350-701 Secure Network Access, Visibility and Enforcement Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. A network administrator is troubleshooting a wired client that has successfully authenticated using MAB. However, the client is unable to access resources beyond the local subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The authorization policy is missing a downloadable ACL (dACL) to allow traffic.. MAB (MAC Authentication Bypass) authenticates the client's MAC address, and after successful authentication, the authorization policy determines what the client can access. If the client can reach the local subnet but not beyond, the most likely cause is that the authorization policy lacks a downloadable ACL (dACL) that permits traffic beyond the local subnet, so the switch applies a default restrictive ACL.

Answer

The client's IP address is from a DHCP scope that does not include a default gateway.

Answer

The VLAN policy is incorrect; the client should be in VLAN 20.

Answer

The switch is not configured for inter-VLAN routing.

Question 2

Refer to the exhibit. A network administrator is troubleshooting a wired client that has successfully authenticated using MAB. However, the client is unable to access resources beyond the local subnet. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The authorization profile does not include a voice VLAN.. The authorization profile applied to the user does not include a voice VLAN assignment, which is required for VoIP traffic. Even though the RADIUS attribute 'device-traffic-class=voice' is present, this only marks the traffic for QoS and does not assign a VLAN. Without a voice VLAN configured in the authorization profile, the phone cannot obtain the necessary VLAN for voice services. Option A is incorrect because whether the phone is configured for 802.1X is irrelevant; the issue is about VLAN assignment. Option B is incorrect because the RADIUS attribute 'device-traffic-class=voice' is correctly formatted for QoS marking, not for VLAN assignment. Option C is incorrect because multi-domain mode is used for scenarios with a phone behind a PC, but here the user's phone is authenticating directly and the problem is the lack of voice VLAN in the authorization profile.

Answer

The user's phone is not configured for 802.1X.

Answer

The RADIUS attribute 'device-traffic-class=voice' is incorrect.

Answer

The switch port is not configured with 'authentication host-mode multi-domain'.

Question 3

Which TWO of the following are authentication methods used for wired network access in Cisco ISE?

Accepted Answer

802.1X. Option D, 802.1X, is correct because it is the IEEE standard port-based network access control method that Cisco ISE uses to authenticate wired supplicants via EAP over LAN (EAPoL), typically with RADIUS as the transport to ISE. Option E, MAC Authentication Bypass (MAB), is correct because it authenticates wired endpoints that lack an 802.1X supplicant by using their MAC address as the credential, again relayed to ISE via RADIUS. Option A, TACACS+, is not an authentication method for wired network access; it is used for device administration (AAA for CLI/privileged access on network devices). Option B, NetFlow, is a traffic-flow monitoring and telemetry protocol, not an authentication method. Option C, RADIUS, is the transport protocol ISE uses to carry 802.1X and MAB authentication requests, but it is not itself the wired access authentication method being asked about.

Answer

TACACS+

Answer

NetFlow

Answer

RADIUS

Question 4

Which TWO methods can be used to propagate SGT information between devices that do not support SGT inline tagging?

Accepted Answer

CDP. SXP (SGT Exchange Protocol) is correct because it is a Cisco protocol designed specifically to propagate SGT-to-IP mappings to devices that cannot perform inline SGT tagging, such as non-Cisco or legacy switches, by carrying the bindings in a TCP-based control plane session. CDP is also correct because it can carry SGT information in its TLVs between directly connected Cisco devices, allowing SGT propagation where inline tagging is not supported. NetFlow is not correct because it exports flow telemetry and can include SGT fields for monitoring, but it does not propagate SGT bindings to other devices for enforcement. LLDP is not correct because, although it is a neighbor discovery protocol, it does not natively carry SGT information in standard implementations. VRF-lite is not correct because it is a Layer 3 virtualization feature for separating routing tables, not a mechanism for SGT propagation.

Answer

NetFlow

Answer

LLDP

Answer

VRF-lite

Question 5

Which THREE attributes can be used in an ISE authorization policy based on endpoint identity?

Accepted Answer

Certificate subject DN. Option A (Certificate subject DN) is correct because ISE can evaluate the subject field of an endpoint's X.509 certificate during authorization, allowing policies based on certificate identity attributes. Option B (AD user group) is correct because ISE authorization policies can reference Active Directory group membership as a condition, tying the policy to the authenticated user's group. Option E (Device MAC address) is correct because ISE can use the endpoint's MAC address (often via profiling or the Calling-Station-ID) as an endpoint identity attribute in authorization rules. Option C (Time of day) is not an endpoint identity attribute; it is a condition based on temporal context, not the endpoint itself. Option D (Switch IP address) is a network device attribute (NAS IP), not an endpoint identity attribute, so it does not qualify.

