- What This Credential Actually Is
- The v1.2 Blueprint and Where the Points Sit
- Exam Mechanics: Format, Fee, Booking and Retakes
- Policy Enforcement: The 25% Domain
- Guest, Profiler and BYOD: The 45% Middle
- Endpoint Compliance and Device Administration
- Architecture and Deployment
- Sequencing Your Preparation Around the Blueprint
- Career Value, Renewal and the CCNP Path
- Frequently Asked Questions
- The 300-715 SISE exam is 90 minutes, closed book, and costs USD 300 plus tax.
- Policy Enforcement carries 25%, the largest weight; Web Auth and Guest Services, Profiler and BYOD each carry 15%.
- Passing earns the Cisco Certified Specialist - Security Identity Management Implementation and fulfills the CCNP Security concentration requirement.
- The v1.2 blueprint adds wired 802.1X host mode and explicit TACACS+ accounting, effective August 27, 2026.
What This Credential Actually Is
The SISE certification exam, officially Implementing and Configuring Cisco Identity Services Engine (300-715 SISE), is a Cisco security exam focused on one product family: Cisco Identity Services Engine (ISE). It tests whether you can deploy ISE, build authentication and authorization policy, run guest and BYOD workflows, profile endpoints, enforce posture compliance, and administer network devices with TACACS+.
Passing the exam earns the Cisco Certified Specialist - Security Identity Management Implementation. It also satisfies the concentration-exam requirement for CCNP Security. To earn the full CCNP Security, you additionally need the 350-701 SCOR core exam. If you are still sorting out the terminology, our explainers on what SISE certification is and what SISE stands for cover the basics, but everything in this article refers specifically to the Cisco 300-715 exam.
There are no formal prerequisites and no mandatory training course. Cisco does recommend familiarity with the Cisco IOS CLI for wired and wireless devices, Cisco Secure Client, Microsoft Windows, and 802.1X. Treat that as a practical readiness checklist rather than an eligibility gate. More detail is in our SISE requirements guide.
The v1.2 Blueprint and Where the Points Sit
The current objectives are published as Implementing and Configuring Cisco Identity Services Engine v1.2 (300-715), effective August 27, 2026. Seven weighted domains define what can appear on your exam:
| Domain | Weight | What It Rewards |
|---|---|---|
| 1. Architecture and Deployment | 10% | Node roles, deployment models, certificates, integration basics |
| 2. Policy Enforcement | 25% | 802.1X, MAB, authentication and authorization policy, host mode, CoA |
| 3. Web Auth and Guest Services | 15% | Central web authentication, guest portals, sponsor and self-registration flows |
| 4. Profiler | 15% | Probes, profiling policies, endpoint identity groups, feeds |
| 5. BYOD | 15% | Onboarding, certificate and supplicant provisioning, device lifecycle |
| 6. Endpoint Compliance | 10% | Posture assessment, client provisioning, remediation |
| 7. Network Access Device Administration | 10% | TACACS+ authentication, authorization, accounting, command sets |
Policy Enforcement is the largest slice at 25%. Web Auth and Guest Services, Profiler and BYOD are tied at 15% each, which together account for 45% of the exam. Architecture and Deployment, Endpoint Compliance, and Network Access Device Administration are each 10%. For a deeper domain-by-domain walkthrough, see the SISE exam domains guide.
What Changed From v1.1
Compared with v1.1, the refresh adds host mode to wired 802.1X, updates the BYOD lifecycle and posture objectives, and explicitly adds TACACS+ accounting. Zero-touch provisioning and Change of Authorization (CoA) were already in the previous blueprint, so older study materials that cover them remain useful. Cisco also notes that related topics may appear and that objectives can change, so use the official PDF as your final scope check.
Exam Mechanics: Format, Fee, Booking and Retakes
Knowing the logistics removes avoidable stress on exam day:
- Length: 90 minutes, proctored and computer-delivered.
- Delivery: Pearson VUE test centers, or eligible OnVUE online appointments.
- Fee: USD 300 plus tax. Cisco Learning Credits are accepted. Our SISE certification cost breakdown covers the full budget including optional training.
- Closed book: Under the Cisco Candidate Rules Agreement (v1.0, June 2019), personal books and notes are excluded, and current policies require you to accept the confidentiality agreement.
- Language: The individual exam page lists English, while the CCNP Security catalog also lists Japanese. Verify the language offered for your specific booking.
- Retake rule: After a failed attempt, wait five calendar days, beginning the following day, before retaking the same exam.
