which load is split between the nodes?

A. log collection

B. device admission

C. AAA

D. network admission

View answer

Correct Answer: C

Question #7

In a standalone Cisco ISE deployment, which two personas are configured on a node? (Choose two.)

A. subscriber

B. primary

C. administration

D. publisher

E. policy service

View answer

Correct Answer: CE

Question #8

What is a method for transporting security group tags throughout the network?

A. y embedding the security group tag in the 802

B. y the Security Group Tag Exchange Protocol

C. y enabling 802

D. y embedding the security group tag in the IP header

View answer

Correct Answer: B

Question #9

Which Cisco ISE deployment model is recommended for an enterprise that has over 50,000 concurrent active endpoints?

A. large deployment with fully distributed nodes running all personas

B. medium deployment with primary and secondary PAN/MnT/pxGrid nodes with shared PSNs

C. medium deployment with primary and secondary PAN/MnT/pxGrid nodes with dedicated PSNs

D. small deployment with one primary and one secondary node running all personas

View answer

Correct Answer: C

Question #10

What is a method for transporting security group tags throughout the network?

A. by enabling 802

B. by the Security Group Tag Exchange Protocol

C. by embedding the security group tag in the IP header

D. by embedding the security group tag in the 802

View answer

Correct Answer: B

Question #11

An engineer is assigned to enhance security across the campus network. The task is to enable MAB across all access switches in the network. Which command must be entered on the switch to enable MAB?

A. Switch(config-if)# mab

B. Switch(config)# mab

C. Switch# authentication port-control auto

D. Switch(config)# authentication port-control auto

View answer

Correct Answer: A

Question #12

A network administrator must configure endpoints using an 802.1X authentication method with EAP identity certificates that are provided by the Cisco ISE.When the endpoint presents the identity certificate to Cisco ISE to validate the certificate, endpoints must be authorized to connect to the network.Which EAP type must be configured by the network administrator to complete this task?

A. EAP-TTLS

B. EAP-TLS

C. EAP-FAST

D. EAP-PEAP-MSCHAPv2

View answer

Correct Answer: B

Question #13

Which two values are compared by the binary comparison function in authentication that is based on Active Directory?

A. ser-presented certificate and a certificate stored in Active Directory

B. S-CHAPv2 provided machine credentials and credentials stored in Active Directory

C. ser-presented password hash and a hash stored in Active Directory

D. ubject alternative name and the common name

View answer

Correct Answer: A

Question #14

An adminístrator is migrating device administration access to Cisco ISE from the legacy TACACS+solution that used only privilege 1 and 15 access levels. The organization requires more granular controls of the privileges and wants to customize access levels 2-5 to correspond with different roles and access needs. Besides defining a new shell profile in Cisco ISE. what must be done to accomplish this configuration?

A. Enable the privilege levels in Cisco ISE

B. Enable the privilege levels in the IOS devices

C. Define the command privileges for levels 2-5 in the IOS devices

D. Define the command privileges for levels 2-5 in Cisco ISE

E. Reveal Answer

View answer

Correct Answer: B

Question #15

A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed interface.Which command should be used to accomplish this task?

A. cts role-based policy priority-static

B. cts cache enable

C. cts authorization list

D. cts role-based enforcement

View answer

Correct Answer: D

Question #16

What are two differences of TACACS+ compared to RADIUS? (Choose two.)

A. TACACS+ uses a connectionless transport protocol, whereas RADIUS uses a connection-oriented transport protocol

B. TACACS+ encrypts the full packet payload, whereas RADIUS only encrypts the password

C. TACACS+ only encrypts the password, whereas RADIUS encrypts the full packet payload

D. TACACS+ uses a connection-oriented transport protocol, whereas RADIUS uses a connectionless transport protocol

E. TACACS+ supports multiple sessions per user, whereas RADIUS supports one session per user

View answer

Correct Answer: BD

Question #17

How is policy services node redundancy achieved in a deployment?

A. y enabling VIP

B. y utilizing RADIUS server list on the NAD

C. y creating a node group

D. y deploying both primary and secondary node

View answer

Correct Answer: C

Question #18

What must match between Cisco ISE and the network access device to successfully authenticate endpoints?

