SkillTestPro | CCNP Security 300-715 SISE Practice Test 11

CCNP Security 300-715 SISE Practice Test 11 (Hard) - Configuring Authorization Policies and Profiles

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco ISE policy component determines what level of network access, VLAN, or ACL a successfully authenticated user or device is actually granted?

An authentication policy, which verifies credentials rather than granting access levels

A sponsor group, which defines sponsor privileges rather than end-user network access levels

An authorization policy, which evaluates conditions and applies an authorization profile

A certificate authentication profile, which maps certificate fields rather than granting access levels

A profiling policy, which classifies endpoints rather than granting access levels directly

A client provisioning policy, which manages agent deployment rather than granting access levels

2 / 10

Which Cisco ISE object defines the specific result (such as VLAN assignment, downloadable ACL, or SGT) that is returned to the network device once an authorization policy rule matches?

An authorization profile

A guest type, which defines guest account attributes rather than the general authorization result

A posture policy, which evaluates endpoint compliance rather than defining the returned authorization result directly

An authentication policy rule, which governs credential verification rather than the returned result

A network device group, which categorizes devices rather than defining the returned result

A client provisioning resource, which is an agent/module package rather than an authorization result

3 / 10

Which type of condition would an authorization policy commonly use to grant different levels of access based on whether a user belongs to a specific Active Directory group?

A condition based on the phase of the moon on the day of the request

A condition based on the end user's favorite sports team

A condition referencing the user's AD group membership attribute retrieved during authentication

A condition based on the color of the end user's badge lanyard

A condition based on the number of unrelated emails in the user's inbox

A condition based on the outdoor temperature at the user's location

4 / 10

Which Cisco ISE feature allows an authorization profile to deliver a highly granular access control list, defined centrally in ISE and pushed to the network device, rather than relying on a pre-provisioned static ACL on every switch?

A syslog server address with no relationship to access control

A DNS resource record with no relationship to access control

A downloadable ACL (dACL)

An NTP server address with no relationship to access control

A DHCP option with no relationship to access control

An SNMP community string with no relationship to access control

5 / 10

Which authorization policy design practice helps ensure that more specific access rules are evaluated before more general fallback rules?

Ensuring every rule uses the exact same condition so that ordering becomes irrelevant

Placing the most general fallback rule at the very top of the policy so it always matches first

Placing all rules in a random, unordered arrangement, since ISE evaluates every rule simultaneously with no top-down logic at all

Disabling rule ordering entirely, since ISE authorization policy has no concept of rule order

Placing all rules alphabetically by rule name with no regard to condition specificity

Ordering authorization policy rules so that more specific conditions appear above broader, more general rules, since ISE evaluates rules top-down and applies the first match

6 / 10

Which authorization result would be appropriate for a policy rule matching corporate-managed laptops that have successfully completed both 802.1X authentication and posture compliance checks?

An authorization profile granting unrestricted access to every other organization's network as well

A relatively permissive authorization profile granting standard corporate network access appropriate to a compliant, trusted device

The most restrictive quarantine VLAN normally reserved for non-compliant devices

An authorization profile intended only for guest users with no relationship to corporate device compliance, in most deployment scenarios

Complete denial of all network access regardless of compliance status

An authorization profile that disables all further posture reassessment permanently for that device

7 / 10

Which troubleshooting approach would help identify why a specific authenticated user is receiving a more restrictive authorization result than expected?

Assuming the issue is caused by the outdoor weather conditions

Assuming the issue cannot be diagnosed and immediately reinstalling ISE from scratch

Assuming the issue is unrelated to ISE and only checking the user's personal email settings

Randomly disabling authorization policy rules with no analysis until the problem happens to go away, in a properly maintained environment

Assuming the issue must be a hardware failure in the end user's keyboard

Reviewing the live authentication/authorization details for that session to see which authorization policy rule actually matched and why

8 / 10

Which authorization policy design would be most appropriate for a Cisco ISE deployment that needs to grant different network access levels to full-time employees, contractors, and guests, all connecting to the same physical switchports?

Separate authorization policy rules with conditions distinguishing employee, contractor, and guest identity sources or attributes, each mapped to an appropriately scoped authorization profile

A single authorization rule granting identical full access to employees, contractors, and guests alike, which is not the standard approach, in accordance with common design practices

Randomly assigning authorization profiles with no relationship to the connecting user's actual role

Using the exact same VLAN and dACL for every single group with no differentiation at all

Denying all three groups any network access under any circumstance

Configuring authorization policy only for employees while leaving contractors and guests completely unauthenticated and unauthorized

9 / 10

Which consequence could result from an authorization policy rule with an overly broad condition unintentionally matching a wider population of users than intended?

The overly broad rule would have no effect at all since ISE ignores conditions that match too many users

ISE would automatically detect and silently correct the overly broad condition with no administrator involvement, under normal operating conditions, under typical configuration conditions

Some users could receive an authorization result (such as network access level) that is either more permissive or more restrictive than actually intended for them

The organization's DNS servers would automatically reconfigure themselves in response

The switch would automatically revert to factory default configuration in response

The overly broad rule would automatically convert itself into an authentication policy rule instead

10 / 10

Which combination of authorization policy practices would provide accurate, least-privilege access control for a large organization with diverse user populations and device types connecting through Cisco ISE?

Conditions based on irrelevant attributes with no relationship to actual risk or role

A single rule granting maximum access to every authenticated user regardless of role or compliance

Disabling logging of authorization decisions to reduce storage requirements

Authorization profiles that are never reviewed or updated after initial deployment, based on standard platform behavior

Well-ordered rules from most specific to most general, conditions based on meaningful attributes such as identity group, device compliance, and location, appropriately scoped authorization profiles, and regular review of policy hit counts and live logs

A flat, unordered list of rules with no consideration of specificity, in accordance with common design practices, which is not the standard approach

Your score is

The average score is 0%