300-715
Implementing and Configuring Cisco Identity Services Engine (SISE) v4.0 (300-715 SISE)
Implementing and Configuring Cisco Identity Services Engine (300-715 SISE): Exam Guide and Study Roadmap
The 300-715 SISE exam validates practical knowledge of implementing Cisco Identity Services Engine for identity-based access control, authentication, authorization, guest access, profiling, BYOD, compliance, and network access device administration. It serves security and network professionals who configure or support ISE-based access policies. This guide helps you decide whether to study from the blueprint alone, add Cisco’s associated hands-on training, or build a focused lab plan before scheduling the English-language exam.
What does the 300-715 SISE exam lead to?
Passing 300-715 SISE earns the Cisco Certified Specialist – Security Identity Management Implementation certification. The exam also satisfies the concentration-exam requirement for the Cisco Certified Network Professional (CCNP) Security certification, and Cisco states that passing it can be used toward recertification.
That makes the exam useful for two different decisions. A candidate pursuing the specialist credential can treat the test as a focused ISE implementation target. A CCNP Security candidate can evaluate it as the concentration exam that fits an identity-management direction. Neither path removes the need to learn the actual blueprint domains.
Cisco’s associated Implementing and Configuring Cisco Identity Services Engine training is designed to prepare candidates for 300-715 SISE. Cisco describes that training as providing hands-on experience with identity-based access control, authentication, authorization, guest access, BYOD onboarding, profiling, and compliance-based access controls.
Use the certification outcome to choose your preparation depth. If ISE is already part of your work, blueprint-led revision and targeted lab validation may be efficient. If you understand networking but have not configured ISE workflows, practical training or a deliberately built lab should be treated as a preparation priority rather than an optional extra.
Who should prepare for this exam?
The strongest fit is a professional who must connect identity, endpoint state, access policy, and network-device behavior in an ISE deployment. The blueprint spans architecture, policy enforcement, guest services, profiling, BYOD, compliance, and network access device administration, so preparation should connect these areas instead of treating them as isolated product features.
A network administrator may need to strengthen identity-store, 802.1X, MAB, and authorization knowledge. A security engineer may need more practice with switch-side behavior, AAA protocols, CoA, and TACACS+ command authorization. A consultant or implementation specialist should be able to explain how a requirement becomes an ISE policy flow and how the network access device participates.
The exam is not best approached as a terminology-only test. Cisco’s training description emphasizes hands-on work across identity-based access control, authentication, authorization, guest access, BYOD onboarding, profiling, and compliance-based controls. That evidence supports a preparation style built around configuration decisions, dependencies, and troubleshooting logic.
Before setting a study schedule, list the ISE tasks you can perform without documentation and the tasks you can only describe. The second group is not automatically a weakness, but it identifies where reading should be followed by configuration practice. Give special attention to workflows that cross multiple domains, such as BYOD onboarding followed by authorization and compliance evaluation.
What skills does the current blueprint measure?
The v1.2 blueprint covers seven domains: architecture and deployment, policy enforcement, Web Auth and guest services, Profiler, BYOD, endpoint compliance, and network access device administration. Use these domains as the structure for your study notes, lab objectives, and final readiness review rather than relying on a generic ISE topic list.
Architecture and deployment carries 10% of the v1.2 blueprint, while policy enforcement carries 25%. The blueprint includes ISE personas, deployment options, hardware and virtual-machine performance specifications, and zero-touch provisioning under architecture and deployment. Policy-related coverage includes identity stores, 802.1X access, IBNS 2.0 deployment modes, MAB, Cisco TrustSec, and authentication and authorization profiles.
Web Auth and guest services carries 15% of the v1.2 blueprint, Profiler carries 15%, and BYOD carries 15%. The blueprint specifically covers Web Auth, guest and sponsor portals, profiler probes and CoA, and BYOD onboarding and certificates. These are substantial domains, so they should receive dedicated study blocks rather than being left for a final review day.
Endpoint compliance carries 10% of the v1.2 blueprint, and network access device administration carries 10%. The blueprint includes endpoint posture and compliance, AAA protocols, and TACACS+ command authorization. The equal weighting of these domains does not mean they are interchangeable; prepare each against its own task list and identify any practical gaps separately.
A useful note-taking format is to create one page for each domain with four fields: purpose, objects or components, configuration sequence, and failure checks. Add a fifth field for cross-domain dependencies. For example, a BYOD page should point to identity, certificates, authorization, and endpoint state rather than presenting onboarding as a standalone wizard.
How should you study the high-value policy areas?
Start with policy enforcement because it represents 25% of the v1.2 blueprint and connects many other ISE functions. Your objective is not simply to remember policy names; it is to understand how identity-store selection, authentication, authorization, endpoint classification, access methods, and network-device behavior combine to produce an access result.