A. SNMP version

B. shared secret

C. certificate

D. profile

E. Reveal Answer

View answer

Correct Answer: B

Question #19

A network engineer is configuring Cisco TrustSec and needs to ensure that the Security Group Tag is being transmitted between two devices.Where in the Layer 2 frame should this be verified?

A. payload

B. 802

C. CMD field

D. 802

View answer

Correct Answer: C

Question #20

What happens when an internal user is configured with an external identity store for authentication, but an engineer uses the Cisco ISE admin portal to select an internal identity store as the identity source?

A. Authentication is redirected to the internal identity source

B. Authentication is granted

C. Authentication fails

D. Authentication is redirected to the external identity source

View answer

Correct Answer: C

Question #21

An engineer is implementing Cisco ISE and needs to configure 802.1X. The port settings are configured for port-based authentication.Which command should be used to complete this configuration?

A. aa authentication dot1x default group radius

B. ot1x system-auth-control

C. uthentication port-control auto

D. ot1x pae authenticator

View answer

Correct Answer: B

Question #22

Which two ports must be open between Cisco ISE and the client when you configure posture on Cisco ISE? (Choose two).

A. TCP 8443

B. TCP 8906

C. TCP 443

D. TCP 80

E. TCP 8905

View answer

Correct Answer: AE

Question #23

Which personas can a Cisco ISE node assume?

A. olicy service, gatekeeping, and monitoring

B. dministration, monitoring, and gatekeeping

C. dministration, policy service, and monitoring

D. dministration, policy service, gatekeeping

View answer

Correct Answer: C

Question #24

Which two Cisco ISE deployment models require two nodes configured with dedicated PAN and MnT personas? (Choose two.)

A. seven PSN nodes with one PxGrid node

B. two PSN nodes with one PxGrid node

C. five PSN nodes with one PxGrid node

D. six PSN nodes

E. three PSN nodes

View answer

Correct Answer: BE

Question #25

A network security engineer needs to configure 802.1X port authentication to allow a single host to be authenticated for data and another single host to be authenticated for voice.Which command should the engineer run on the interface to accomplish this goal?

A. authentication host-mode multi-domain

B. authentication host-mode single-host

C. authentication host-mode multi-auth

D. authentication host-mode multi-host

View answer

Correct Answer: A

Question #26

Which two probes must be enabled for the ARP cache to function in the Cisco ISE profile service sothat a user can reliably bind the IP address and MAC addresses of endpoints? (Choose two.)

A. etFlow

B. NMP

C. TTP

D. HCP

E. ADIUS

View answer

Correct Answer: DE

Question #27

An administrator connects an HP printer to a dot1x enable port, but the printer is nor accessible.Which feature must the administrator enable to access the printer?

A. change of authorization

B. MAC authentication bypass

C. TACACS authentication

D. RADIUS authentication

View answer

Correct Answer: B

Question #28

Which file extension is required when deploying Cisco ISE using a ZTP configuration file in Microsoft Hyper-V?

A.

B.

C.

D.

View answer

Correct Answer: D

Question #29

What are two requirements of generating a single certificate in Cisco ISE by using a certificate provisioning portal, without generating a certificate signing request? (Choose two.)

A. Enter the IP address of the device

B. Enter the common name

C. Choose the hashing method

D. Locate the CSV file for the device MAC

E. Select the certificate template

View answer

Correct Answer: BE

Question #30

An engineer wants to ease the management of endpoint identity groups from the Cisco ISE GUI. From the Identity Management menu in Cisco ISE, the engineer must be able to list the endpoint identity groups with a name that contains Android.Which task must the engineer perform?

A. Create and save a quick filter with name equals Android as the criteria

B. Create an identity group named Android and set the parent group to profiled

C. Create and save an advanced filter with name equals Android as the criteria

D. Create an identity group named Android and populate the group with Android devices only

View answer

Correct Answer: C

Question #31

A network engineer is configuring Cisco TrustSec and needs to ensure that the Security Group Tag is being transmitted between two devices.Where in the Layer 2 frame should this be verified?

A. ayload

B. 02

C. MD field

D. 02

View answer

Correct Answer: C

Question #32

A network engineer must configure a centralized Cisco ISE solution for wireless guest access with users in different time zones. The guest account activation time must be independent of the user time zone, and the guest account must be enabled automatically when the user self-registers on the guest portal.Which option in the time profile settings must be selected to meet the requirement?

