350-701 Secure Network Access, Visibility and Enforcement — 20 Questions

Question 1

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

Accepted Answer

Authorization policy. Option C is correct because authorization policies in Cisco ISE define the access permissions granted to authenticated users, such as allowing or denying network access. In this scenario, after a user authenticates via Active Directory (handled by the authentication policy), the authorization policy evaluates conditions (e.g., AD group membership) to enforce the required access control for the corporate wireless network.

Answer

Profiling policy

Answer

Authentication policy

Answer

Policy set

Question 2

A company uses Cisco ISE for network access control. Users connecting via wired 802.1X are successfully authenticated but cannot reach the internet. The administrator checks the authorization policy and notices that the correct dACL is being applied. What is the most likely cause of the issue?

Accepted Answer

The RADIUS server is not sending the dACL attribute in the Access-Accept. The most likely cause is that the RADIUS server (ISE) is not sending the dACL attribute in the Access-Accept packet. Even though the authorization policy applies a dACL, if the RADIUS message does not include the dACL name (e.g., Cisco-AV-Pair = "ip:inacl#100=...") or the switch does not receive it, the switch cannot enforce the filter, leaving the user authenticated but with no internet access due to default deny-all behavior.

Answer

The switchport is configured as dynamic desirable

Answer

The switch port MTU is set to 1500 bytes

Answer

ISE is out of licenses for endpoint devices

Question 3

An organization is implementing TrustSec to enforce micro-segmentation. The Security Group Tag (SGT) is assigned to a user via ISE after authentication. However, traffic from this user to a server with SGT 5 is being dropped. The administrator checks the SGACL configuration on the switch and finds the following: 'permit ip source 2 destination 5'. What is the most likely reason for the traffic being dropped?

Accepted Answer

The SGACL defaults to deny if no explicit permit is found for the source-destination SGT pair. The SGACL on the switch explicitly permits traffic from source SGT 2 to destination SGT 5. However, TrustSec SGACLs operate with an implicit deny at the end of the access list. Since the administrator only configured a single permit entry and no explicit permit for the specific source-destination SGT pair being tested, the traffic is dropped by the implicit deny. Option D correctly identifies this default behavior.

Answer

The PAC on the switch has expired

Answer

SXP is not configured between ISE and the switch

Answer

The CTRL protocol is not enabled on the switch

Question 4

A company is deploying Cisco ISE for guest access. They want to provide a self-service portal where guests can register their devices and receive a temporary username and password. Which ISE component is used to accomplish this?

Accepted Answer

Guest Portal. C is correct because the Guest Portal in Cisco ISE is specifically designed to provide a self-service registration page where guests can create their own accounts, receive temporary credentials, and gain network access. This portal handles the entire guest lifecycle, including sponsor approval if required, and can deliver the username/password via SMS, email, or on-screen display.

Answer

BYOD Portal

Answer

Mobile Device Management (MDM)

Answer

Profiler Service

Question 5

An engineer is troubleshooting a Cisco ISE deployment where some endpoints are not being profiled correctly. The administrator notices that the endpoints are not sending DHCP requests. Which profiling probe should be primarily used to identify these endpoints?

Accepted Answer

NetFlow probe. The correct answer is A (NetFlow probe) because when endpoints do not send DHCP requests, the DHCP probe cannot collect any data. The NetFlow probe analyzes network traffic flows to identify endpoints based on IP addresses, ports, and protocols, even without DHCP activity. This allows Cisco ISE to profile endpoints by observing their communication patterns, such as HTTP or DNS traffic, which still occur even if DHCP is not used.

Answer

DHCP probe

Answer

HTTP probe

Answer

DNS probe

Question 6

A network administrator wants to implement 802.1X on a Cisco switch port for a device that does not support 802.1X. Which feature should be configured to allow the device to connect?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) is the correct feature because it allows a device that does not support 802.1X supplicant software to authenticate by using its MAC address as the identity. The switch acts as a proxy, sending the MAC address as the username and password to the RADIUS server, which can then grant or deny access based on the MAC address in its database.