Build a policy decision map before opening a lab. Begin with the access method, identify the identity source, record the authentication outcome, then show the conditions that select authorization. Add the resulting profile, VLAN or access treatment where applicable in your lab, and any CoA or TrustSec relationship you are testing. This exposes missing dependencies early.
Review native Active Directory and LDAP integration, identity-store options, 802.1X access, IBNS 2.0 deployment modes, MAB, Cisco TrustSec, and authentication and authorization profiles as connected implementation choices. For each, write down what problem it solves, what must already exist, and what evidence would show that the intended rule was selected.
Use contrasting scenarios rather than repeated successful configurations. Compare a known user with an unknown endpoint, an 802.1X attempt with MAB fallback, and a compliant endpoint with one that fails a posture condition. The aim is to explain why the policy result changes, not to memorize a sequence of interface clicks.
A common mistake is to study authentication and authorization as synonyms. Keep them separate in your notes. Authentication establishes how an identity is evaluated; authorization determines the access result after the relevant conditions are considered. Then connect both to the network access device, because a correct ISE rule still depends on the surrounding AAA and access-control configuration.
How do guest services, profiling, and BYOD fit together?
Treat guest services, Profiler, and BYOD as separate study domains with shared dependencies. Each carries 15% of the v1.2 blueprint, and each can involve identity, endpoint classification, portals, certificates, authorization, and network access behavior. Study the complete workflow, but test yourself on the specific responsibility of each feature.
For Web Auth and guest services, trace the user journey from initial connection through portal interaction, sponsor involvement where relevant, authentication or registration, and the resulting authorization. Include both Web Auth and guest and sponsor portals in your review. A useful exercise is to document which component handles the user-facing step and which policy determines the resulting access.
For Profiler, concentrate on how probes produce endpoint information and how CoA participates in changing access after classification. Do not stop at listing probe types. Write a cause-and-effect chain: observed endpoint information, profiling decision, policy condition, authorization outcome, and any required change to the session. This makes the topic operational rather than descriptive.
For BYOD, study onboarding and certificates as a sequence with prerequisites. Map the device’s identity, onboarding action, certificate role, subsequent authentication, and authorization result. Then ask what happens when the certificate is unavailable, invalid, or associated with a different expected state. The purpose is to reason through the lifecycle, not to memorize a happy-path enrollment.
Keep guest access and BYOD distinct in your revision. Both can use portals and policy decisions, but they solve different access scenarios. Similarly, profiling can influence authorization without being the same thing as BYOD onboarding. Draw separate diagrams and mark the points where the workflows interact.
What should you know about architecture and deployment?
Architecture and deployment is weighted at 10% in the v1.2 blueprint, but it provides the foundation for the other domains. Study ISE personas, deployment options, hardware and virtual-machine performance specifications, and zero-touch provisioning as design decisions. The exam blueprint places these subjects together because implementation depends on selecting and configuring an appropriate ISE arrangement.
Create a deployment decision table with columns for requirement, ISE persona or service involved, deployment choice, resource consideration, and validation step. This is more useful than copying definitions. For example, when studying a persona, record the function it supports and how that function affects the rest of the deployment in your lab or design exercise.
Review hardware and virtual-machine performance specifications directly against the current Cisco material. Do not rely on an old sizing note or an informal table, because resource requirements can be time-sensitive. The supplied blueprint confirms that these specifications are measured, but it does not provide a complete set of values here.
Include zero-touch provisioning in your checklist rather than treating it as an administrative footnote. Explain its purpose in the deployment sequence, identify the information or prerequisites your scenario requires, and record how you would verify that provisioning completed as intended. This type of preparation is practical without depending on live exam questions.
Avoid spending your entire architecture study block on diagrams. A deployment diagram is useful only when you can explain the role of each component, the choice behind the topology, and the effect of a deployment decision on policy or administration. Use the diagram as a prompt for configuration reasoning.
How should endpoint compliance and network access administration be prepared?
Endpoint compliance and network access device administration each carry 10% of the v1.2 blueprint. Prepare them as implementation domains, not as leftover review topics. The first requires you to connect posture or compliance state to access policy; the second requires you to understand how AAA protocols and TACACS+ command authorization govern device administration.
For endpoint compliance, define the states your lab will use and identify how each state affects authorization. Record the evidence that moves an endpoint into a state and the policy result associated with it. Then test an endpoint that does not meet the requirement. A strong study note explains both permitted and restricted outcomes and the transition between them.
For network access device administration, review AAA protocols and TACACS+ command authorization in the context of an administrator accessing a network device. Map the request, the identity source, the authorization decision, and the commands or administrative result. Keep this workflow separate from user or endpoint access even though both involve AAA concepts.
