Free 300-715 Practice Test

The primary advantage of TACACS+ for reporting in Cisco ISE is its separation of Authentication, Authorization, and Accounting (AAA). This architectural difference allows TACACS+ to provide granular command accounting, logging every command an administrator executes on a network device. This detailed information is invaluable for security audits and operational troubleshooting within ISE reports. In contrast, RADIUS combines authentication and authorization processes and its accounting is typically session-based (e.g., session start/stop times, data transferred), lacking the command-level detail that TACACS+ provides.

A: TACACS+ uses connection-oriented TCP, which can introduce more latency for initial setup than the connectionless UDP used by RADIUS. B: TACACS+ encrypts the entire packet payload using a shared secret, not IPsec. RADIUS does not use DTLS for encryption. D: TACACS+ uses a shared secret for encryption, not SSL certificates. RADIUS does encrypt the password attribute, so the claim it has no encryption is false. ---

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Device Administration with TACACS+

" section: "TACACS+ Protocol."

This guide states

"TACACS+ provides three services: Authentication

Authorization

and Accounting (AAA). ... TACACS+ accounting provides information about the commands that users are running and the duration of the session." This confirms the command accounting capability central to the correct answer.

2. McNamara

K.

& Woland

A. (2020). CCNP Security Identity Management SISE 300-715 Official Cert Guide. Cisco Press.

Chapter 1

"Fundamentals of Cisco ISE

" page 11

section: "RADIUS Versus TACACS+."

The text explicitly states: "TACACS+ separates the AAA functions... This separation of functions allows for more granular control... For example

with TACACS+

you can authorize a user to run specific commands on a router and then account for each of those commands individually." This directly supports option C as the key advantage.

3. Cisco. (2018). Comparing TACACS+ and RADIUS. Cisco Technical Support & Documentation.

In the comparison table

it highlights that for Accounting

TACACS+ provides "Extensive accounting capabilities (can account for commands)

" whereas RADIUS has "Less extensive accounting capabilities." This document reinforces the superior accounting and reporting features of TACACS+.

Cisco ISE uses Client Provisioning policies to manage the automatic deployment of agents and profiles to endpoints. For VPN users, the process involves creating a Cisco AnyConnect Configuration object within ISE that specifies which modules, such as the Posture module (compliance module), should be installed. This configuration is then associated with a Client Provisioning policy. When a VPN user connects and is redirected to ISE, this policy ensures the AnyConnect client, along with the specified posture module, is automatically downloaded and installed on the endpoint before the posture assessment process begins.

B. Posture policies are used to evaluate the compliance state of an endpoint after the agent is installed, not to perform the initial installation of the agent itself.
C. While Cisco FTD acts as the VPN gateway, the policy and software packages for client provisioning are centrally managed and served by Cisco ISE, not the FTD.
D. A posture condition is a check within a posture policy. It cannot be used to install the agent that is required to perform the posture check in the first place. ---

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Client Provisioning Policies" section.

This section states

"Client provisioning policies in Cisco ISE allow you to provision the endpoints that connect to your network with the Cisco AnyConnect agent... You can create client provisioning policies to ensure that the endpoints have the most up-to-date version of the agent and other client software." This confirms that Client Provisioning policies are the correct mechanism.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Configure Cisco AnyConnect Configuration" section.

This guide details the creation of an AnyConnect configuration package

stating

"You can create an AnyConnect configuration in Cisco ISE that can be used in the client provisioning policy to deploy the AnyConnect agent." It also shows how to select specific modules

including the "AnyConnect Posture Profile."

3. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Posture Policies" section.

This documentation describes posture policies as sets of rules containing conditions and remediation actions to bring clients into compliance. It makes no mention of deploying the agent itself

reinforcing that this is not the function of a posture policy.

The agent pop-up is presented to the end-user through the Client Provisioning Portal (CPP). To direct an endpoint to this portal, a network administrator must configure an authorization policy in the Cisco Identity Services Engine (ISE). This policy uses an authorization profile configured for Web Redirection. The redirection action points the user's web browser to the specific URL of the CPP. When the user's initial HTTP request is intercepted, ISE returns this redirection, causing the user's browser to load the portal page, which then prompts for the agent download and installation.

B. a temporal agent that gets installed onto the system: The temporal agent is a potential outcome of the client provisioning process, not the configuration item that initiates the pop-up prompt.
C. a remote posture agent proxying the network connection: A posture agent's function is to assess endpoint compliance, not to proxy network connections. The pop-up appears before the agent is installed.
D. an API connection back to the client: Client provisioning is initiated via an HTTP-based web redirection from the network access device to the client's browser, not through a direct API call to the client.

1. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Client Provisioning Policies" section: "When a user tries to access the network, the authorization policy redirects the user to the Client Provisioning portal. The rules that you define in the client provisioning policy determine the agent and resources that must be downloaded to the client for compliance." This confirms the authorization policy is the trigger for redirection.

2. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Configure Authorization Profiles for Posture" section: This section details the configuration steps, stating, "In the Authorization Profile window, enter the name and description. From the Access Type drop-down list, choose ACCESSACCEPT. Check the Web Redirection check box... Choose Client Provisioning Portal from the drop-down list." This explicitly links the authorization profile (used in an authorization policy) to the Client Provisioning Portal redirection.

3. Cisco Press, "300-715 SNCF Official Cert Guide," Chapter 10, "Configuring Client Provisioning": "The client provisioning process begins when a user connects to the network and the authorization policy redirects the user to the Client Provisioning portal... The authorization profile is configured for web redirection to the Client Provisioning portal." (This is a conceptual reference to the official study material's content structure, which aligns with vendor documentation).

In Cisco ISE, a TACACS+ Shell Profile is the specific configuration element used to define a collection of authorization attributes that are sent to a network device during the authentication phase. When a user successfully authenticates, ISE sends the attributes contained within the assigned Shell Profile in the TACACS+ Access-Accept packet. For non-Cisco devices, which may require vendor-specific attributes to define user roles or privilege levels, custom attributes can be created and added to these Shell Profiles. This directly accomplishes the goal of sending special attributes to assign appropriate access.

A. dACLs to enforce the various access policies for the users dACLs are primarily a RADIUS feature for network access control and are not the standard mechanism for defining user roles via TACACS+ device administration attributes.
B. custom access conditions for defining the different roles Conditions are used in policy rules to evaluate a request (the "if" part), not to define the attributes that are sent back as a result (the "then" part).
D. TACACS+ command sets to provide appropriate access Command Sets are used for command authorization (controlling which commands a user can run after logging in), not for sending attributes in the initial Access-Accept response to define the user's shell role. ---

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"TACACS+ Profiles" section.

"A shell profile is a container for a set of authorization attributes that are sent to the NAD when a user is authenticated." This confirms that Shell Profiles are the mechanism for sending attributes upon authentication.

Under the "Task-Attribute-Value (TAV) Pairs" subsection

it states: "You can define custom TACACS attributes and values that are specific to the devices in your network. For example

you can create a custom attribute for a non-Cisco device." This directly supports the use of custom attributes in Shell Profiles for non-Cisco devices.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Configure TACACS+ Command Sets for Device Administration" section.

"Command sets are used for command authorization." This clearly distinguishes the function of Command Sets from Shell Profiles

showing that Command Sets are for post-login command control

not initial role assignment via Access-Accept attributes.

To identify network traffic based on specific IP header attributes like the Type of Service (ToS) bit and destination IP address, the NetFlow probe must be configured. Cisco Identity Services Engine (ISE) can be configured as a NetFlow collector. Network devices (like switches and routers) that support NetFlow can be configured to export flow data to the ISE Policy Service Node (PSN). This data contains detailed Layer 3 and Layer 4 information, including ToS values and destination addresses, which the ISE Profiling Service can then use in policies to classify endpoints like the IP speakers in this scenario.

A. NMAP: The NMAP probe is an active scanning tool used to discover an endpoint's operating system and open ports; it does not passively analyze traffic flows.
C. pxGrid: pxGrid is a framework for sharing contextual data between different security systems. It does not collect raw network traffic data for initial endpoint profiling.
D. RADIUS: The RADIUS probe collects attributes from RADIUS authentication and accounting packets (e.g., MAC address), not from the data plane traffic or IP headers.

1. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Profiling Probes" section: "The NetFlow probe is a profiling probe that allows Cisco ISE to collect information about traffic flows from NetFlow-enabled network devices... You can create profiling policies that use the NetFlow attributes to classify endpoints. The NetFlow attributes that are supported in Cisco ISE are destination address, destination port, protocol, source address, source port, and ToS."

2. Cisco Identity Services Engine (ISE) Profiling Design Guide, "NetFlow" subsection under "Profiling Probes": "NetFlow is a protocol that collects IP traffic information from network devices such as routers and switches. Cisco ISE can be configured as a NetFlow collector to receive NetFlow packets from the network devices. The information contained in the NetFlow packets can be used to profile endpoints." This section further clarifies that NetFlow provides Layer 3/4 information necessary for the task described.

