Free Cisco 300-715 SISE practice questions

10 free Cisco 300-715 SISE practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 407 questions. Work through them, then open each answer to check your reasoning.

Get all 407 questions (US$39) · Download these 10 as a PDF

Question 1

Which personas can a Cisco ISE node assume?

  1. policy service, gatekeeping, and monitoring
  2. administration, monitoring, and gatekeeping
  3. administration, policy service, and monitoring
  4. administration, policy service, gatekeeping
Show answer and explanation

Correct answer: C. administration, policy service, and monitoring

A Cisco ISE node can assume the Administration, Monitoring, and Policy Service personas. Administration handles configuration and database replication, Monitoring collects logs and generates reports, and Policy Service performs authentication, authorization, profiling, and posture. pxGrid is an additional persona used for context sharing.

Why the other options are wrong

  • A. Gatekeeping is not a Cisco ISE persona, and administration is missing from this set.
  • B. Gatekeeping is not a Cisco ISE persona, and policy service is missing from this set.
  • D. Gatekeeping is not a Cisco ISE persona; monitoring is the third persona a node can run.

Question 2

What occurs when a Cisco ISE distributed deployment has two nodes and the secondary node is deregistered?

  1. The secondary node restarts.
  2. The primary node restarts.
  3. Both nodes restart.
  4. The primary node becomes standalone.
Show answer and explanation

Correct answer: D. The primary node becomes standalone.

Deregistering the only secondary node from a two-node deployment leaves a single node, so the primary automatically reverts to standalone mode and again handles all personas by itself.

Why the other options are wrong

  • A. The secondary is simply removed from the deployment; the question asks about the resulting state of the remaining node.
  • B. The primary keeps running; only its role changes, to standalone.
  • C. Nothing in this deregistration forces both nodes to restart.

Question 3

Which two features are available when the primary admin node is down and the secondary admin node has not been promoted? (Choose two.)

  1. new AD user 802.1X authentication
  2. hotspot
  3. posture
  4. guest AUP
  5. BYOD
Show answer and explanation

Correct answer: A, C

A. new AD user 802.1X authentication C. posture With the primary admin node down and no secondary promoted, Policy Service nodes continue to authenticate and authorize endpoints, so new AD user 802.1X authentication and posture assessment still work. Features that must write to the PAN database, such as hotspot, guest AUP acceptance, and BYOD registration, are unavailable until a PAN is restored or promoted.

Why the other options are wrong

  • B. Hotspot acceptance writes endpoint data to the PAN database, so it fails during a PAN outage.
  • D. Guest AUP acceptance requires a database write to the PAN and cannot complete.
  • E. BYOD registration writes endpoint and certificate data to the PAN and is unavailable.

Question 4

Which supplicant(s) and server(s) are capable of supporting EAP-CHAINING?

  1. Cisco Secure Services Client and Cisco Access Control Server
  2. Cisco AnyConnect NAM and Cisco Identity Service Engine
  3. Cisco AnyConnect NAM and Cisco Access Control Server
  4. Windows Native Supplicant and Cisco Identity Service Engine
Show answer and explanation

Correct answer: B. Cisco AnyConnect NAM and Cisco Identity Service Engine

Engine Cisco AnyConnect NAM (Network Access Manager) supplicant and Cisco Identity Service Engine server are the components capable of supporting EAP-CHAINING. This feature allows multiple EAP methods to be chained together in a single authentication exchange, and only these specific Cisco products provide this functionality.

Why the other options are wrong

  • A. Cisco Secure Services Client does not support EAP-CHAINING; Cisco Access Control Server is not the correct server component.
  • C. Cisco Access Control Server does not support EAP-CHAINING; ISE is the correct server for this feature.
  • D. Windows Native Supplicant does not support EAP-CHAINING; while ISE is correct, the supplicant component is incorrect.

Question 5

What is a requirement for Feed Service to work?

  1. TCP port 8080 must be opened between Cisco ISE and the feed server.
  2. Cisco ISE has access to an internal server to download feed update.
  3. Cisco ISE has a base license.
  4. Cisco ISE has Internet access to download feed update.
Show answer and explanation

Correct answer: D. Cisco ISE has Internet access to download feed update.

Feed Service requires Cisco ISE to reach the Cisco feed server on the Internet. The Profiler Feed Service downloads new and updated endpoint profiling policies and OUI data from Cisco so that profiling stays current.

