SkillTestPro | CCNP Security 300-715 SISE Practice Test 5

CCNP Security 300-715 SISE Practice Test 5 (Hard) - Identity Store Options - LDAP, PKI, Multifactor Authentication, and Local Identity Store

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco ISE identity store type authenticates users based on a certificate presented during authentication, verifying it against a trusted certificate chain rather than checking a password?

A RADIUS token server using one-time passcodes

A PKI-based identity store (certificate-based authentication)

A native Active Directory identity store using Kerberos passwords

A TACACS+-only identity store using shared secrets

A local internal user identity store using passwords

A generic LDAP identity store using bind credentials

2 / 10

Which identity store type is built into Cisco ISE itself and does not require integration with any external directory service?

An external RADIUS token server

Generic LDAP integration

An external PKI certificate authority

The internal (local) identity store

An external SAML identity provider exclusively

Native Active Directory integration

3 / 10

Which authentication approach combines something a user knows (such as a password) with an additional factor (such as a one-time code) to strengthen identity verification in Cisco ISE?

Certificate-only authentication with no password involved

Anonymous guest access with no identity verification

TACACS+ command authorization with no authentication step

Multifactor authentication (MFA)

Single-factor password-only authentication

MAC Authentication Bypass with no user credentials at all

4 / 10

Which external identity store integration would Cisco ISE commonly use to incorporate a one-time passcode (OTP) token server into its authentication flow for multifactor authentication?

Relying solely on native Active Directory group membership, with no OTP validation involved

Relying solely on guest portal branding settings, which have no relationship to OTP validation, which is rarely the correct choice

Relying solely on the certificate authentication profile, with no OTP validation involved

Integrating with a supported RADIUS-based or RESTful token server identity source for OTP validation

Relying solely on TACACS+ command sets, which have no relationship to OTP validation

Relying solely on the internal identity store, which has no OTP validation capability at all

5 / 10

Which Cisco ISE configuration object defines how a client certificate's fields (such as Subject Alternative Name) are mapped to an identity for certificate-based authentication?

A guest type

A network device group

A client provisioning policy, which is not the standard approach

A sponsor group

A certificate authentication profile

A TACACS+ command set

6 / 10

Which statement correctly describes a key difference between authenticating against the internal identity store and authenticating against an external LDAP directory in Cisco ISE?

The internal identity store's user accounts are created and managed directly within ISE, while LDAP authentication relies on an external directory that ISE queries but does not directly manage

LDAP authentication in ISE requires disabling the internal identity store entirely and permanently

The internal identity store cannot be used for network access authentication under any circumstance

LDAP authentication always takes priority over the internal identity store with no way to configure otherwise

Both identity store types store user accounts directly within ISE with no external component at all

The internal identity store requires an external directory server while LDAP does not require any server at all, in most deployment scenarios, which is not the standard approach, in most deployment scenarios

7 / 10

Which factor would most influence a decision to use certificate-based (PKI) authentication rather than password-based authentication for a specific group of managed corporate laptops in Cisco ISE?

The desire to eliminate the need for any network connectivity between the laptop and ISE, which does not align with best practices

The desire to remove all logging of authentication events entirely

The desire for stronger, phishing-resistant authentication that does not depend on a user-remembered or user-enterable password

The desire to force every laptop to use exactly the same, single shared password

The desire to disable all authorization policy evaluation for these laptops

The desire to make authentication depend entirely on the laptop's exterior case color

8 / 10

Which combination of identity store choices would provide strong, layered authentication for a security-conscious organization managing both corporate-owned devices and a smaller set of privileged administrator accounts in Cisco ISE?

Relying solely on MAC Authentication Bypass for privileged administrator account access

Using only the internal identity store with a single shared password for every account, including administrators, in most deployment scenarios, which is not the standard approach, which is not the standard approach

Using multifactor authentication exclusively for guest users while leaving administrator accounts on single-factor passwords

Certificate-based (PKI) authentication for corporate-owned device machine authentication, combined with multifactor authentication (password plus OTP token) for privileged administrator accounts

Using certificate-based authentication exclusively for guest users with no relationship to corporate devices

Disabling all authentication entirely for corporate-owned devices to simplify onboarding

9 / 10

Which practical limitation is commonly associated with relying solely on the Cisco ISE internal identity store for a large enterprise with tens of thousands of employees already managed in a corporate directory?

The internal identity store is only usable for guest portal branding and never for authentication

The internal identity store requires a completely separate, incompatible hardware appliance to function

The internal identity store would automatically disable all external identity stores the moment it is enabled

User accounts would need to be duplicated and manually maintained in ISE separately from the existing corporate directory, creating administrative overhead and consistency risk

The internal identity store cannot store any user accounts at all under any circumstance

The internal identity store would automatically synchronize with any external directory with zero configuration required

10 / 10

Which identity store option would be most appropriate for authenticating a small number of contractor accounts that exist only for the duration of a short-term project and are not part of the corporate Active Directory?

Requiring the contractors to authenticate only via an external RADIUS token server with no ISE involvement at all

Refusing to provide the contractors any form of authenticated access under any circumstance

Creating dedicated accounts in the ISE internal identity store scoped to the contractors' project duration

Requiring the contractors to share a single administrator-level TACACS+ account with full device configuration rights

Requiring the contractors to use certificate-based authentication issued from an unrelated, unaffiliated third-party's internal certificate authority

Requiring the contractors to be added permanently to the corporate Active Directory as full employees

Your score is

The average score is 0%