- The v1.2 Blueprint at a Glance
- What Changed From v1.1
- Domain 1: Architecture and Deployment
- Domain 2: Policy Enforcement
- Domain 3: Web Auth and Guest Services
- Domain 4: Profiler
- Domain 5: BYOD
- Domain 6: Endpoint Compliance
- Domain 7: Network Access Device Administration
- Exam Format and Logistics
- Sequencing Your Preparation by Domain
- Frequently Asked Questions
- The 300-715 SISE v1.2 blueprint has seven domains; Policy Enforcement is the largest at 25%.
- Web Auth and Guest Services, Profiler, and BYOD each carry 15% of the exam.
- The v1.2 refresh adds wired 802.1X host mode and explicit TACACS+ accounting coverage.
- The exam lasts 90 minutes, costs USD 300 plus tax, and is delivered through Pearson VUE.
The v1.2 Blueprint at a Glance
The Implementing and Configuring Cisco Identity Services Engine (SISE) exam, numbered 300-715, tests whether you can deploy and operate Cisco ISE as the policy engine for network access. The current official objectives are labeled v1.2, effective August 27, 2026, and they divide the exam into seven weighted domains. Understanding how those weights are distributed is the single most efficient way to decide where your study hours go.
| Domain | Name | Weight |
|---|---|---|
| 1 | Architecture and Deployment | 10% |
| 2 | Policy Enforcement | 25% |
| 3 | Web Auth and Guest Services | 15% |
| 4 | Profiler | 15% |
| 5 | BYOD | 15% |
| 6 | Endpoint Compliance | 10% |
| 7 | Network Access Device Administration | 10% |
Notice the shape of the blueprint. One domain carries a quarter of the exam, three carry 15% each, and three carry 10% each. Policy Enforcement, Web Auth and Guest Services, Profiler, and BYOD together account for 70% of the exam, so shallow knowledge in those four areas is expensive. Cisco also cautions that related topics may appear beyond the listed objectives and that the objectives may change, so treat the blueprint as a floor, not a ceiling.
If you are new to the credential itself, our explainers on what SISE certification is and what SISE stands for cover the basics before you dive into the domain detail below.
What Changed From v1.1
If you are working from older study material, the differences between v1.1 and v1.2 matter. Based on Cisco's published objectives, the refresh introduces these shifts:
- Host mode in wired 802.1X: the blueprint now explicitly adds host mode as part of configuring wired 802.1X, so you should be able to explain how single-host, multi-host, multi-domain, and multi-auth behavior affects what an authenticated port allows.
- BYOD lifecycle and posture updates: objectives around the onboarding lifecycle and posture were refreshed, so older single-purpose BYOD notes may be incomplete.
- TACACS+ accounting: accounting is now explicitly listed in the device administration domain, rather than being something you might have skipped after authentication and authorization.
Zero-touch provisioning and Change of Authorization (CoA) were already present in v1.1, so they are not new, but they remain testable. Software version labels do not replace the exam blueprint label: Cisco's August 27, 2026 update confirms that the training covers ISE 3.4/3.5, but the exam you register for is still identified by the v1.2 objectives.
Domain 1: Architecture and Deployment (10%)
This domain is the foundation. It is the smallest tier by weight, but every other domain assumes you understand how an ISE deployment is structured and how it talks to the network and to identity sources.
What Candidates Must Understand
Know the roles of ISE nodes and how they combine in standalone and distributed deployments, plus how ISE integrates with external identity stores and certificate infrastructure.
- Administration, Policy Service, and monitoring persona responsibilities in a distributed deployment
- Integration with external identity sources such as Active Directory and LDAP
- The role of certificates in securing ISE communication and EAP authentication
- RADIUS communication between network access devices and ISE, including shared secrets and device definitions
Because Domain 1 is a smaller share of the exam, resist the temptation to over-invest here. But do not skip it: when a scenario question about a failed authentication hinges on a certificate trust problem or a missing network device definition, this is where the answer lives.
Domain 2: Policy Enforcement (25%)
Policy Enforcement is the heart of the exam and the largest domain at 25%. It covers the logic that decides who gets onto the network and what they receive once they are there.
Core Topics in Policy Enforcement
Expect scenario-style questions that ask you to trace an endpoint from connection attempt through authentication, authorization, and enforcement.
