350-701 Secure Network Access, Visibility and Enforcement Practice Test 4 — 15 Questions

Question 1

An administrator needs to ensure that only authorized hosts can connect to a switch port. The port is connected to a single PC. Which 802.1X host mode should be configured?

Accepted Answer

Single-Host. Option A is correct because 'Single-Host' mode allows only one authenticated device per port, which is appropriate for a single PC. Option B is incorrect because 'Multi-Host' allows multiple devices after one authentication. Option C is incorrect because 'Multi-Domain' allows one device per domain (data and voice). Option D is incorrect because 'Multi-Auth' allows multiple authentications but is overkill for a single PC.

Answer

Multi-Domain

Answer

Multi-Auth

Answer

Multi-Host

Question 2

A company is deploying Cisco ISE to enforce access policies based on endpoint posture. Endpoints must be compliant before being granted full network access. Which policy type is used to define the compliance requirements?

Accepted Answer

Posture policy. Option D is correct because Posture policy defines the compliance requirements (e.g., antivirus, patch level) and the remediation actions. Option A is incorrect because Authentication policy determines the method of authentication. Option B is incorrect because Authorization policy determines the resulting access after authentication and posture. Option C is incorrect because Profiling policy identifies device type.

Answer

Authentication policy

Answer

Profiling policy

Answer

Authorization policy

Question 3

An engineer notices that the 'show authentication sessions' command on a switch shows a session in 'CRITICAL' state. What does this indicate?

Accepted Answer

The authentication server is unreachable and the port is using the critical VLAN. Option C is correct because a CRITICAL state means the port has fallen back to the critical VLAN due to authentication server unavailability. Option A is incorrect because 'Authz Failed' indicates a different failure. Option B is incorrect because administratively down would show different state. Option D is incorrect because MAB is a method, not a state.

Answer

The host is being authenticated via MAB

Answer

The port is administratively down

Answer

The authentication attempt was rejected by the RADIUS server

Question 4

A network administrator wants to centrally manage and enforce access policies for wired and wireless users. Which Cisco product provides this functionality?

Accepted Answer

Cisco Identity Services Engine (ISE). Option A is correct because Cisco ISE is the policy administration point for network access control across wired, wireless, and VPN. Option B is incorrect because WLC manages only wireless. Option C is incorrect because ASA is a firewall. Option D is incorrect because Prime Infrastructure is for management and assurance, not policy enforcement.

Answer

Cisco Prime Infrastructure

Answer

Cisco Adaptive Security Appliance (ASA)

Answer

Cisco Wireless LAN Controller (WLC)

Question 5

An organization requires that all endpoint traffic be verified against a security policy before being forwarded. Which Cisco umbrella solution provides this capability?

Accepted Answer

Cisco Umbrella. Option B is correct because Cisco Umbrella is a cloud-based security solution that enforces policy for all DNS and IP traffic. Option A is incorrect because Stealthwatch provides network visibility and analytics. Option C is incorrect because Firepower is an NGFW. Option D is incorrect because AnyConnect is a VPN client.

Answer

Cisco AnyConnect

Answer

Cisco Stealthwatch

Answer

Cisco Firepower NGFW

Question 6

During a security incident, an investigator wants to identify all endpoints that communicated with a known malicious IP address within the last 24 hours. Which Cisco tool is best suited for this forensic analysis?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch). Option D is correct because Cisco Secure Network Analytics (Stealthwatch) provides network visibility, flow records, and can query historical data for such investigations. Option A is incorrect because Umbrella is real-time DNS protection. Option B is incorrect because Firepower is a firewall. Option C is incorrect because ISE is for access control.

Answer

Cisco Firepower NGFW

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 7

A user connected to port Gi1/0/1 cannot access the network. Based on the output, what is the most likely cause?

Accepted Answer

The client does not support 802.1X. Option B is correct because the 'Reason: EAP-timeout' indicates that the client did not respond to 802.1X EAP requests, which typically means the client does not support 802.1X or it is not enabled. Option A is incorrect because if the RADIUS server were unreachable, the switch would likely use a critical VLAN, but the reason is EAP-timeout from the client side. Option C is incorrect because AAA configuration would cause different errors. Option D is incorrect because 'Errdisable' would show a different port state.

Answer

The RADIUS server is unreachable

Answer

The switch has a misconfigured AAA command

Answer

The port is in errdisable state

Question 8

A guest device in VLAN 200 attempts to reach a server at 10.10.1.1. What happens to the traffic?

Accepted Answer

The traffic is dropped. Option B is correct because the VACL 'BLOCK_MAP' is applied to VLAN 200. The access-list BLOCK_GUEST denies traffic from any source to the 10.10.0.0/16 network. Since the destination 10.10.1.1 falls within this range, the traffic is dropped. Option A is incorrect because the ACL denies the traffic. Option C is incorrect because the VACL match occurs. Option D is incorrect because logging is not configured in the VACL.