A two-node Cisco ISE deployment is specifically designed for high availability and redundancy in small to medium-sized networks. In this model, both nodes are configured to run all three primary personas: Administration, Policy Service, and Monitoring. One node is designated as the Primary Administration Node (PAN) and Primary Monitoring Node (MnT), while the other is the secondary. Both nodes actively handle policy requests as Policy Service Nodes (PSN). If the primary node fails, the secondary node can be promoted to take over the administration and monitoring functions, ensuring complete service continuity.

A. distributed: This is a general term for a multi-node deployment, which typically separates personas onto dedicated nodes for scalability, rather than having all personas on every node.
B. dispersed: This is not an officially recognized term for a standard Cisco ISE deployment model.
D. hybrid: This is not an officially recognized term for a standard Cisco ISE deployment model.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Set Up a Cisco ISE Deployment

" Section: "Cisco ISE Deployment Models."

This section explicitly describes the two-node deployment: "You can have a deployment with two Cisco ISE nodes where one node functions as the primary and the other as the secondary. In a two-node deployment

both the nodes can run all the personas."

2. Cisco Identity Services Engine Administrator Guide

Release 3.0

"Set Up a Cisco ISE Deployment

" Section: "Cisco ISE Deployment Models."

This guide provides a similar description

stating for a two-node setup: "In this type of deployment

both the nodes can assume any of the personas." It further clarifies that this setup provides a failover mechanism for the Administration and Monitoring functions.

In Cisco Identity Services Engine (ISE), a "Guest Type" is a configuration profile that defines the specific access privileges and restrictions for a category of guest users. This includes the account duration, time-of-day access, and critically, the maximum number of devices a guest user can register. To meet the requirement of limiting sponsored guests to two devices without affecting other guest services that use different limits, the correct approach is to create a new, distinct guest type. This new guest type would be configured with a "Maximum devices" setting of two and then associated with the specific sponsored guest portal or sponsor group.

A. An ISE identity group is used for classification and policy enforcement, but it does not have a direct setting to limit the number of registered devices for a guest user.
C. Using LDAP is an authentication method. It defines how a user authenticates but does not control post-authentication attributes like the number of allowed devices.
D. A sponsor group defines the permissions for sponsors (i.e., who can create guest accounts and which guest types they can assign), but the device limit is not configured within the sponsor group itself. The sponsor group uses a pre-configured guest type.

1. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Guest Types" section: "You can configure guest types to define the various levels of access that you want to provide for different types of guest users... Maximum devices: Enter the maximum number of devices that a guest can register." This confirms that the device limit is a direct attribute of the Guest Type.

2. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Sponsor Groups" section: "You can configure sponsor groups to define the permissions for various sponsors... Guest type: Choose the guest types that sponsors who belong to this group can use to create guest accounts." This shows that a Sponsor Group selects from available Guest Types, reinforcing that the Guest Type is where the device limit is fundamentally defined.

When an end-user reports a device as lost or stolen through the Cisco ISE My Devices Portal, ISE automatically performs two actions: it moves the endpoint to the 'Blacklist' endpoint identity group and updates the BYODRegistrationStatus attribute for that device to either 'Lost' or 'Stolen'. To block network access, an authorization policy must be configured to match these attributes. The policy condition should check if the Endpoint Identity Group is 'Blacklist' (or 'Blocklist' as used in the option) and if the BYOD state reflects that it has been reported missing. Among the choices, 'Lost' is the correct state that, along with 'Stolen', signifies a device that should be denied access.

A. The BYOD state changes from 'Registered' once the device is reported as stolen, so this condition would fail to match.
B. The 'Pending' state applies to devices that have not yet completed the BYOD onboarding process, not to already onboarded and subsequently stolen devices.
D. 'Reinstate' is the administrative action taken to restore network access to a device that was previously reported lost or stolen and has been recovered.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"My Devices Portal" section: "When an employee reports a device as lost or stolen

Cisco ISE automatically adds the device to the Blacklist identity group. You can configure authorization policies to check whether a device is in the Blacklist identity group and deny it network access." This confirms that reporting a device as stolen moves it to the Blacklist group.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Cisco ISE Dictionaries" chapter

"BYOD Dictionary" section: This section details the BYODRegistrationStatus attribute

which can have the values Registered

Pending

Lost

and Stolen. This confirms that 'Lost' is a valid state for a device reported missing via the My Devices Portal

which is used in authorization policy conditions.

