CCNP 802.1X and TrustSec Practice Test 2 — 15 Questions

Question 1

A network engineer runs the following command on switch SW7:

SW7# show authentication registrations

Authentication Method Registrations:

Method    Priority   Type
dot1x     10         Interface
mab       20         Interface
webauth   30         Interface

Based on this output, what can be concluded?

Accepted Answer

The switch will try 802.1X first, then MAB, then web authentication.. The output shows the registered authentication methods and their priorities. dot1x has priority 10, mab has 20, and webauth has 30. This means dot1x is tried first, then mab, then webauth. This is the typical fallback order.

Answer

The switch will try MAB before 802.1X.

Answer

Web authentication is the primary method.

Answer

Only 802.1X is registered.

Question 2

A network engineer runs the following command on switch SW8:

SW8# show cts role-based sgt-map 192.168.1.10

IP Address: 192.168.1.10
SGT: 10
Source: SXP

Based on this output, what can be concluded?

Accepted Answer

The SGT mapping was learned via SXP from a peer.. The output shows the SGT for IP 192.168.1.10 is 10, and the source is SXP, meaning the mapping was learned via the SGT Exchange Protocol from an SXP peer. This is dynamic, not static.

Answer

The SGT mapping was configured manually.

Answer

The IP address 192.168.1.10 is not mapped to any SGT.

Answer

The SGT mapping is from local authentication.

Question 3

A network engineer runs the following command on switch SW9:

SW9# show cts role-based policy

Role-based policy:

Source Group   Dest Group   Action
10             20           PERMIT
10             30           DENY
20             30           PERMIT

Based on this output, what can be concluded?

Accepted Answer

Traffic from SGT 20 to SGT 30 is permitted.. The output shows the role-based policy table. It lists the source and destination SGTs and the action (PERMIT or DENY). This is the policy that the switch enforces for traffic between SGTs.

Answer

Traffic from SGT 10 to SGT 20 is denied.

Answer

Traffic from SGT 30 to SGT 10 is denied.

Answer

The policy is configured on an ISE server.

Question 4

Consider the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout tx-period 5
 spanning-tree portfast

What is the effect of this configuration?

Accepted Answer

The switch will act as an 802.1X authenticator and the port will be unauthorized until a successful authentication.. This configuration enables 802.1X authentication on the interface with the authenticator role, sets the transmit period to 5 seconds, and enables PortFast to avoid STP delays. The 'authentication port-control auto' command puts the port in unauthorized state until authentication succeeds.

Answer

The port will immediately transition to forwarding state and then wait for authentication.

Answer

The port will be placed in a VLAN assigned by the RADIUS server after authentication.

Answer

The switch will act as a supplicant and respond to EAP requests from an upstream authenticator.

Question 5

Examine the following configuration snippet:

interface GigabitEthernet1/0/2
 switchport mode access
 authentication port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10

Which statement about this configuration is true?

Accepted Answer

802.1X will be attempted first; if the client does not respond, MAB will be used as a fallback.. This configuration enables both 802.1X and MAB (MAC Authentication Bypass) on the interface. MAB is used as a fallback if the connected device does not support 802.1X. The switch acts as an authenticator.

Answer

MAB will be attempted first, and if it fails, 802.1X will be used.

Answer

The port will be placed in a guest VLAN if both 802.1X and MAB fail.

Answer

The switch will act as a supplicant for MAB and an authenticator for 802.1X.

Question 6

Consider the following TrustSec configuration on a Cisco switch:

cts role-based enforcement
interface GigabitEthernet1/0/3
 cts manual
 sap pmk 0123456789ABCDEF mode-list both

What is the purpose of this configuration?

Accepted Answer

It enables CTS inline tagging with a pre-shared key for SGT exchange between peers.. This enables CTS role-based enforcement globally and configures the interface for manual CTS with a pre-shared key (PMK) for SGT exchange. The 'mode-list both' allows both source and destination SGT enforcement.

Answer

It enables 802.1X authentication with a pre-shared key.

Answer

It configures the interface to use SGT (Security Group Tag) propagation via SXP.

Answer

It enables dynamic VLAN assignment based on user authentication.

Question 7

Examine the following configuration:

aaa new-model
aaa authentication dot1x default group radius
dot1x system-auth-control
interface GigabitEthernet1/0/4
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout quiet-period 30

What is the effect of the 'dot1x timeout quiet-period 30' command?

