I85PREP
⌘ K
Cisco 300-715 SISE study materials
Cisco 300-715 SISE study resources

Cisco 300-715 SISE: Identity Management and Secure Access

Cisco 300-715 SISE · Work through your exam, one topic at a time.

All guide sections

Identity Management and Secure Access

Identity Management and Secure Access

This domain tests how ISE establishes identity before policy is evaluated: authentication protocols, internal and external identity stores, identity source sequences, certificate-based authentication, MFA, and guest/sponsor identities. Questions often ask which store is consulted next or why a valid account is rejected after a store failure.

Core rules

  • Authentication proves an identity; authorization returns a result. A user can authenticate successfully and still receive a deny or restricted authorization profile.
  • Internal Users and Endpoints are local stores. AD is a joined domain service; LDAP is a bind-based directory. Guest accounts live in the guest store unless external identity is configured.
  • An identity source sequence is an ordered list. Its advanced settings decide two different cases: user not found and store unavailable. 'Continue' moves to the next store; 'Drop'/'Reject' stops processing.
  • AD join needs DNS, accurate time, and the machine account; LDAP needs a bind DN/password and a search base. Do not treat them as interchangeable.
  • Certificate authentication uses a certificate authentication profile to select the identity field and a trusted CA to validate the chain; OCSP/CRL checking and EKU client authentication matter.
  • MFA is enforced by chaining a RADIUS token/external RADIUS store or integrating a supported provider; it is not simply a local password setting.

Worked example

A company wants AD users to authenticate with PEAP-MSCHAPv2, but also needs a local breakglass account during an AD outage. The sequence is AD first, Internal Users second. On the AD entry, set 'If a user is not found' to Continue and 'If a store is unavailable' to Continue. If AD is down, ISE falls through to Internal Users, the breakglass account authenticates, and an authorization rule for Internal Users returns a restricted profile. If AD is up but the username is unknown, the sequence also falls through. If the AD entry is left at Drop on unavailable, the breakglass login fails because the sequence never reaches Internal Users. This is the reasoning the exam expects: sequence behavior is controlled by the two advanced settings, not by the order alone.

Traps

  • Confusing 'user not found' with 'store unavailable'; the defaults may not match the design.
  • Joining AD but forgetting DNS, NTP, or the machine account password.
  • Using an LDAP bind account where AD join is required, or vice versa.
  • Certificate auth with the wrong CA, missing EKU, or no OCSP/CRL reachability.
  • Assuming a guest sponsor is an AD user; sponsor accounts can be local.
  • Ignoring inner vs outer identity in PEAP/TTLS.