350-701 Secure Network Access, Visibility and Enforcement Practice Test 3 — 15 Questions

Question 1

A company is deploying Cisco ISE for network access control. Which three policies must be configured to enforce access based on device posture? (Choose three)

Accepted Answer

Authorization policy. The Authorization policy (A) is required because it is where ISE evaluates posture results (e.g., Compliant/Non-Compliant from the posture assessment) and returns the appropriate authorization result, such as a downloadable ACL, VLAN, or SGT, to enforce access based on device posture. The Posture policy (B) is essential because it defines the posture conditions and remediation actions, specifying which posture checks (e.g., Windows Defender enabled, antivirus up to date) must pass for a device to be deemed compliant. The Authentication policy (D) is necessary because posture enforcement depends on the identity and authentication result of the endpoint/user; ISE must first authenticate the session (via 802.1X, MAB, or web auth) and determine the identity store and authentication protocol before posture can be evaluated and enforced. The Guest access policy (C) is not required for posture-based enforcement, as it governs sponsor/guest onboarding and access, not device compliance checks. The Profiling policy (E) is also not required, since profiling identifies and classifies endpoints by attributes but does not itself evaluate or enforce posture compliance.

Answer

Guest access policy

Answer

Profiling policy

Question 2

An organization wants to implement MAC Authentication Bypass (MAB) for devices that do not support 802.1X. Which configuration is required on a Cisco switch to allow MAB fallback?

Accepted Answer

authentication order mab dot1x. The 'authentication order mab dot1x' command configures the switch to attempt MAB first and then fall back to 802.1X if MAB fails. This is the exact requirement for devices that do not support 802.1X, ensuring they are authenticated via MAC address while still allowing 802.1X for capable devices.

Answer

authentication priority dot1x mab

Answer

authentication port-control auto

Answer

authentication fallback mab

Question 3

In a Cisco TrustSec environment, a network administrator observes that traffic between two endpoints in the same SGT group is being denied. The relevant switch has CTS configured with 'cts manual' and 'policy static sgt 10'. What is the most probable cause?

Accepted Answer

The SGT classification is not applied to the correct VLAN.. In Cisco TrustSec with 'cts manual' and 'policy static sgt 10', the SGT is statically assigned to an interface or VLAN. If traffic between two endpoints in the same SGT group is denied, the most probable cause is that the SGT classification is applied to the wrong VLAN, causing the switch to enforce SGACLs incorrectly. Since both endpoints share SGT 10, intra-group traffic should be permitted by default unless a specific SGACL denies it, but misclassification can lead to unexpected drops.

Answer

The SGT is not propagated to the downstream switch.

Answer

The endpoint's NAC agent is not reporting posture.

Answer

The IP-to-SGT mapping is missing on the switch.

Question 4

A laptop fails to authenticate via 802.1X on a Cisco switch. The switch logs show: 'Authentication failed for user 'jdoe' on interface GigabitEthernet1/0/24: EAP session timeout.' What is the most likely cause?

Accepted Answer

The wired authentication timeout on the switch is too low.. The error 'EAP session timeout' indicates the switch did not receive a timely EAP response from the supplicant. The wired authentication timeout on the switch controls how long the switch waits for EAP messages during the authentication exchange. If this timeout is too low, the session times out before the supplicant can respond, causing authentication failure. The other options would produce different error messages (e.g., 'RADIUS server unreachable' or 'no RADIUS server configured').

Answer

The supplicant is using an incorrect EAP method.

Answer

The RADIUS server is unreachable.

Answer

The switch is not configured with a RADIUS server.

Question 5

An organization wants to provide guest wireless access with a captive portal. Which Cisco ISE portal type should be used?

Accepted Answer

Self-Registered Guest Portal. (Self-Registered Guest Portal). This portal enables guests to self-register via a captive portal, creating their own credentials without needing a sponsor. Option A (Sponsored Guest Portal) requires an existing user to sponsor the guest. Option B (Central Web Authentication Portal) is typically used for BYOD or device onboarding, not guest self-registration. Option C (Hotspot Guest Portal) provides simple internet access without any registration or authentication.

Answer

Sponsored Guest Portal

Answer

Central Web Authentication (CWA) Portal

Answer

Hotspot Guest Portal

Question 6

Which TWO conditions must be met for a Cisco switch to initiate 802.1X authentication? (Choose two.)

