350-701 Secure Network Access, Visibility and Enforcement Practice Test 2 — 15 Questions

Question 1

A company has deployed Cisco ISE for network access control. After a recent upgrade, the operations team notices that some users are being assigned incorrect authorization profiles. The ISE logs show that the users are being matched to the correct identity group, but the authorization result is different from expected. What is the most likely cause?

Accepted Answer

The authorization policy rules are not in the correct order, causing a different rule to match first.. In Cisco ISE, authorization policies are evaluated in top-down order, and the first matching rule is applied. Even if users are correctly assigned to an identity group, a higher-priority authorization policy rule that matches on other conditions (e.g., endpoint profile, device type, or time condition) can override the expected result. This is the most likely cause when authentication and group assignment are correct but the authorization result is unexpected.

Answer

The passive identity feature is overriding the user's group assignment.

Answer

The network device group assignment has changed, causing the device to be in a different group.

Answer

The authentication policy is misconfigured, causing users to be placed in the wrong identity group.

Question 2

A network engineer is implementing TrustSec on a Cisco switch. The goal is to tag traffic from the engineering VLAN with Security Group Tag (SGT) 10 and enforce policies on upstream switches. Which configuration is required on the access switch to propagate the SGT?

Accepted Answer

cts manual policy static sgt 10. Option A is correct because the 'cts manual policy static sgt 10' command assigns a static Security Group Tag (SGT) to the switch port, which is then propagated to upstream switches via Cisco TrustSec (CTS) using SGT Exchange Protocol (SXP) or inline tagging. This ensures that traffic from the engineering VLAN is tagged with SGT 10, enabling policy enforcement on upstream devices.

Answer

switchport voice vlan 10

Answer

authentication host-mode multi-domain

Answer

spanning-tree portfast

Question 3

Which THREE of the following are valid components of Cisco ISE's visibility and enforcement architecture?

Accepted Answer

TrustSec with SGTs. Cisco ISE's visibility and enforcement architecture relies on TrustSec with Security Group Tags (SGTs) to enforce access policies based on logical groupings rather than IP addresses. SGTs are propagated via SXP or inline tagging, enabling dynamic policy enforcement across the network.

Answer

NetFlow for flow analysis

Answer

SNMP traps for alerting

Question 4

Refer to the exhibit. A network administrator is troubleshooting device tracking on a Cisco switch. The output shows two devices in VLAN 100. The switch is configured with IPv6 first-hop security features. The administrator notices that the device with MAC address aaaa.bbbb.cccc is not receiving RA guard protection. What is the most likely reason?

Accepted Answer

The interface Gi0/1/1 is not configured as a trusted interface for RA guard.. RA Guard protection is applied per interface based on trust configuration. The exhibit shows the device with MAC aaaa.bbbb.cccc is reachable via Gi0/1/1, but if that interface is not explicitly configured as trusted for RA Guard (e.g., using `ipv6 nd raguard trust`), the switch will not apply RA Guard filtering to RAs received on that port. This allows rogue RA messages from that device to bypass protection, making A the correct answer.

Answer

The device is not in the same VLAN as the RA guard policy.

Answer

The device tracking entry for aaaa.bbbb.cccc is invalid.

Answer

The device tracking table has reached its limit.

Question 5

A large enterprise has deployed Cisco ISE for network access control. The network consists of multiple access switches and wireless LAN controllers. The security team wants to enforce that only domain-joined Windows computers with up-to-date antivirus can access the corporate network. Non-compliant devices should be placed in a quarantine VLAN with limited access to remediation servers. The ISE policies are configured with posture assessment. However, during a test, a non-compliant Windows computer is granted full network access instead of being quarantined. The ISE logs show that the posture assessment passed, but the computer's antivirus is outdated. What is the most likely reason for this behavior?

Accepted Answer

The posture policy is configured with 'continue' action for non-compliant status, allowing the user to proceed to authorization.. Option B is correct because in Cisco ISE, when a posture policy is configured with a 'continue' action for non-compliant status, the session does not terminate; instead, it proceeds to the authorization policy. This means the endpoint is evaluated by authorization rules, which may grant full network access if no quarantine rule is matched. The logs show the posture assessment passed because the 'continue' action treats non-compliance as a passing state for policy flow, not a failure.

Answer

The authorization policy is matching before the posture policy is evaluated.

Answer

The posture agent is not installed on the endpoint, so the assessment is skipped.

Answer

The posture requirement is set to 'mandatory' but the agent is set to 'any', allowing non-compliant devices.

Question 6

A network administrator is troubleshooting an issue where users in the Sales VLAN cannot access the internet through the Cisco Firepower Threat Defense (FTD) device. The FTD is configured with a security policy that allows traffic from the Sales subnet to any destination. However, the traffic is being blocked. Which feature should the administrator check first to resolve the issue?

