300-715 — Frequently Asked Questions

Self-Registered portals allow guests to create their own accounts via email verification, violating the requirement that guests cannot create accounts.

No, Hotspot Guest Access typically relies on Acceptable Use Policy (AUP) acceptance without requiring specific user credentials.

SNMP is an ISE-side probe that queries the WLC for attributes; it is not a Device Sensor protocol configured on the WLC to push client data to ISE.

It forwards DHCP and RADIUS attributes such as hostname, device type, and OS so ISE can build endpoint profiles for authorization policies.

The portal is only the navigation path; the actual upload happens when you select agent resources from the local disk inside the Client Provisioning Resources page.

Yes, go to Policy > Results > Client Provisioning > Resources, click Add, and choose Agent resources from local disk to upload the downloaded compliance module.

ISE returns the Default Privilege in the TACACS+ authorization reply; a value of 1 puts the admin in user exec, forcing the enable command that the requirement explicitly forbids.

Enumerating all commands is impractical and error-prone; selecting "Permit any command that is not listed below" grants full access while still allowing explicit denies.

OWN_ACCOUNTS limits a sponsor to the guest accounts that sponsor personally created, so peers in the same business unit would be invisible — narrower than the stated requirement.

GROUP_ACCOUNTS lets a sponsor manage only accounts created by sponsors in its own sponsor group, while ALL_ACCOUNTS grants management of every guest account across the deployment.

pxGrid only carries attributes between ISE and the external adapters; the authorization decision itself is evaluated by the Policy Service (PSN) persona, which is what the question asks for.

Adapter integration does use the pxGrid framework, but the question asks which persona makes the authorization decision, and that is always Policy Service.

MAP Location is evaluated as a condition in the authorization policy rule using data from the MSE integration. It cannot be selected inside the Authorization Profile, which is what this question asks about.

ISE queries the integrated MSE for the endpoint's location about every five minutes and triggers a CoA when the location changes, re-applying the room-scoped authorization profile.

The WLC authorizes by management role, so ISE must return the Monitor role in the TACACS profile to restrict helpdesk users to the Monitor tab.

AireOS controllers use role-based access control over whole UI menus rather than per-command authorization, so command sets (E) have no effect.