- What SISE Stands For
- What the 300-715 Exam Covers
- Cisco ISE in Plain Terms
- The Seven Domains and What They Mean in Practice
- Exam Mechanics: Fee, Format and Booking
- Where SISE Sits in the CCNP Security Path
- Who Needs This Skill Set
- Sequencing Your Preparation by Domain
- Validity and Renewal
- Frequently Asked Questions
- SISE means Implementing and Configuring Cisco Identity Services Engine, exam code 300-715, issued by Cisco.
- Policy Enforcement is the largest domain at 25%; Web Auth and Guest Services, Profiler and BYOD each carry 15%.
- The exam is 90 minutes, closed book, USD 300 plus tax, delivered through Pearson VUE.
- Passing earns Cisco Certified Specialist - Security Identity Management Implementation and fulfills the CCNP Security concentration requirement.
What SISE Stands For
In this context, SISE is Cisco's short name for the exam titled Implementing and Configuring Cisco Identity Services Engine, with exam code 300-715. The letters come from the Cisco exam naming convention, where "SISE" identifies the Identity Services Engine implementation exam in the security track. It is not a general industry acronym, and it should not be confused with unrelated credentials that happen to share four letters. Everything on this page refers only to the Cisco 300-715 exam and the skills it validates.
If you are looking for a shorter explanation of the term, our pages on what SISE stands for and what SISE certification is cover the basics. This article goes further: it explains what the name actually commits you to learning, how the exam is structured, and how the credential fits into Cisco's certification ladder.
What the 300-715 Exam Covers
The 300-715 SISE exam is a concentration exam within Cisco's CCNP Security program. It tests whether you can deploy, configure and operate Cisco ISE for network access control. That includes authenticating users and devices, enforcing authorization policy, running guest portals, profiling endpoints, onboarding personal devices, checking endpoint compliance, and administering network devices through TACACS+.
The exam objectives are published by Cisco as a weighted blueprint. The current one is v1.2, copyright 2026 and effective August 27, 2026. Cisco cautions that related topics may also appear and that the objectives may change, so treat the blueprint as a floor rather than a ceiling. For a deeper walk through each content area, see our complete guide to all seven SISE exam domains.
There is no formal prerequisite and no mandatory course. Cisco's training overview recommends familiarity with the Cisco IOS CLI for wired and wireless devices, Cisco Secure Client, Microsoft Windows and 802.1X, but these are preparation suggestions, not eligibility gates. Our SISE requirements guide covers eligibility in more detail.
Cisco ISE in Plain Terms
To understand the exam name, you need to understand the product. Cisco Identity Services Engine is a policy platform that decides who and what may connect to a network, under which conditions, and with what level of access. In a typical deployment, a switch, wireless controller or VPN headend acts as a network access device (NAD) and asks ISE to authenticate a connecting user or device. ISE evaluates policy and returns an authorization result, such as a VLAN, a downloadable ACL or a security group tag.
Several moving parts recur throughout the exam:
- RADIUS for network access authentication and authorization, and TACACS+ for device administration.
- 802.1X, MAB and web authentication as the primary methods for identifying endpoints on wired and wireless networks.
- Policy sets, authentication policies and authorization policies that determine the outcome for each session.
- Change of Authorization (CoA), which lets ISE alter a live session after the fact, for example once posture status or a profiling result changes.
- Deployment personas such as Policy Administration, Monitoring and Policy Service nodes, which shape how you scale and distribute an ISE deployment.
Cisco's updated training covers ISE versions 3.4 and 3.5, but software versions do not replace the v1.2 exam-blueprint label. The blueprint is the authoritative statement of what you are tested on.
The Seven Domains and What They Mean in Practice
The v1.2 blueprint divides the exam into seven weighted domains. The weights below come directly from Cisco's published objectives.
| Domain | Weight | Practical Focus |
|---|---|---|
| Architecture and Deployment | 10% | Personas, node deployment, certificates and integration basics |
| Policy Enforcement | 25% | 802.1X, MAB, host mode, authorization results, CoA, policy sets |
| Web Auth and Guest Services | 15% | Central web authentication, guest portals, sponsor and self-registration flows |
| Profiler | 15% | Probes, profiling policies, endpoint identity groups |
| BYOD | 15% | Onboarding flow, certificate provisioning, device lifecycle |
| Endpoint Compliance | 10% | Posture assessment, remediation, client provisioning |
| Network Access Device Administration | 10% | TACACS+ authentication, authorization and accounting |
Domain 2: Policy Enforcement (25%)
This is the heart of the exam and the single largest block of questions you should expect to prepare for. It tests how you translate business rules into ISE policy that switches and controllers can actually enforce.
