350-701 Secure Network Access, Visibility and Enforcement Practice Test 2 — 15 Questions

Question 1

A network engineer notices that some Windows 10 clients fail to authenticate via 802.1X after a recent OS update. The supplicant shows 'EAPOL-Start' but never receives an EAP-Request/Identity. The switch port is configured with 'authentication port-control auto' and 'dot1x pae authenticator'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The switch port is configured as a trunk port. The most likely cause is that the switch port is configured as a trunk port. 802.1X authentication is designed for access ports, not trunk ports. On a trunk port, the switch does not process EAPOL frames correctly because the port is expected to carry multiple VLANs and the switch's 802.1X state machine does not initiate the authentication process. As a result, the supplicant sends EAPOL-Start but the switch never responds with an EAP-Request/Identity, leading to authentication failure.

Answer

The switch has 'aaa authentication dot1x default none' globally

Answer

The switch port is configured with 'authentication order mab dot1x'

Answer

The switch is configured with 'snmp-server community' which disables 802.1X

Question 2

An engineer is troubleshooting a user who cannot access the network after successful 802.1X authentication. The user's PC receives an IP address from DHCP, but cannot reach the internet. The switch port is in the correct VLAN (10) after authentication. The ISE posture policy requires the user to install a corporate certificate, but the user skipped that step. What is the most likely cause of the internet access failure?

Accepted Answer

The ISE posture policy returned 'NonCompliant' and ISE applied a Change of Authorization (CoA) to place the port in a remediation VLAN. The ISE posture policy requires a corporate certificate, and since the user skipped that step, the endpoint is marked as 'NonCompliant'. ISE then sends a Change of Authorization (CoA) to the switch, which dynamically moves the port from the authorized VLAN (10) to a remediation VLAN. This remediation VLAN typically has restricted access, such as no internet connectivity, while still allowing DHCP to assign an IP address from that VLAN's scope.

Answer

The user is not logged into the domain

Answer

The switchport is still in the default VLAN

Answer

The DHCP server does not have a scope for VLAN 10

Question 3

During a network audit, an engineer finds that a switch configured for 802.1X is allowing a device to access the network without authentication. The switch logs show 'MAB failed', 'dot1x failed', but the port is in the forwarding state. The port configuration includes 'authentication fallback final mab' and 'dot1x timeout server-timeout 10'. What is the most likely explanation?

Accepted Answer

The 'authentication fallback final mab' command allows the port to become authorized even if MAB fails. The 'authentication fallback final mab' command includes the 'final' keyword, which configures the switch to authorize the port (place it in the forwarding state) even if MAB fails. In this scenario, both 802.1X and MAB failed, but the 'final' keyword overrides the failure and allows the port to forward traffic. This explains why the device gains network access despite authentication failures.

Answer

The device is using a MAC address that matches a static CAM entry

Answer

The switch has 'aaa authentication dot1x default local' which allows local fallback

Answer

The 'dot1x timeout server-timeout' is too short, causing the switch to skip authentication

Answer

The switch is running an IOS version that treats 'authentication fallback final mab' as a no-op

Question 4

An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?

Accepted Answer

ISE has cached the previous password and is still using it for authentication. ISE caches user credentials for efficiency, including the password used during 802.1X authentication. When a user changes their domain password, ISE may still have the old password cached and will attempt to authenticate with it until the cache expires (typically up to 30 minutes). Option A is incorrect because DNS updates are not related to cached passwords; stale DNS records would affect all users, not just those with recent password changes. Option C is incorrect because wireless controllers do not cache passwords for 802.1X; they forward credentials to the RADIUS server (ISE). Option D is incorrect because the RADIUS server (ISE) is the one caching credentials, not the wireless controller.

Answer

DNS records for the domain controller have not updated

Answer

The wireless controller has a local password cache

Answer

The RADIUS server on the wireless controller is caching credentials

Question 5

A network engineer is deploying TrustSec using SGT over VXLAN in a data center fabric. The fabric switches are configured as VXLAN Tunnel Endpoints (VTEPs). The engineer must ensure that SGT information is propagated from the border leaves to the spine. Which mechanism should be used?

Accepted Answer

VXLAN Group Policy Option (GPO) in the VXLAN header. VXLAN Group Policy Option (GPO) is the correct mechanism because it embeds the SGT directly into the VXLAN header (in the Group Policy ID field, bits 24-31 of the VXLAN Network Identifier). This allows the spine switches, which are also VTEPs, to receive and forward the SGT information without needing a separate control plane protocol. The border leaf encodes the SGT in the VXLAN encapsulation, and the spine decodes it from the header, ensuring end-to-end SGT propagation across the fabric.

