350-701 Secure Network Access, Visibility and Enforcement — 20 Questions

Question 1

A network administrator is troubleshooting an issue where users in the finance VLAN are unable to access a critical server in the server VLAN. The switch logs show multiple 'Authentication failed' messages for MAC addresses in the finance VLAN. The switchport security feature is enabled on the access ports. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Switchport security violation has caused the ports to error-disable or drop traffic.. The switch logs show 'Authentication failed' messages, which are typically generated by 802.1X or MAC Authentication Bypass (MAB) processes. However, the switchport security feature is enabled on the access ports. When a switchport security violation occurs (e.g., due to an unauthorized MAC address or exceeding the allowed MAC limit), the port can be configured to error-disable (shutdown) or drop traffic (restrict). This action will prevent any traffic from passing, including authentication traffic, leading to connectivity loss. The 'Authentication failed' messages are likely a consequence of the port being in an error-disabled state, causing subsequent authentication attempts to fail. Therefore, the most likely root cause is a switchport security violation that has disabled or restricted the ports.

Answer

The switch ports are configured as trunks and are not allowing the finance VLAN.

Answer

802.1X authentication is failing for the finance users.

Answer

Spanning Tree Protocol (STP) is blocking the ports in the finance VLAN.

Question 2

Which TWO configuration steps are required to implement 802.1X authentication on a Cisco switch for wired clients?

Accepted Answer

Configure AAA authentication using RADIUS. Options D and E are both correct because 802.1X on a Cisco switch requires two mandatory steps: (1) AAA authentication using RADIUS must be configured with the 'aaa authentication dot1x default group radius' command so the switch can forward EAP messages to a RADIUS server; (2) the switchport must be configured in access mode (not trunk) to support single-host 802.1X. Option A (enable dot1x globally) is optional; 'dot1x port-control auto' can be applied per interface without global enablement. Option B (trunk) is incorrect because 802.1X is only supported on access ports. Option C (define RADIUS server) is part of the AAA configuration but is not listed as a separate required step in Cisco's typical multiple-choice framing.

Answer

Enable dot1x globally on the switch

Answer

Set the switchport mode to trunk

Answer

Define the RADIUS server IP and shared secret

Question 3

An organization is deploying Cisco ISE with passive identity mapping from Active Directory. They notice that users are not being correctly identified on the network, and some workstations are appearing with multiple IP addresses. What is the most likely cause?

Accepted Answer

The DHCP server is not configured to forward DHCP packets to ISE.. Passive identity mapping via DHCP requires the DHCP server to forward DHCP packets to ISE. Without this, IP-to-MAC mappings are incomplete. Option A is incorrect because domain join credentials affect ISE-AD communication, not DHCP mapping. Option C is incorrect because the passive identity service must be enabled, but the symptom points to missing DHCP data, not an inactive service. Option D is incorrect because SNMP traps for MAC notification are used for endpoint classification, not passive identity mapping.

Answer

ISE is configured with incorrect Active Directory domain join credentials.

Answer

The ISE node is not configured for passive identity service.

Answer

The network switches are not configured with SNMP traps for MAC notification.

Question 4

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

Accepted Answer

Authorization policy. Authorization policies in Cisco ISE define the access permissions granted to authenticated users, such as allowing or denying network access. In this scenario, after a user authenticates via Active Directory (handled by the authentication policy), the authorization policy evaluates conditions (e.g., AD group membership) to enforce the required access control for the corporate wireless network.

Answer

Profiling policy

Answer

Authentication policy

Answer

Policy set

Question 5

A company uses Cisco ISE for network access control. Users connecting via wired 802.1X are successfully authenticated but cannot reach the internet. The administrator checks the authorization policy and notices that the correct dACL is being applied. What is the most likely cause of the issue?

Accepted Answer

The RADIUS server is not sending the dACL attribute in the Access-Accept. The most likely cause is that the RADIUS server (ISE) is not sending the dACL attribute in the Access-Accept packet. Even though the authorization policy applies a dACL, if the RADIUS message does not include the dACL name (e.g., Cisco-AV-Pair = "ip:inacl#100=...") or the switch does not receive it, the switch cannot enforce the filter, leaving the user authenticated but with no internet access due to default deny-all behavior.