Question Style
Cisco's general guidance for Associate and Professional exams describes multiple-choice items, drag-and-drop, and possibly performance-based lab items. It does not guarantee a particular mix for every SISE delivery, and no fixed question count has been verified. Prepare for configuration-flavored reasoning: given a symptom or a requirement, which ISE setting, policy condition, or switch command achieves the result? Scenario questions often reward you for knowing the order of operations, such as which policy set matches first, or which authorization result applies after posture changes state.
Scoring Transparency
Cisco does not publish fixed numeric passing scores. Standards are determined statistically and can change, and there is no verified official pass rate. That is why articles claiming an exact cutoff deserve skepticism. Our SISE passing score article and pass rate analysis explain what is and is not known. The practical takeaway is simple: do not try to game a threshold. Build competence across all seven domains.
Policy Enforcement: The 25% Domain
With the biggest weight on the exam, Policy Enforcement is where candidates either bank a comfortable lead or lose their margin. It spans wired and wireless access control, and it is deeply configuration-oriented.
Domain 2: Policy Enforcement (25%)
You need to explain, configure and troubleshoot how ISE authenticates endpoints and decides what access they receive.
- 802.1X and MAB: EAP method selection, certificate trust for EAP-TLS, PEAP inner methods, and when MAC Authentication Bypass is the fallback for non-supplicant devices.
- Wired host modes: The v1.2 addition. Know how single-host, multi-host, multi-domain and multi-auth modes change which sessions the switch port authenticates and what that means for phones, PCs behind phones, and hubs.
- Authentication and authorization policy: Policy sets, condition logic, identity sources and sequences, authorization profiles, downloadable ACLs, security group tags and VLAN assignment.
- Change of Authorization: How and why ISE re-authorizes active sessions, including port bounce versus reauthentication, and which network device settings must exist for CoA to work.
- Network device configuration: The AAA, RADIUS, and 802.1X commands on IOS switches and the equivalent wireless controller settings that make enforcement real.
A reliable way to study this domain is to build a small lab and break it deliberately: change a host mode, remove a RADIUS key, or reorder authorization rules, then read the live logs and detailed authentication reports to see what ISE reports. Troubleshooting questions on the exam often mirror those failure patterns.
Key Takeaway
Because Policy Enforcement is a quarter of the exam and its concepts (CoA, authorization results, host modes) feed Guest, BYOD and posture flows, mastering it first improves your performance in at least four other domains.
Guest, Profiler and BYOD: The 45% Middle
Three 15% domains sit in the middle of the blueprint, and they share more design logic than their separate names suggest.
Domain 3: Web Auth and Guest Services (15%)
Centralized web authentication is the backbone: the network redirects an unauthenticated user to an ISE portal, then CoA moves the session to the right access level.
- Redirect ACLs and the switch or controller configuration behind them
- Hotspot, sponsored and self-registered guest portal types and their account lifecycles
- Sponsor groups, guest types, and portal customization and certificates
- Why a certificate mismatch on the portal breaks user experience before policy even matters
Domain 4: Profiler (15%)
Profiling classifies endpoints so policy can treat a printer differently from a laptop without any supplicant.
- Probes such as DHCP, RADIUS, SNMP, NMAP, HTTP and DNS, and what attributes each contributes
- Profiling policies, certainty factors and endpoint identity groups
- Using profile results in authorization policy, and how profile changes trigger CoA
- Keeping the profiler feed current and tuning custom policies
Domain 5: BYOD (15%)
This domain covers securely onboarding personally owned devices, and the v1.2 blueprint updates the lifecycle objectives.
- Single-SSID versus dual-SSID onboarding flows
- Native supplicant provisioning and certificate issuance through the ISE internal CA or an external CA
- Zero-touch provisioning concepts, which were already in scope before v1.2
- Device registration, blocklisting lost devices, and the full lifecycle from onboarding to revocation
Notice the dependency chain: BYOD onboarding uses the same redirect-and-CoA machinery as guest access, and both rely on authorization policy from Domain 2. Studying these as three isolated topics wastes time. Study them as variations on one pattern: redirect, collect or classify, authorize, and re-authorize.
Endpoint Compliance and Device Administration
Two 10% domains round out the operational side of the exam, and each has distinctive vocabulary worth memorizing.
Domain 6: Endpoint Compliance (10%)
Posture determines whether a connecting endpoint meets your security requirements before it gets full access. The v1.2 blueprint updates the posture objectives.
- Client provisioning policy and how Cisco Secure Client delivers the posture module
- Posture conditions, requirements and policies, and how they map to compliant, noncompliant and unknown states
- Remediation actions and grace periods
- Authorization rules that give limited access to unknown or noncompliant endpoints and then re-authorize after assessment
Domain 7: Network Access Device Administration (10%)
This is the TACACS+ domain, concerned with who can log into and configure network devices, not with endpoint access.
