- The 300-715 Exam at a Glance
- Domain Weights and Where the Points Live
- Policy Enforcement: The 25% Core
- Web Auth, Guest Services and BYOD
- Profiler and Endpoint Compliance
- Architecture, Deployment and Device Administration
- What Changed in the v1.2 Blueprint
- Fees, Retakes, Renewal and Pathway Facts
- Sequencing Your Review by Domain
- Frequently Asked Questions
- The 300-715 exam runs 90 minutes, costs USD 300 plus tax, and is delivered through Pearson VUE or OnVUE.
- Policy Enforcement is the heaviest domain at 25%; Web Auth and Guest, Profiler and BYOD each carry 15%.
- The v1.2 blueprint adds host mode to wired 802.1X and explicitly adds TACACS+ accounting.
- Passing earns the Cisco Certified Specialist - Security Identity Management Implementation and satisfies the CCNP Security concentration requirement.
The 300-715 Exam at a Glance
This page condenses what you need to recall about Implementing and Configuring Cisco Identity Services Engine (SISE) 300-715 into a single review pass. If you are new to the credential, start with What Is SISE Certification? and then return here for the rapid-fire facts.
| Item | What to Remember |
|---|---|
| Issuer | Cisco |
| Exam code | 300-715 SISE (blueprint label v1.2) |
| Credential earned | Cisco Certified Specialist - Security Identity Management Implementation |
| CCNP Security role | Satisfies the concentration requirement; the full CCNP Security also requires the core exam 350-701 SCOR |
| Duration | 90 minutes, proctored, closed book |
| Delivery | Pearson VUE test centers or eligible OnVUE online appointments |
| Fee | USD 300 plus tax; Cisco Learning Credits accepted |
| Prerequisites | None formal; no mandatory training course |
| Passing score | Not published as a fixed number; set statistically and subject to change |
| Retake wait | Five calendar days, beginning the following day |
Two items on that table trip people up. First, no official question count or pass rate was verified, so be skeptical of any site quoting exact figures; the SISE passing score guide and the SISE pass rate analysis explain what can and cannot be known. Second, Cisco's general exam guidance mentions multiple-choice, drag-and-drop and possible performance-based lab items, but it does not guarantee a particular item mix for every delivery. Prepare for all three styles.
Domain Weights and Where the Points Live
The seven domains below are the official weighted objectives from the v1.2 blueprint. For a deeper walkthrough of each area, read the complete SISE exam domains guide.
| Domain | Weight | Core Theme |
|---|---|---|
| 1. Architecture and Deployment | 10% | Personas, nodes, deployment models, certificates |
| 2. Policy Enforcement | 25% | 802.1X/MAB, authentication and authorization policy, CoA, host mode |
| 3. Web Auth and Guest Services | 15% | Portals, sponsor and hotspot flows, redirection |
| 4. Profiler | 15% | Probes, profiling policies, feeds, endpoint identity groups |
| 5. BYOD | 15% | Onboarding, certificates, supplicant provisioning, lifecycle |
| 6. Endpoint Compliance | 10% | Posture, agents, remediation |
| 7. Network Access Device Administration | 10% | TACACS+ authentication, authorization, accounting |
Policy Enforcement: The 25% Core
This is where the exam concentrates its difficulty. If you can reason through why an endpoint landed in a particular authorization result, you can handle a large share of scenario questions.
Domain 2: Policy Enforcement
Expect to connect network device configuration to ISE policy behavior, not just recite policy-set menus.
- 802.1X versus MAB: know when each applies, what happens when a device lacks a supplicant, and how fallback behaves.
- Host modes on wired ports: single-host, multi-host, multi-domain and multi-auth behave differently; the v1.2 blueprint explicitly adds host mode to wired 802.1X.
- Policy structure: policy sets, authentication policy, authorization policy, conditions, and how rule order drives outcomes.
- Authorization results: VLAN assignment, downloadable ACLs, security group tags, and redirect ACLs.
- Change of Authorization (CoA): what triggers it, which flavors exist (reauthenticate, disconnect, port bounce), and why it requires RADIUS configuration on the NAD.
- Identity sources: internal users, Active Directory, LDAP, certificate authentication profiles, and identity source sequences.
Troubleshooting mindset
Scenario questions often hand you a symptom: a device is not redirected, CoA never arrives, or authorization hits the default rule. Train yourself to walk the path in order: NAD configuration, RADIUS reachability, authentication method, identity lookup, policy match, and finally the enforcement result. The Live Logs and detailed authentication reports are the reference tools to understand conceptually.
Web Auth and Guest Services, Plus BYOD
These two domains total 30% and share a technical backbone: URL redirection, portals, and CoA to move a session from a restricted state into a final state.
Domain 3: Web Auth and Guest Services
Portal types and the redirect mechanism are the repeat offenders.
- Guest flow types: hotspot, self-registered, and sponsored access, and what distinguishes each.
- Central Web Authentication (CWA) versus local web authentication, and why CWA depends on redirect ACLs and CoA.
- Sponsor groups, guest types, and account lifetime settings.
- Portal customization, certificates on portals, and FQDN and DNS considerations.
Domain 5: BYOD
The v1.2 refresh updated BYOD lifecycle objectives, so review lifecycle management and not only first-time onboarding.
- Single-SSID versus dual-SSID onboarding and the trade-offs.
- Native supplicant provisioning and certificate issuance through the ISE internal CA.
- Zero-touch provisioning concepts (present in both v1.1 and v1.2).
- Device registration, endpoint identity groups, and revocation of lost or retired devices.
- Differentiating employee-owned device policy from corporate-asset policy.
Key Takeaway
Guest and BYOD both live and die on redirection and CoA. If a flow fails in a question, check the redirect ACL, the portal certificate and name resolution, and the CoA path before assuming a policy-rule error.