Answer

Time of day

Answer

Switch IP address

Question 6

A large enterprise has deployed Cisco ISE for network access control with 802.1X and MAB across its wired and wireless networks. The network consists of Cisco Catalyst switches, Cisco Wireless LAN Controllers (WLCs), and ISE in a distributed deployment with three Policy Service Nodes (PSNs) and an Admin Node. Recently, the company implemented a new security policy requiring all endpoints to pass posture assessment before gaining full network access. The posture assessment uses AnyConnect ISE Posture Module.

Shortly after the change, users report that some wired clients are unable to connect to the network. The ISE logs show that the authentication is successful, but the session is terminated immediately with a 'Session-Timeout' attribute set to 0. The network team notices that the affected clients are all connected to switches running older Cisco IOS versions. The ISE administrator confirms that the authorization profiles for the affected clients include a session-timeout of 1 hour. Which course of action should the network engineer take to resolve the issue?

Accepted Answer

Upgrade the switch IOS to a version that supports the new ISE posture attributes.. The Session-Timeout attribute set to 0 in the RADIUS Access-Accept is a known behavior when older Cisco IOS switches do not correctly parse newer ISE posture authorization attributes, causing the switch to interpret the value as an immediate session termination. Upgrading the switch IOS to a version that supports the current ISE posture AV pairs resolves the parsing mismatch. The authentication succeeds, so the problem is not posture policy logic but attribute handling on the network access device.

Answer

Disable posture assessment for the affected switch ports using a different authorization policy.

Answer

Configure the switches to ignore the Session-Timeout attribute sent by ISE.

Answer

Increase the session-timeout value in the ISE authorization profile to a larger value.

Question 7

A company is deploying Cisco TrustSec to enforce micro-segmentation between data center servers. Security team wants to use Security Group Tags (SGTs) assigned dynamically via ISE. Which method should the engineer use to propagate SGTs to the access switches that connect the servers, assuming the network uses Cisco Nexus 9000 switches and ISE as the policy server?

Accepted Answer

Deploy SXP (SGT Exchange Protocol) between ISE and the Nexus switches. For dynamic SGT propagation from ISE to network devices, SXP (SGT Exchange Protocol) is the standard method. It carries IP-to-SGT mappings from ISE to the Nexus switches, enabling the switches to enforce policies without requiring inline tagging on every link. Option B (CoA) is used for reauthentication and session changes, not for bulk SGT propagation. Option C (SGT inline tagging) is a hardware-based method for carrying SGTs on frame headers between switches, but it does not propagate the bindings from ISE; it requires all links to support tagging. Option D (dedicated VLAN per security group) is a traditional segmentation method, not related to Cisco TrustSec SGTs. Therefore, A is correct.

Answer

Configure ISE as a RADIUS server to send CoA with SGT

Answer

Enable SGT inline tagging on all interswitch links

Answer

Use a dedicated VLAN per security group

Question 8

An engineer is implementing Cisco ISE posture assessment for corporate Windows laptops. The requirement: endpoints that are missing critical Microsoft security patches must be quarantined in a remediation VLAN. The ISE posture policy uses an 'Application Condition' to check for the patch. However, some laptops with missing patches are still allowed access. During testing, the engineer notices that the posture agent reports 'NAC Agent: Posture Unknown' for those laptops. What is the most likely cause?

Accepted Answer

The authorization policy does not include a posture profile. The most likely cause is that the authorization policy does not include a posture profile, so even though the posture condition evaluates the patch status, the authorization result does not enforce quarantine because no posture profile is bound to the authorization rule. In Cisco ISE, posture assessment requires both a posture policy (to evaluate conditions) and an authorization policy that references a posture profile to apply the correct VLAN or ACL. Without the posture profile in the authorization policy, the endpoint falls through to a default permit rule.

Answer

The posture agent software is outdated

Answer

The missing patches are not on the ISE patch list

Answer

The ISE server is unreachable from the client VLAN

Question 9

Which TWO factors should be considered when designing a Cisco ISE deployment for network access control (NAC) in a multi-site environment? (Choose two.)