Accepted Answer

The switch will wait 30 seconds before sending a new EAPOL-Start after a failed authentication.. The quiet-period timer defines the number of seconds the switch waits after a failed authentication attempt before re-initiating authentication. The default is 60 seconds; here it is set to 30 seconds.

Answer

The switch will wait 30 seconds for a response from the supplicant before timing out.

Answer

The switch will wait 30 seconds before placing the port in the unauthorized state after a link up event.

Answer

The switch will wait 30 seconds for the RADIUS server to respond before failing authentication.

Question 8

Consider this configuration for TrustSec on a Cisco switch:

cts role-based enforcement
interface GigabitEthernet1/0/5
 cts manual
 sap pmk AABBCCDDEEFF00112233445566778899 mode-list both
 propagate sgt

What is the purpose of the 'propagate sgt' command under the interface?

Accepted Answer

It enables the switch to insert SGT tags into packets forwarded out of this interface.. The 'propagate sgt' command enables the switch to insert SGT information into packets received on this interface, allowing SGT propagation to downstream devices.

Answer

It allows the switch to receive SGT information from the connected device.

Answer

It enables the switch to enforce role-based access control on this interface.

Answer

It configures the interface to use SXP for SGT propagation.

Question 9

Examine the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/6
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
 dot1x timeout tx-period 3
 dot1x max-req 3
 dot1x timeout supp-timeout 10

What is the total time the switch will wait for a supplicant to respond before failing authentication?

Accepted Answer

9 seconds. The switch sends up to 'max-req' (3) EAP-Request/Identity packets, each with a 'tx-period' of 3 seconds. The total time is max-req * tx-period = 3 * 3 = 9 seconds. The 'supp-timeout' is for EAP packets after identity, but the initial identity timeout is governed by tx-period.

Answer

30 seconds

Answer

10 seconds

Answer

13 seconds

Question 10

What is the default quiet-period timer value in Cisco IOS 802.1X configuration?

Accepted Answer

60 seconds. The quiet-period timer defines the number of seconds the switch waits after a failed authentication attempt before re-initiating authentication. The default value is 60 seconds.

Answer

30 seconds

Answer

120 seconds

Answer

10 seconds

Question 11

In Cisco TrustSec, which component is responsible for assigning a Security Group Tag (SGT) to a user or device based on authentication?

Accepted Answer

The RADIUS server (ISE) assigns the SGT during authentication.. The Identity Services Engine (ISE) acts as the policy decision point, authenticating users/devices and assigning SGTs based on policy. The switch enforces based on the SGT.

Answer

The switch dynamically assigns the SGT based on the MAC address.

Answer

The endpoint device sends its SGT in the EAPOL-Start message.

Answer

The SGT is derived from the VLAN ID assigned to the port.

Question 12

What is the default tx-period timer value in Cisco IOS 802.1X configuration?

Accepted Answer

30 seconds. The tx-period timer defines the number of seconds the switch waits for a response to an EAP-Request/Identity packet before retransmitting. The default value is 30 seconds.

Answer

3 seconds

Answer

10 seconds

Answer

60 seconds

Question 13

Drag and drop the steps of the 802.1X EAP-TLS authentication exchange into the correct order, from first to last.

Accepted Answer

Supplicant sends EAPoL-Start. The 802.1X EAP-TLS process begins with the supplicant initiating an EAPoL-Start, then the authenticator requests identity. The supplicant responds with an EAP-Response/Identity, the authenticator forwards it to the RADIUS server, and the server requests the client certificate to start the TLS handshake.

Question 14

Drag and drop the steps of TrustSec SGT classification and enforcement into the correct order, from first to last.

Accepted Answer

Switch classifies endpoint and assigns SGT. TrustSec first classifies traffic by assigning an SGT based on user/device identity, then the switch tags packets with the SGT. The packet is forwarded with the SGT intact, and the destination switch enforces policy by checking the SGT against an SGACL. Finally, the destination switch permits or denies traffic based on the SGACL.

Question 15

Drag and drop the steps of 802.1X port authentication with MAB fallback into the correct order, from first to last.

Accepted Answer

Switch sends EAP-Request/Identity. The switch first attempts 802.1X by sending an EAP-Request/Identity. If no response is received, it initiates MAB by sending a RADIUS Access-Request with the MAC address. The RADIUS server checks the MAC against its database and responds with Access-Accept or Access-Reject. The switch then opens or blocks the port accordingly.