Cisco 300-715 SISE study plan

Map every component of an ISE deployment (PAN, MnT, PSN, pxGrid, SXP) to its role and traffic flows, then draw the topology from memory

Configure a basic standalone ISE node in a lab (or simulator) and verify service status for PAN, MnT, and PSN personas

Enumerate the identity sources ISE supports (AD, LDAP, local, certificate, SAML, social) and describe when each is appropriate

Set up an AD join and LDAP identity source in the lab and confirm successful user lookup from the ISE admin UI

Configure certificate services (internal CA, CSR generation, import, and trust chain) on ISE and validate EAP certificate use

Build an identity certificate template and enroll a test endpoint via SCEP or manual import

Explain pxGrid architecture, node registration, and at least three published topics, then enable pxGrid between two lab nodes

Differentiate authentication vs authorization vs accounting flows in RADIUS and map each to ISE policy stages

Build authentication policy sets with compound conditions (AD group, device type, protocol) and test allow/deny outcomes

Configure authorization profiles for VLAN, DACL, and SGT assignment and verify the returned RADIUS attributes

Create an endpoint identity group and manually register endpoints, then confirm group membership drives policy

Trace a failed authentication through ISE live logs and identify the policy stage where it failed

Configure profiling probes (RADIUS, DHCP, SNMP, NetFlow, pxGrid) and confirm at least two probes populate endpoint attributes

Create custom profiling policies using MAC OUI, DHCP fingerprint, and HTTP user-agent conditions

Apply an endpoint profiling policy to an authorization rule and verify the endpoint moves from Unknown to a profiled group

Set up an exception/static assignment and explain when static profiling overrides dynamic results

Configure guest portals (sponsored, self-registered, hot-spot) and walk through each flow end to end

Build guest and sponsor policy sets with authorization profiles that redirect unauthenticated guests to the portal

Create guest account lifecycle rules (duration, sponsor approval, device registration limits) and test expiry behavior

Configure a BYOD onboarding flow with certificate provisioning and verify the device reconnects using the issued certificate

Configure TACACS+ device administration with command authorization sets and test permit/deny on a lab switch

Create a TrustSec policy: define SGTs, SGACLs, and an egress policy matrix, then enforce on a lab device

Configure SXP or inline tagging to propagate SGTs and verify tag propagation with show commands

Explain change of authorization (CoA) and configure ISE to send a CoA that re-profiles or re-authorizes a session

Integrate ISE with external services: MDM, Threat Defense/pxGrid, and SIEM logging, and verify data exchange

Configure deployment scaling (node addition, persona distribution, licensing) and describe high-availability failover behavior

Design a monitoring and troubleshooting workflow using live logs, reports, and the MnT troubleshooting tools

Practice reading RADIUS and TACACS+ packet captures to diagnose a failed authentication

Review all eight weeks' lab notes and rebuild the two weakest configurations from scratch without notes

Take a timed practice assessment and classify every miss by domain and root cause

Re-drill the highest-miss subtopics (profiling, guest, TrustSec, deployment) until each is explained without reference

Write a one-page exam-day reference of key defaults, port numbers, and flow sequences