350-701 Secure Network Access, Visibility and Enforcement Practice Test 5 — 15 Questions

Question 1

In a Cisco TrustSec environment, a network administrator observes that traffic between two endpoints in the same SGT group is being denied. The relevant switch has CTS configured with 'cts manual' and 'policy static sgt 10'. What is the most probable cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SGT classification is not applied to the correct VLAN.. In Cisco TrustSec with 'cts manual' and 'policy static sgt 10', the SGT is statically assigned to an interface or VLAN. If traffic between two endpoints in the same SGT group is denied, the most probable cause is that the SGT classification is applied to the wrong VLAN, causing the switch to enforce SGACLs incorrectly. Since both endpoints share SGT 10, intra-group traffic should be permitted by default unless a specific SGACL denies it, but misclassification can lead to unexpected drops.

Answer

The SGT is not propagated to the downstream switch.

Answer

The endpoint's NAC agent is not reporting posture.

Answer

The IP-to-SGT mapping is missing on the switch.

Question 2

Which protocol does Cisco ISE use to communicate with the pxGrid controller for sharing contextual data?

Accepted Answer

JSON-RPC over certificate-based TLS. Cisco ISE uses the JSON-RPC protocol over certificate-based TLS to communicate with the pxGrid controller for sharing contextual data. This ensures encrypted, authenticated, and structured messaging between ISE and other pxGrid-enabled services, such as Cisco Threat Response or third-party integrations.

Answer

REST API over HTTPS

Answer

TACACS+

Answer

RADIUS

Question 3

A laptop fails to authenticate via 802.1X on a Cisco switch. The switch logs show: 'Authentication failed for user 'jdoe' on interface GigabitEthernet1/0/24: EAP session timeout.' What is the most likely cause?

Accepted Answer

The wired authentication timeout on the switch is too low.. The 'EAP session timeout' error specifically indicates that the authentication process did not complete within the configured timeout period on the switch. Option A is incorrect because an incorrect EAP method would typically result in an EAP failure or NAK, not a timeout. Option C is incorrect because an unreachable RADIUS server would cause a different error, such as 'RADIUS server timeout' or 'No response from server'. Option D is incorrect because if the switch had no RADIUS server configured, it would not even attempt 802.1X authentication or would fall back to other methods.

Answer

The supplicant is using an incorrect EAP method.

Answer

The RADIUS server is unreachable.

Answer

The switch is not configured with a RADIUS server.

Question 4

You are troubleshooting a Cisco ISE deployment where some endpoints are stuck in the 'Not Compliant' posture after a posture scan. ISE logs show 'Conditional NAC Agent result: Not Compliant due to missing required application.' The application is installed on the endpoint. What should you check?

Accepted Answer

The posture policy requires a specific version that is not installed.. The log indicates a missing application, but it is installed. This often occurs when the posture policy requires a specific version or patch level. Option A is incorrect because antivirus definitions are separate. Option C is incorrect because agent version would cause a different error. Option D is incorrect because firewall blocking would prevent scan results.

Answer

The NAC Agent is running an outdated version.

Answer

The endpoint's firewall is blocking the ISE posture probe.

Answer

The antivirus definition file is outdated.

Question 5

An organization wants to provide guest wireless access with a captive portal. Which Cisco ISE portal type should be used?

Accepted Answer

Self-Registered Guest Portal. (Self-Registered Guest Portal). This portal enables guests to self-register via a captive portal, creating their own credentials without needing a sponsor. Option A (Sponsored Guest Portal) requires an existing user to sponsor the guest. Option B (Central Web Authentication Portal) is typically used for BYOD or device onboarding, not guest self-registration. Option C (Hotspot Guest Portal) provides simple internet access without any registration or authentication.

Answer

Sponsored Guest Portal

Answer

Central Web Authentication (CWA) Portal

Answer

Hotspot Guest Portal

Question 6

Which Cisco security product provides network visibility and traffic analytics using NetFlow and IPFIX?

Accepted Answer

Cisco Stealthwatch. Cisco Stealthwatch uses NetFlow/IPFIX for network visibility and threat detection. Option A (FMC) is for firewall management. Option D (ISE) is for identity services. Option C (Umbrella) is for cloud security.

Answer

Cisco Firepower Management Center

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 7

In a Cisco TrustSec deployment, you want to dynamically assign SGTs based on user authentication. Which mechanism should you use?

Accepted Answer

CTS identity-based networking (IBNS) with RADIUS CoA. Identity-Based Networking Services (IBNS) with RADIUS Change of Authorization (CoA) allows dynamic assignment of SGTs during authentication. Option A (CTS SXP) propagates SGTs but doesn't assign dynamically. Option B (CTS RBACL) is for role-based access control, not SGT assignment. Option C (CTS device classification) is for static assignment.

Answer

CTS SXP

Answer

CTS RBACL

Answer

CTS device classification

Question 8

Which TWO conditions must be met for a Cisco switch to initiate 802.1X authentication? (Choose two.)

Accepted Answer

The switch port is configured with 'authentication port-control auto'.. The 'authentication port-control auto' command places the switch port in 802.1X authentication mode, allowing it to initiate the authentication process when a new endpoint connects. Without this configuration, the port remains in a force-authorized state and will not trigger 802.1X exchanges.

Answer

The switch port is configured with 'switchport mode access'.

Answer

The endpoint has a 802.1X supplicant enabled.

Answer

The switch has a VLAN configured for guest access.

Question 9

Which THREE are valid methods to obtain security group tags (SGTs) on a Cisco switch? (Choose three.)

Accepted Answer

IP-to-SGT mapping via RADIUS. Options A, B, and E are correct. IP-to-SGT mapping via RADIUS (A) dynamically assigns SGTs based on authentication results. CTS manual configuration (B) allows static SGT assignment per interface or port. SXP (E) propagates SGTs between devices. Option C (Cisco ISE pxGrid subscription) is used for data sharing, not for a switch to obtain SGTs. Option D (VLAN-to-SGT mapping) is not a standard method; SGTs are assigned per host, not per VLAN.

Answer

Cisco ISE pxGrid subscription

Answer

VLAN-to-SGT mapping

Question 10

Which TWO are common causes for CoA (Change of Authorization) failures in a Cisco ISE deployment? (Choose two.)

Accepted Answer

The switch does not support the CoA protocol.. Options A and C are correct. The switch must support CoA (RFC 3576) for the protocol to work, and the RADIUS shared secret between ISE and the switch must match for CoA packets to be accepted. Option B is not a common cause because ISE and the switch can be in different subnets as long as network connectivity exists. Option D is incorrect because 'authentication periodic' is a feature that triggers reauthentication, not a cause of CoA failure. Option E is incorrect because a wireless controller that proxies RADIUS can still forward CoA packets.

Answer

The ISE node serving the CoA is not in the same subnet as the switch.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The endpoint is connected through a wireless controller that proxies RADIUS.

Question 11

Refer to the exhibit. An engineer configures this interface for 802.1X. Users report that after successful authentication, they are forced to reauthenticate every hour even though the authentication session is still active. What configuration change should be made to prevent reauthentication unless triggered by a change?

Accepted Answer

Remove 'authentication periodic'.. The 'authentication periodic' command enables periodic reauthentication. Removing it with 'no authentication periodic' stops automatic reauthentication, preventing the hourly reauthentication. Option A is incorrect because increasing 'dot1x timeout tx-period' only affects the timeout for initial EAP over LAN (EAPoL) transmissions, not reauthentication intervals. Option B is incorrect because setting 'authentication timer reauthenticate' to 0 would disable periodic reauthentication, but the proper fix is to remove the 'authentication periodic' command to allow reauthentication only on change. Option D is incorrect because 'authentication event server dead action authorize' configures behavior when the RADIUS server is unavailable, which is unrelated to periodic reauthentication.

Answer

Increase 'dot1x timeout tx-period' to 60.

Answer

Change 'authentication timer reauthenticate' to 0.

Answer

Add 'authentication event server dead action authorize'.

Question 12

Refer to the exhibit. An ISE administrator sees this error in the logs. What is the most likely cause?

Accepted Answer

The PassiveID identity source is not configured with the correct SGT mapping.. The error indicates that PassiveID received an SGT from a network device but does not have a mapping to convert it to an identity. This typically happens when the PassiveID identity source is not configured with the correct SGT-to-identity mapping. Option A is incorrect because licensing issues would produce different errors. Option C is incorrect because the SGT number range is not the cause of missing mapping. Option D is incorrect because a pxGrid connection failure would show connection-related errors, not a missing SGT mapping.

Answer

The ISE license does not support SGT.

Answer

The SGT number is out of range.

Answer

The pxGrid connection is down.

Question 13

Refer to the exhibit. A network analyst reviews a Stealthwatch flow analysis output. What is the most likely interpretation?

Accepted Answer

This is likely a data exfiltration attempt using a non-standard port.. The flow shows 1.2 GB of data transferred over 5 minutes on a non-standard TCP port 4444 with a high threat score of 85, which is characteristic of data exfiltration attempts. Option B is incorrect because video streaming typically uses standard ports like 80 or 443 and exhibits different traffic patterns. Option C is incorrect because database replication usually uses well-known ports (e.g., 1433 for SQL) and consistent transfer patterns. Option D is incorrect because backup jobs often occur on standard ports and follow regular schedules.

Answer

This is a typical video streaming session.

Answer

This is normal database replication traffic.

Answer

This is a misconfigured backup job.

Question 14

A network engineer is configuring 802.1X on a Cisco switch for wired clients. After configuration, some clients fail authentication. The engineer notices that the clients are not sending any EAP packets. What is the most likely cause?

Accepted Answer

The clients do not have an 802.1X supplicant enabled.. If no EAP packets are sent, the client likely does not have an 802.1X supplicant enabled. Option A is incorrect because access VLAN assignment does not affect EAP transmission. Option B is incorrect because 'authentication port-control auto' is the correct command to enable 802.1X. Option D is incorrect because if the RADIUS server were unreachable, the switch would still see EAP packets from the client.

Answer

The switch port is configured with access VLAN instead of voice VLAN.

Answer

The RADIUS server is unreachable.

Answer

The switch port is configured with 'authentication port-control auto'.

Question 15

A company uses Cisco ISE for network access control. They have deployed TrustSec and want to enforce segmentation using Security Group Tags (SGTs). The network team reports that SGTs are not being propagated correctly. Which protocol is responsible for SGT propagation between switches?

Accepted Answer

SXP. SXP (SGT Exchange Protocol) is the protocol used for propagating Security Group Tags (SGTs) between switches that do not support inline tagging. Option A is incorrect because NETCONF is a network configuration protocol and not used for SGT propagation. Option B is incorrect because while RADIUS can carry SGTs in AV pairs from ISE to the network device, it is not used for switch-to-switch propagation. Option C is incorrect because CDP (Cisco Discovery Protocol) is used for device discovery and not for SGT propagation.

Answer

NETCONF

Answer

RADIUS

Answer

CDP