Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Cisco
Exam Format
90 min
55-65
Not published by Cisco
Professional
Registration
$300 USD
Pearson VUE
Validity
3 years
Pass any Expert-level written exam; Pass the current CCNP Security exam or concentration exam; Pass a Cisco Specialist exam
300-208 Exam Topics and Domains
300-208 is organized into 5 weighted domains. Expect to work with Cisco ISE, Network devices, Cisco TrustSec, Wireless infrastructure, and more.
1
Identity Management/Secure Access
33%
Implement device administration
Compare and select AAA optionsTACACS+RADIUSDescribe Native AD and LDAP
- Compare and select appropriate AAA options for device administration
- Configure TACACS+ for device administration
- Configure RADIUS for network access
- Integrate Active Directory and LDAP with ISE
Describe identity management
Describe features and functionality of authentication and authorizationDescribe identity store optionsImplement accounting
- Understand authentication and authorization functionality
- Select appropriate identity store options
- Implement accounting for compliance and auditing
Implement wired/wireless 802.1X
Describe RADIUS flowsAV pairsEAP typesDescribe supplicant, authenticator, and serverSupplicant options802.1X phasing (monitor mode, low impact, closed mode)AAA serverNetwork access devices
- Understand RADIUS authentication flows
- Configure 802.1X on wired and wireless infrastructure
- Select and configure appropriate EAP types
- Implement phased 802.1X deployment strategies
Implement MAB
Describe the MAB process within an 802.1X frameworkFlexible authentication configurationISE authentication/authorization policiesISE endpoint identity configurationVerify MAB Operation
- Understand MAB authentication process
- Configure flexible authentication with 802.1X and MAB
- Implement ISE policies for MAB devices
- Verify and troubleshoot MAB operation
Implement network authorization enforcement
dACLDynamic VLAN assignmentDescribe SGANamed ACLCoA
- Configure downloadable ACLs for dynamic enforcement
- Implement dynamic VLAN assignment
- Understand Security Group Access concepts
- Use Change of Authorization for policy updates
Implement Central Web Authentication (CWA)
Describe the function of CoA to support web authenticationConfigure authentication policy to facilitate CWAURL redirect policyRedirect ACLCustomize web portalVerify central web authentication operation
- Understand CoA's role in central web authentication
- Configure ISE policies for CWA
- Implement URL redirection and redirect ACLs
- Customize and verify web authentication portals
Implement profiling
Enable the profiling servicesNetwork probesIOS Device SensorFeed serviceProfiling policy rulesUtilize profile assignment in authorization policiesVerify profiling operation
- Enable and configure ISE profiling services
- Configure network probes and Device Sensor
- Create and manage profiling policies
- Use profiling in authorization policies
Implement guest services
Managing sponsor accountsSponsor portalsGuest portalsGuest PoliciesSelf registrationGuest activationDifferentiated secure accessVerify guest services operation
- Configure sponsor and guest portals
- Implement guest types and policies
- Set up self-registration and activation methods
- Verify and troubleshoot guest services
Implement posture services
Describe the function of CoA to support posture servicesAgent optionsClient provisioning policy and redirect ACLPosture policyQuarantine/remediationVerify posture service operation
- Understand CoA's role in posture assessment
- Configure posture agents and provisioning
- Implement posture policies and requirements
- Set up remediation and quarantine strategies
Implement BYOD access
Describe elements of a BYOD policyDevice registrationMy devices portalDescribe supplicant provisioning
- Understand BYOD policy elements
- Configure device registration workflows
- Implement My Devices portal
- Set up supplicant provisioning for BYOD
2
Threat Defense
10%
Describe TrustSec Architecture
SGT Classification - dynamic/staticSGT Transport - inline tagging and SXPSGT Enforcement - SGACL and SGFWMACsec
- Understand TrustSec architecture components
- Describe SGT classification and transport mechanisms
- Explain SGT enforcement with SGACLs
- Understand MACsec for link-level encryption
3
Troubleshooting, Monitoring and Reporting Tools
7%
Troubleshoot identity management solutions
Identify issues using authentication event details in Cisco ISETroubleshoot using Cisco ISE diagnostic toolsTroubleshoot endpoint issuesUse debug commands to troubleshoot RADIUS and 802.1X on IOS switches and wireless controllersTroubleshoot backup operations
- Use ISE Live Logs for troubleshooting
- Apply ISE diagnostic tools effectively
- Troubleshoot endpoint and authentication issues
- Use debug commands on network devices
- Verify backup and restore operations
4
Threat Defense Architectures
17%
Design highly secure wireless solution with ISE
Identity Management802.1XMABNetwork authorization enforcementCWAProfilingGuest ServicesPosture ServicesBYOD Access
- Design secure wireless architecture with ISE
- Integrate 802.1X, MAB, and CWA for wireless
- Implement profiling and guest services for wireless
- Design BYOD and posture for wireless clients
5
Identity Management Architectures
33%
Device administration
Device admin architecture
- Design device administration architecture
- Plan TACACS+ deployment for scale and HA
Identity Management
AAA architecture design
- Design comprehensive AAA architecture
- Select appropriate authentication and authorization methods
Profiling
Profiling architecture design
- Design effective profiling architecture
- Select optimal probes and policies
Guest Services
Guest architecture design
- Design guest services architecture
- Plan guest workflows and access policies
Posturing Services
Posture architecture design
- Design posture assessment architecture
- Plan remediation and compliance workflows
BYOD Access
BYOD architecture design
- Design comprehensive BYOD architecture
- Plan certificate provisioning and device lifecycle
How do I earn this certification?
Passing 300-208 earns the CCNP Security (Legacy Track) certification. It sits in the Security (Legacy) track.
Current Level Exams
Next Level Options
CCIE Security Lab - CCIE Security Lab Exam Expert-level certification
Alternative Paths
- 350-701 - SCORCore exam for current CCNP Security track
- 300-715 - SISEDirect content replacement focusing on ISE implementation
- 300-435 - ENAUTO - Automating Cisco Enterprise SolutionsComplementary automation skills for network security
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for 300-208 is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- RETIRED
- Last content update: 2020-02-24
- Announcement date: 2019-06-24
Updates
- Cisco Identity Services Engine (ISE) 3.3 The 300-208 covered ISE 1.2. Modern ISE 3.x includes AI-powered threat detection, enhanced pxGrid, and Zero Trust features not covered in the legacy exam. • Release date: 2024-03-15
- Cisco TrustSec Current TrustSec fundamentals from 300-208 remain relevant. Modern implementations include enhanced policy matrix, cloud integration, and SD-Access integration. • Release date: Continuous updates
- 802.1X Authentication IEEE 802.1X-2020 Core 802.1X concepts unchanged. Modern deployments focus on certificate-based authentication and integration with cloud identity providers. • Release date: 2020
Who should take this exam?
- Knowledge of 802.1X authentication and authorization
- Understanding of Cisco TrustSec and Security Group Tags (SGT)
- Experience with Cisco Identity Services Engine (ISE)
- Understanding of TACACS+ and RADIUS protocols
- Knowledge of MAC Authentication Bypass (MAB)
- Network security fundamentals
- Active Directory integration experience