350-701 Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. A user has successfully authenticated via 802.1X. However, the SGT (Security Group Tag) assigned is 0, which is the default untagged value. Which configuration change would most likely allow ISE to assign a non-zero SGT for this user?

Accepted Answer

In ISE authorization profile, add Cisco AV pair 'cts:security-group-tag=15'. Option D is correct because ISE must include the SGT in the RADIUS Access-Accept (e.g., via cisco-av-pair). Option A is wrong because the show command indicates authorization success, so AAA is functional. Option B is wrong because the session already shows authorization by server. Option C is wrong because SGT assignment does not require SGT caching on the switch. Option E is wrong because global 'cts' command is required for TrustSec, but it must be enabled.

Answer

Enable 'cts manual' globally on the switch

Answer

Ensure that the switch has a RADIUS server defined with 'radius-server host 10.1.1.1 auth-port 1645'

Answer

Configure 'aaa authorization network default group radius' on the switch

Answer

Enable 'sgt caching' on the switch port

Question 2

Refer to the exhibit. A switch port is configured for 802.1X with MAB. The switch has reached its maximum number of authentication sessions (platform limit). When a new device attempts to connect, what happens?

Accepted Answer

The new device is not authenticated and remains unauthorized. Option C is correct because when the maximum number of authentication sessions is reached, new authentication requests are denied unless 'authentication limit authen-fail-action' is configured otherwise. Option A is wrong because the port does not shut down by default. Option B is wrong because the port does not forward immediately. Option D is wrong because the switch does not fail open automatically.

Answer

The new device is allowed to pass traffic due to fallback

Answer

The switch sends a CoA to ISE to free up a session

Answer

The port is automatically shut down

Question 3

Refer to the exhibit. An engineer configured ISE to use both Active Directory and LDAP for authentication. Users from Active Directory are unable to authenticate. What is the most likely reason?

Accepted Answer

The LDAP identity store is unreachable and ISE is attempting LDAP before AD. Option A is correct because the LDAP server is showing a timeout error, and if LDAP is ranked higher, ISE may attempt LDAP first and fail before falling back. Option B is wrong because AD shows connected. Option C is wrong because the sequence is not shown but the LDAP error indicates the problem. Option D is wrong because authentication failure does not change the AD identity store.

Answer

Active Directory users are not allowed in the policy

Answer

The Active Directory identity store is disconnected

Answer

The authentication sequence is set to 'AD then LDAP'

Question 4

An organization wants to implement endpoint protection that uses behavioral analysis to detect ransomware. The solution must be able to roll back changes made by the ransomware after detection. Which Cisco endpoint security feature provides this capability?

Accepted Answer

Exploit prevention with ransomware rollback. Option A is correct because Cisco's endpoint protection includes a behavioral analysis engine that monitors for ransomware-like activities (e.g., mass file encryption, rapid file modifications). Upon detection, the feature automatically triggers a rollback, restoring affected files to their pre-encryption state using Volume Shadow Copy Service (VSS) snapshots or similar mechanisms, effectively reversing the ransomware's changes.

Answer

File reputation scanning

Answer

Device flow telemetry

Answer

Application blocking via policy

Question 5

A network administrator is troubleshooting intermittent authentication failures on a switch port configured for 802.1X with MAB fallback. Users can connect but get dropped after a few minutes. What is the most likely cause?

Accepted Answer

Reauthentication timer set too short. Option C is correct because a reauthentication timer that is too short causes frequent reauthentication attempts, which may fail if the RADIUS server is slow or if the client fails to respond in time. Option A is incorrect because an incorrect shared secret would cause all authentications to fail immediately. Option B is incorrect because MAB timeout affects initial authentication, not ongoing sessions. Option D is incorrect because incorrect VLAN assignment would prevent network access entirely.

Answer

Incorrect VLAN assignment

Answer

Incorrect RADIUS shared secret

Answer

MAB timeout set too low

Question 6

A network engineer is implementing TrustSec on a Cisco switch. The goal is to tag traffic from the engineering VLAN with Security Group Tag (SGT) 10 and enforce policies on upstream switches. Which configuration is required on the access switch to propagate the SGT?