- Wired 802.1X configuration, including the host mode behavior newly added in v1.2.
- The differences between single-host, multi-host, multi-domain and multi-auth modes, and when each fits.
- Building authentication and authorization policies, and understanding the order in which ISE evaluates them.
- Authorization results: VLAN assignment, dACLs, SGTs and how they interact with the NAD configuration.
- CoA behavior and the conditions that trigger it.
Domain 3: Web Auth and Guest Services (15%)
Guest access sits at the intersection of ISE configuration and network redirection, which is why candidates who know ISE well still stumble here.
- Central web authentication flow, including the redirect ACL and the role of CoA after login.
- Guest portal types and sponsor workflows.
- Guest account lifecycle, including creation, expiry and reporting.
Domain 4: Profiler (15%)
Profiling lets ISE classify endpoints automatically so policy can treat a printer differently from a laptop without manual lists.
- Probes and the attributes each one collects.
- How profiling policies score endpoints and assign them to identity groups.
- Using profiling results inside authorization policy.
Domain 5: BYOD (15%)
The v1.2 refresh updated the BYOD lifecycle objectives. Expect questions on how a personal device moves from unknown to onboarded.
- The onboarding sequence, including supplicant and certificate provisioning.
- Zero-touch provisioning concepts, already present in earlier versions of the blueprint.
- Handling a device through its lifecycle, including re-enrollment and revocation.
Domain 6: Endpoint Compliance (10%)
Posture determines whether an endpoint meets your security baseline before it receives full access. The v1.2 objectives updated posture topics.
- Posture policy elements: conditions, requirements and remediation.
- Client provisioning and the agent or Cisco Secure Client role in posture checks.
- Granting limited access during assessment and transitioning to full access after compliance.
Domain 7: Network Access Device Administration (10%)
This domain moves from user access to administrator access on network gear using TACACS+.
- Command authorization and shell profiles.
- TACACS+ policy sets and how they differ from RADIUS policy sets.
- TACACS+ accounting, which v1.2 explicitly adds to the objectives.
Domain 1: Architecture and Deployment (10%)
The smallest-weighted foundation, but it underpins everything else.
- ISE node personas and how they combine in standalone and distributed deployments.
- Certificate usage across ISE roles and why certificate mistakes break otherwise correct policy.
- Integration with identity sources and network devices.
Exam Mechanics: Fee, Format and Booking
Knowing what SISE means is only useful if you also know how the exam is delivered. These are the verified details:
- Fee: USD 300 plus tax. Cisco Learning Credits are accepted. A fuller breakdown is in our SISE certification cost guide.
- Duration: 90 minutes.
- Delivery: proctored, computer-delivered, through Pearson VUE test centers or eligible OnVUE online appointments.
- Rules: closed book. Under the Cisco Candidate Rules Agreement (v1.0, June 2019), personal books and notes are excluded, and current policies require acceptance of the confidentiality agreement.
- Retake wait: after a failed attempt, you wait five calendar days beginning the following day before retaking the same exam.
- Language: the individual SISE page lists English, while the CCNP Security catalog also lists Japanese, so verify the language offered for your specific booking.
Question Style
Cisco does not publish a fixed question count for SISE, and no official pass rate has been verified. Cisco's general guidance for Associate and Professional exams describes multiple-choice items, drag-and-drop items and the possibility of performance-based lab items, but it does not guarantee a particular mix on every SISE delivery. In practice, prepare for scenario-style questions where you read a policy configuration, a log excerpt or a flow description and identify what ISE will do next or why a session failed.
Scoring
Cisco does not publish a fixed numeric passing score. Standards are determined statistically and can change, so any website quoting an exact cut score should be treated with caution. Our article on the SISE passing score explains what is and is not known, and the SISE pass rate discussion covers why a verified pass rate is not available.
Key Takeaway
Because the exam is closed book and the question count is not fixed, depth beats breadth. Be able to explain, from memory, why ISE returns a given result for a given session. Pairing hands-on lab time with scenario practice from the SISE practice test site builds that reasoning habit.