Answer

LISP (Locator/ID Separation Protocol)

Answer

SXP (SGT Exchange Protocol) between VTEPs

Answer

IS-IS protocol extensions for SGT

Question 6

During a security incident, an engineer needs to quickly quarantine an endpoint that is connected to a switch via 802.1X. The engineer wants to use ISE to send a Change of Authorization (CoA) to move the port to a restrictive VLAN. What must be configured on the switch to allow ISE to send CoA?

Accepted Answer

The switch must have 'aaa server radius dynamic-author' configured with a client entry for ISE. The `aaa server radius dynamic-author` command defines a local RADIUS dynamic-author server on the switch, which listens for Change of Authorization (CoA) and Disconnect messages from ISE. The client entry specifies the ISE server's IP address and shared secret, allowing the switch to accept and process the CoA request to dynamically change the VLAN assignment for the 802.1X-authenticated endpoint.

Answer

The switch must listen on UDP port 1700 for CoA packets

Answer

The switch must have a VTY line configured with 'transport input ssh'

Answer

RADIUS accounting must be enabled on the switch

Answer

The switch must have 'authentication event server dead action authorize' configured

Question 7

Which TWO are valid options for configuring a switch port to handle authentication failures in an 802.1X environment? (Select two.)

Accepted Answer

authentication event no-response action authorize vlan 100. Option A is correct because the 'authentication event no-response action authorize vlan 100' command tells the switch port to place the client into VLAN 100 when the supplicant does not respond to EAPoL identity requests, which is a valid handling of an authentication failure due to no response. Option E is correct because 'authentication event fail action authorize vlan 999' configures the port to assign the client to VLAN 999 when authentication explicitly fails (for example, wrong credentials), which is a supported failure-handling action in 802.1X environments. Option B is not a valid IOS command for this purpose; 'dot1x critical profile' is not a recognized syntax for configuring authentication failure behavior. Option C is not correct because 'authentication event server dead action reinitialize' handles the case where the RADIUS server is unreachable by reinitializing authentication, not a general authentication failure action. Option D is not correct because 'authentication port-control force-authorized' disables 802.1X authentication on the port entirely, placing it unconditionally in the authorized state rather than handling authentication failures.

Answer

dot1x critical profile

Answer

authentication event server dead action reinitialize

Answer

authentication port-control force-authorized

Question 8

Refer to the exhibit. A user has successfully authenticated via 802.1X. However, the SGT (Security Group Tag) assigned is 0, which is the default untagged value. Which configuration change would most likely allow ISE to assign a non-zero SGT for this user?

Accepted Answer

In ISE authorization profile, add Cisco AV pair 'cts:security-group-tag=15'. The SGT (Security Group Tag) is assigned by ISE via a RADIUS AV (Attribute-Value) pair during the 802.1X authorization phase. The Cisco AV pair 'cts:security-group-tag=15' explicitly instructs ISE to send SGT value 15 in the RADIUS Access-Accept message. Without this AV pair in the authorization profile, ISE defaults to SGT 0 (untrusted/unassigned), even if the user successfully authenticates.

Answer

Enable 'cts manual' globally on the switch

Answer

Ensure that the switch has a RADIUS server defined with 'radius-server host 10.1.1.1 auth-port 1645'

Answer

Configure 'aaa authorization network default group radius' on the switch

Answer

Enable 'sgt caching' on the switch port

Question 9

Refer to the exhibit. An engineer configured ISE to use both Active Directory and LDAP for authentication. Users from Active Directory are unable to authenticate. What is the most likely reason?

Accepted Answer

The LDAP identity store is unreachable and ISE is attempting LDAP before AD. When ISE is configured with both Active Directory and LDAP identity stores, the authentication sequence determines the order in which they are tried. If the sequence is set to 'LDAP then AD' and the LDAP server is unreachable, ISE will attempt LDAP first, fail (due to unreachability), and then proceed to AD. However, if the LDAP server is unreachable but the sequence is 'AD then LDAP', AD would be tried first and succeed for AD users. The most likely reason AD users fail is that the sequence is 'LDAP then AD' and LDAP is unreachable, causing ISE to attempt LDAP first and fail before ever reaching AD, or the sequence is misconfigured such that AD is not tried at all. This aligns with the exhibit's implication that LDAP is attempted before AD, and LDAP being unreachable blocks AD authentication.

Answer

Active Directory users are not allowed in the policy

Answer

The Active Directory identity store is disconnected

Answer

The authentication sequence is set to 'AD then LDAP'

Question 10

A company wants to implement software-defined segmentation using Cisco ISE and TrustSec. Which component is responsible for assigning the Security Group Tag (SGT) to packets at the ingress?