- Wired and wireless 802.1X, including the new emphasis on host mode behavior at the switch port
- MAB (MAC Authentication Bypass) as a fallback for devices that cannot run a supplicant
- Authentication and authorization policy construction, including conditions, rule ordering, and policy sets
- Authorization results such as VLAN assignment, downloadable ACLs, and Security Group Tags
- Change of Authorization (CoA) to re-evaluate or modify an active session
- Troubleshooting with live logs and RADIUS details to determine why a policy matched or failed
The best preparation here is hands-on. Build policy sets in a lab, deliberately misconfigure a condition, and read the live log to see which rule matched. The ability to diagnose a failure from log output is a recurring theme. Our difficulty guide for the SISE exam explains why candidates with only theoretical familiarity often struggle with exactly this kind of reasoning.
Key Takeaway
With 25% of the exam resting on Policy Enforcement, spend your most intensive lab time here. Be able to explain not just how to configure a rule, but why a particular endpoint matched a particular authorization result.
Domain 3: Web Auth and Guest Services (15%)
This domain addresses endpoints that authenticate through a browser portal rather than a supplicant, along with the full guest access experience.
Web Auth and Guest Topics
You need to understand both the network-side redirection mechanics and the ISE-side portal configuration.
- Central Web Authentication (CWA) flow, including redirect, portal presentation, and CoA after successful login
- Local Web Authentication versus central approaches and when each applies
- Guest portal types such as hotspot, self-registered, and sponsored guest access
- Guest account lifecycle, sponsor groups, and the policies governing guest access duration and permissions
- Portal customization and the role of authorization profiles in limiting guest access
A common point of confusion is the sequence in CWA: the initial authentication returns a redirect, the user authenticates through the portal, and then CoA applies the final access. Practice drawing that sequence from memory, because exam questions frequently test which step is failing when a guest remains stuck at the portal.
Domain 4: Profiler (15%)
Profiling lets ISE classify endpoints by device type so policy can be applied without manual inventory. At 15%, it is a major scoring opportunity.
Profiler Fundamentals
Focus on how ISE collects attributes, matches them against profiling policies, and uses the resulting classification in authorization.
- Profiling probes such as DHCP, HTTP, RADIUS, SNMP, and NetFlow, and what attributes each contributes
- Profiling policies, certainty factors, and how conditions accumulate toward an endpoint classification
- Endpoint identity groups and how profiled endpoints feed authorization rules
- Profiler feed service and keeping profiling policies current
- Using profiling results in policy to treat headless devices such as printers or IP phones appropriately
The conceptual trap is assuming one probe is enough. Understand why combining probes raises certainty, and be ready to identify which probe is missing when an endpoint remains classified as a generic or unknown device.
Domain 5: BYOD (15%)
Bring-your-own-device is another 15% domain, and it was refreshed in v1.2. It covers securely onboarding personal devices and issuing them credentials.
BYOD Lifecycle Essentials
Think of BYOD as a lifecycle: identify the device, onboard it, provision credentials, and later revoke or manage it.
- Single-SSID versus dual-SSID onboarding designs and the tradeoffs between them
- Native supplicant provisioning and certificate enrollment for personal devices
- Zero-touch provisioning concepts, which were already part of the earlier blueprint
- Device registration, My Devices portal management, and handling lost or stolen devices
- The role of the internal certificate authority and how issued certificates are used in subsequent authentications
Because the BYOD lifecycle objectives were updated, rely on current materials. Our SISE study guide outlines how to build a lab that walks an endpoint through the complete onboarding path rather than studying each stage in isolation.
Domain 6: Endpoint Compliance (10%)
Endpoint Compliance covers posture: verifying that a device meets your security requirements before granting full access. It is weighted at 10%, and the objectives were updated in v1.2.
Posture Concepts to Master
Understand the posture flow from discovery through assessment to remediation and final authorization.
- Posture policies, requirements, and conditions, and how they chain together
- Client provisioning and the agent deployment that performs the assessment, including Cisco Secure Client
- Posture states such as unknown, compliant, and non-compliant, and the authorization results mapped to each
- Remediation actions and how CoA moves an endpoint between states
- Interaction between posture and ISE authorization policy
The recommended preparation in Cisco's training overview includes familiarity with Cisco Secure Client, which is a hint that you should have seen the client-side experience, not just the ISE configuration screens.
Domain 7: Network Access Device Administration (10%)
The final domain covers using ISE to control administrative access to network devices through TACACS+. Where RADIUS governs endpoints connecting to the network, TACACS+ governs administrators logging into the infrastructure.
TACACS+ Topics
Know the three A's and, with the v1.2 refresh, give accounting equal attention.
