350-701 Secure Network Access, Visibility and Enforcement Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. Based on the exhibit, what is the current state of the client and what action should the network administrator take to allow full network access?

Accepted Answer

The client is in a quarantine state due to posture assessment failure; the administrator should check the ISE posture policy and ensure the client meets compliance.. The exhibit (implied) shows the client in a quarantine state, which in Cisco ISE occurs when posture assessment fails — the client authenticated but does not meet compliance requirements (e.g., missing antivirus, outdated OS patches). The administrator should review the posture policy and remediate the client to restore full network access.

Answer

The client's authentication succeeded but authorization is incomplete; the administrator should configure a new dACL on the switch.

Answer

The client is being redirected to a guest portal; the administrator should disable the URL redirect and assign a new VLAN.

Answer

The client is fully authenticated and authorized; no action is needed.

Question 2

An engineer is deploying Cisco TrustSec in a data center. The requirement is to apply a Security Group Tag (SGT) to traffic based on the source VM's IP address, because the hypervisor cannot perform 802.1X or SXP. The engineer configures a static IP-to-SGT mapping on the Cisco Nexus 9000 switch that connects to the hypervisor. However, when traffic from the VM arrives at the first hop switch, the SGT is not being applied and the packet is forwarded without a tag. What is the most likely cause?

Accepted Answer

The switch is not configured with the 'cts manual' command and the 'policy static sgt' and 'trusted' options on the interface.. For static IP-to-SGT mapping to take effect on a switch port, the interface must be configured for manual TrustSec tagging with 'cts manual' and the 'policy static sgt <tag> trusted' command. This allows the switch to insert the SGT based on the source IP address of the incoming traffic. Without these commands, the mapping is ignored and packets are forwarded without a tag.

Answer

The IP-to-SGT mapping must be configured on the Cisco ISE server, not on the switch.

Answer

The switch port connected to the hypervisor is configured as a trunk instead of an access port.

Answer

The VM's IP address is not included in the Cisco ISE posture policy, so the SGT is not assigned.

Question 3

A network security engineer is deploying Cisco TrustSec in a large enterprise. The engineer needs to assign Security Group Tags (SGTs) to endpoints based on static IP-to-SGT mappings configured on Cisco ISE. Which ISE feature should be used to accomplish this?

Accepted Answer

TrustSec static SGT assignment. Cisco TrustSec supports static SGT assignment through Cisco ISE, where administrators manually map IP addresses or subnets to SGTs. This is useful for devices that do not support 802.1X or when dynamic classification is not desired. The static mappings are configured in ISE and can be propagated to network devices via SXP for enforcement, ensuring consistent policy application across the network.

Answer

Dynamic SGT assignment via 802.1X

Answer

SXP (SGT Exchange Protocol) peering

Answer

Security Group Access (SGA) static mapping

Question 4

A security administrator is deploying Cisco TrustSec in an ISE environment. The requirement is to assign Security Group Tags (SGTs) to endpoints based on the Active Directory group to which the user belongs. The administrator has configured the Active Directory external identity source and created authorization policies. Which additional step is required to ensure that SGTs are properly assigned and enforced?

Accepted Answer

Enable SGT propagation on the network devices using inline tagging or SXP.. SGT assignment occurs at the enforcement point, but for other devices to enforce policies based on that SGT, the tag must be propagated. Inline tagging embeds the SGT in the packet header on supported platforms, while SXP shares IP-to-SGT mappings with devices that cannot read inline tags. Without propagation, SGT-based enforcement fails beyond the first hop.

Answer

Assign static SGTs to all endpoints in the ISE database.

Answer

Configure the ISE policy set to use the 'AD-User' condition for SGT assignment.

Answer

Enable MACsec encryption on all switch ports to carry SGTs.

Question 5

A network security engineer is deploying Cisco TrustSec in a data center. The requirement is to assign Security Group Tags (SGTs) to IP phones based on the device type without requiring 802.1X authentication on the phones. The engineer decides to use SGT propagation via Cisco Discovery Protocol (CDP). Which statement accurately describes how this works?

Accepted Answer

The switch learns the SGT from the phone via CDP and dynamically assigns it to the phone's MAC address in the device tracking table.. CDP can carry SGT information from a Cisco IP phone to the switch. The switch uses this to classify traffic without 802.1X, allowing dynamic SGT assignment for devices that support CDP. This method is efficient for IP phones and similar devices that may not run supplicant software.

Answer

The SGT is embedded in the CDP packet by the switch and then advertised to the phone, which then uses it for all its traffic.

Answer

CDP is used only for VLAN assignment; SGTs are assigned exclusively through 802.1X and MACsec.

Answer

The switch queries the Cisco ISE server for the SGT and then pushes it to the phone via CDP.

Question 6

A network security engineer is configuring 802.1X on a Cisco Catalyst switch for a conference room wall port. The requirement is that when no supplicant is present, the port should still allow a single device to connect without authentication, but if a second MAC address appears, the port should immediately go into the err-disabled state. Which host mode should be configured on the interface?

Accepted Answer

single-host. The requirement is to allow only one device on the port and disable the port if a second MAC address is detected. Single-host mode enforces this by permitting only one MAC address to be authenticated; a second MAC triggers a security violation and the port enters err-disabled state. Other host modes either allow multiple authenticated devices or permit multiple devices after a single authentication, which does not meet the scenario.