Answer

The switchport is configured as dynamic desirable

Answer

The switch port MTU is set to 1500 bytes

Answer

ISE is out of licenses for endpoint devices

Question 6

An organization is implementing TrustSec to enforce micro-segmentation. The Security Group Tag (SGT) is assigned to a user via ISE after authentication. However, traffic from this user to a server with SGT 5 is being dropped. The administrator checks the SGACL configuration on the switch and finds the following: 'permit ip source 2 destination 5'. What is the most likely reason for the traffic being dropped?

Accepted Answer

SXP is not configured between ISE and the switch. The SGACL entry 'permit ip source 2 destination 5' exists, but traffic from the user to the server with SGT 5 is still being dropped. This is likely because the switch does not know the user's SGT. TrustSec uses SXP to dynamically propagate SGT mappings from ISE to network devices. Without SXP configured between ISE and the switch, the switch cannot map the user's authentication identity to the correct SGT (e.g., SGT 2). As a result, the switch either treats the user as untagged (SGT 0) or drops the traffic due to lack of a matching SGACL entry for the actual SGT pair. Thus, configuring SXP is essential for the switch to enforce SGACLs based on user-assigned SGTs.

Answer

The PAC on the switch has expired

Answer

The CTRL protocol is not enabled on the switch

Answer

The SGACL defaults to deny if no explicit permit is found for the source-destination SGT pair

Question 7

A company is deploying Cisco ISE for guest access. They want to provide a self-service portal where guests can register their devices and receive a temporary username and password. Which ISE component is used to accomplish this?

Accepted Answer

Guest Portal. C is correct because the Guest Portal in Cisco ISE is specifically designed to provide a self-service registration page where guests can create their own accounts, receive temporary credentials, and gain network access. This portal handles the entire guest lifecycle, including sponsor approval if required, and can deliver the username/password via SMS, email, or on-screen display.

Answer

BYOD Portal

Answer

Mobile Device Management (MDM)

Answer

Profiler Service

Question 8

An engineer is troubleshooting a Cisco ISE deployment where some endpoints are not being profiled correctly. The administrator notices that the endpoints are not sending DHCP requests. Which profiling probe should be primarily used to identify these endpoints?

Accepted Answer

NetFlow probe. (NetFlow probe) because when endpoints do not send DHCP requests, the DHCP probe cannot collect any data. The NetFlow probe analyzes network traffic flows to identify endpoints based on IP addresses, ports, and protocols, even without DHCP activity. This allows Cisco ISE to profile endpoints by observing their communication patterns, such as HTTP or DNS traffic, which still occur even if DHCP is not used.

Answer

DHCP probe

Answer

HTTP probe

Answer

DNS probe

Question 9

A network administrator wants to implement 802.1X on a Cisco switch port for a device that does not support 802.1X. Which feature should be configured to allow the device to connect?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) is the correct feature because it allows a device that does not support 802.1X supplicant software to authenticate by using its MAC address as the identity. The switch acts as a proxy, sending the MAC address as the username and password to the RADIUS server, which can then grant or deny access based on the MAC address in its database.

Answer

802.1X with EAP-MSCHAPv2

Answer

Downloadable ACL (dACL)

Answer

Web Authentication (WA)

Question 10

An organization is using Cisco ISE to enforce posture compliance. Endpoints that are non-compliant should be placed into a quarantine VLAN. Which ISE policy component is used to assign the VLAN?

Accepted Answer

Authorization profile. An Authorization Profile in Cisco ISE defines the enforcement actions to be applied to an endpoint after successful authentication and authorization. When a posture assessment determines an endpoint is non-compliant, the authorization policy can match that condition and return an authorization profile that includes a specific VLAN ID (e.g., quarantine VLAN) via RADIUS attributes such as Tunnel-Private-Group-ID (RFC 2868). This VLAN assignment is a core function of the authorization profile, not of authentication or profiling.