A. Select FromFirstLogin from the Account Type dropdown

B. Select FromCreation from the Account Type dropdown

C. Set the Maximum Account Duration to 1 Day

D. Set the Duration field to 24:00:00

View answer

Correct Answer: A

Question #33

An administrator must onboard MacOS endpoints that connect to Cisco switches using the BYOD portal in Cisco ISE. The authentication method must be configured to meet these requirements:- Cisco ISE identifies itself by providing its identity certificate tothe endpoint.- The endpoint validates the Cisco ISE identity certificate.- The endpoint provides its endpoint identity certificate, signed byCisco ISE, to Cisco ISE.- Cisco ISE confirms the endpoint certificate validity, and theendpoint is authorized onto the network.Which protocol must be configured?

A. AP-GTC

B. AP-TTLS

C. AP-FAST

D. AP-TLS

View answer

Correct Answer: D

Question #34

What does a fully distributed Cisco ISE deployment include?

A. PAN and MnT on the same node while PSNs are on their own dedicated nodes

B. All Cisco ISE personas are sharing the same node

C. All Cisco ISE personas on their own dedicated nodes

D. PAN and PSN on the same node while MnTs are on their own dedicated nodes

View answer

Correct Answer: C

Question #35

Which are two characteristics of TACACS+? (Choose two ) ,

A. It uses TCP port 49

B. It combines authorization and authentication functions

C. It separates authorization and authentication functions

D. It encrypts the password only

E. It uses UDP port 49

View answer

Correct Answer: AC

Question #36

Which supplicant(s) and server(s) are capable of supporting EAP-CHAINING?

A. Cisco Secure Services Client and Cisco Access Control Server

B. Cisco AnyConnect NAM and Cisco Identity Service Engine

C. Cisco AnyConnect NAM and Cisco Access Control Server

D. Windows Native Supplicant and Cisco Identity Service Engine

View answer

Correct Answer: B

Question #37

When configuring Active Directory groups, what does the Cisco ISE use to resolve ambiguous group names?

A. MIB

B. SID

C. MAB

D. TGT

View answer

Correct Answer: B

Question #38

Which supplicant(s) and server(s) are capable of supporting EAP-CHAINING?

A. isco Secure Services Client and Cisco Access Control Server

B. isco AnyConnect NAM and Cisco Identity Service Engine

C. isco AnyConnect NAM and Cisco Access Control Server

D. indows Native Supplicant and Cisco Identity Service Engine

View answer

Correct Answer: B

Question #39

In a Cisco ISE split deployment model, which load is split between the nodes?

A. AAA

B. network admission

C. log collection

D. device admission

E. Reveal Answer

View answer

Correct Answer: A

Question #40

An engineer is configuring a guest password policy and needs to ensure that the password complexity requirements are set to mitigate brute force attacks. Which two requirement complete this policy? (Choose two)

A. Aminimum password length

B. Bactive username limit

C. Caccess code control

D. Dgpassword expiration period

E. Eusername expiration date

View answer

Correct Answer: AD

Question #41

Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?

A. session-timeout

B. termination-action

C. radius-server timeout

D. idle-timeout

View answer

Correct Answer: D

Question #42

An engineer is configuring a virtual Cisco ISE deployment and needs each persona to be on a different node.Which persona should be configured with the largest amount of storage in this environment?

A. Monitoring and Troubleshooting

B. Policy Services

C. Primary Administration

D. Platform Exchange Grid

View answer

Correct Answer: A

Question #43

An administrator is configuring new probes to use with Cisco ISE and wants to use metadata to help profile the endpoints. The metadata must contain traffic information relating to the endpoints instead of industry-standard protocol information Which probe should be enabled to meet these requirements?

A. NetFlow probe

B. DNS probe

C. DHCP probe

D. SNMP query probe

View answer

Correct Answer: C

Question #44

Which permission is common to the Active Directory Join and Leave operations?

A. Remove the Cisco ISE machine account from the domain

B. Search Active Directory to see if a Cisco ISE machine account already exists

C. Set attributes on the Cisco ISE machine account

D. Create a Cisco ISE machine account in the domain if the machine account does not already exist

View answer

Correct Answer: B

Question #45

What are two requirements of generating a single certificate in Cisco ISE by using a certificate provisioning portal, without generating a certificate signing request?(Choose two.)

