350-701 Practice Test 14 — 15 Questions

Question 1

An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?

Accepted Answer

ISE has cached the previous password and is still using it for authentication. Option C is correct because ISE caches credentials for a period; if the password is changed, the cached version may still be used until the cache expires. Option A is wrong because RADIUS servers do not typically cache credentials by default. Option B is wrong because DNS issues would affect all users, not just those with password changes. Option D is wrong because the wireless controller does not cache passwords; it passes through to ISE.

Answer

DNS records for the domain controller have not updated

Answer

The wireless controller has a local password cache

Answer

The RADIUS server on the wireless controller is caching credentials

Question 2

Which TWO are valid methods for determining the SGT (Security Group Tag) assigned to an endpoint in a TrustSec deployment?

Accepted Answer

Static assignment on the network access device (switch) using the 'cts role-based sgt' command. Options A and C are correct. A: Static assignment on switch port via 'cts role-based sgt'. B: DHCP Option 141 is not used for SGT. C: ISE can dynamically assign SGT via authentication policy. D: DNS is not involved. E: IP address does not determine SGT; it's based on identity.

Answer

DNS resolution of the endpoint hostname

Answer

The IP address of the endpoint

Answer

DHCP Option 141

Question 3

A network engineer notices that some Windows 10 clients fail to authenticate via 802.1X after a recent OS update. The supplicant shows 'EAPOL-Start' but never receives an EAP-Request/Identity. The switch port is configured with 'authentication port-control auto' and 'dot1x pae authenticator'. What is the most likely cause?

Accepted Answer

The switch port is configured as a trunk port. Option B is correct because if the switch port is configured as a trunk, 802.1X is not supported on trunk ports by default. Option A is wrong because SNMP does not affect EAPOL. Option C is wrong because global authentication mode 'none' would not affect a single port. Option D is wrong because MAB is a fallback method, not the cause of EAPOL-Start not being answered.

Answer

The switch has 'aaa authentication dot1x default none' globally

Answer

The switch port is configured with 'authentication order mab dot1x'

Answer

The switch is configured with 'snmp-server community' which disables 802.1X

Question 4

Which THREE are characteristics of Cisco ISE profiler service?

Accepted Answer

It can determine the endpoint operating system based on MAC OUI and DHCP fingerprints. Options B, D, and E are correct. B: Profiling uses both active and passive probes. C: Profiling does not require an agent; it is agentless. A: Profiler does not perform posture assessments; that's posture service. D: Profiling can be based on MAC OUI and DHCP fingerprints. E: Profiler can feed attributes to authorization policies.

Answer

It performs posture compliance checking on endpoints

Answer

It requires the installation of an ISE agent on all endpoints

Question 5

An ISE deployment uses TrustSec with SGTs assigned by Active Directory group membership. A group of users in the 'Finance' AD group is correctly receiving SGT 5, but a new user added to that group is getting SGT 0. The ISE policy is unchanged, and other users in the group work fine. What is the most likely cause?

Accepted Answer

ISE has not synchronized the latest AD group membership. Option D is correct because ISE caches AD groups; a new user may not be in the cache until the next sync. Option A is wrong because SGT classification can be based on AD groups without PAC. Option B is wrong because endpoint protection is separate. Option C is wrong because profiling is not involved in AD group-based SGT assignment.

Answer

The user endpoint has not been profiled by ISE yet

Answer

The user endpoint is running antivirus software that blocks SGT assignment

Answer

The user does not have a PAC (Protected Access Credential)

Answer

The switchport is configured with 'authentication violation restrict' which blocks the new user

Question 6

Which TWO are valid options for configuring a switch port to handle authentication failures in an 802.1X environment? (Select two.)

Accepted Answer

authentication event no-response action authorize vlan 100. Options A and C are correct. A: 'authentication event fail action authorize vlan 999' allows placing the port in a guest VLAN on failure. B: 'authentication event server dead action reinitialize' is for RADIUS server failure, not authentication failure. C: 'authentication event no-response action authorize vlan 100' is for when the endpoint does not respond to EAPOL. D: 'authentication port-control force-authorized' forces the port to authorized state, bypassing authentication entirely. E: 'dot1x critical' is for critical voice VLAN, not failure handling.

Answer

dot1x critical profile

Answer

authentication event server dead action reinitialize

Answer

authentication port-control force-authorized

Question 7

A network administrator wants to implement 802.1X authentication on a switch port that connects a printer. The printer does not support 802.1X, so the administrator configures MAC Authentication Bypass (MAB) as a fallback method. Which command must be included in the switch port configuration to ensure MAB is attempted after 802.1X times out?

Accepted Answer

authentication order dot1x mab. Option C is correct because 'authentication order dot1x mab' sets the order: first 802.1X, then MAB. Option A is wrong because 'authentication priority' is not a valid command. Option B is wrong because 'authentication port-control auto' enables authentication but does not set order. Option D is wrong because 'dot1x timeout tx-period' only affects 802.1X timers.

Answer

authentication priority dot1x mab

Answer

dot1x timeout tx-period 30

Answer

authentication port-control auto

Question 8

An engineer is troubleshooting a user who cannot access the network after successful 802.1X authentication. The user's PC receives an IP address from DHCP, but cannot reach the internet. The switch port is in the correct VLAN (10) after authentication. The ISE posture policy requires the user to install a corporate certificate, but the user skipped that step. What is the most likely cause of the internet access failure?

Accepted Answer

The ISE posture policy returned 'NonCompliant' and ISE applied a Change of Authorization (CoA) to place the port in a remediation VLAN. Option B is correct because ISE can send a CoA to place the port in a restricted VLAN after authentication if posture is not compliant. Option A is wrong because AD login is not required for internet access. Option C is wrong because the switchport is already in the correct VLAN as stated. Option D is wrong because there is no indication of DHCP issues.

