350-701 Secure Network Access, Visibility and Enforcement Practice Test 3 — 15 Questions

Question 1

An engineer is troubleshooting a user who cannot access the network after successful 802.1X authentication. The user's PC receives an IP address from DHCP, but cannot reach the internet. The switch port is in the correct VLAN (10) after authentication. The ISE posture policy requires the user to install a corporate certificate, but the user skipped that step. What is the most likely cause of the internet access failure?

Accepted Answer

The ISE posture policy returned 'NonCompliant' and ISE applied a Change of Authorization (CoA) to place the port in a remediation VLAN. Option B is correct because ISE can send a CoA to place the port in a restricted VLAN after authentication if posture is not compliant. Option A is wrong because AD login is not required for internet access. Option C is wrong because the switchport is already in the correct VLAN as stated. Option D is wrong because there is no indication of DHCP issues.

Answer

The user is not logged into the domain

Answer

The switchport is still in the default VLAN

Answer

The DHCP server does not have a scope for VLAN 10

Question 2

During a network audit, an engineer finds that a switch configured for 802.1X is allowing a device to access the network without authentication. The switch logs show 'MAB failed', 'dot1x failed', but the port is in the forwarding state. The port configuration includes 'authentication fallback final mab' and 'dot1x timeout server-timeout 10'. What is the most likely explanation?

Accepted Answer

The 'authentication fallback final mab' command allows the port to become authorized even if MAB fails. Option D is correct because 'authentication fallback final mab' means if dot1x and MAB fail, the switch still authorizes the device as a final fallback, effectively overriding the authentication failure. Option A is wrong because the logs show authentication attempts. Option B is wrong because the logs explicitly show failures. Option C is wrong because server-timeout alone does not cause this behavior.

Answer

The device is using a MAC address that matches a static CAM entry

Answer

The switch has 'aaa authentication dot1x default local' which allows local fallback

Answer

The 'dot1x timeout server-timeout' is too short, causing the switch to skip authentication

Answer

The switch is running an IOS version that treats 'authentication fallback final mab' as a no-op

Question 3

An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?

Accepted Answer

ISE has cached the previous password and is still using it for authentication. Option C is correct because ISE caches credentials for a period; if the password is changed, the cached version may still be used until the cache expires. Option A is wrong because RADIUS servers do not typically cache credentials by default. Option B is wrong because DNS issues would affect all users, not just those with password changes. Option D is wrong because the wireless controller does not cache passwords; it passes through to ISE.

Answer

DNS records for the domain controller have not updated

Answer

The wireless controller has a local password cache

Answer

The RADIUS server on the wireless controller is caching credentials

Question 4

A network engineer is deploying TrustSec using SGT over VXLAN in a data center fabric. The fabric switches are configured as VXLAN Tunnel Endpoints (VTEPs). The engineer must ensure that SGT information is propagated from the border leaves to the spine. Which mechanism should be used?

Accepted Answer

VXLAN Group Policy Option (GPO) in the VXLAN header. Option A is correct because SGT over VXLAN uses Group Policy Option (GPO) bits in the VXLAN header. Option B is wrong because SXP is for non-VXLAN environments. Option C is wrong because IS-IS carries routing, not SGT. Option D is wrong because LISP carries endpoint IDs, not SGT.

Answer

LISP (Locator/ID Separation Protocol)

Answer

SXP (SGT Exchange Protocol) between VTEPs

Answer

IS-IS protocol extensions for SGT

Question 5

An engineer is configuring ISE for guest access via a sponsor portal. The policy requires that a sponsor must approve each guest. However, guests are being automatically approved without sponsor interaction. What is the most likely misconfiguration?

Accepted Answer

The guest portal's 'Access setting' is set to 'Self-Registration' instead of 'Sponsor Approval'. Option C is correct because the guest portal settings must be set to 'Sponsor Approval' to require sponsor approval. Option A is wrong because the sponsor account type affects who can sponsor, not the approval process. Option B is wrong because guest report is just for notification. Option D is wrong because self-registration is the opposite of requiring sponsor approval.

Answer

The guest portal is not configured to send email notifications to sponsors

Answer

The sponsor user account is assigned to the wrong sponsor group

Answer

The guest endpoint is being profiled as a known device

Question 6

During a security incident, an engineer needs to quickly quarantine an endpoint that is connected to a switch via 802.1X. The engineer wants to use ISE to send a Change of Authorization (CoA) to move the port to a restrictive VLAN. What must be configured on the switch to allow ISE to send CoA?

Accepted Answer

The switch must have 'aaa server radius dynamic-author' configured with a client entry for ISE. Option D is correct because CoA requires the switch to act as a RADIUS client for dynamic authorization, configured with 'aaa server radius dynamic-author'. Option A is wrong because RADIUS accounting is separate. Option B is wrong because CoA uses UDP port 3799 by default. Option C is wrong because 'authentication event server dead action' is for RADIUS server failure, not CoA.

Answer

The switch must listen on UDP port 1700 for CoA packets

Answer

The switch must have a VTY line configured with 'transport input ssh'

Answer

RADIUS accounting must be enabled on the switch

Answer

The switch must have 'authentication event server dead action authorize' configured

Question 7

Which TWO are valid methods for determining the SGT (Security Group Tag) assigned to an endpoint in a TrustSec deployment?

Accepted Answer

Static assignment on the network access device (switch) using the 'cts role-based sgt' command. Options A and C are correct. A: Static assignment on switch port via 'cts role-based sgt'. B: DHCP Option 141 is not used for SGT. C: ISE can dynamically assign SGT via authentication policy. D: DNS is not involved. E: IP address does not determine SGT; it's based on identity.

Answer

DNS resolution of the endpoint hostname

Answer

The IP address of the endpoint

Answer

DHCP Option 141

Question 8

Which THREE are characteristics of Cisco ISE profiler service?

Accepted Answer

It can determine the endpoint operating system based on MAC OUI and DHCP fingerprints. Options B, D, and E are correct. B: Profiling uses both active and passive probes. C: Profiling does not require an agent; it is agentless. A: Profiler does not perform posture assessments; that's posture service. D: Profiling can be based on MAC OUI and DHCP fingerprints. E: Profiler can feed attributes to authorization policies.

Answer

It performs posture compliance checking on endpoints

Answer

It requires the installation of an ISE agent on all endpoints

Question 9

Which TWO are valid options for configuring a switch port to handle authentication failures in an 802.1X environment? (Select two.)

Accepted Answer

authentication event no-response action authorize vlan 100. Options A and C are correct. A: 'authentication event fail action authorize vlan 999' allows placing the port in a guest VLAN on failure. B: 'authentication event server dead action reinitialize' is for RADIUS server failure, not authentication failure. C: 'authentication event no-response action authorize vlan 100' is for when the endpoint does not respond to EAPOL. D: 'authentication port-control force-authorized' forces the port to authorized state, bypassing authentication entirely. E: 'dot1x critical' is for critical voice VLAN, not failure handling.

Answer

dot1x critical profile

Answer

authentication event server dead action reinitialize

Answer

authentication port-control force-authorized

Question 10

Refer to the exhibit. A user has successfully authenticated via 802.1X. However, the SGT (Security Group Tag) assigned is 0, which is the default untagged value. Which configuration change would most likely allow ISE to assign a non-zero SGT for this user?

Accepted Answer

In ISE authorization profile, add Cisco AV pair 'cts:security-group-tag=15'. Option D is correct because ISE must include the SGT in the RADIUS Access-Accept (e.g., via cisco-av-pair). Option A is wrong because the show command indicates authorization success, so AAA is functional. Option B is wrong because the session already shows authorization by server. Option C is wrong because SGT assignment does not require SGT caching on the switch. Option E is wrong because global 'cts' command is required for TrustSec, but it must be enabled.