Answer

Policy set

Answer

Profiling policy

Answer

Authentication policy

Question 11

A security engineer is configuring Cisco ISE to enforce SGT-based access control. The engineer creates an SGACL on the switch that permits traffic from SGT 10 to SGT 20. However, traffic from SGT 10 to SGT 20 is still being dropped. The engineer verifies that the SGTs are correctly assigned. What is a possible reason for the drop?

Accepted Answer

There is a deny SGACL with a higher priority that matches the traffic. Cisco ISE enforces SGT-based access control using Security Group ACLs (SGACLs) that are evaluated in priority order. Even if a permit SGACL exists for SGT 10 to SGT 20, a deny SGACL with a higher priority (lower sequence number) that matches the same traffic will take precedence and cause the traffic to be dropped. The engineer must check the full SGACL list and their sequence numbers on the switch to identify conflicting rules.

Answer

SXP is not configured

Answer

The CTRL protocol is not enabled

Answer

The PAC on the switch is expired

Question 12

Which TWO of the following are valid methods for Cisco ISE to collect endpoint attributes for profiling? (Choose TWO)

Accepted Answer

NetFlow Probe. Cisco ISE can use a NetFlow Probe to collect NetFlow records from network devices, which provide metadata about traffic flows (e.g., IP addresses, ports, protocols) that ISE analyzes to profile endpoints. This passive collection method helps identify endpoint attributes without requiring active agent deployment.

Answer

Syslog

Answer

RADIUS Accounting

Answer

SNMP Polling

Question 13

Which THREE of the following are required for a successful 802.1X authentication on a Cisco switch? (Choose THREE)

Accepted Answer

The switch must be configured as a RADIUS client to ISE. For 802.1X authentication, the switch must act as a RADIUS client (authenticator) forwarding EAP frames to the ISE (authentication server). Without this configuration, the switch cannot communicate with ISE to validate the endpoint's credentials, making it a mandatory requirement.

Answer

Security Group Tag (SGT) must be assigned

Answer

A downloadable ACL (dACL) must be configured on ISE

Question 14

Which TWO of the following are features of Cisco TrustSec? (Choose TWO)

Accepted Answer

Security Group Tag Exchange Protocol (SXP). Security Group Tag Exchange Protocol (SXP) is a Cisco TrustSec feature that propagates Security Group Tag (SGT) bindings between network devices without requiring inline tagging on every packet. It allows devices that do not natively support SGT in hardware to participate in TrustSec by exchanging IP-to-SGT mappings over TCP, enabling consistent policy enforcement across heterogeneous environments.

Answer

IPsec VPN

Answer

Network Access Control (NAC)

Answer

802.1X authentication

Question 15

A multinational corporation is deploying Cisco ISE to enforce network access for both wired and wireless users. The company has 5,000 employees and 2,000 guest users daily. The ISE deployment consists of two nodes: a primary Administration Node (PAN) and a Monitoring Node (MNT). All policies are configured on the PAN. Recently, the company has experienced intermittent authentication failures during peak hours. The failures affect both wired 802.1X and wireless users. The syslogs show 'RADIUS request dropped' messages on the ISE nodes. The network team has verified that the RADIUS shared secret is correct and that the network devices can reach the ISE nodes. The ISE nodes have sufficient CPU and memory. However, the authentication failures correlate with times when the number of concurrent sessions exceeds 500. What is the most likely cause of the issue?

Accepted Answer

The ISE node is running out of RADIUS session capacity. The 'RADIUS request dropped' messages and correlation with concurrent sessions exceeding 500 indicate that the ISE node has reached its RADIUS session capacity. Cisco ISE nodes have a finite number of RADIUS session contexts (typically 500 for a single node in many deployments), and once this limit is exceeded, new authentication requests are dropped. This is a licensing and resource limitation, not a CPU or memory issue, and it explains why failures occur only during peak hours.