Accepted Answer

ISE node roles and placement (primary, secondary, monitoring). Option A is correct because in a multi-site Cisco ISE deployment, the roles assigned to nodes — Primary Administration, Secondary Administration, Monitoring (MnT), and Policy Service (PSN) — and their physical placement determine administrative redundancy, failover behavior, and where policy decisions are enforced; PSNs should be placed locally at each site so 802.1X/MAC authentication and authorization don't depend on distant nodes. Option E is correct because ISE relies on RADIUS (UDP 1812/1813) and, for some flows, RADIUS accounting and pxGrid (TCP 8910) between sites, so WAN latency and reliability directly affect authentication timeouts, failover to secondary PSNs, and the user experience during 802.1X or MAB transactions. Option B is not a design factor specific to multi-site NAC deployment; profiling is a functional requirement that applies regardless of site topology. Option C is a scalability/capacity consideration rather than a multi-site design factor, and ISE sizing is based on total endpoints, use cases, and deployment size, not a per-policy-evaluator endpoint count. Option D is a general integration consideration for any ISE deployment (switch, WLC, or VPN concentrator support for RADIUS/CoA) and is not unique to the multi-site dimension being asked about.

Answer

Endpoint profiling needs

Answer

Number of endpoints per policy evaluator

Answer

Type of network access device (switch, WLC, VPN)

Question 10

Which THREE capabilities are provided by Cisco ISE's visibility services within the Secure Network Access domain? (Choose three.)

Accepted Answer

Endpoint profiling and classification (including IoT). Option A is correct because Cisco ISE's visibility services include endpoint profiling and classification, using probes such as RADIUS, DHCP, SNMP, NetFlow, and NMAP to identify device types, operating systems, and IoT devices, then assigning them to logical profiles. Option D is correct because guest user registration and sponsor workflows are part of ISE's visibility and access services, where guests self-register or are sponsored, and ISE tracks their identity and session context for policy decisions. Option E is correct because ISE passively monitors identity and context through pxGrid, RADIUS accounting, and other data sources, collecting user, device, posture, and location attributes that feed visibility dashboards and policy evaluation. Option B is not correct here because 802.1X authentication is an access control enforcement mechanism, not a visibility service, even though ISE supports it. Option C is not correct because security group access control enforcement (TrustSec/SGACL) is a policy enforcement capability, not a visibility function.

Answer

802.1X authentication for wired and wireless

Answer

Security group access control enforcement

Question 11

A hospital is deploying Cisco ISE for network access control. They have a mix of employee laptops, medical devices (e.g., infusion pumps), and guest smartphones. The network uses Cisco Catalyst 9300 switches and Aironet 3700 series access points. For medical devices, the policy must use Machine Authentication (MAB) since they are 802.1X incapable. The ISE policy authenticates via MAB and then assigns the device to a specific VLAN for medical devices. During a pilot, the network team notices that some infusion pumps (MAC: 00:1A:2B:3C:4D:5E) are failing MAB authentication. The switch logs show 'Authentication failed for MAC 001a.2b3c.4d5e on interface GigabitEthernet1/0/10'. ISE logs show 'Authentication failed - RADIUS server rejected - Reason: Invalid Endpoint ID'. The engineer has verified the MAC address is in the ISE endpoint repository with correct identity group. What should the engineer check next to resolve this issue?

Accepted Answer

Check the MAC address format in the ISE endpoint identity store (such as using lowercase with a hyphen separator). The error 'Invalid Endpoint ID' typically indicates that the username/password used for MAB is not matching. For MAB, the switch sends the MAC address as both username and password. If the ISE repository has the MAC but the authentication profile expects a different format (e.g., lowercase, colon-separated), it can fail. Option B is correct because the switch might be sending the MAC in different case (upper vs lower) or without dashes. Option A would cause different error. Option C would prevent any auth. Option D would cause other services to fail, not specific to MAB.

Answer

Verify that the switch port is configured with 'authentication port-control auto'

Answer

Confirm that the ISE policy for MAB allows the device to authenticate

Answer

Ensure the RADIUS shared secret is correct on the switch and ISE

Question 12

A financial company is deploying Cisco ISE with TrustSec to enforce segmentation between application tiers (web, app, DB). They have a Cisco Catalyst 9500 as the core, and Catalyst 9300s as access switches. The SXP is configured between ISE and core switch, and the core switch propagates SGTs to access switches via SGT inline tagging on trunk ports. The engineer has configured SGTs for web (SGT=2), app (SGT=3), DB (SGT=4). However, when testing from a web server (IP 10.1.1.10, SGT=2) to an app server (IP 10.1.2.20, SGT=3), the app server sees the traffic without SGT in the packet, so the access switch cannot enforce policy. The engineer checks 'show cts role-based sgt-map' on the core and sees the mapping for 10.1.1.10 -> 2. What is the most likely issue?

