SkillTestPro | CCNP Security 300-715 SISE Practice Test 18

CCNP Security 300-715 SISE Practice Test 18 (Hard) - Change of Authorization (CoA) and Endpoint Identity Management

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco ISE and network device capability allows ISE to dynamically change an already-authenticated session's authorization result (such as after profiling or posture status changes) without requiring the endpoint to physically reconnect?

A TACACS+ command set update, which governs device administration commands rather than session authorization

A certificate revocation list update, which affects certificate validity rather than session authorization directly

RADIUS Change of Authorization (CoA)

A manual reboot of the network switch, which is disruptive and not the dynamic mechanism ISE uses

A DHCP lease renewal, which reassigns IP addressing rather than changing authorization dynamically

A DNS cache flush, which clears name resolution data rather than changing session authorization

2 / 10

Which CoA type would forcibly terminate an existing session, requiring the endpoint to fully re-authenticate from scratch?

A profiler feed service update, which is unrelated to terminating an active session

A TACACS+ command authorization change, which is unrelated to RADIUS session CoA

A guest account suspension, which is unrelated to a general non-guest CoA action

A sponsor group privilege change, which is unrelated to RADIUS session CoA

CoA Terminate (or Disconnect)

CoA Reauthenticate, which typically re-runs authorization without necessarily tearing down the session as forcibly

3 / 10

Which endpoint identity management capability allows an administrator to manually override an endpoint's automatically profiled classification, such as when profiling produces an incorrect result for a specific device?

Reinstalling ISE entirely as the only way to correct a single endpoint's classification

Static endpoint identity group assignment (manually editing the endpoint's group in the endpoint database)

Waiting exactly 90 days for the classification to automatically correct itself with no administrative action

Disabling the profiler service network-wide as the only available correction method

Contacting Cisco TAC to manually edit the device remotely as the only available correction method

Deleting the entire endpoint database and starting over as the only available correction method

4 / 10

Which practical benefit does triggering an automatic CoA after a posture reassessment provide in a typical Cisco ISE deployment?

It permanently disables posture assessment for that endpoint going forward with no further checks ever occurring, which is not the standard approach, under typical configuration conditions

It automatically reconfigures the network device's spanning tree settings in response

It automatically issues a brand new digital certificate to the endpoint regardless of posture outcome

It allows a previously restricted endpoint that has since become compliant to be granted appropriate full access without requiring the user to manually disconnect and reconnect

It automatically converts the endpoint into a guest account with sponsor-created credentials

It automatically removes the endpoint from all profiling policies permanently

5 / 10

Which risk is most associated with excessive or improperly triggered CoA activity across a large ISE deployment with many active sessions?

CoA activity would automatically corrupt the ISE database with no possibility of recovery

CoA activity would automatically and permanently disable all future authentication on the network, which is inconsistent with expected behavior

CoA activity would automatically revoke every digital certificate in the deployment

Unnecessary session churn and increased load on network devices and ISE, potentially degrading the user experience or system performance

CoA activity would automatically convert all sessions into TACACS+ device administration sessions

CoA activity has no performance impact at any scale under any circumstance

6 / 10

Which endpoint identity management practice would help ensure that manually corrected (statically assigned) endpoint classifications are not inadvertently reverted by a later automatic profiling update?

Disabling the profiler feed service permanently for the entire deployment to prevent any future updates, which is rarely the correct choice, which is inconsistent with expected behavior

Manually re-entering the same override every single day indefinitely as the only available method

Assuming manual overrides are always automatically permanent by default with no configuration needed

Deleting the profiling policy library entirely so no automatic matching can ever occur again

Configuring the static assignment or an appropriate exception so the manual override takes precedence over subsequent automatic profiling matches

Requiring a full ISE reinstall every time a manual override needs to persist

7 / 10

Which troubleshooting step would be appropriate if an administrator observes that CoA requests sent from ISE to a network device are not taking effect on the session?

Assume the issue is caused by the phase of the moon

Assume the issue is unrelated to configuration and only check the end user's home internet connection

Assume CoA is a deprecated feature no longer supported by any Cisco platform

Immediately replace the network device with new hardware as the first troubleshooting step

Assume the issue is caused by the guest portal's background image configuration

Verify that the network device is correctly configured to accept CoA requests from the ISE node's IP address, including any required shared secret and firewall rules

8 / 10

Which combination of practices would provide reliable, low-risk use of CoA and endpoint identity overrides in a large enterprise ISE deployment?

Triggering CoA constantly for every minor event regardless of necessity, in accordance with common design practices, which is not the standard approach

Assuming every network device automatically supports CoA with no configuration required at all

Making manual endpoint overrides with no documentation or tracking of any kind

Disabling all logging related to CoA activity to reduce storage usage

Never verifying whether network devices actually support or are configured for CoA before relying on it

Verifying network device CoA support and configuration, using overrides sparingly and only when justified, monitoring CoA-related logs, and documenting manual endpoint classification changes

9 / 10

Which statement accurately describes the relationship between profiling, posture assessment, and CoA in a typical Cisco ISE access-control workflow?

Profiling automatically replaces the need for authorization policy entirely once an endpoint is classified

CoA can only be used for guest account termination and has no other applicable use case

Profiling and posture assessment can each produce updated context about an endpoint, and CoA is the mechanism ISE uses to apply a correspondingly updated authorization result to the active session

Posture assessment and CoA are only relevant to guest and sponsor workflows, with no relevance to corporate endpoints

CoA must always occur before profiling and posture assessment can begin, reversing the typical sequence

Profiling, posture assessment, and CoA are simply three different names for the exact same single process with no distinction between them

10 / 10

Which factor would most influence how aggressively an organization configures automatic CoA triggers in response to profiling and posture status changes?

The average outdoor temperature at the organization's headquarters

The color scheme configured for the ISE administrative GUI

The font used in the organization's internal newsletter

The number of parking spaces available in the visitor lot

The organization's balance between wanting rapid enforcement of updated access decisions and minimizing unnecessary session disruption or system load

The specific brand of coffee served in the network operations center

Your score is

The average score is 0%