- Device administration policy sets, command sets and shell profiles
- Authentication and authorization for administrators against internal and external identity stores
- TACACS+ accounting, now explicitly listed in v1.2
- How TACACS+ differs from RADIUS in protocol behavior and in the granularity of command authorization
Many candidates under-prepare for TACACS+ because it feels small. At 10% it is comparable in weight to Architecture and to posture, and the explicit accounting addition means it should not be skimmed.
Architecture and Deployment
This domain is only 10%, but it underpins every lab you will build. Expect questions about ISE personas and how they are distributed across nodes, standalone versus distributed deployment, and what happens when nodes fail. Certificates deserve special attention: admin, EAP, portal and pxGrid usage roles each need appropriate certificates, and trust-store mistakes are among the most common real-world failure causes.
- Administration, Policy Service and Monitoring personas and their placement
- Active Directory and LDAP integration, including join and identity source concepts
- Network device onboarding, RADIUS shared secrets and device groups
- Certificate roles, trust chains and the internal certificate authority
Sequencing Your Preparation Around the Blueprint
Rather than a generic schedule, order your study by dependency. A sample progression that follows the blueprint logic is below; adjust the pace to your lab access and experience. For a broader plan, see the SISE study guide.
Architecture, Certificates and Network Devices
- Deploy a lab ISE node and join an identity source
- Understand personas, certificate usage roles and trust
- Add switch or controller devices with RADIUS configuration
Policy Enforcement Deep Dive
- Configure 802.1X, MAB and wired host modes
- Build policy sets, authorization profiles, dACLs and SGTs
- Practice CoA and read live logs to troubleshoot
Guest, Profiler and BYOD
- Build guest portals and sponsor flows with redirect ACLs
- Enable profiling probes and write profile-driven authorization rules
- Configure onboarding and certificate provisioning for BYOD
Posture, TACACS+ and Review
- Set up client provisioning and posture policies
- Configure TACACS+ command sets and accounting
- Take timed practice tests and revisit weak domains
Why this order? Policy Enforcement concepts reappear everywhere, so learning them early gives later domains something to attach to. Timed practice matters because the exam gives you 90 minutes, and our SISE practice tests help you rehearse reading scenario-based items at pace. Keep the SISE cheat sheet handy for last-week review of ports, protocols and portal types.
Gauging Difficulty Honestly
Candidates with hands-on switching and AAA experience often find the exam more approachable than those who have only read about ISE. The product has many interdependent settings, and the questions reward practical familiarity. Our difficulty guide breaks down which backgrounds tend to find which domains hardest.
Career Value, Renewal and the CCNP Path
Roles that value this credential tend to be those that own network access control: network security engineers, NAC and identity engineers, security architects, and consultants or integrators who deploy ISE for customers. Employers searching for ISE experience often list the product by name, so the certification helps signal hands-on capability. Explore SISE-related jobs and the salary guide for context, and weigh the investment using the ROI analysis.
Validity and Renewal Rules
The Specialist certification is valid for three years. Renewal through continuing education requires 40 credits before expiry. The official 300-715 training course awards 32 CE credits, so the course alone is not enough to renew the Specialist. For Professional-level CCNP certification, renewal requires 80 CE credits, with qualifying concentration exam passes earning 40 CE and core exam passes earning 80.
There is also a separate three-year window for combining CCNP exam passes (for example, 350-701 SCOR plus 300-715). That window is distinct from renewal of an earned certification, and CE renewal does not extend the exam-completion window. If CCNP Security is your goal, plan the core and concentration exams within the same window.
Key Takeaway
If you hold the Specialist, schedule your renewal plan early: the 32-credit course contributes but does not reach the 40 credits needed, so you will need an additional qualifying activity or exam.
Frequently Asked Questions
It earns the Cisco Certified Specialist - Security Identity Management Implementation and satisfies the CCNP Security concentration requirement. Full CCNP Security also requires passing the 350-701 SCOR core exam.
The fee is USD 300 plus tax, and Cisco Learning Credits are accepted. The exam lasts 90 minutes and is delivered through Pearson VUE test centers or eligible OnVUE online appointments. Check scheduling guidance for booking details.
Policy Enforcement at 25% is the largest, and its concepts support the Guest, BYOD and posture domains. Web Auth and Guest Services, Profiler and BYOD each carry 15%, so together they matter just as much as one dominant domain.
Cisco does not publish a fixed numeric passing score; standards are set statistically and can change. No official pass rate has been verified either, so aim for solid competence in all seven domains.
Yes. You must wait five calendar days, beginning the following day, before retaking the same exam. Use the gap to review the domains where your score report shows weakness, and try additional practice questions before rebooking.