Answer

The ISE nodes are not reachable from the network devices

Answer

The RADIUS shared secret is mistyped on some network devices

Answer

The CPU and memory are insufficient despite appearing sufficient

Question 16

A university is using Cisco ISE to provide secure wireless access for students and faculty. The wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. Recently, some faculty members reported that they cannot connect to the wireless network from their personal laptops, while student devices connect without issues. The faculty members are using the same SSID and entering their credentials correctly. The ISE logs show that the authentication attempts from faculty devices are failing with 'RADIUS Access-Reject' due to incorrect credentials. However, the faculty members are certain they are using the correct password. The IT department has verified that the user accounts in Active Directory are active and not locked. What is the most likely cause of the issue?

Accepted Answer

The ISE authentication policy is not configured to query Active Directory for faculty users. The most likely cause is that the ISE authentication policy is not configured to query Active Directory for faculty users. Since student devices connect successfully, the policy likely matches students to an AD identity source but fails for faculty because their accounts are in a different AD group or domain not included in the policy. The 'RADIUS Access-Reject' with 'incorrect credentials' error in ISE logs indicates the authentication policy is not finding the user in the configured identity stores, even though the password is correct.

Answer

The faculty laptops do not have a valid client certificate

Answer

The faculty accounts are locked due to multiple failed attempts

Answer

The RADIUS shared secret on the wireless controller is incorrect

Question 17

A security architect is designing network access control for a campus network. The requirement is to authenticate users before granting network access and to enforce policies based on user identity and device posture. Which solution should be deployed?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the correct solution because it provides centralized policy-based network access control that authenticates users via 802.1X, MAB, or web authentication, and enforces dynamic VLAN assignment, ACLs, or SGTs based on user identity and device posture (e.g., compliance with antivirus, OS patches). Unlike a generic AAA server, ISE integrates with posture assessment (via AnyConnect or NAC Agent) and supports profiling, guest access, and BYOD onboarding, directly meeting the requirement for identity- and posture-based enforcement.

Answer

AAA server with TACACS+

Answer

VPN concentrator with client certificate authentication

Answer

Next-generation firewall with application control

Question 18

A company has deployed Cisco ISE for network access control. After a recent upgrade, the operations team notices that some users are being assigned incorrect authorization profiles. The ISE logs show that the users are being matched to the correct identity group, but the authorization result is different from expected. What is the most likely cause?

Accepted Answer

The authorization policy rules are not in the correct order, causing a different rule to match first.. In Cisco ISE, authorization policies are evaluated in top-down order, and the first matching rule is applied. Even if users are correctly assigned to an identity group, a higher-priority authorization policy rule that matches on other conditions (e.g., endpoint profile, device type, or time condition) can override the expected result. This is the most likely cause when authentication and group assignment are correct but the authorization result is unexpected.

Answer

The passive identity feature is overriding the user's group assignment.

Answer

The network device group assignment has changed, causing the device to be in a different group.

Answer

The authentication policy is misconfigured, causing users to be placed in the wrong identity group.

Question 19

A network engineer is implementing TrustSec on a Cisco switch. The goal is to tag traffic from the engineering VLAN with Security Group Tag (SGT) 10 and enforce policies on upstream switches. Which configuration is required on the access switch to propagate the SGT?

Accepted Answer

cts manual policy static sgt 10. The 'cts manual policy static sgt 10' command assigns a static Security Group Tag (SGT) to the switch port, which is then propagated to upstream switches via Cisco TrustSec (CTS) using SGT Exchange Protocol (SXP) or inline tagging. This ensures that traffic from the engineering VLAN is tagged with SGT 10, enabling policy enforcement on upstream devices.

Answer

switchport voice vlan 10

Answer

authentication host-mode multi-domain

Answer

spanning-tree portfast

Question 20

Which THREE of the following are valid components of Cisco ISE's visibility and enforcement architecture?

Accepted Answer

TrustSec with SGTs. Cisco ISE's visibility and enforcement architecture relies on TrustSec with Security Group Tags (SGTs) to enforce access policies based on logical groupings rather than IP addresses. SGTs are propagated via SXP or inline tagging, enabling dynamic policy enforcement across the network.

Answer

NetFlow for flow analysis

Answer

SNMP traps for alerting