Answer

802.1X with EAP-MSCHAPv2

Answer

Downloadable ACL (dACL)

Answer

Web Authentication (WA)

Question 7

An organization is using Cisco ISE to enforce posture compliance. Endpoints that are non-compliant should be placed into a quarantine VLAN. Which ISE policy component is used to assign the VLAN?

Accepted Answer

Authorization profile. The correct answer is A because an Authorization Profile in Cisco ISE defines the enforcement actions to be applied to an endpoint after successful authentication and authorization. When a posture assessment determines an endpoint is non-compliant, the authorization policy can match that condition and return an authorization profile that includes a specific VLAN ID (e.g., quarantine VLAN) via RADIUS attributes such as Tunnel-Private-Group-ID (RFC 2868). This VLAN assignment is a core function of the authorization profile, not of authentication or profiling.

Answer

Policy set

Answer

Profiling policy

Answer

Authentication policy

Question 8

A security engineer is configuring Cisco ISE to enforce SGT-based access control. The engineer creates an SGACL on the switch that permits traffic from SGT 10 to SGT 20. However, traffic from SGT 10 to SGT 20 is still being dropped. The engineer verifies that the SGTs are correctly assigned. What is a possible reason for the drop?

Accepted Answer

There is a deny SGACL with a higher priority that matches the traffic. Option D is correct because Cisco ISE enforces SGT-based access control using Security Group ACLs (SGACLs) that are evaluated in priority order. Even if a permit SGACL exists for SGT 10 to SGT 20, a deny SGACL with a higher priority (lower sequence number) that matches the same traffic will take precedence and cause the traffic to be dropped. The engineer must check the full SGACL list and their sequence numbers on the switch to identify conflicting rules.

Answer

SXP is not configured

Answer

The CTRL protocol is not enabled

Answer

The PAC on the switch is expired

Question 9

Which TWO of the following are valid methods for Cisco ISE to collect endpoint attributes for profiling? (Choose TWO)

Accepted Answer

NetFlow Probe. Option C is correct because Cisco ISE can use a NetFlow Probe to collect NetFlow records from network devices, which provide metadata about traffic flows (e.g., IP addresses, ports, protocols) that ISE analyzes to profile endpoints. This passive collection method helps identify endpoint attributes without requiring active agent deployment.

Answer

Syslog

Answer

RADIUS Accounting

Answer

SNMP Polling

Question 10

Which THREE of the following are required for a successful 802.1X authentication on a Cisco switch? (Choose THREE)

Accepted Answer

The switch must be configured as a RADIUS client to ISE. For 802.1X authentication, the switch must act as a RADIUS client (authenticator) forwarding EAP frames to the ISE (authentication server). Without this configuration, the switch cannot communicate with ISE to validate the endpoint's credentials, making it a mandatory requirement.

Answer

Security Group Tag (SGT) must be assigned

Answer

A downloadable ACL (dACL) must be configured on ISE

Question 11

Which TWO of the following are features of Cisco TrustSec? (Choose TWO)

Accepted Answer

Security Group Tag Exchange Protocol (SXP). Security Group Tag Exchange Protocol (SXP) is a Cisco TrustSec feature that propagates Security Group Tag (SGT) bindings between network devices without requiring inline tagging on every packet. It allows devices that do not natively support SGT in hardware to participate in TrustSec by exchanging IP-to-SGT mappings over TCP, enabling consistent policy enforcement across heterogeneous environments.

Answer

IPsec VPN

Answer

Network Access Control (NAC)

Answer

802.1X authentication

Question 12

A multinational corporation is deploying Cisco ISE to enforce network access for both wired and wireless users. The company has 5,000 employees and 2,000 guest users daily. The ISE deployment consists of two nodes: a primary Administration Node (PAN) and a Monitoring Node (MNT). All policies are configured on the PAN. Recently, the company has experienced intermittent authentication failures during peak hours. The failures affect both wired 802.1X and wireless users. The syslogs show 'RADIUS request dropped' messages on the ISE nodes. The network team has verified that the RADIUS shared secret is correct and that the network devices can reach the ISE nodes. The ISE nodes have sufficient CPU and memory. However, the authentication failures correlate with times when the number of concurrent sessions exceeds 500. What is the most likely cause of the issue?