A. nter the IP address of the device

B. nter the common name

C. hoose the hashing method

D. ocate the CSV file for the device MAC

E. elect the certificate template

View answer

Correct Answer: BE

Question #46

Which two fields are available when creating an endpoint on the context visibility page of Cisco ISE? (Choose two.)

A. Security Group Tag

B. Endpoint Family

C. Policy Assignment

D. Identity Group Assignment

E. IP Address

View answer

Correct Answer: CD

Question #47

An administrator is configuring TACACS+ on a Cisco switch but cannot authenticate users with Cisco ISE. The configuration contains the correct key of Cisc039712287. but the switch is not receiving a response from the Cisco ISE instance What must be done to validate the AAA configuration and identify the problem with the TACACS+ servers?

A. Check for server reachability using the test aaa group tacacs+ adminlegacy command

B. Test the user account on the server using the test aaa group radius server CUCS user admin passlegacy command

C. Validate that the key value is correct using the test aaa authentication adminlegacy command

D. Confirm the authorization policies are correct using the test aaa authorization admin drop legacy command

E. Reveal Answer

View answer

Correct Answer: A

Question #48

Which types of design are required in the Cisco ISE ATP program?

A. igh-level and low-level designs

B. reliminary and final

C. chematic and detailed

D. op down and bottom up

View answer

Correct Answer: A

Question #49

A network administrator is configuring client provisioning resource policies for client machines and must ensure that an agent pop-up is presented to the client when attempting to connect to the network Which configuration item needs to be added to allow for this'?

A. Athe client provisioning URL in the authorization policy

B. Ba temporal agent that gets installed onto the system

C. Ca remote posture agent proxying the network connection

D. Dan API connection back to the client

View answer

Correct Answer: C

Question #50

An engineer must configure an HTTP probe on a Cisco ISE virtual appliance running on VMWare using a dedicated interface for profiling. The interface is assigned to the VM Network port group. The engineer is logged into the hypervisor with a user account that only provides access to the Cisco ISE VM and the network settings for the VM.Which security setting must be changed for this interface to accept SPAN traffic?

A. Set Promiscuous mode to inherit from vSwitch in the Port Group properties

B. Set Promiscuous mode to inherit from Port Group in the vSwitch properties

C. Set Promiscuous mode to Accept in the Port Group properties

D. Set Promiscuous mode to Accept in the vSwitch properties

View answer

Correct Answer: C

Question #51

An engineer is configuring web authentication using non-standard ports and needs the switch to redirect traffic to the correct port. Which command should be used to accomplish this task?

A. permit tcp any any eq

B. aaa group server radius proxy

C. IP http port

D. aaa group server radius

View answer

Correct Answer: A

Question #52

What is a method for transporting security group tags throughout the network?

A. by embedding the security group tag in the 802

B. by the Security Group Tag Exchange Protocol

C. by enabling 802

D. by embedding the security group tag in the IP header

View answer

Correct Answer: B

Question #53

Refer to the exhibit.Which switch configuration change will allow only one voice and one data endpoint on each port?

A. auto to manual

B. mab to dot1x

C. multi-auth to multi-domain

D. multi-auth to single-auth

View answer

Correct Answer: C

Question #54

A network engineer must enforce access control using special tags, without re-engineering the network design.Which feature should be configured to achieve this in a scalable manner?

A. RBAC

B. dACL

C. SGT

D. VLAN

View answer

Correct Answer: C

Question #55

Which profiling probe collects the user - agent string?

A. DHCP

B. AD

C. HTTP

D. NMAP

View answer

Correct Answer: C

Question #56

A network security engineer needs to configure 802.1X port authentication to allow a single host to be authenticated for data and another single host to be authenticated for voice.Which command should the engineer run on the interface to accomplish this goal?

A. authentication host-mode multi-domain

B. authentication host-mode single-host

C. authentication host-mode multi-auth

D. authentication host-mode multi-host

View answer

Correct Answer: A

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free Cisco 300-715 SISE Practice Questions 2026 Part3

View The Updated 300-715 Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free Cisco 300-715 SISE Practice Questions 2026 Part3

View The Updated 300-715 Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now