- Device administration policy sets, separate from network access policy sets
- Command sets and shell profiles used to authorize what an administrator may do
- Authentication against internal or external identity stores for administrators
- TACACS+ accounting, now explicitly listed in the objectives
- Configuring the network device side so it points to ISE for administrative AAA
Exam Format and Logistics
Knowing the content is half the job; understanding the delivery rules removes surprises on test day.
- Duration: the proctored, computer-delivered written exam lasts 90 minutes.
- Delivery: through Pearson VUE test centers or eligible OnVUE online appointments.
- Fee: USD 300 plus tax, and Cisco Learning Credits are accepted. See our SISE certification cost breakdown for the full picture.
- Closed book: personal books and notes are excluded under the Cisco Candidate Rules Agreement, and you must accept the confidentiality agreement.
- Question types: Cisco's general guidance mentions multiple-choice, drag-and-drop, and possible performance-based lab items, but no particular item mix is guaranteed for every SISE delivery.
- Question count and scoring: no fixed question count or official pass rate was verified, and Cisco does not publish a fixed numeric passing score. Details are covered in our pages on the SISE passing score and SISE pass rate.
- Retakes: after a failed attempt, wait five calendar days beginning the following day before retaking the same exam.
- Language: the individual SISE page lists English, while the CCNP Security catalog also lists Japanese, so verify the language offered for your specific booking.
There is no formal prerequisite or mandatory training course. For eligibility details, see SISE requirements. Cisco's official course awards 32 CE credits and prepares for v1.2, and it recommends familiarity with Cisco IOS CLI for wired and wireless devices, Cisco Secure Client, Microsoft Windows, and 802.1X. Those are recommended background, not exam prerequisites.
Sequencing Your Preparation by Domain
Rather than a generic schedule, sequence by dependency and weight. Here is one ordering that follows how the domains build on each other.
Architecture, then Policy Enforcement foundations
- Cover Domain 1 quickly so node roles and identity sources are settled
- Begin Domain 2 with 802.1X, host mode, and MAB at the switch port
Deepen Policy Enforcement
- Build policy sets, authorization profiles, and practice CoA
- Troubleshoot with live logs until diagnosis feels routine
Portals, Profiler, and BYOD
- Work through CWA and guest portals, then probes and certainty factors
- Walk a device through the complete BYOD lifecycle
Compliance and device administration
- Run a posture flow end to end with Cisco Secure Client
- Configure TACACS+ authentication, authorization, and accounting
Finish with timed practice. The SISE practice tests on our main site let you rehearse the 90-minute pacing, and you can pair that with the SISE cheat sheet for last-pass review. Because the exam is closed book, final-week recall practice matters more than re-reading.
Why These Domains Matter Beyond the Exam
The seven domains map closely to real engineering work: designing secure access, onboarding users and guests, classifying devices, enforcing compliance, and locking down administrative access. Passing earns the Cisco Certified Specialist - Security Identity Management Implementation and satisfies the CCNP Security concentration requirement. Full CCNP Security also requires the 350-701 SCOR core exam. If you are weighing the investment, see whether the SISE certification is worth it and our look at SISE jobs for the roles that value this skill set.
Keep renewal in mind too. The Specialist certification is valid for three years, and its CE renewal route requires 40 credits before expiry, so the 32-credit course alone is insufficient. CCNP renewal requires 80 CE credits, with concentration exam passes earning 40 and core exam passes earning 80. The three-year window for combining CCNP exam passes is separate from certification renewal, and CE renewal does not extend that exam-completion window.
Frequently Asked Questions
Policy Enforcement is the largest domain at 25%. Web Auth and Guest Services, Profiler, and BYOD each carry 15%, while Architecture and Deployment, Endpoint Compliance, and Network Access Device Administration each carry 10%.
The refresh adds host mode to wired 802.1X, updates the BYOD lifecycle and posture objectives, and explicitly adds TACACS+ accounting. Zero-touch provisioning and Change of Authorization were already in the earlier version.
The proctored exam runs 90 minutes and costs USD 300 plus tax, with Cisco Learning Credits accepted. It is delivered through Pearson VUE test centers or eligible OnVUE online appointments.
Not by itself. Passing 300-715 earns the Cisco Certified Specialist - Security Identity Management Implementation and satisfies the CCNP Security concentration requirement, but full CCNP Security also requires passing the 350-701 SCOR core exam.
You must wait five calendar days, beginning the following day, before retaking the same exam. Cisco does not publish a fixed numeric passing score, so review your domain-level results and focus on the heavier-weighted areas first.