SkillTestPro | CCNP Security 300-715 SISE Practice Test 23

CCNP Security 300-715 SISE Practice Test 23 (Hard) - BYOD Certificate Lifecycle Management

CISCO CCNP Security Exam Logo

1 / 10

Which action would an administrator take in Cisco ISE to immediately invalidate a BYOD device's certificate after the associated employee reports the device lost or stolen?

Revoke the device's certificate (and typically also remove or disable its endpoint record) so it can no longer authenticate successfully

Wait until the certificate's normal expiration date with no earlier intervention possible

Change the guest portal's background image as the only available response

Power off the entire wireless network to revoke the one device's access

Contact the device manufacturer and ask them to remotely disable the device with no ISE-side action, though this is not generally recommended

Rename the SSID network-wide to revoke the one device's access

2 / 10

Which certificate lifecycle attribute determines how long a BYOD device's ISE-issued certificate remains valid before requiring renewal or re-enrollment?

The sponsor group's permitted guest types setting, which is unrelated to BYOD certificate validity

The profiler feed service's update schedule, which is unrelated to certificate validity

The TACACS+ command set's expiration setting, which is unrelated to BYOD device certificates

The guest type's maximum account duration setting, which applies to guest accounts rather than BYOD certificates

The network device group's location hierarchy, which is unrelated to certificate validity

The certificate's configured validity period (expiration date) set at issuance

3 / 10

Which practical challenge would an organization face if BYOD certificates were issued with an excessively long validity period and no straightforward revocation process?

A lost, stolen, or decommissioned device could retain valid network access credentials for an extended time, increasing security risk

The profiler feed service would automatically disable itself as a direct result

ISE would automatically shut down entirely once any certificate reaches its expiration date

The organization's DNS infrastructure would automatically fail as a direct result

The organization would automatically be required to reissue every certificate on a daily basis regardless of the configured validity period

All network devices would automatically lose RADIUS connectivity as a direct and unavoidable result

4 / 10

Which combination of certificate management practices helps balance user convenience with security for BYOD devices?

Extremely short validity periods requiring re-enrollment every single hour regardless of user impact, in accordance with common design practices, which is not the standard approach, based on standard platform behavior

Certificates that can never be revoked once issued under any circumstance

Certificates issued with no defined validity period or expiration mechanism at all

Indefinite, non-expiring certificates issued to every device with no revocation capability at all

Reasonable validity periods that reduce re-enrollment frequency, combined with prompt revocation capability for lost, stolen, or decommissioned devices and periodic review of issued certificates

No review of issued certificates at any point after initial issuance regardless of device status changes

5 / 10

Which process would an employee typically need to complete again if their BYOD device's certificate expires and the device needs continued network access?

Submitting a printed paper form and waiting 30 business days for manual processing with no digital option

Contacting Cisco TAC directly to have the certificate manually reissued with no self-service option available

Purchasing an entirely new device, since expired certificates can never be renewed under any circumstance

A renewal or re-enrollment process, potentially re-authenticating and obtaining a new certificate through the onboarding or renewal flow

Physically mailing the device to IT headquarters for manual certificate installation with no self-service option

Waiting exactly 90 days with no action required for the certificate to automatically renew itself with no user involvement, which is rarely the correct choice

6 / 10

Which reporting capability would help an administrator identify all currently active BYOD certificates approaching their expiration date, to proactively notify affected users?

The TACACS+ command set repository, which has no relationship to certificate expiration tracking

The guest portal's background image configuration, which has no relationship to certificate expiration tracking

The wireless access point's physical firmware version display, which has no relationship to certificate expiration tracking

Certificate-related reports or endpoint/context visibility data within ISE that reflect certificate status and expiration

The network device RADIUS shared secret configuration, which has no relationship to certificate expiration tracking

The sponsor group's permitted guest types setting, which has no relationship to certificate expiration tracking

7 / 10

Which security risk is most directly mitigated by promptly revoking a BYOD certificate when an employee leaves the organization?

The risk that the network operations center runs out of coffee

The departed employee's personal device retaining valid network access credentials after their employment (and associated authorization) has ended

The risk that the organization's printed employee handbook becomes outdated, though this is not generally recommended, which is inconsistent with expected behavior

The risk that the guest portal's background image becomes outdated

The risk that the ISE administrative GUI's color scheme becomes outdated

The risk that the visitor parking lot becomes overcrowded

8 / 10

Which combination of practices would provide effective certificate lifecycle governance for BYOD devices across a large organization with regular employee turnover?

Requiring every certificate renewal to go through a multi-week manual TAC engagement

Assuming employee turnover has no relationship to BYOD certificate governance needs

Never monitoring certificate expiration and only reacting after users report being locked out

Integrating certificate revocation into the employee offboarding process, setting reasonable validity periods, monitoring upcoming expirations, and maintaining a straightforward self-service renewal flow

Treating certificate revocation as entirely unrelated to the employee offboarding process, in accordance with common design practices, which is not the standard approach, in most deployment scenarios, under typical configuration conditions

Issuing certificates with no expiration and no revocation capability to simplify administration

9 / 10

Which factor would most influence how an organization sets the validity period for BYOD device certificates?

The average outdoor temperature at the organization's headquarters

The number of parking spaces available in the visitor lot

The specific brand of coffee served in the network operations center, though this is not generally recommended, in most deployment scenarios, in most deployment scenarios, in accordance with common design practices

The color scheme configured for the ISE administrative GUI

The organization's balance between minimizing user re-enrollment friction and limiting the window of risk if a device is lost, stolen, or a user's access should be revoked

The font used in the organization's internal newsletter

10 / 10

Which statement accurately describes why certificate-based BYOD authentication requires an ongoing lifecycle management process rather than a one-time issuance activity?

Devices are lost, stolen, decommissioned, or reassigned, and employees join or leave the organization, so certificates must be renewed, monitored, and revoked accordingly over time to remain secure and accurate

Certificate-based authentication requires no ongoing management once a certificate has been issued, since it remains valid forever with no risk change over time, which is rarely the correct choice, though this is not generally recommended

Employee turnover has no bearing on whether previously issued BYOD certificates should be reviewed or revoked

Ongoing certificate lifecycle management is only relevant to guest accounts and never applies to BYOD devices

Certificates automatically manage their own revocation with no administrator or process involvement required

Device loss or theft has no relationship to whether a previously issued certificate should be revoked

Your score is

The average score is 0%