Profiler and Endpoint Compliance
Domain 4: Profiler
Profiling is evidence collection followed by classification. Know which evidence source answers which question.
- Probes: DHCP, DHCP SPAN, HTTP, RADIUS, NMAP, DNS, SNMP query and trap, and Active Directory, along with what attribute each contributes.
- Profiling policies, certainty factors, and how multiple conditions combine toward a match.
- Feed service updates and custom profiles for devices the default library does not recognize.
- Profiling-driven authorization using endpoint identity groups and profile conditions.
- Why wired switches often need device sensor or IP helper configuration to deliver profiling data.
Domain 6: Endpoint Compliance
Posture checks whether a connecting endpoint meets policy, then drives an authorization outcome.
- Posture conditions, requirements, and policies, and how they chain together.
- Agent options through Cisco Secure Client and the client provisioning flow.
- Unknown, compliant and non-compliant states, and the authorization profile applied to each.
- Remediation actions and grace or reassessment behavior.
- Dependence on redirection and CoA to move the endpoint between states.
Architecture, Deployment and Device Administration
These are the two 10% domains plus Endpoint Compliance. They are smaller but approachable, and they supply dependable points.
Domain 1: Architecture and Deployment
- Personas: Policy Administration Node (PAN), Monitoring (MnT), Policy Service Node (PSN), and pxGrid.
- Standalone versus distributed deployment, and what high availability looks like for each persona.
- Certificates: system certificate usages, trust stores, and why mismatched or untrusted certificates break portals and EAP.
- Integration points such as external identity stores and pxGrid-based sharing of context.
- Node registration and role assignment fundamentals.
Domain 7: Network Access Device Administration
- TACACS+ versus RADIUS: separation of authentication, authorization and accounting, and why TACACS+ suits device administration.
- Device admin policy sets, command sets, and shell profiles with privilege levels.
- Configuring network devices to use ISE for administrator login.
- TACACS+ accounting, which the v1.2 blueprint now calls out explicitly.
What Changed in the v1.2 Blueprint
Cisco states the v1.2 objectives take effect August 27, 2026, and that related topics may also appear and the objectives may change. Compared with v1.1, the verified differences are:
- Host mode added to wired 802.1X.
- Updated BYOD lifecycle and posture objectives.
- TACACS+ accounting added explicitly.
- Zero-touch provisioning and CoA were already present, so do not treat them as new.
Fees, Retakes, Renewal and Pathway Facts
Registration and exam day
You schedule through Pearson VUE, choosing either a test center or an eligible online (OnVUE) appointment. The exam is closed book, and the Cisco Candidate Rules Agreement excludes personal books and notes; current policies require acceptance of the confidentiality agreement. The individual SISE page lists English, while the CCNP Security catalog also lists Japanese, so verify the language offered for your specific booking. Full cost context lives in the SISE certification cost breakdown.
Retakes
If you fail, wait five calendar days beginning the following day before retaking the same exam. Each attempt incurs the exam fee again, so a pre-exam readiness check is cheaper than a retry. A timed run through the SISE practice tests is a sensible gate before you book.
Validity and renewal
| Credential | Validity | CE Renewal Requirement |
|---|---|---|
| Specialist (Security Identity Management Implementation) | Three years | 40 CE credits before expiry |
| Professional / CCNP Security | Three years | 80 CE credits |
The official SISE training course awards 32 CE credits, which is not enough on its own to renew the Specialist. A qualifying concentration exam pass earns 40 CE and a core exam pass earns 80 CE. Separately, the three-year window for combining CCNP exam passes is distinct from earned-certification renewal, and CE renewal does not extend that exam-completion window.
Career context
ISE skills map to network security, access control and zero trust implementation roles. For realistic role titles and market framing, see the SISE jobs overview and the SISE certification ROI analysis; for pay discussion that avoids invented figures, consult the SISE salary guide.
Sequencing Your Review by Domain
Rather than generic scheduling, order your review by dependency: later domains reuse the mechanics of earlier ones. This sequence is a suggestion for a four-week final review; adjust to your lab access. The broader plan is in the SISE study guide, and difficulty expectations are in how hard the SISE exam is.
Foundations and Policy Enforcement
- Architecture personas and certificate usage (Domain 1).
- 802.1X, MAB, host modes, policy sets and CoA (Domain 2), because every later domain depends on them.
Redirect-Driven Flows
- Guest portals and CWA (Domain 3).
- BYOD onboarding and lifecycle (Domain 5), reusing the same redirect and CoA mechanics.
Context and Compliance
- Profiler probes and policies (Domain 4).
- Posture and remediation (Domain 6).
Device Admin and Full Review
- TACACS+ authentication, authorization and accounting (Domain 7).
- Timed mixed-domain sets, then revisit Policy Enforcement weak spots.
For more on how each section is framed, the domains guide pairs well with this sequencing, and practice questions help you confirm which domain needs a second pass.
Frequently Asked Questions
It is a proctored, closed-book, computer-delivered written exam lasting 90 minutes. You can sit it at a Pearson VUE test center or through an eligible OnVUE online appointment.
Policy Enforcement at 25%. Web Auth and Guest Services, Profiler and BYOD each carry 15%, while Architecture and Deployment, Endpoint Compliance and Network Access Device Administration each carry 10%.
Not by itself. Passing 300-715 satisfies the CCNP Security concentration requirement and earns the Specialist credential, but full CCNP Security also requires the core exam 350-701 SCOR.
Cisco does not publish a fixed numeric passing score. Standards are determined statistically and can change, so no reliable single number exists. See the passing score article for details.
You must wait five calendar days, beginning the day after the failed attempt, before retaking the same exam, and the exam fee applies again for the new attempt.