Cisco Implementing and Configuring Cisco Identity Services Engine (SISE) v1.1 (300-715 SISE) 300-715 Exam Dumps: Updated Questions & Answers (July 2026)

The Policy Service persona must be enabled because the Policy Service Node processes authentication, authorization, and accounting requests, including TACACS+ requests handled by the Device Administration service. When a network administrator signs in to a router, switch, firewall, or wireless controller, the network device forwards the TACACS+ request to an ISE node on which Device Administration is enabled. That node evaluates the applicable device-administration policy set, identity source, command set, and TACACS+ shell profile. The Administration persona provides the management interface and maintains deployment-wide configuration but does not independently process endpoint or device-administration authentication requests. The Monitoring persona collects operational data, logs, reports, and troubleshooting information. The pxGrid persona publishes and exchanges contextual information with integrated security platforms. Therefore, the Device Admin service must operate on a Policy Service Node.

A TACACS+ authorization profile and command sets are required to control the administrator’s ASA session. The authorization profile, commonly implemented as a TACACS+ shell profile, returns session-level attributes such as the assigned privilege level or service parameters. TACACS+ command sets define which ASA commands are permitted or denied and allow Cisco ISE to validate each command authorization request sent by the firewall. Authentication against the local ISE user database is selected through the Device Administration authentication policy and identity-source configuration; it does not require a generic “enable local authentication” action. An authentication profile is associated with certificate-based network access rather than this TACACS+ workflow. A user identity group can be useful as a policy condition, but the users have already been configured and the stated missing requirements concern session authorization and command validation.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200534-ISE-2-0-Certificate-Provisioning-Portal.html

https://community.cisco.com/t5/security-knowledge-base/segmentation-strategy/ta-p/3757424: " The method of sending out IP to SGT mappings from ISE is particularly useful if the access switch does not support TrustSec "

EAP-GTC, or EAP Generic Token Card, supports authentication using token-based or one-time-password credentials. It can operate within a protected EAP method, such as PEAP, so that the token credentials are transmitted through an encrypted TLS tunnel. This makes it appropriate when Cisco Secure Client users authenticate against an LDAP-backed token system. MS-CHAPv2 is primarily designed for username-and-password authentication and requires password-verification capabilities that generic LDAP or token systems may not provide. LEAP is a legacy Cisco authentication method with known security weaknesses and should not be selected for a new secure deployment. EAP-MD5 provides only basic challenge-response authentication, lacks mutual authentication, and does not provide suitable protection for wireless enterprise access. Therefore, EAP-GTC is the protocol aligned with secure-token authentication through Cisco Secure Client.

https://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_aaa/configuration/15-2mt/sec-config-mab.html