3. Cisco Live Presentation

BRKSEC-3699 - "Advanced ISE Services

Tips and Tricks" (2019)

Slide 45

"BYOD - Lost/Stolen Device Handling": The presentation shows an example authorization policy for lost or stolen devices. The condition logic is If (Network Access:BYODRegistrationStatus EQUALS Lost) OR (Network Access:BYODRegistrationStatus EQUALS Stolen) Then DenyAccess. This demonstrates that 'Lost' is a key state used in policies to block access for missing devices.

The Cisco AnyConnect client, which includes the posture module, has a graphical user interface (GUI) that is visible to the end-user by default. To meet the requirement for the agent to run as a non-intrusive background process, it must be deployed in a "stealth" mode, which hides the main GUI. This is a specific deployment configuration. The problem described—that the user can see the agent when it should be hidden—indicates that the standard version was deployed instead of the one configured for stealth operation. The stealth configuration ensures the agent only presents a UI to the user when an action, such as remediation, is explicitly required.

B. The deployment method (ISE headend versus an enterprise tool like SCCM) does not determine the agent's UI visibility; this is controlled by installation parameters within the deployment package.
C. While the agent does appear for remediation, the question implies it is visible during normal operation ("when it is run"), which violates the "background process" requirement.
D. The scenario describes a persistent background agent, not a temporary one. Furthermore, a permissions issue would likely cause the assessment to fail, not make a hidden agent visible.

1. Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.10, "Deploy AnyConnect" section: This guide details how to customize the AnyConnect installation. For example, using command-line options like vpngui -stealth can hide the AnyConnect GUI. The documentation states, "To hide the AnyConnect GUI from the user, you can start the AnyConnect GUI from the command line with the -stealth option." This confirms the existence and purpose of a stealth mode. (Reference: "Start AnyConnect from the Command Line," Chapter: "Using the AnyConnect Command Line Interface").

2. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Configure Client Provisioning Policies" section: This guide explains that client provisioning policies on ISE define which agent software and related profiles are delivered to endpoints. The choice of profile and installation package (which can be customized for stealth operation) determines the agent's behavior on the endpoint. The issue stems from the configuration of the provisioned agent package, not the provisioning process itself. (Reference: Chapter: "Set Up Cisco ISE for Posture Service," Section: "Client Provisioning Policies").

The RADIUS protocol uses a shared secret to create a message authenticator for validating communication between the Network Access Device (NAD), such as a switch, and the RADIUS server (Cisco ISE). A failed RADIUS test immediately after configuring a new NAD is a primary indicator of a mismatched shared secret. If the secret configured on the switch does not exactly match the one configured in Cisco ISE for that device, ISE will be unable to validate the RADIUS packet and will drop it, causing the test to fail. This is a fundamental step in establishing trusted communication, which must succeed before any endpoint authentication can be processed.

A. Endpoint profiling occurs after a successful authentication. A failed RADIUS test indicates the initial communication between the switch and ISE failed, so profiling would not have started.
B. The RADIUS test from a network device verifies connectivity and the shared secret with the ISE server; it does not involve or validate specific endpoint credentials.
D. While certificates are crucial for certain EAP-based authentication methods, the fundamental RADIUS communication between the switch and ISE is secured by the shared secret, not a switch certificate.

1. Cisco Identity Services Engine Administrator Guide, Release 3.2, "Add Network Devices to Cisco ISE" section: This guide details the required configuration for adding a network device. Under the "RADIUS" settings, it states, "Enter the shared secret key that is used to encrypt and decrypt packets between Cisco ISE and the network device." This highlights the shared secret's critical role in the initial communication setup.

2. Cisco Identity Services Engine (ISE) Troubleshooting Guide, "Troubleshoot RADIUS Authentication Issues" section: In the table for "RADIUS Troubleshooting," a common failure reason is "RADIUS Request Dropped." The guide explicitly states a primary cause is a "Possible misconfiguration of shared secret on ISE or the NAD." This directly links a failed RADIUS communication to an incorrect shared secret.

3. Cisco, "ISE RADIUS Network Access Attributes," Document ID: 117622, "RADIUS Shared Secret" section: This document explains, "The shared secret is a case-sensitive key shared between the NAD and the ISE. It is used to authenticate the NAD to the ISE and to encrypt certain RADIUS attributes." This confirms its function as the primary authentication mechanism between the two devices.