Accepted Answer

cts manual policy static sgt 10. Option A is correct because the 'cts manual policy static sgt 10' command assigns a static Security Group Tag (SGT) to the switch port, which is then propagated to upstream switches via Cisco TrustSec (CTS) using SGT Exchange Protocol (SXP) or inline tagging. This ensures that traffic from the engineering VLAN is tagged with SGT 10, enabling policy enforcement on upstream devices.

Answer

switchport voice vlan 10

Answer

authentication host-mode multi-domain

Answer

spanning-tree portfast

Question 7

An administrator reviews the AMP event log shown in the exhibit. The same file hash appears in all events. What is the most likely explanation for the third event showing a 'TETRA Event' with 'Action: Quarantine' and 'Disposition: Unknown'?

Accepted Answer

The file was executed and, because its disposition was unknown, AMP quarantined it and submitted it for cloud analysis.. The third event shows a TETRA (Trajectory) event with 'Action: Quarantine' and 'Disposition: Unknown' because AMP uses TETRA to correlate related events into a single trajectory. When a file with an unknown disposition is executed, AMP quarantines it locally and submits it to the cloud for analysis. The 'Unknown' disposition indicates the cloud had not yet classified the file at the time of the event, and the quarantine action is a precautionary measure while analysis is pending.

Answer

The AMP connector failed to communicate with the cloud and generated a TETRA event as an error.

Answer

The file was previously blocked, but the user executed it from a different location, triggering a TETRA event.

Answer

The file was determined to be malicious by the cloud after the first detection.

Question 8

A company uses Cisco Umbrella to protect its remote users. The security team notices that some users are able to bypass Umbrella by using a different DNS resolver. Which deployment method ensures that all DNS traffic is forced through Umbrella?

Accepted Answer

Install the Umbrella roaming client on all endpoints.. The Cisco Umbrella roaming client (C) is the correct deployment method because it installs a local agent on each endpoint that intercepts all DNS queries at the operating system level, regardless of the DNS resolver configured in the network settings. This ensures that all DNS traffic is forced through Umbrella's cloud-based security platform, preventing users from bypassing protection by manually changing their DNS resolver to a non-Umbrella server.

Answer

Deploy the Umbrella virtual appliance in the data center.

Answer

Use BGP to redirect traffic to Umbrella.

Answer

Configure Active Directory integration.

Question 9

A network administrator configures the above policy on a Cisco Firepower Threat Defense (FTD) device. Users report that they cannot access the login page at https://www.example.com/login. What is the most likely cause?

Accepted Answer

The 'inspect' action in INSIDE_INSPECT does not permit the traffic; it only inspects.. Option C is correct because in Cisco Firepower Threat Defense (FTD), the 'inspect' action only monitors traffic for threats without explicitly permitting it. For traffic to be allowed through the device, a separate 'allow' or 'permit' action is required in the access control policy. Since INSIDE_INSPECT uses only 'inspect', the HTTPS traffic to the login page is blocked by default, as FTD implicitly denies traffic that is not explicitly permitted.

Answer

The 'match request uri regex ".*evil.*"' in OUTSIDE_INSPECT is blocking the page.

Answer

The 'match request body regex ".*malware.*"' in OUTSIDE_INSPECT is blocking the page.

Answer

The class-map HTTP_CLASS is incorrectly matching the host header for example.com.

Question 10

Refer to the exhibit. A network administrator is troubleshooting device tracking on a Cisco switch. The output shows two devices in VLAN 100. The switch is configured with IPv6 first-hop security features. The administrator notices that the device with MAC address aaaa.bbbb.cccc is not receiving RA guard protection. What is the most likely reason?