Answer

The traffic is permitted

Answer

The traffic is forwarded without any action

Answer

The traffic is logged and forwarded

Question 9

An endpoint with MAC 0011.2233.4455 and user 'guest' authenticates but fails. However, the device is not assigned to quarantine. Which policy condition is most likely responsible for the unexpected behavior?

Accepted Answer

The device is compliant and the device type is in the allowed list. Option C is correct because the condition requires either 'EndPointCompliant EQUALS No' OR device type not in the list. If the device is compliant (posture passed) and the device type is in the list, the condition is false, so the quarantine rule is not applied, and a default permit rule might apply instead. Option A is incorrect because authentication failure would show 'Failed' and not reach authorization. Option B is incorrect because MAB is not in use here. Option D is incorrect because if the device were in quarantine, it would have been assigned.

Answer

The authentication failure overrides authorization

Answer

The quarantine VLAN is not configured on the switch

Answer

The device is authenticated via MAB, bypassing posture

Question 10

A network engineer is implementing Cisco TrustSec. Which two components are required to enforce Security Group Access Control List (SGACL) policies? (Choose two)

Accepted Answer

Cisco Catalyst switch with CTS. Options A and C are correct. Cisco ISE (A) is the policy server that defines SGACL rules and distributes them to enforcement points. A Cisco Catalyst switch with CTS (C) is the enforcement point that applies SGACLs based on SGTs. Option B (ASA) can also enforce but is not required for basic TrustSec deployment. Option D (WLC) can enforce but is not core. Option E (AnyConnect) is an endpoint client, not for enforcement.

Answer

Cisco Wireless LAN Controller

Answer

Cisco ASA Firewall

Answer

Cisco AnyConnect Secure Mobility Client

Question 11

An administrator is configuring 802.1X on a switch port for both an IP phone and a PC. Which two commands should be configured to support this scenario? (Choose two)

Accepted Answer

authentication host-mode multi-domain. Options B and C are correct. 'authentication host-mode multi-domain' (B) allows one device per domain (voice and data). 'authentication port-control auto' (C) enables 802.1X authentication on the port. Option A (multi-auth) allows multiple devices in the same domain, which is not needed. Option D (violation restrict) is an action when a violation occurs, not mandatory. Option E (dot1x pae authenticator) is required but not among the two most specific; it is often enabled by default.

Answer

dot1x pae authenticator

Answer

authentication violation restrict

Answer

authentication host-mode multi-auth

Question 12

A company is deploying Cisco ISE for network access control. Which three policies must be configured to enforce access based on device posture? (Choose three)

Accepted Answer

Authorization policy. Options A, B, and D are correct. Authentication policy (A) determines how users/devices are authenticated (e.g., 802.1X, MAB). Authorization policy (B) defines the access rights based on conditions including posture. Posture policy (D) defines posture requirements and remediation. Profiling policy (C) identifies device type but is not directly required for posture enforcement; guest policy (E) is separate. However, profiling is often helpful but not strictly required; posture policy directly handles the compliance check.

Answer

Guest access policy

Answer

Profiling policy

Question 13

A network engineer configures ISE for 802.1X with PEAP-MSCHAPv2. Users report intermittent authentication failures on certain switches. The engineer checks ISE logs and sees 'Authentication failed' with reason 'User not found in identity store'. What is the most likely issue?

Accepted Answer

The user is not in the Active Directory group that ISE is configured to query.. Option C is correct. The error 'User not found in identity store' indicates that the user's credentials are not present in the configured identity source, such as Active Directory. Option A is incorrect because a shared secret mismatch would result in different errors. Option B is incorrect because certificate expiration would cause a certificate-related error. Option D is incorrect because periodic reauthentication does not cause this error.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The switch is not configured with the correct shared secret.

Answer

The user's certificate is expired.

Question 14

An organization wants to implement MAC Authentication Bypass (MAB) for devices that do not support 802.1X. Which configuration is required on a Cisco switch to allow MAB fallback?

Accepted Answer

authentication order mab dot1x. Option A is correct. The command 'authentication order mab dot1x' sets the order of authentication methods, trying MAB first and then 802.1X. Option B is incorrect because 'authentication priority' does not exist in IOS. Option C is required for port control but not specifically for MAB fallback. Option D is not a valid command.

Answer

authentication priority dot1x mab

Answer

authentication port-control auto

Answer

authentication fallback mab

Question 15

In a Cisco TrustSec environment, a network administrator observes that traffic between two endpoints in the same SGT group is being denied. The relevant switch has CTS configured with 'cts manual' and 'policy static sgt 10'. What is the most probable cause?

Accepted Answer

The SGT classification is not applied to the correct VLAN.. Option D is correct. If the SGT classification is not applied to the correct VLAN, the switch may not classify traffic correctly, leading to default denial. Option A is incorrect because with manual CTS, IP-to-SGT mapping is done via static configuration or RADIUS, and missing mapping would cause unknown SGT. Option B is irrelevant to traffic forwarding. Option C is incorrect because SGT propagation is not needed for same-switch communication.

Answer

The SGT is not propagated to the downstream switch.

Answer

The endpoint's NAC agent is not reporting posture.

Answer

The IP-to-SGT mapping is missing on the switch.