Accepted Answer

The ISE node is running out of RADIUS session capacity. The 'RADIUS request dropped' messages and correlation with concurrent sessions exceeding 500 indicate that the ISE node has reached its RADIUS session capacity. Cisco ISE nodes have a finite number of RADIUS session contexts (typically 500 for a single node in many deployments), and once this limit is exceeded, new authentication requests are dropped. This is a licensing and resource limitation, not a CPU or memory issue, and it explains why failures occur only during peak hours.

Answer

The ISE nodes are not reachable from the network devices

Answer

The RADIUS shared secret is mistyped on some network devices

Answer

The CPU and memory are insufficient despite appearing sufficient

Question 13

A university is using Cisco ISE to provide secure wireless access for students and faculty. The wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. Recently, some faculty members reported that they cannot connect to the wireless network from their personal laptops, while student devices connect without issues. The faculty members are using the same SSID and entering their credentials correctly. The ISE logs show that the authentication attempts from faculty devices are failing with 'RADIUS Access-Reject' due to incorrect credentials. However, the faculty members are certain they are using the correct password. The IT department has verified that the user accounts in Active Directory are active and not locked. What is the most likely cause of the issue?

Accepted Answer

The ISE authentication policy is not configured to query Active Directory for faculty users. The most likely cause is that the ISE authentication policy is not configured to query Active Directory for faculty users. Since student devices connect successfully, the policy likely matches students to an AD identity source but fails for faculty because their accounts are in a different AD group or domain not included in the policy. The 'RADIUS Access-Reject' with 'incorrect credentials' error in ISE logs indicates the authentication policy is not finding the user in the configured identity stores, even though the password is correct.

Answer

The faculty laptops do not have a valid client certificate

Answer

The faculty accounts are locked due to multiple failed attempts

Answer

The RADIUS shared secret on the wireless controller is incorrect

Question 14

A network administrator is troubleshooting an issue where users in the finance VLAN are unable to access a critical server in the server VLAN. The switch logs show multiple 'Authentication failed' messages for MAC addresses in the finance VLAN. The switchport security feature is enabled on the access ports. What is the most likely cause of the issue?

Accepted Answer

Switchport security violation has caused the ports to error-disable or drop traffic.. The switch logs show 'Authentication failed' messages for MAC addresses in the finance VLAN, and switchport security is enabled. When a switchport security violation occurs (e.g., due to a MAC address limit or an unauthorized MAC address), the port can be configured to error-disable or drop traffic. This explains why users in the finance VLAN cannot reach the server, as the access ports are effectively blocking traffic due to the security violation.

Answer

The switch ports are configured as trunks and are not allowing the finance VLAN.

Answer

802.1X authentication is failing for the finance users.

Answer

Spanning Tree Protocol (STP) is blocking the ports in the finance VLAN.

Question 15

A security architect is designing network access control for a campus network. The requirement is to authenticate users before granting network access and to enforce policies based on user identity and device posture. Which solution should be deployed?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the correct solution because it provides centralized policy-based network access control that authenticates users via 802.1X, MAB, or web authentication, and enforces dynamic VLAN assignment, ACLs, or SGTs based on user identity and device posture (e.g., compliance with antivirus, OS patches). Unlike a generic AAA server, ISE integrates with posture assessment (via AnyConnect or NAC Agent) and supports profiling, guest access, and BYOD onboarding, directly meeting the requirement for identity- and posture-based enforcement.

Answer

AAA server with TACACS+

Answer

VPN concentrator with client certificate authentication

Answer

Next-generation firewall with application control

Question 16

A company has deployed Cisco ISE for network access control. After a recent upgrade, the operations team notices that some users are being assigned incorrect authorization profiles. The ISE logs show that the users are being matched to the correct identity group, but the authorization result is different from expected. What is the most likely cause?