One preparation trap is to treat endpoint compliance as a list of agent or posture terms. Instead, ask what the network should do with the result. Another is to study TACACS+ only as authentication. The blueprint explicitly includes command authorization, so your notes should cover the authorization of administrative actions as well as the initial identity check.
If your lab cannot reproduce every endpoint condition, create decision tables and trace logs from the scenarios you can run. Mark which conclusions are directly observed and which are design reasoning. That distinction prevents false confidence while still allowing you to prepare for configuration relationships that are difficult to reproduce in a small environment.
What practical lab should you build?
A useful SISE lab should let you follow an identity or endpoint from connection attempt to final access result. Build around a small set of repeatable scenarios rather than trying to reproduce a large enterprise. The lab’s value comes from changing one condition at a time and recording how authentication, authorization, profiling, portals, certificates, compliance, or device administration respond.
Begin with a baseline access flow. Add an identity source, an access method, an authentication rule, and an authorization result. Once the baseline is understandable, introduce MAB or an alternative identity-store path and observe the difference. Then add a classification or compliance condition and verify whether the policy result changes as expected.
Create separate exercises for guest access, profiling, and BYOD. For guest access, document the portal and sponsor path you are studying. For profiling, introduce endpoint information and examine the effect of probes and CoA. For BYOD, trace onboarding and certificates, then repeat the flow with a deliberately different certificate or device condition if the environment allows it.
Include a network access device administration exercise covering AAA protocols and TACACS+ command authorization. The exercise should require you to distinguish login authentication from permission to perform an administrative action. Keep records of the ISE-side policy and the device-side configuration so you can identify which layer caused an unexpected result.
Do not use a lab as a substitute for the blueprint. A lab can overemphasize the features you happen to have available. After each exercise, return to the official domain list and mark the specific objective it supports. For subjects unavailable in the lab, use architecture diagrams, decision tables, and configuration-sequence notes instead of pretending they were validated hands-on.
What is a realistic study sequence?
A staged plan is more effective than starting with portals or memorizing feature names. First establish architecture and policy foundations, then add guest services, profiling, BYOD, compliance, and network access administration. Finish with cross-domain scenarios and timed recall. This order follows the dependencies between configuration decisions while still giving attention to every blueprint domain.
Stage one: read the v1.2 blueprint and convert every domain into a checklist. Mark each item as explain, configure, validate, or troubleshoot. Do not mark a topic complete because you have read it once. A complete item should have a short explanation and, where feasible, a lab result or decision trace.
Stage two: work through architecture and deployment, identity stores, authentication, authorization, 802.1X, MAB, IBNS 2.0 deployment modes, Cisco TrustSec, and access profiles. The goal is a stable policy foundation. Write your own end-to-end flow and use it to test whether you understand the order and relationship of the decisions.
Stage three: study Web Auth and guest services, Profiler, and BYOD in separate blocks. For each block, build one workflow diagram, one configuration checklist, and one failure scenario. The workflow should include the relevant portal, probe or CoA behavior, certificate path, or policy condition identified by the blueprint.
Stage four: cover endpoint compliance and network access device administration, then revisit the earlier workflows. Add a compliance result to an access scenario and add TACACS+ command authorization to an administrative scenario. This deliberate cross-connection helps reveal whether you understand ISE as a system rather than as independent chapters.
Stage five: perform a readiness review without notes. Explain each blueprint item aloud or in writing, identify the policy result for each scenario, and list the configuration dependencies. Spend the remaining study time on uncertain items and repeated mistakes, not on rereading topics you can already explain accurately.
A compact four-week version
With four weeks available, use the first week for the blueprint, architecture, identity stores, authentication, authorization, and access methods. Use the second week for policy enforcement scenarios and network access device administration. Use the third week for guest services, Profiler, BYOD, and compliance. Reserve the fourth week for lab repetition, cross-domain troubleshooting, and final blueprint coverage checks.
A longer preparation version
With more time, repeat the same sequence at a slower pace and add a second scenario for each domain. Do not merely extend reading time. Use the additional time to rebuild workflows from a blank configuration, compare successful and failed outcomes, and review current Cisco documentation for subjects where implementation details may change.
What exam and scheduling details are confirmed?
Cisco lists 300-715 SISE as a 90-minute certification exam offered in English. The listed exam price is US$300, or candidates may use Cisco Learning Credits. Confirm the current registration and delivery information on Cisco’s exam page before scheduling, because this guide should not be used as a substitute for live booking details.
The version transition is important for candidates choosing a test date. Cisco lists August 26, 2026, as the last date to test 300-715 SISE v1.1 and August 27, 2026, as the first date to test v1.2. If your preparation materials or course reference v1.1, compare them with the v1.2 blueprint before committing to a schedule.