Accepted Answer

The switch port is configured with 'authentication port-control auto'.. Option A is correct because 802.1X authentication on a Cisco switch port is only initiated when the port is placed under the control of the authenticator using the interface command 'authentication port-control auto', which allows the port to start in the unauthorized state and trigger EAPOL exchanges. Option E is correct because the switch (authenticator) must have a reachable RADIUS server configured (for example, via 'radius server' or 'aaa authentication dot1x' plus 'dot1x system-auth-control') to relay the supplicant's credentials and receive the Accept/Reject decision; without a reachable RADIUS server, authentication cannot complete. Option B is not required, since 802.1X can be enabled on ports regardless of whether they are explicitly set to 'switchport mode access' (and it can also apply to voice or trunk scenarios). Option C describes a condition on the endpoint (supplicant), not on the switch, so it is not a switch-side requirement. Option D is irrelevant because a guest VLAN is an optional fallback feature, not a prerequisite for initiating 802.1X authentication.

Answer

The switch port is configured with 'switchport mode access'.

Answer

The endpoint has a 802.1X supplicant enabled.

Answer

The switch has a VLAN configured for guest access.

Question 7

Which THREE are valid methods to obtain security group tags (SGTs) on a Cisco switch? (Choose three.)

Accepted Answer

IP-to-SGT mapping via RADIUS. Option A (IP-to-SGT mapping via RADIUS) is correct because Cisco TrustSec supports downloading IP-to-SGT bindings from an authentication server such as Cisco ISE via RADIUS, allowing the switch to classify traffic by source IP address. Option B (CTS manual configuration) is correct because an administrator can statically configure SGTs on interfaces or as static IP-to-SGT bindings using CLI commands like 'cts manual' and 'cts role-based sgt-map'. Option E (SXP) is correct because the SGT Exchange Protocol propagates SGT-to-IP bindings between TrustSec-capable and non-capable devices, letting a switch learn SGT mappings from peers. Option C (Cisco ISE pxGrid subscription) is not a valid method for a switch to obtain SGTs, since pxGrid is used for context sharing and integration with other platforms, not for directly populating a switch's SGT bindings. Option D (VLAN-to-SGT mapping) is not a supported TrustSec mechanism, as SGTs are assigned via static bindings, 802.1X/RADIUS, or SXP rather than by mapping VLANs to SGTs.

Answer

Cisco ISE pxGrid subscription

Answer

VLAN-to-SGT mapping

Question 8

Refer to the exhibit. An engineer configures this interface for 802.1X. Users report that after successful authentication, they are forced to reauthenticate every hour even though the authentication session is still active. What configuration change should be made to prevent reauthentication unless triggered by a change?

Accepted Answer

Remove 'authentication periodic'.. The 'authentication periodic' command enables periodic reauthentication. Removing it with 'no authentication periodic' stops automatic reauthentication, preventing the hourly reauthentication. Option A is incorrect because increasing 'dot1x timeout tx-period' only affects the timeout for initial EAP over LAN (EAPoL) transmissions, not reauthentication intervals. Option B is incorrect because setting 'authentication timer reauthenticate' to 0 would disable periodic reauthentication, but the proper fix is to remove the 'authentication periodic' command to allow reauthentication only on change. Option D is incorrect because 'authentication event server dead action authorize' configures behavior when the RADIUS server is unavailable, which is unrelated to periodic reauthentication.

Answer

Increase 'dot1x timeout tx-period' to 60.

Answer

Change 'authentication timer reauthenticate' to 0.

Answer

Add 'authentication event server dead action authorize'.

Question 9

Refer to the exhibit. An ISE administrator sees this error in the logs. What is the most likely cause?

Accepted Answer

The PassiveID identity source is not configured with the correct SGT mapping.. The error indicates that ISE cannot map the endpoint to a Security Group Tag (SGT) because the PassiveID identity source lacks the correct SGT mapping. PassiveID ingests user/endpoint attributes from sources like Active Directory or syslog, and SGT assignment depends on those mappings being configured. Without the mapping, ISE cannot resolve the SGT for the session, producing the log error.

Answer

The ISE license does not support SGT.

Answer

The SGT number is out of range.

Answer

The pxGrid connection is down.

Question 10

Refer to the exhibit. A network analyst reviews a Stealthwatch flow analysis output. What is the most likely interpretation?

Accepted Answer

This is likely a data exfiltration attempt using a non-standard port.. Stealthwatch flow analysis flags anomalies such as large outbound transfers to unusual destinations on non-standard ports, which is consistent with data exfiltration. A non-standard port combined with suspicious flow volume or direction is a classic exfiltration indicator. The other options describe benign traffic patterns that would not typically trigger this kind of alert.