Accepted Answer

URL filtering policy. The correct answer is D, URL filtering policy. Even though the security policy allows traffic from the Sales subnet to any destination, a URL filtering policy can block internet access by categorizing or matching the destination URLs. If the policy is set to block all URLs or a specific category (e.g., 'Uncategorized URLs'), traffic will be dropped before it reaches the internet, regardless of the allow rule in the access control policy.

Answer

Identity policy

Answer

SSL decryption policy

Answer

Intrusion prevention policy

Question 7

Which TWO configuration steps are required to implement 802.1X authentication on a Cisco switch for wired clients?

Accepted Answer

Configure AAA authentication using RADIUS. Option D is correct because 802.1X requires AAA authentication to be configured on the switch to forward EAP frames to a RADIUS server for user credential verification. Without the 'aaa authentication dot1x default group radius' command, the switch cannot process authentication requests, making this a mandatory step.

Answer

Enable dot1x globally on the switch

Answer

Set the switchport mode to trunk

Answer

Define the RADIUS server IP and shared secret

Question 8

A network administrator has configured the above on a Cisco switch port for a device that supports both MAB and 802.1X. The device sends an EAPOL-start but the switch responds with an EAP-Request/Identity. The device does not respond to the EAP-Request/Identity. After a timeout, the switch attempts MAB. However, MAB also fails because the RADIUS server does not have the MAC address. Which of the following best describes the final port state?

Accepted Answer

The port will remain in an unauthorized state, blocking all traffic. When 802.1X authentication fails because the device does not respond to the EAP-Request/Identity, and MAB also fails because the RADIUS server lacks the MAC address, the switch port remains in an unauthorized state. This is the default behavior for a port configured with both authentication methods: if neither succeeds, the port stays in the 802.1X unauthorized state, blocking all traffic until a successful authentication occurs or a fallback action (like a critical VLAN) is explicitly configured.

Answer

The port will be placed in a critical authentication VLAN

Answer

The port will be error-disabled due to authentication failure

Answer

The port will be placed in VLAN 10 with restricted access

Question 9

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

Question 10

Drag and drop the steps to configure NetFlow on a Cisco IOS router for traffic monitoring in the correct order.

Question 11

Match each Cisco security product to its category.

Question 12

Match each Cisco security command to its function.

Question 13

A network engineer notices that some Windows 10 clients fail to authenticate via 802.1X after a recent OS update. The supplicant shows 'EAPOL-Start' but never receives an EAP-Request/Identity. The switch port is configured with 'authentication port-control auto' and 'dot1x pae authenticator'. What is the most likely cause?

Accepted Answer

The switch port is configured as a trunk port. Option B is correct because if the switch port is configured as a trunk, 802.1X is not supported on trunk ports by default. Option A is wrong because SNMP does not affect EAPOL. Option C is wrong because global authentication mode 'none' would not affect a single port. Option D is wrong because MAB is a fallback method, not the cause of EAPOL-Start not being answered.

Answer

The switch has 'aaa authentication dot1x default none' globally

Answer

The switch port is configured with 'authentication order mab dot1x'

Answer

The switch is configured with 'snmp-server community' which disables 802.1X

Question 14

An ISE deployment uses TrustSec with SGTs assigned by Active Directory group membership. A group of users in the 'Finance' AD group is correctly receiving SGT 5, but a new user added to that group is getting SGT 0. The ISE policy is unchanged, and other users in the group work fine. What is the most likely cause?

Accepted Answer

ISE has not synchronized the latest AD group membership. Option D is correct because ISE caches AD groups; a new user may not be in the cache until the next sync. Option A is wrong because SGT classification can be based on AD groups without PAC. Option B is wrong because endpoint protection is separate. Option C is wrong because profiling is not involved in AD group-based SGT assignment.

Answer

The user endpoint has not been profiled by ISE yet

Answer

The user endpoint is running antivirus software that blocks SGT assignment

Answer

The user does not have a PAC (Protected Access Credential)

Answer

The switchport is configured with 'authentication violation restrict' which blocks the new user

Question 15

A network administrator wants to implement 802.1X authentication on a switch port that connects a printer. The printer does not support 802.1X, so the administrator configures MAC Authentication Bypass (MAB) as a fallback method. Which command must be included in the switch port configuration to ensure MAB is attempted after 802.1X times out?

Accepted Answer

authentication order dot1x mab. Option C is correct because 'authentication order dot1x mab' sets the order: first 802.1X, then MAB. Option A is wrong because 'authentication priority' is not a valid command. Option B is wrong because 'authentication port-control auto' enables authentication but does not set order. Option D is wrong because 'dot1x timeout tx-period' only affects 802.1X timers.

Answer

authentication priority dot1x mab

Answer

dot1x timeout tx-period 30

Answer

authentication port-control auto