Why the other options are wrong

  • A. Port 8080 is not used; ISE reaches feedservice.cisco.com outbound over TCP 8443.
  • B. The profiler feed is hosted by Cisco and retrieved over the Internet, not from an internal server.
  • C. Licensing alone does not enable the download; reachability to the Cisco feed server is the requirement.

Question 6

What is a method for transporting security group tags throughout the network?

  1. by embedding the security group tag in the 802.1Q header
  2. by the Security Group Tag Exchange Protocol
  3. by enabling 802.1AE on every network device
  4. by embedding the security group tag in the IP header
Show answer and explanation

Correct answer: B. by the Security Group Tag Exchange Protocol

SXP, the Security Group Tag Exchange Protocol, carries SGT-to-IP bindings across the network. It lets ISE and capable devices share tag information with switches and routers that cannot tag traffic inline, keeping enforcement consistent.

Why the other options are wrong

  • A. The 802.1Q header carries VLAN information, not security group tags.
  • C. 802.1AE inline tagging requires every hop to support it, so it is not the general transport method.
  • D. The IP header carries no SGTs; tags travel in the Cisco Meta Data field or as SXP bindings.

Question 7

An engineer is configuring a virtual Cisco ISE deployment and needs each persona to be on a different node.

Which persona should be configured with the largest amount of storage in this environment?

  1. Monitoring and Troubleshooting
  2. Policy Services
  3. Primary Administration
  4. Platform Exchange Grid
Show answer and explanation

Correct answer: A. Monitoring and Troubleshooting

The Monitoring and Troubleshooting persona requires the largest storage allocation in a distributed virtual ISE deployment. This persona collects and retains logs, reports, and troubleshooting data from all other nodes, making it the most storage-intensive.

Why the other options are wrong

  • B. Policy Services needs CPU and memory for authentication load but retains far less data than Monitoring.
  • C. Primary Administration stores configuration and the replicated database, not the bulk of log data.
  • D. The pxGrid persona shares context with other platforms and has modest storage needs.

Question 8

In a standalone Cisco ISE deployment, which two personas are configured on a node? (Choose two.)

  1. subscriber
  2. primary
  3. administration
  4. publisher
  5. policy service
Show answer and explanation

Correct answer: C, E

C. administration E. policy service A standalone Cisco ISE node runs all personas, including Administration, Monitoring, and Policy Service. Of the choices listed, administration and policy service are the two personas assigned to that single node.

Why the other options are wrong

  • A. Subscriber describes a pxGrid client role, not a persona assigned to an ISE node.
  • B. Primary is a role designation for admin and monitoring nodes in a distributed deployment, not a persona.
  • D. Publisher describes a pxGrid role for sharing context, not an ISE node persona.

Question 9

A network engineer must enforce access control using special tags, without r-ngineering the network design.

Which feature should be configured to achieve this in a scalable manner?

  1. RBAC
  2. dACL
  3. SGT
  4. VLAN
Show answer and explanation

Correct answer: C. SGT

Security Group Tags (SGT) are Cisco's solution for enforcing access control based on special tags without requiring network redesign. SGTs enable scalable, identity-based access control that works across the network infrastructure by tagging traffic and applying policies based on those tags. RBAC is role-based access control for administrative functions, dACL is dynamic ACL which requires network reconfiguration, and VLAN segmentation requires network redesign.

Why the other options are wrong

  • A. RBAC controls administrative access, not data plane traffic filtering based on tags.
  • B. dACL requires network reconfiguration and doesn't use special tags natively.
  • D. VLAN segmentation requires network redesign, which the requirement explicitly avoids.

Question 10

A network engineer is configuring a network device that needs to filter traffic based on security group tags using a security policy on a routed interface.

Which command should be used to accomplish this task?

  1. cts role-based policy priority-static
  2. cts cache enable
  3. cts authorization list
  4. cts role-based enforcement
Show answer and explanation

Correct answer: D. cts role-based enforcement

The 'cts role-based enforcement' command enables role-based access control enforcement on a routed interface using security group tags. This command configures the device to filter traffic based on security policies that reference SGTs. The other commands relate to policy priority, caching, and authorization lists, which do not directly enable SG-ased filtering on an interface.

Why the other options are wrong

  • A. cts role-based policy priority-static sets policy priority, not enforcement on interfaces.
  • B. cts cache enable configures caching for performance, not enforcement mechanisms.
  • C. cts authorization list defines authorization rules but doesn't enable enforcement on routed interfaces.

That was 10 of 407.

The full Cisco 300-715 SISE pack has all 407 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack