300-715 — frequently asked questions

Self-Registered portals allow guests to create their own accounts via email verification, violating the requirement that guests cannot create accounts.

No, Hotspot Guest Access typically relies on Acceptable Use Policy (AUP) acceptance without requiring specific user credentials.

SNMP is an ISE-side probe that queries the WLC for attributes; it is not a Device Sensor protocol configured on the WLC to push client data to ISE.

It forwards DHCP and RADIUS attributes such as hostname, device type, and OS so ISE can build endpoint profiles for authorization policies.

The portal is only the navigation path; the actual upload happens when you select agent resources from the local disk inside the Client Provisioning Resources page.

Yes, go to Policy > Results > Client Provisioning > Resources, click Add, and choose Agent resources from local disk to upload the downloaded compliance module.

ISE returns the Default Privilege in the TACACS+ authorization reply; a value of 1 puts the admin in user exec, forcing the enable command that the requirement explicitly forbids.

Enumerating all commands is impractical and error-prone; selecting "Permit any command that is not listed below" grants full access while still allowing explicit denies.

OWN_ACCOUNTS limits a sponsor to the guest accounts that sponsor personally created, so peers in the same business unit would be invisible — narrower than the stated requirement.

GROUP_ACCOUNTS lets a sponsor manage only accounts created by sponsors in its own sponsor group, while ALL_ACCOUNTS grants management of every guest account across the deployment.

pxGrid only carries attributes between ISE and the external adapters; the authorization decision itself is evaluated by the Policy Service (PSN) persona, which is what the question asks for.

Adapter integration does use the pxGrid framework, but the question asks which persona makes the authorization decision, and that is always Policy Service.

MAP Location is evaluated as a condition in the authorization policy rule using data from the MSE integration. It cannot be selected inside the Authorization Profile, which is what this question asks about.

ISE queries the integrated MSE for the endpoint's location about every five minutes and triggers a CoA when the location changes, re-applying the room-scoped authorization profile.

The WLC authorizes by management role, so ISE must return the Monitor role in the TACACS profile to restrict helpdesk users to the Monitor tab.

AireOS controllers use role-based access control over whole UI menus rather than per-command authorization, so command sets (E) have no effect.

While Android often uses EST, other OS versions or configurations may also support it. More importantly, the protocol is an implementation detail, whereas having a certificate is a mandatory security requirement.

Typically, the CN contains the username or identity, and the SAN contains the MAC address or MAC+GUID to uniquely identify the device.

Dual-SSID is the deployment model (an onboarding SSID plus a secure SSID), not an SSID type. The WLC SSID you dedicate to onboarding is configured as a guest SSID.

Yes. In the dual-SSID BYOD flow the onboarding SSID is open with centralized web authentication, redirecting the client to the ISE BYOD/guest portal for registration and certificate provisioning.

Client Provisioning delivers supplicant, posture and compliance software to endpoints that can run it; it does not register devices that have no native supplicant and cannot install one.

The BYOD portal drives self-service onboarding with supplicant and certificate provisioning for capable devices; My Devices covers registering endpoints that lack that supplicant support.

File existence, date, and version checks are posture conditions in ISE posture policy; they evaluate endpoint state after the posture agent is provisioned.

Yes, ISE client provisioning can deliver native supplicant profiles for personal devices in addition to posture agent profiles for Windows, macOS, and Linux.

A Service Condition in ISE checks whether a Windows service or macOS daemon is running; it does not evaluate AD group membership, so it cannot differentiate posture per AD group.

It is referenced under the posture policy's Other Conditions; the policy then applies its posture requirements only to endpoints whose users match that AD group condition.

ISE nodes verify each other over TLS during registration, so a missing or untrusted admin certificate breaks that handshake and ISE surfaces the failure as an unreachable node.

No. A newly installed node is standalone by default and must be registered before deployment roles apply, so standalone mode is the expected starting state, not the error cause.

NMAP is an active scanner that generates traffic. When an NMS exists, SNMP is preferred for passive, low-disruption integration.

No. RADIUS is an authentication protocol. Probes like SNMP are used to discover device attributes and inventory.

Inside the named RADIUS server stanza — 'radius server cisco-ise' followed by 'pac key Cisco123' — not with the ASA command 'cts import-pac', which IOS does not support.

1812/1813 are the IETF-standard RADIUS authentication and accounting ports defined by RFC 2865/2866, while 1645/1646 are the legacy pre-RFC values that Cisco ISE and current TrustSec guides no longer use.