Accepted Answer

Cisco Catalyst switch with CTS. The Cisco Catalyst switch with Cisco TrustSec (CTS) is responsible for assigning the Security Group Tag (SGT) to packets at the ingress. When a packet enters the network, the switch performs a lookup based on the source identity (e.g., IP address, user, or device) against the SGT mapping received from Cisco ISE, and then tags the packet with the appropriate SGT using the SGT header (Cisco proprietary, often carried in the MACsec or VXLAN header). This inline tagging at the ingress switch is the core mechanism of software-defined segmentation in TrustSec.

Answer

Endpoint with posture agent

Answer

Firewall with IPS capability

Answer

Cisco ISE Policy Service Node

Question 11

An organization requires that all endpoint traffic be verified against a security policy before being forwarded. Which Cisco umbrella solution provides this capability?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security service that enforces security policy by intercepting all DNS and IP-layer requests from endpoints and checking them against the organization's security policy before allowing traffic to proceed. This ensures that every connection attempt is verified at the DNS or IP layer, blocking threats before a TCP handshake is completed.

Answer

Cisco AnyConnect

Answer

Cisco Stealthwatch

Answer

Cisco Firepower NGFW

Question 12

A user connected to port Gi1/0/1 cannot access the network. Based on the output, what is the most likely cause?

Accepted Answer

The client does not support 802.1X. The 'Reason: EAP-timeout' indicates that the client did not respond to 802.1X EAP requests, which typically means the client does not support 802.1X or it is not enabled. Option A is incorrect because if the RADIUS server were unreachable, the switch would likely use a critical VLAN, but the reason is EAP-timeout from the client side. Option C is incorrect because AAA configuration would cause different errors. Option D is incorrect because 'Errdisable' would show a different port state.

Answer

The RADIUS server is unreachable

Answer

The switch has a misconfigured AAA command

Answer

The port is in errdisable state

Question 13

A guest device in VLAN 200 attempts to reach a server at 10.10.1.1. What happens to the traffic?

Accepted Answer

The traffic is dropped. In a properly segmented network, a guest VLAN (VLAN 200) is isolated from the internal corporate network where the server at 10.10.1.1 resides. Inter-VLAN routing between the guest VLAN and the internal server subnet is blocked by ACLs or firewall policy, so the traffic is dropped at the gateway. This enforces the security principle that guest devices must not reach internal resources.

Answer

The traffic is permitted

Answer

The traffic is forwarded without any action

Answer

The traffic is logged and forwarded

Question 14

An endpoint with MAC 0011.2233.4455 and user 'guest' authenticates but fails. However, the device is not assigned to quarantine. Which policy condition is most likely responsible for the unexpected behavior?

Accepted Answer

The device is compliant and the device type is in the allowed list. In Cisco Identity Services Engine (ISE), authorization policies are evaluated independently of authentication results. Even if authentication fails (e.g., wrong credentials for user 'guest'), the authorization policy can still match based on other conditions like device compliance status and device type. If the device is compliant and its device type is in the allowed list, the authorization result may be a permit access (e.g., full access or a specific VLAN) rather than quarantine. Thus, the device is not quarantined because the authorization policy explicitly allows it, overriding the typical expectation that failed authentication leads to quarantine. This is a key ISE behavior: authentication and authorization are separate policy stages.

Answer

The authentication failure overrides authorization

Answer

The quarantine VLAN is not configured on the switch

Answer

The device is authenticated via MAB, bypassing posture

Question 15

An administrator is configuring 802.1X on a switch port for both an IP phone and a PC. Which two commands should be configured to support this scenario? (Choose two)

Accepted Answer

authentication host-mode multi-domain. Option A, 'authentication host-mode multi-domain', is correct because it allows exactly one data device (the PC) and one voice device (the IP phone) to authenticate independently on the same switch port, which matches this scenario. Option D, 'authentication port-control auto', is correct because it enables 802.1X authentication on the port, requiring the connected endpoints to authenticate before gaining access. Option B, 'dot1x pae authenticator', is not needed here because the newer 'authentication port-control auto' command already configures the port as an authenticator in the IBNS framework. Option C, 'authentication violation restrict', is a violation-handling action, not a required command for enabling this dual-device scenario. Option E, 'authentication host-mode multi-auth', is incorrect because multi-auth permits multiple data devices on the data domain, whereas the scenario requires only one PC plus one IP phone, which multi-domain handles.

Answer

dot1x pae authenticator

Answer

authentication violation restrict

Answer

authentication host-mode multi-auth