Cisco 300-715 Practice Test

300-715 practice test: what's covered

• Implementing Cisco ISE
• CCNP Security concentration

Free 300-715 sample questions

1. A senior network security engineer is designing a high-availability Cisco ISE 3.x distributed deployment with 2 Primary Administration Nodes (PAN), 2 Monitoring & Troubleshooting (MnT) nodes, and 4 Policy Service Nodes (PSN). Which primary operational responsibilities are handled exclusively by the PSNs?

   • A. Centralized log collection, report generation, and session monitoring
   • B. Processing RADIUS and TACACS+ authentication requests, endpoint profiling, and posture evaluation
   • C. Primary GUI administration, database configuration writes, and REST API calls
   • D. Managing internal root certificate authority revocation lists and OCSP validation
   Show answer

   Correct: B. Policy Service Nodes (PSN) serve as the runtime data plane, handling RADIUS/TACACS+ authentications, profiling probes, and posture state evaluation against rules pushed from the PAN. Centralized log collection is wrong because that is handled by MnT nodes. Primary GUI administration is incorrect as that belongs to the PAN. Managing internal CA revocation lists is handled by the dedicated ISE internal CA service, not exclusively by PSNs.

2. In a Cisco ISE 3.x deployment with primary and secondary Policy Administration Nodes (PAN), a hardware failure causes the primary PAN to go offline. Which two statements describe the failover behavior and administrative impact? (Select TWO.)

   • A. Network authentications and authorization processing continue uninterrupted on active Policy Service Nodes (PSNs).
   • B. The secondary PAN automatically assumes primary administration write capability without manual intervention.
   • C. Administrative GUI updates and configuration changes require manually promoting the secondary PAN to primary.
   • D. All active RADIUS and TACACS+ sessions across the enterprise are terminated immediately upon PAN failure.
   Show answer

   Correct: A and C. The PAN operates in active-standby mode for administration. Run-time authentication continues uninterrupted because PSNs utilize cached policies. However, GUI administration and configuration writes require an administrator to manually promote the secondary PAN. Automatic promotion is incorrect because Cisco ISE does not perform auto-failover for administration to prevent split-brain scenarios. Terminating active sessions is wrong because session state is maintained locally on PSNs.

3. A network security administrator is configuring a new Policy Set in Cisco ISE 3.x for corporate dot1x access. How does the Authentication Policy within the Policy Set evaluate incoming network requests?

   • A. It evaluates conditions such as NAS-Port-Type and RADIUS attributes to select the appropriate Identity Source Sequence.
   • B. It enforces network VLAN assignments and downloadable Access Control Lists (dACL) after authentication succeeds.
   • C. It checks endpoint hardware MAC addresses exclusively against an external active directory database.
   • D. It assigns Security Group Tags (SGT) directly based on the posture compliance state of the endpoint.
   Show answer

   Correct: A. The Authentication Policy within a Policy Set checks protocol-specific conditions (like NAS-Port-Type or EAP types) to choose which Identity Source (or Sequence) validates the credentials. Enforcing VLANs and dACLs is incorrect because that is the role of the Authorization Policy. Checking MAC addresses exclusively is wrong as dot1x uses user/machine credentials. Assigning SGTs is incorrect as SGT assignment occurs during authorization.

4. A company requires that authenticated employees in the Active Directory Domain Users group receive VLAN 10 assignment and a restrictive downloadable ACL (dACL) for internal subnets. Which two components must be configured in Cisco ISE to fulfill this requirement? (Select TWO.)

   • A. An Authorization Profile containing the VLAN ID, dACL name, and Access-Accept result
   • B. An Authorization Rule mapping the AD external group condition to the corresponding Authorization Profile
   • C. A TACACS+ command set granting privilege level 15 to the employee endpoint MAC address
   • D. A posture requirement condition mandating AnyConnect Web-Agent installation before network admission
   Show answer

   Correct: A and B. Authorization in ISE requires an Authorization Profile (defining RADIUS attributes like VLAN and dACL) paired with an Authorization Rule (matching conditions like AD group membership). TACACS+ command sets are incorrect because TACACS+ manages device administration CLI commands, not 802.1X network access. Posture requirements are wrong here because posture compliance is separate from standard AD group authorization matching.

5. An engineer is deploying Network Access Control on switches connecting legacy IP phones and printers. Under which condition is MAC Authentication Bypass (MAB) appropriate to use?

   • A. When endpoints do not support 802.1X authentication and must be authorized based on their MAC address against an identity store.
   • B. When corporate Windows laptops need high-assurance EAP-TLS certificate authentication before accessing internal servers.
   • C. When guest users require temporary web portal redirection for acceptance of acceptable use policy terms.
   • D. When administrator CLI access to switch console ports needs full command-level accounting and authorization.
   Show answer

   Correct: A. MAB is designed as a fallback method for legacy devices (like printers or IP phones) that lack 802.1X supplicants. EAP-TLS certificate authentication for corporate laptops is incorrect because laptops support dot1x. Guest portal redirection is wrong as that uses Central Web Authentication (CWA). Switch CLI command accounting is incorrect because TACACS+ handles device administration.

Last updated: 2026-10-19

300-715 practice test FAQ

Related practice tests

• CCIE Security Written 350-701 practice test
• CCNA 200-301 practice test
• Cisco 300-410 practice test
• CCNP ENCOR 350-401 practice test
• Cisco 100-160 practice test
• Cisco 200-201 practice test