The supplied official facts confirm the language, time, listed price, Learning Credits option, and version-transition dates. They do not establish every possible delivery arrangement, appointment rule, identification requirement, rescheduling condition, or testing-center detail. Check Cisco’s current exam information when you are ready to book rather than inferring those details from an older article.
Schedule only after you can account for every blueprint domain and explain your main workflows without relying on memorized prompts. If the version date affects your plan, choose the blueprint first and then align your training, lab notes, and revision materials to that version.
Which preparation mistakes create false confidence?
The most damaging mistake is studying ISE as a collection of screens instead of a sequence of identity, policy, endpoint, and network decisions. Other common problems include ignoring smaller domains, confusing similar workflows, using outdated material across a version change, and measuring readiness by familiarity rather than by the ability to explain and validate an outcome.
Do not allocate all study time to policy enforcement simply because it carries the largest blueprint percentage. Policy enforcement carries 25% of the v1.2 blueprint, but architecture and deployment, guest services, Profiler, BYOD, compliance, and network access administration are also tested domains. Cover all seven and use the official labels when tracking progress.
Do not assume that a successful guest workflow proves BYOD readiness. Guest and sponsor portals, profiling probes and CoA, and BYOD onboarding and certificates appear as distinct blueprint subjects. Prepare separate explanations and separate tests, then identify their shared policy and identity dependencies.
Do not treat hands-on training as proof that every objective is covered. Cisco says the associated training provides hands-on experience in several core areas, but your own study still needs to map that experience to the v1.2 blueprint. Conversely, do not assume that reading the blueprint demonstrates configuration competence.
Finally, avoid relying on exam dumps, leaked questions, or memorization claims. They do not replace understanding and are not a sound basis for preparation. Use official Cisco information, controlled practice, scenario notes, and honest gap analysis instead.
How can you decide whether you are ready?
Readiness means you can connect a requirement to an ISE configuration path, identify the participating identity or endpoint information, predict the access or administrative result, and explain how you would validate it. Use the blueprint as a coverage test and your lab or decision tables as evidence of practical understanding.
Run a domain-by-domain review. For architecture and deployment, explain personas, deployment options, resource specifications, and zero-touch provisioning. For policy enforcement, trace identity stores, 802.1X, MAB, IBNS 2.0 deployment modes, TrustSec, authentication, and authorization. For guest services, Profiler, and BYOD, reproduce the relevant workflow in your notes without copying a screen sequence.
Then review endpoint compliance and network access device administration independently. Explain how posture or compliance affects access, and how AAA protocols and TACACS+ command authorization affect administrative access. If you can describe only the initial login but not the resulting permission or policy action, keep studying that domain.
Use a traffic-light system, but define it precisely. Green means you can explain and validate the objective. Amber means you can describe it but cannot reliably trace a result or dependency. Red means the term is familiar but the implementation path is unclear. Spend the final revision cycle on amber and red items, with priority given to cross-domain failures.
Before booking, check the version of every major study source against the exam date. For a v1.2 appointment, use the v1.2 blueprint as the controlling checklist. For a date near the published transition, verify Cisco’s current exam information and make sure your preparation materials match the version you intend to take.
What should you do next?
Download or review the official v1.2 exam-topics document, mark every domain objective, and choose a preparation route that matches your experience: associated Cisco training, a focused lab, or both. Then set a review date for your coverage checklist before paying for an appointment.
Start with one complete identity-based access scenario and document every dependency. Expand it into guest, profiling, BYOD, compliance, and network-device administration exercises. Keep the official domain names in your notes, label practical recommendations as your own study choices, and revisit Cisco’s exam page for current scheduling information when you are ready.
If your target is CCNP Security, confirm that this concentration exam fits your certification plan. If your target is the specialist certification, use the same blueprint-led process but keep the preparation focused on the implementation decisions measured by 300-715 SISE.
A disciplined plan should leave you with more than a list of features. It should leave you able to explain why an access decision occurred, what information influenced it, how a network device participated, and which configuration or policy change would alter the result.
Conclusion
300-715 SISE rewards preparation that joins ISE architecture, policy, identity, endpoint state, portals, certificates, profiling, compliance, and network-device administration into coherent workflows. Use the v1.2 blueprint to allocate coverage, Cisco’s training information to judge whether hands-on instruction fits your needs, and a controlled lab or decision-trace notebook to test understanding. Confirm the applicable exam version and current booking details before scheduling, then use the final review to close specific gaps rather than rereading everything.
Related exams
- Securing Networks with Cisco Firepower (300-710 SNCF)
- Securing Email with Cisco Email Security Appliance (300-720 SESA)
- Securing the Web with Cisco Web Security Appliance (300-725 SWSA)
- 300-730 exam — Implementing Secure Solutions with Virtual Private Networks (SVPN)
- Automating and Programming Cisco Security Solutions (300-735 SAUTO)
- 300-740 exam — Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT)