I85PREP
⌘ K
Cisco 300-715 SISE study materials
Cisco 300-715 SISE study resources

Cisco 300-715 SISE: Policy Enforcement and Profiling

Cisco 300-715 SISE · Work through your exam, one topic at a time.

All guide sections

Policy Enforcement and Profiling

Policy Enforcement and Profiling

This domain tests the decision path after identity: policy sets, authentication and authorization rules, authorization profiles, profiling, posture, client provisioning, and BYOD. The exam expects you to predict which rule fires and what happens when an endpoint's profile or posture changes.

Core rules

  • A policy set is the top-level container; conditions can match device type, location, SSID, protocol, and other dictionary attributes. If no policy set matches, the default policy set applies.
  • Inside a policy set, authentication selects the identity source; authorization rules are evaluated top-down and the first match wins. Order is a design decision, not a cosmetic setting.
  • Authorization profiles return results such as VLAN, DACL, SGT, URL redirect, web authentication, posture, or client provisioning.
  • Profiling uses probes such as RADIUS, DHCP, SNMP, NetFlow, DNS, HTTP, and NMAP. Endpoint profile policies map profiler conditions to profiles; a profile change needs CoA to reapply authorization.
  • Posture evaluates posture conditions and can remediate or restrict. It depends on the posture module/client provisioning flow.
  • BYOD uses native supplicant provisioning, certificate enrollment, and the My Devices portal; it is a workflow, not a single authorization rule.

Worked example

A corporate wireless policy set matches SSID Corp. Authentication is AD. Authorization rules are ordered: (1) PostureStatus Unknown -> Client Provisioning redirect; (2) PostureStatus NotCompliant -> Remediation VLAN; (3) PostureStatus Compliant AND Profiler:OperatingSystem Windows -> Employee-FullAccess with VLAN 100 and DACL; (4) default -> Deny. A Windows laptop first appears as Unknown, so rule 1 redirects it to provisioning. After the agent runs and posture becomes Compliant, ISE issues CoA; the new session matches rule 3. If rule 3 were placed above rule 1, the unknown session would fall through to the default and never remediate. The reasoning is first-match order plus CoA after a posture/profile change.

Traps

  • Placing a broad permit above a specific exception.
  • Forgetting that a profiler update does not reauthorize without CoA.
  • Mixing posture status with endpoint profile; they are different conditions.
  • Returning a VLAN and a DACL that conflict with the switch port configuration.
  • Assuming client provisioning and BYOD are the same portal flow.
  • Using 'Permit' as a default when an explicit deny is required.