[UPDATED 2026] Free Cisco 300-715 Exam Questions Self-Assess Preparation [Q55-Q70]

5/5 - (1 vote)

[UPDATED 2026] Free Cisco 300-715 Exam Questions Self-Assess Preparation

300-715 Free Sample Questions to Practice One Year Update

For more info about Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Cisco 300-715 exam covers a wide range of topics related to Cisco ISE implementation and configuration, including network access devices, user and device authentication, endpoint compliance, and policy enforcement. It also covers the latest Cisco ISE features and capabilities, such as integration with third-party products and technologies, threat protection, and advanced analytics and reporting.

Cisco 300-715 exam is a challenging certification exam that validates your skills and knowledge in implementing and configuring Cisco ISE solutions. It is an essential certification for IT professionals who specialize in network security and want to advance their careers. By passing the exam, you demonstrate your proficiency in securing network access, managing devices, and enforcing policies using Cisco ISE.

NO.55 Which two values are compared by the binary comparison function in authentication that is based on Active Directory?

user-presented certificate and a certificate stored in Active Directory

MS-CHAPv2 provided machine credentials and credentials stored in Active Directory

user-presented password hash and a hash stored in Active Directory

subject alternative name and the common name

Section: Policy Enforcement
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/ISE-ADIntegrationDoc/b_ISE- ADIntegration.html

NO.56 An administrator must configure Cisco ISE to send CoA requests to a Cisco switch using SNMP. These configurations were already performed:
enabled SNMP on the switch
added the switch to Cisco ISE
configured a network device profile
configured the NAD port detection method
configured the operation to be performed on the switch port
configured an authorization profile
Which two configurations must be performed to send the CoA requests? (Choose two.)

Select the CoA type as SNMP in the network device profile.

Configure the SNMP server in Cisco ISE.

Configure SNMP authentication in Cisco ISE.

Configure a network device group.

Configure the switch SNMP settings of the NAD.

NO.57 An administrator wants to configure network device administration and is trying to decide whether to use TACACS* or RADIUS. A reliable protocol must be used that can check command authorization Which protocol meets these requirements and why?

TACACS+ because it runs over TCP

RADIUS because it runs over UDP

RADIUS because it runs over TCP.

TACACS+ because it runs over UDP

NO.58 What is the difference between how RADIUS and TACACS+ handle encryption?

RADIUS encrypts the entire packet, whereas TACACS+ encrypts only the username and password fields.

RADIUS encrypts the entire packet, whereas TACACS+ only encrypts the password field.

RADIUS only encrypts the password field, whereas TACACS+ encrypts the payload of the packet.

RADIUS encrypts only the username and password fields, whereas TACACS+ encrypts the entire packet.

NO.59 An engineer must configure an HTTP probe on a Cisco ISE virtual appliance running on VMWare using a dedicated interface for profiling. The interface is assigned to the VM Network port group.
The engineer is logged into the hypervisor with a user account that only provides access to the Cisco ISE VM and the network settings for the VM. Which security setting must be changed for this interface to accept SPAN traffic?

Set Promiscuous mode to inherit from vSwitch in the Port Group properties.

Set Promiscuous mode to inherit from Port Group in the vSwitch properties.

Set Promiscuous mode to Accept in the Port Group properties.

Set Promiscuous mode to Accept in the vSwitch properties.

NO.60 An engineer is configuring a guest password policy and needs to ensure that the password complexity requirements are set to mitigate brute force attacks. Which two requirement complete this policy? (Choose two)

minimum password length

active username limit

access code control

password expiration period

username expiration date

NO.61 In a standalone Cisco ISE deployment, which two personas are configured on a node? (Choose two.)

subscriber

primary

administration

publisher

policy service

Section: Architecture and Deployment

NO.62 An administrator is migrating device administration access to Cisco ISE from the legacy TACACS+ solution that used only privilege 1 and 15 access levels. The organization requires more granular controls of the privileges and wants to customize access levels 2-5 to correspond with different roles and access needs. Besides defining a new shell profile in Cisco ISE. what must be done to accomplish this configuration?

Enable the privilege levels in Cisco ISE

Enable the privilege levels in the IOS devices.

Define the command privileges for levels 2-5 in the IOS devices

Define the command privileges for levels 2-5 in Cisco ISE

NO.63 A network engineer is in the predeployment discovery phase of a Cisco ISE deployment and must discover the network. There is an existing network management system for network monitoring.
Which type of probe must be configured to gather the information?

NMAP

RADIUS

SNMP

NetFlow

When there’s an existing network management system (NMS) already doing network monitoring, the appropriate ISE probe is SNMP – specifically the SNMP Query probe, which allows ISE to query network devices (switches, WLCs) to gather endpoint information such as MAC addresses, connected ports, and VLAN data.
SNMP integrates naturally with an existing NMS infrastructure during the discovery phase. The other options are distractors: NMAP is active scanning, RADIUS requires authentication events to already be flowing, and NetFlow is for traffic analysis rather than endpoint discovery.

NO.64 An engineer must configure web redirection for guests to a portal where no authentication is required and an Acceptable Use Policy must be accepted by the guest before network access is allowed. Which type of guest portal must be configured in Cisco ISE to meet the requirement?

Sponsored

Self Registered

Hotspot

Custom

NO.65 An engineer is configuring a new Cisco ISE node. The Device Admin service must run on this node to handle authentication requests for network-device access through TACACS+. Which persona must be enabled on this node to perform this function?

Monitoring

Policy Service

Administration

pxGrid

The Policy Service persona must be enabled because the Policy Service Node processes authentication, authorization, and accounting requests, including TACACS+ requests handled by the Device Administration service. When a network administrator signs in to a router, switch, firewall, or wireless controller, the network device forwards the TACACS+ request to an ISE node on which Device Administration is enabled. That node evaluates the applicable device-administration policy set, identity source, command set, and TACACS+ shell profile. The Administration persona provides the management interface and maintains deployment-wide configuration but does not independently process endpoint or device-administration authentication requests. The Monitoring persona collects operational data, logs, reports, and troubleshooting information. The pxGrid persona publishes and exchanges contextual information with integrated security platforms. Therefore, the Device Admin service must operate on a Policy Service Node.

NO.66 Which RADIUS attribute is used to dynamically assign the Inactivity active timer for MAB users from the Cisco ISE node?

session-timeout

termination-action

radius-server timeout

idle-timeout

Section: Policy Enforcement

NO.67 An engineer is configuring web authentication and needs to allow specific protocols to permit DNS traffic.
Which type of access list should be used for this configuration?

reflexive ACL

extended ACL

standard ACL

numbered ACL

NO.68 Which supplicant(s) and server(s) are capable of supporting EAP-CHAINING?

Cisco Secure Services Client and Cisco Access Control Server

Cisco AnyConnect NAM and Cisco Identity Service Engine

Cisco AnyConnect NAM and Cisco Access Control Server

Windows Native Supplicant and Cisco Identity Service Engine

Section: Architecture and Deployment
Explanation/Reference: https://www.cisco.com/c/en/us/support/docs/wireless-mobility/eap-fast/200322-Understanding- EAP-FAST-and-Chaining-imp.html

NO.69 An engineer is configuring a new Cisco ISE node. Context-sensitive information must be shared between the Cisco ISE and a Cisco ASA. Which persona must be enabled?

Administration

Policy Service

pxGrid

Monitoring

NO.70 Drag and drop the description from the left onto the protocol on the right that is used to carry out system authentication, authentication, and accounting.

Loading …

Real exam questions are provided for CCNP Security tests, which can make sure you 100% pass: https://www.braindumpstudy.com/300-715_braindumps.html