Accepted Answer

The authorization policy rules are not in the correct order, causing a different rule to match first.. In Cisco ISE, authorization policies are evaluated in top-down order, and the first matching rule is applied. Even if users are correctly assigned to an identity group, a higher-priority authorization policy rule that matches on other conditions (e.g., endpoint profile, device type, or time condition) can override the expected result. This is the most likely cause when authentication and group assignment are correct but the authorization result is unexpected.

Answer

The passive identity feature is overriding the user's group assignment.

Answer

The network device group assignment has changed, causing the device to be in a different group.

Answer

The authentication policy is misconfigured, causing users to be placed in the wrong identity group.

Question 17

A network engineer is implementing TrustSec on a Cisco switch. The goal is to tag traffic from the engineering VLAN with Security Group Tag (SGT) 10 and enforce policies on upstream switches. Which configuration is required on the access switch to propagate the SGT?

Accepted Answer

cts manual policy static sgt 10. Option A is correct because the 'cts manual policy static sgt 10' command assigns a static Security Group Tag (SGT) to the switch port, which is then propagated to upstream switches via Cisco TrustSec (CTS) using SGT Exchange Protocol (SXP) or inline tagging. This ensures that traffic from the engineering VLAN is tagged with SGT 10, enabling policy enforcement on upstream devices.

Answer

switchport voice vlan 10

Answer

authentication host-mode multi-domain

Answer

spanning-tree portfast

Question 18

Which THREE of the following are valid components of Cisco ISE's visibility and enforcement architecture?

Accepted Answer

TrustSec with SGTs. Cisco ISE's visibility and enforcement architecture relies on TrustSec with Security Group Tags (SGTs) to enforce access policies based on logical groupings rather than IP addresses. SGTs are propagated via SXP or inline tagging, enabling dynamic policy enforcement across the network.

Answer

NetFlow for flow analysis

Answer

SNMP traps for alerting

Question 19

Refer to the exhibit. A network administrator is troubleshooting device tracking on a Cisco switch. The output shows two devices in VLAN 100. The switch is configured with IPv6 first-hop security features. The administrator notices that the device with MAC address aaaa.bbbb.cccc is not receiving RA guard protection. What is the most likely reason?

Accepted Answer

The interface Gi0/1/1 is not configured as a trusted interface for RA guard.. RA Guard protection is applied per interface based on trust configuration. The exhibit shows the device with MAC aaaa.bbbb.cccc is reachable via Gi0/1/1, but if that interface is not explicitly configured as trusted for RA Guard (e.g., using `ipv6 nd raguard trust`), the switch will not apply RA Guard filtering to RAs received on that port. This allows rogue RA messages from that device to bypass protection, making A the correct answer.

Answer

The device is not in the same VLAN as the RA guard policy.

Answer

The device tracking entry for aaaa.bbbb.cccc is invalid.

Answer

The device tracking table has reached its limit.

Question 20

A large enterprise has deployed Cisco ISE for network access control. The network consists of multiple access switches and wireless LAN controllers. The security team wants to enforce that only domain-joined Windows computers with up-to-date antivirus can access the corporate network. Non-compliant devices should be placed in a quarantine VLAN with limited access to remediation servers. The ISE policies are configured with posture assessment. However, during a test, a non-compliant Windows computer is granted full network access instead of being quarantined. The ISE logs show that the posture assessment passed, but the computer's antivirus is outdated. What is the most likely reason for this behavior?

Accepted Answer

The posture policy is configured with 'continue' action for non-compliant status, allowing the user to proceed to authorization.. Option B is correct because in Cisco ISE, when a posture policy is configured with a 'continue' action for non-compliant status, the session does not terminate; instead, it proceeds to the authorization policy. This means the endpoint is evaluated by authorization rules, which may grant full network access if no quarantine rule is matched. The logs show the posture assessment passed because the 'continue' action treats non-compliance as a passing state for policy flow, not a failure.

Answer

The authorization policy is matching before the posture policy is evaluated.

Answer

The posture agent is not installed on the endpoint, so the assessment is skipped.

Answer

The posture requirement is set to 'mandatory' but the agent is set to 'any', allowing non-compliant devices.