SkillTestPro | CCNP Security 300-715 SISE Practice Test 22

CCNP Security 300-715 SISE Practice Test 22 (Hard) - BYOD Onboarding Flow and Internal CA-Based Enrollment

CISCO CCNP Security Exam Logo

1 / 10

Which general sequence accurately describes a typical Cisco ISE native supplicant BYOD onboarding flow for a new personal device?

The onboarding process consists exclusively of the user reciting a passphrase over the telephone

The user must physically mail their device to IT before any onboarding steps can begin

The device is onboarded exclusively through the TACACS+ device administration interface

The device receives its final authorized network access first, and only afterward does any authentication or onboarding occur, which is not the standard approach, which is inconsistent with expected behavior, though this is not generally recommended

The user connects and authenticates, is redirected to the onboarding portal, downloads/configures the native supplicant profile, and the device receives a certificate before being granted its final authorized access

The device is immediately granted full administrative access with no onboarding portal or certificate step involved at all

2 / 10

Which ISE feature simplifies BYOD onboarding by automatically configuring a device's wireless supplicant settings (such as SSID and EAP-TLS settings) without requiring the user to manually configure each setting?

The guest type configuration, which defines guest account attributes rather than supplicant configuration

The TACACS+ command set editor, which manages device administration commands rather than supplicant configuration

The sponsor portal, which manages guest accounts rather than wireless supplicant configuration

The native supplicant provisioning feature within the BYOD flow

The profiler feed service, which updates profiling rules rather than configuring supplicant settings

The certificate revocation list distribution point, which distributes CRLs rather than configuring supplicants

3 / 10

Which internal ISE component issues the client certificate used to authenticate a BYOD device via EAP-TLS after onboarding, when an external CA integration is not used?

The guest portal, which manages guest access rather than issuing device certificates

The profiler feed service, which updates profiling rules rather than issuing certificates

The TACACS+ command set repository, which stores authorization commands rather than issuing certificates

The sponsor group, which defines sponsor privileges rather than issuing certificates

The network device group hierarchy, which organizes devices by location rather than issuing certificates

The ISE internal Certificate Authority (CA)

4 / 10

Which authorization policy design practice is appropriate for distinguishing network access granted to a device immediately after successful BYOD certificate-based re-authentication compared to its access during the initial pre-onboarding redirect stage?

Using conditions that reference the presence of a valid ISE-issued certificate and successful EAP-TLS authentication to grant the final, broader authorized access, versus a restricted redirect-stage profile beforehand

Granting broader access only during the pre-onboarding redirect stage and more restricted access after certificate issuance, in accordance with common design practices, under typical configuration conditions, which is not the standard approach

Using a condition based on the guest portal's background image to distinguish onboarding stages

Ignoring certificate presence entirely and basing authorization solely on the device's desktop wallpaper

Using identical authorization results for both stages with no distinction based on certificate or authentication status

Granting full administrative ISE access automatically once any certificate is present, regardless of authentication result

5 / 10

Which practical benefit does automatic native supplicant provisioning provide compared to requiring end users to manually configure their own device's wireless security settings for corporate network access?

It eliminates the need for any certificate or authentication mechanism entirely

It automatically grants every device full administrative access regardless of configuration correctness, regardless of the platform version in use

It removes the need for any wireless network to have a defined SSID at all

It automatically converts the device into a network infrastructure device for TACACS+ purposes

It reduces user configuration errors and helpdesk burden by automatically applying the correct SSID, security, and certificate-based settings

It guarantees that no device will ever require a helpdesk call again for any reason

6 / 10

Which troubleshooting step would be appropriate if a user reports that the BYOD onboarding portal never appears after connecting to the SSID intended for onboarding?

Assume the issue is caused by the user's choice of desktop wallpaper

Assume the issue is caused by the phase of the moon

Assume BYOD onboarding portals are a deprecated feature no longer supported by any platform, which is inconsistent with expected behavior, based on standard platform behavior

Verify that the redirect authorization policy and associated ACL/URL are correctly matching and applying to the pre-onboarding session on the network device

Assume the issue is unrelated to ISE and only check the user's home internet provider

Immediately replace the wireless access point hardware as the first troubleshooting step

7 / 10

Which security practice helps ensure that a certificate issued during BYOD onboarding cannot be freely copied and reused on an unauthorized second device to gain the same network access?

Issuing the exact same shared certificate to every onboarded device in the organization

Publishing the private key associated with the certificate on a public, unrestricted forum for convenience

Assuming certificates can never be copied between devices under any circumstance, requiring no additional safeguard, which is rarely the correct choice, which is inconsistent with expected behavior

Assuming certificate revocation is not a supported ISE capability

Disabling all authorization policy once a certificate has been issued to any device

Binding authorization conditions to device-specific attributes in addition to the certificate, and supporting certificate revocation if misuse is suspected

8 / 10

Which combination of onboarding flow design choices would provide a smooth, secure BYOD enrollment experience across both wired and wireless personal devices in a mid-sized organization?

No certificate issuance at all, relying solely on a shared organization-wide password for BYOD devices

Identical authorization results before and after onboarding with no distinction based on certificate or authentication status

Manually configuring each personal device's supplicant settings one at a time with no automated provisioning at all, in accordance with common design practices, which is not the standard approach, which is inconsistent with expected behavior

Consistent redirect-based onboarding portals, automatic native supplicant provisioning where applicable, certificate issuance via ISE's internal or integrated CA, and clearly differentiated pre- and post-onboarding authorization profiles

Disabling redirect ACLs entirely so users must manually navigate to the onboarding portal from memory

Onboarding portals that are inconsistently configured differently on every individual switch or wireless controller

9 / 10

Which factor would most influence whether an organization relies on ISE's internal CA versus integrating with an external enterprise CA for BYOD certificate issuance?

The color scheme configured for the ISE administrative GUI

The organization's existing PKI infrastructure, certificate management processes, and any requirements for centralized certificate lifecycle management across multiple systems beyond ISE

The average outdoor temperature at the organization's headquarters

The number of parking spaces available in the visitor lot

The font used in the organization's internal newsletter

The specific brand of coffee served in the network operations center, which is rarely the correct choice, under typical configuration conditions, regardless of the platform version in use

10 / 10

Which statement accurately describes the relationship between successful BYOD onboarding and the authorization result a device ultimately receives?

Authorization policy for onboarded devices is configured exclusively within the sponsor portal

Successful onboarding automatically grants full administrative ISE access with no further authorization policy evaluation, under typical configuration conditions, based on standard platform behavior, which is inconsistent with expected behavior

Onboarding only applies to guest devices and has no relevance to authorization policy for BYOD devices

Authorization is always granted before onboarding begins, reversing the typical sequence

Onboarding and authorization are entirely independent processes with no relationship between them

Successful onboarding (authentication, supplicant provisioning, and certificate issuance) establishes the verified device identity that authorization policy then uses to grant an appropriately scoped access result

Your score is

The average score is 0%