Where SISE Sits in the CCNP Security Path
The 300-715 is a concentration exam. Passing it does two things at once: it earns the standalone Cisco Certified Specialist - Security Identity Management Implementation credential, and it satisfies the concentration requirement for CCNP Security. The full CCNP Security certification also requires the core exam, 350-701 SCOR. So SISE alone does not make you CCNP Security certified, but it is one of the two exams that do.
| Outcome | What You Need |
|---|---|
| Cisco Certified Specialist - Security Identity Management Implementation | Pass 300-715 SISE |
| CCNP Security concentration requirement | Pass 300-715 SISE (or another approved concentration) |
| Full CCNP Security | Pass 350-701 SCOR plus a concentration exam such as SISE |
For a broader look at the credential itself, see our overview of SISE certification, and for a value assessment, our analysis of whether the SISE certification is worth it.
Who Needs This Skill Set
ISE skills are in demand wherever organizations control network access at scale: enterprises with large campus and branch networks, healthcare providers managing clinical devices, education institutions handling guest and personal devices, government agencies, and managed service providers that operate network access control for clients. The roles that typically benefit include network security engineers, network access control specialists, security architects, and systems engineers at Cisco partners who deploy ISE for customers.
The SISE objectives map neatly to daily tasks in those roles: troubleshooting why a device landed in the wrong VLAN, building a guest portal for a visitor network, onboarding employee-owned phones, or configuring TACACS+ so only authorized staff can change a core switch. For more on the job market, see our pages on SISE jobs and the SISE salary guide. Both treat compensation qualitatively, since reliable figures vary widely by region and employer.
Sequencing Your Preparation by Domain
You need only one generic idea here: study in dependency order, not blueprint order. ISE concepts build on each other, so the sequence below puts foundations first and the heaviest domain early enough to revisit.
Architecture, then Policy Enforcement
- Learn personas, certificates and NAD integration first, since later labs depend on them.
- Work through 802.1X, MAB, host modes, authorization results and CoA. This is 25% of the exam, so give it the most lab time.
Web Auth, Profiler and BYOD
- Build a guest portal and trace the redirect and CoA sequence.
- Enable profiling probes and write authorization rules that use profiling results.
- Walk through the BYOD onboarding lifecycle end to end.
Endpoint Compliance and Device Administration
- Configure posture policy and understand limited-access states during assessment.
- Set up TACACS+ authorization and accounting, the newly explicit v1.2 item.
Integration and Review
- Revisit Policy Enforcement scenarios where several domains interact.
- Take timed practice sets against the 90-minute limit and review every miss.
For a fuller plan, read our SISE study guide, and keep our SISE cheat sheet handy for last-day review. If you are weighing how much preparation you need, how hard the SISE exam is gives an honest difficulty view. Cisco also offers an official Implementing and Configuring Cisco Identity Services Engine training course, which prepares for v1.2 and awards 32 CE credits; see our page on SISE training for options.
Validity and Renewal
The Specialist certification is valid for three years. Its continuing education renewal route requires 40 credits before expiry, so the 32-credit official course alone is not enough to renew on its own. Professional-level CCNP renewal requires 80 CE credits; a qualifying concentration exam pass earns 40 CE and a core exam pass earns 80.
One distinction trips people up: the three-year window for combining CCNP exam passes is separate from renewal of an earned certification. CE renewal does not extend the window in which you must complete the exams for a CCNP. Plan your SCOR and SISE attempts with that window in mind, and check the SISE exam dates and scheduling guide for booking logistics.
Frequently Asked Questions
SISE refers to the Cisco exam Implementing and Configuring Cisco Identity Services Engine, exam code 300-715. It validates skills for deploying and operating Cisco ISE for network access control. For related phrasing, see our pages on what SISE means and what SISE is.
No. SISE is one concentration exam. Passing it earns a Specialist certification and satisfies the CCNP Security concentration requirement, but full CCNP Security also requires the 350-701 SCOR core exam.
Cisco does not publish a fixed question count or a fixed numeric passing score for this exam. Standards are determined statistically and can change. The exam lasts 90 minutes and is closed book.
No formal prerequisites or mandatory training exist. Familiarity with the Cisco IOS CLI, Cisco Secure Client, Microsoft Windows and 802.1X is recommended preparation, not a requirement. The official course is optional.
Policy Enforcement, at 25%, carries the most weight, followed by Web Auth and Guest Services, Profiler and BYOD at 15% each. Because ISE domains interact, strong Policy Enforcement skills also help you reason through questions in the other areas.