Answer

The user is not logged into the domain

Answer

The switchport is still in the default VLAN

Answer

The DHCP server does not have a scope for VLAN 10

Question 9

During a network audit, an engineer finds that a switch configured for 802.1X is allowing a device to access the network without authentication. The switch logs show 'MAB failed', 'dot1x failed', but the port is in the forwarding state. The port configuration includes 'authentication fallback final mab' and 'dot1x timeout server-timeout 10'. What is the most likely explanation?

Accepted Answer

The 'authentication fallback final mab' command allows the port to become authorized even if MAB fails. Option D is correct because 'authentication fallback final mab' means if dot1x and MAB fail, the switch still authorizes the device as a final fallback, effectively overriding the authentication failure. Option A is wrong because the logs show authentication attempts. Option B is wrong because the logs explicitly show failures. Option C is wrong because server-timeout alone does not cause this behavior.

Answer

The device is using a MAC address that matches a static CAM entry

Answer

The switch has 'aaa authentication dot1x default local' which allows local fallback

Answer

The 'dot1x timeout server-timeout' is too short, causing the switch to skip authentication

Answer

The switch is running an IOS version that treats 'authentication fallback final mab' as a no-op

Question 10

A network engineer is deploying TrustSec using SGT over VXLAN in a data center fabric. The fabric switches are configured as VXLAN Tunnel Endpoints (VTEPs). The engineer must ensure that SGT information is propagated from the border leaves to the spine. Which mechanism should be used?

Accepted Answer

VXLAN Group Policy Option (GPO) in the VXLAN header. Option A is correct because SGT over VXLAN uses Group Policy Option (GPO) bits in the VXLAN header. Option B is wrong because SXP is for non-VXLAN environments. Option C is wrong because IS-IS carries routing, not SGT. Option D is wrong because LISP carries endpoint IDs, not SGT.

Answer

LISP (Locator/ID Separation Protocol)

Answer

SXP (SGT Exchange Protocol) between VTEPs

Answer

IS-IS protocol extensions for SGT

Question 11

A company is deploying Cisco Email Security Appliance (ESA) to protect against phishing attacks. The security team wants to implement two security features to detect malicious URLs in emails. Which two features should be enabled? (Choose two.)

Accepted Answer

URL reputation filtering. URL reputation filtering is correct because it uses the Cisco Talos threat intelligence to analyze and block emails containing malicious URLs based on real-time reputation scores. Cisco Advanced Phishing Protection is correct because it uses machine learning and behavioral analysis to detect and block sophisticated phishing URLs that may bypass traditional reputation checks.

Answer

DomainKeys Identified Mail (DKIM) signing

Answer

Sender Policy Framework (SPF) verification

Answer

Domain-based Message Authentication, Reporting & Conformance (DMARC)

Question 12

Which THREE of the following are valid components of Cisco ISE's visibility and enforcement architecture?

Accepted Answer

TrustSec with SGTs. Cisco ISE's visibility and enforcement architecture relies on TrustSec with Security Group Tags (SGTs) to enforce access policies based on logical groupings rather than IP addresses. SGTs are propagated via SXP or inline tagging, enabling dynamic policy enforcement across the network.

Answer

NetFlow for flow analysis

Answer

SNMP traps for alerting

Question 13

During a security incident, an engineer needs to quickly quarantine an endpoint that is connected to a switch via 802.1X. The engineer wants to use ISE to send a Change of Authorization (CoA) to move the port to a restrictive VLAN. What must be configured on the switch to allow ISE to send CoA?

Accepted Answer

The switch must have 'aaa server radius dynamic-author' configured with a client entry for ISE. Option D is correct because CoA requires the switch to act as a RADIUS client for dynamic authorization, configured with 'aaa server radius dynamic-author'. Option A is wrong because RADIUS accounting is separate. Option B is wrong because CoA uses UDP port 3799 by default. Option C is wrong because 'authentication event server dead action' is for RADIUS server failure, not CoA.

Answer

The switch must listen on UDP port 1700 for CoA packets

Answer

The switch must have a VTY line configured with 'transport input ssh'

Answer

RADIUS accounting must be enabled on the switch

Answer

The switch must have 'authentication event server dead action authorize' configured

Question 14

An administrator needs to ensure that only authorized hosts can connect to a switch port. The port is connected to a single PC. Which 802.1X host mode should be configured?

Accepted Answer

Single-Host. Option A is correct because 'Single-Host' mode allows only one authenticated device per port, which is appropriate for a single PC. Option B is incorrect because 'Multi-Host' allows multiple devices after one authentication. Option C is incorrect because 'Multi-Domain' allows one device per domain (data and voice). Option D is incorrect because 'Multi-Auth' allows multiple authentications but is overkill for a single PC.

Answer

Multi-Domain

Answer

Multi-Auth

Answer

Multi-Host

Question 15

An administrator is configuring 802.1X on a switch port for both an IP phone and a PC. Which two commands should be configured to support this scenario? (Choose two)

Accepted Answer

authentication host-mode multi-domain. Options B and C are correct. 'authentication host-mode multi-domain' (B) allows one device per domain (voice and data). 'authentication port-control auto' (C) enables 802.1X authentication on the port. Option A (multi-auth) allows multiple devices in the same domain, which is not needed. Option D (violation restrict) is an action when a violation occurs, not mandatory. Option E (dot1x pae authenticator) is required but not among the two most specific; it is often enabled by default.

Answer

dot1x pae authenticator

Answer

authentication violation restrict

Answer

authentication host-mode multi-auth