Accepted Answer

The trunk between core and access is not configured for SGT inline tagging. For SGT inline tagging to work, the trunk link between the core switch and the access switch must be explicitly configured to carry SGTs (e.g., using 'cts role-based enforcement' and 'cts inline tagging' on the interface). Since the core has the correct SGT mapping but the access switch sees no SGT in the packet, the most likely cause is that the trunk is not tagging the frames with SGT. This prevents the access switch from enforcing role-based policies.

Answer

The ISE policy does not allow the traffic from web to app

Answer

The access switch does not have the security group ACL configured

Answer

The SXP connection between ISE and core is not established

Question 13

A small business uses Cisco ISE to authenticate employees via Active Directory. The company has a single ISE node and two Catalyst 2960-X switches. Employees connect to the network and are successfully authenticated using 802.1X with PEAP. The business wants to provide guest wireless access using a separate SSID with a captive portal. The engineer configures a new WLAN on the WLC (Cisco 2504) pointing to the same ISE node. Guest users can associate to the WLAN and get an IP address, but when they open a browser, they do not see the captive portal page; instead, they get a 'Connection refused' error. The engineer verifies that the guest portal is enabled on ISE and the WLC is configured to use ISE for RADIUS. What is the most likely cause?

Accepted Answer

The WLC is not configured with the ISE portal IP address for redirection. For guest captive portal with Cisco ISE, the WLC must be configured with the ISE portal IP address so it can redirect unauthenticated guest clients to the ISE guest portal. Without this redirection configuration, the client's HTTP request is not intercepted and redirected, resulting in a 'Connection refused' error when the browser tries to reach the originally requested site. The WLC uses the redirect URL (typically the ISE guest portal) in the RADIUS Access-Accept or via URL redirection ACL.

Answer

The ISE guest portal service is not running

Answer

The guest user's device does not have a valid DNS server

Answer

The guest WLAN does not have a pre-authentication ACL

Question 14

A government agency is deploying Cisco ISE with a posture agent to ensure endpoints comply with security policies before accessing the network. The posture policy requires that all Windows computers have antivirus (AV) software running. The engineer configures a condition 'AV installed and running' and binds it to an authorization profile that grants full access if compliant, or quarantine if not. During testing, a computer that has AV installed and running (verified manually) is placed in quarantine. ISE logs show 'Posture - AV condition not satisfied'. The engineer checks the ISE posture configuration: the AV condition uses a default Cisco AV dictionary. What is the most likely cause?

Accepted Answer

The AV vendor is not supported by the ISE default posture dictionary. The posture condition uses a dictionary that maps known AV products. If the specific AV brand is not in the Cisco default dictionary, the condition will fail even if AV is running. Option A is correct. Option B is incorrect because the condition does not require the AV version. Option C would cause other issues like no posture assessment. Option D is possible but less likely.

Answer

The posture policy is configured to require the AV version as well

Answer

The client's ISE posture agent is not installed

Answer

The client's firewall is blocking communication with ISE

Question 15

A network administrator is configuring 802.1X for wired access on a Cisco switch. The switch is configured for RADIUS using a Cisco ISE server. During testing, a client that supports 802.1X is unable to authenticate and fails to gain network access. The administrator checks the switch logs and sees "Authentication failed: invalid EAP code received". What is the most likely cause?

Accepted Answer

The client is using an unsupported EAP method (e.g., EAP-TLS instead of PEAP).. The error 'invalid EAP code received' indicates that the switch received an EAP packet with a code it does not support, which typically occurs when the client uses an unsupported EAP method. Option A is correct because if the client attempts a method like EAP-TLS while the switch or RADIUS server expects PEAP, the EAP code may be unrecognized. Option B is wrong because RADIUS unreachability would result in timeouts or 'no response' errors, not EAP code errors. Option C is wrong because a shared secret mismatch would cause RADIUS authentication rejections (e.g., 'Access-Reject'), not EAP parsing issues. Option D is wrong because a trunk port configuration would cause VLAN mismatches or connectivity issues, not EAP code errors.

Answer

The RADIUS server is unreachable.

Answer

The switch is configured with the wrong shared secret for RADIUS.

Answer

The switch port is configured as a trunk port rather than an access port.