Answer

Enable 'cts manual' globally on the switch

Answer

Ensure that the switch has a RADIUS server defined with 'radius-server host 10.1.1.1 auth-port 1645'

Answer

Configure 'aaa authorization network default group radius' on the switch

Answer

Enable 'sgt caching' on the switch port

Question 11

Refer to the exhibit. A switch port is configured for 802.1X with MAB. The switch has reached its maximum number of authentication sessions (platform limit). When a new device attempts to connect, what happens?

Accepted Answer

The new device is not authenticated and remains unauthorized. Option C is correct because when the maximum number of authentication sessions is reached, new authentication requests are denied unless 'authentication limit authen-fail-action' is configured otherwise. Option A is wrong because the port does not shut down by default. Option B is wrong because the port does not forward immediately. Option D is wrong because the switch does not fail open automatically.

Answer

The new device is allowed to pass traffic due to fallback

Answer

The switch sends a CoA to ISE to free up a session

Answer

The port is automatically shut down

Question 12

Refer to the exhibit. An engineer configured ISE to use both Active Directory and LDAP for authentication. Users from Active Directory are unable to authenticate. What is the most likely reason?

Accepted Answer

The LDAP identity store is unreachable and ISE is attempting LDAP before AD. Option A is correct because the LDAP server is showing a timeout error, and if LDAP is ranked higher, ISE may attempt LDAP first and fail before falling back. Option B is wrong because AD shows connected. Option C is wrong because the sequence is not shown but the LDAP error indicates the problem. Option D is wrong because authentication failure does not change the AD identity store.

Answer

Active Directory users are not allowed in the policy

Answer

The Active Directory identity store is disconnected

Answer

The authentication sequence is set to 'AD then LDAP'

Question 13

A network administrator is troubleshooting intermittent authentication failures on a switch port configured for 802.1X with MAB fallback. Users can connect but get dropped after a few minutes. What is the most likely cause?

Accepted Answer

Reauthentication timer set too short. Option C is correct because a reauthentication timer that is too short causes frequent reauthentication attempts, which may fail if the RADIUS server is slow or if the client fails to respond in time. Option A is incorrect because an incorrect shared secret would cause all authentications to fail immediately. Option B is incorrect because MAB timeout affects initial authentication, not ongoing sessions. Option D is incorrect because incorrect VLAN assignment would prevent network access entirely.

Answer

Incorrect VLAN assignment

Answer

Incorrect RADIUS shared secret

Answer

MAB timeout set too low

Question 14

A company wants to implement software-defined segmentation using Cisco ISE and TrustSec. Which component is responsible for assigning the Security Group Tag (SGT) to packets at the ingress?

Accepted Answer

Cisco Catalyst switch with CTS. Option B is correct because a switch with Cisco TrustSec (CTS) capability is responsible for classifying and tagging packets with the SGT at the ingress port. Option A is incorrect because ISE defines the policy but does not tag packets. Option C is incorrect because the endpoint posture agent may report attributes but does not tag. Option D is incorrect because the firewall enforces policies but is not the primary tagging device at the edge.

Answer

Endpoint with posture agent

Answer

Firewall with IPS capability

Answer

Cisco ISE Policy Service Node

Question 15

An engineer is deploying Cisco ISE for guest access. The guest portal uses a self-provisioned username and password. To ensure secure credential transmission, which protocol should be enforced on the portal?

Accepted Answer

HTTPS with a valid certificate. Option A is correct because HTTPS with a valid certificate encrypts the credential transmission between the client and the portal. Option B is incorrect because HTTP transmits credentials in cleartext. Option C is incorrect because RADIUS over TLS is used between the NAS and ISE, not between the client and portal. Option D is incorrect because DNSSEC does not encrypt traffic.

Answer

DNSSEC

Answer

RADIUS over TLS

Answer

HTTP with redirect to captive portal