Answer

This is a typical video streaming session.

Answer

This is normal database replication traffic.

Answer

This is a misconfigured backup job.

Question 11

A network engineer is configuring 802.1X on a Cisco switch for wired clients. After configuration, some clients fail authentication. The engineer notices that the clients are not sending any EAP packets. What is the most likely cause?

Accepted Answer

The clients do not have an 802.1X supplicant enabled.. If no EAP packets are sent, the client likely does not have an 802.1X supplicant enabled. Option A is incorrect because access VLAN assignment does not affect EAP transmission. Option B is incorrect because 'authentication port-control auto' is the correct command to enable 802.1X. Option D is incorrect because if the RADIUS server were unreachable, the switch would still see EAP packets from the client.

Answer

The switch port is configured with access VLAN instead of voice VLAN.

Answer

The RADIUS server is unreachable.

Answer

The switch port is configured with 'authentication port-control auto'.

Question 12

An organization is deploying Cisco ISE with passive identity mapping from Active Directory. They notice that users are not being correctly identified on the network, and some workstations are appearing with multiple IP addresses. What is the most likely cause?

Accepted Answer

The DHCP server is not configured to forward DHCP packets to ISE.. The DHCP server is not configured to forward DHCP packets to ISE. Passive identity mapping relies on ISE receiving DHCP snooping or DHCP relay/proxy data (via RADIUS accounting, DHCP snooping, or the ISE DHCP probe) to correlate IP addresses with MAC addresses and AD user identities; without that forwarding, ISE cannot reliably bind users to IPs, and stale or missing bindings cause workstations to appear with multiple IP addresses. Incorrect AD join credentials (A) would prevent AD integration entirely rather than produce partial/multiple IP mappings, and the passive identity service (C) being disabled would stop all passive mappings, not specifically cause duplicate IP entries. SNMP MAC notification traps (D) are not the mechanism ISE uses for DHCP-based passive identity, so they would not resolve this symptom.

Answer

ISE is configured with incorrect Active Directory domain join credentials.

Answer

The ISE node is not configured for passive identity service.

Answer

The network switches are not configured with SNMP traps for MAC notification.

Question 13

A junior engineer is configuring MAB (MAC Authentication Bypass) on a Cisco switch for legacy printers. After configuration, the printers are still being placed into the default VLAN instead of the authorized VLAN. Which configuration is missing?

Accepted Answer

authentication order mab. For MAB to work on a Cisco switch port, you must configure the authentication order to include MAB. The command 'authentication order mab' tells the switch to attempt MAC Authentication Bypass as the authentication method. Without it, the switch may default to dot1x and never try MAB, causing the printers to fail authentication and be placed in the default VLAN.

Answer

authentication port-control auto

Answer

dot1x pae authenticator

Answer

spanning-tree portfast

Question 14

A network engineer is troubleshooting an issue where a user's device is successfully authenticated via 802.1X, but the user cannot access the corporate network. ISE logs show that the user was granted access with a downloadable ACL (dACL). What could be the cause of no network access?

Accepted Answer

The switch does not support downloadable ACLs.. If the switch does not support downloadable ACLs (dACLs), it cannot enforce the ACL pushed by ISE, resulting in the user being authenticated but unable to access the network. The dACL is sent as a RADIUS attribute, and if the switch lacks support, it may ignore the attribute or fail to apply it, effectively denying access or allowing unintended access.

Answer

The user's device is in a different subnet.

Answer

The RADIUS server is not reachable after authentication.

Answer

The switch port is configured with 'access-session port-control auto'.

Question 15

A company is using Cisco ISE for guest access. They have configured a guest portal with a self-registration page. Some guests report that after registering, they are not redirected to the success page but instead see a '401 Unauthorized' error. What is the most likely cause?

Accepted Answer

The central web authentication (CWA) is not enabled on the switch.. The most likely cause is that Central Web Authentication (CWA) is not enabled on the switch. CWA is required for the guest portal redirect to work properly. Without CWA, the switch may not redirect the guest's HTTP traffic to the ISE guest portal, leading to a 401 Unauthorized error when the guest tries to access the success page.

Answer

The ISE node is not configured for HTTP redirect.

Answer

The guest portal certificate is not trusted by the client.

Answer

The authorization policy for guests is missing.