Accepted Answer

The interface Gi0/1/1 is not configured as a trusted interface for RA guard.. RA Guard protection is applied per interface based on trust configuration. The exhibit shows the device with MAC aaaa.bbbb.cccc is reachable via Gi0/1/1, but if that interface is not explicitly configured as trusted for RA Guard (e.g., using `ipv6 nd raguard trust`), the switch will not apply RA Guard filtering to RAs received on that port. This allows rogue RA messages from that device to bypass protection, making A the correct answer.

Answer

The device is not in the same VLAN as the RA guard policy.

Answer

The device tracking entry for aaaa.bbbb.cccc is invalid.

Answer

The device tracking table has reached its limit.

Question 11

A security architect is designing network access control for a campus network. The requirement is to authenticate users before granting network access and to enforce policies based on user identity and device posture. Which solution should be deployed?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the correct solution because it provides centralized policy-based network access control that authenticates users via 802.1X, MAB, or web authentication, and enforces dynamic VLAN assignment, ACLs, or SGTs based on user identity and device posture (e.g., compliance with antivirus, OS patches). Unlike a generic AAA server, ISE integrates with posture assessment (via AnyConnect or NAC Agent) and supports profiling, guest access, and BYOD onboarding, directly meeting the requirement for identity- and posture-based enforcement.

Answer

AAA server with TACACS+

Answer

VPN concentrator with client certificate authentication

Answer

Next-generation firewall with application control

Question 12

A company wants to implement software-defined segmentation using Cisco ISE and TrustSec. Which component is responsible for assigning the Security Group Tag (SGT) to packets at the ingress?

Accepted Answer

Cisco Catalyst switch with CTS. Option B is correct because a switch with Cisco TrustSec (CTS) capability is responsible for classifying and tagging packets with the SGT at the ingress port. Option A is incorrect because ISE defines the policy but does not tag packets. Option C is incorrect because the endpoint posture agent may report attributes but does not tag. Option D is incorrect because the firewall enforces policies but is not the primary tagging device at the edge.

Answer

Endpoint with posture agent

Answer

Firewall with IPS capability

Answer

Cisco ISE Policy Service Node

Question 13

An engineer is deploying Cisco ISE for guest access. The guest portal uses a self-provisioned username and password. To ensure secure credential transmission, which protocol should be enforced on the portal?

Accepted Answer

HTTPS with a valid certificate. Option A is correct because HTTPS with a valid certificate encrypts the credential transmission between the client and the portal. Option B is incorrect because HTTP transmits credentials in cleartext. Option C is incorrect because RADIUS over TLS is used between the NAS and ISE, not between the client and portal. Option D is incorrect because DNSSEC does not encrypt traffic.

Answer

DNSSEC

Answer

RADIUS over TLS

Answer

HTTP with redirect to captive portal

Question 14

A company is deploying Cisco ISE to enforce access policies based on endpoint posture. Endpoints must be compliant before being granted full network access. Which policy type is used to define the compliance requirements?

Accepted Answer

Posture policy. Option D is correct because Posture policy defines the compliance requirements (e.g., antivirus, patch level) and the remediation actions. Option A is incorrect because Authentication policy determines the method of authentication. Option B is incorrect because Authorization policy determines the resulting access after authentication and posture. Option C is incorrect because Profiling policy identifies device type.

Answer

Authentication policy

Answer

Profiling policy

Answer

Authorization policy

Question 15

A company is deploying Cisco ISE for network access control. Which three policies must be configured to enforce access based on device posture? (Choose three)

Accepted Answer

Authorization policy. Options A, B, and D are correct. Authentication policy (A) determines how users/devices are authenticated (e.g., 802.1X, MAB). Authorization policy (B) defines the access rights based on conditions including posture. Posture policy (D) defines posture requirements and remediation. Profiling policy (C) identifies device type but is not directly required for posture enforcement; guest policy (E) is separate. However, profiling is often helpful but not strictly required; posture policy directly handles the compliance check.

Answer

Guest access policy

Answer

Profiling policy

350-701 Practice Test 15 — 15 Questions

Exhibit

350-701 Practice Test 15 — 15 Questions

Exhibit