Answer

multi-auth

Answer

multi-host

Answer

multi-domain

Question 7

A network administrator is configuring 802.1X on a Cisco Catalyst switch port that connects to an IP phone and a PC daisy-chained behind it. The administrator wants the phone authenticated via MAB and the PC via 802.1X, both on the same port, and wants the PC traffic to use the voice VLAN only for voice. Which switch port feature must be configured to support this setup?

Accepted Answer

Multi-Domain Authentication (MDA). The scenario requires both an IP phone and a PC to authenticate on the same switch port, with the phone using MAB and the PC using 802.1X. MDA is the only feature that creates separate voice and data domains on a single port, allowing each device to authenticate independently and be placed in the correct VLAN. The other options either allow multiple devices without separate domains or are monitoring tools, so they cannot meet the requirement.

Answer

802.1X Monitor Mode

Answer

Multi-Host

Answer

Multi-Authentication

Question 8

A network administrator is deploying Cisco TrustSec in a campus network. The requirement is to assign Security Group Tags (SGTs) to endpoints based on the VLAN they connect to, and then enforce access policies based on those SGTs. The administrator has already created the SGTs and configured the Security Group ACLs (SGACLs) in Cisco ISE. Which additional step is required to assign SGTs to endpoints based on VLAN?

Accepted Answer

Configure the 'cts role-based sgt-map vlan' command on the switch to map the VLAN to the desired SGT.. To assign SGTs based on VLAN, the switch must be configured with the 'cts role-based sgt-map vlan' command, which statically maps a VLAN to an SGT. This method is straightforward and does not rely on authentication. The SGACLs defined in ISE will then enforce policies based on the assigned SGTs. This is a common deployment for devices that cannot perform 802.1X.

Answer

Configure the 'cts sgt-map' command on the switch to map the VLAN to the desired SGT.

Answer

Configure the VLAN-to-SGT mapping on the Cisco ISE server and enable SGT propagation on the switches.

Answer

Enable 802.1X authentication on the switch ports and configure the SGT as an authorization result in Cisco ISE.

Question 9

A network administrator is configuring 802.1X authentication on a Cisco switch. The administrator wants to ensure that if the RADIUS server is unreachable, endpoints are placed into a guest VLAN with limited access. Which feature should be configured on the switch to achieve this?

Accepted Answer

Configure a guest VLAN that is applied when authentication fails or times out, including when the RADIUS server is unreachable.. The guest VLAN feature in 802.1X allows the switch to place a port into a restricted VLAN when authentication fails, including when the RADIUS server is unreachable. This provides limited access for endpoints until authentication can succeed. Critical authentication would grant access during server outage but not necessarily limited guest access, and MAB or RADIUS failover do not address the requirement for a fallback VLAN with restricted permissions.

Answer

Configure critical authentication (critical VLAN) to allow access when the RADIUS server is unavailable.

Answer

Configure RADIUS server deadtime and failover to a backup server to ensure authentication continues.

Answer

Enable MAC Authentication Bypass (MAB) to authenticate devices that do not support 802.1X.

Question 10

A network engineer is implementing Cisco TrustSec in a campus network. The engineer needs to ensure that Security Group Tags (SGTs) are properly propagated and enforced across network devices that do not support native SGT tagging. Which two mechanisms can be used to achieve this? (Choose two.)

Accepted Answer

SXP (SGT Exchange Protocol). SXP and static SGT assignment are both mechanisms that enable SGT propagation and enforcement on devices that do not support native SGT tagging. SXP dynamically shares IP-to-SGT mappings, while static assignment manually maps IP addresses to SGTs. Both allow non-TrustSec-capable devices to participate in a TrustSec domain by enforcing policies based on the SGT information they receive or are configured with.

Answer

MACsec encryption

Answer

802.1X with EAP-TLS

Answer

Inline tagging

Question 11

A security architect is designing a Cisco TrustSec deployment. The architect must ensure that traffic between security groups is properly enforced and that the enforcement is scalable and consistent across the network. Which two statements about TrustSec SGACL enforcement are true? (Choose two.)

Accepted Answer

SGACLs can be enforced on devices that do not support hardware-based SGT tagging if they receive SGT mappings via SXP.. SGACLs are enforced at the destination device, and enforcement is possible on devices without hardware SGT support if they receive SGT mappings via SXP. SGACLs are centrally defined on Cisco ISE and downloaded to enforcement devices, ensuring consistent policy. Enforcement is not at the source, and IPv6 is supported.

Answer

SGACLs are always enforced at the source device before the packet is sent.

Answer

SGACLs are enforced on the egress interface of the destination device.

Answer

SGACLs can only be applied to IPv4 traffic; IPv6 is not supported.

Question 12

A security engineer is deploying Cisco ISE in a distributed deployment with two Policy Administration Nodes (PANs) for high availability. The engineer needs to ensure that if the primary PAN fails, the secondary PAN automatically takes over. Which ISE deployment configuration is required to achieve this?

Accepted Answer

Configure the two PANs in a high-availability pair with one as primary and the other as secondary, and enable automatic failover.. Cisco ISE high availability for PANs requires configuring two nodes as a primary-secondary pair with automatic failover enabled. This ensures that if the primary PAN fails, the secondary PAN takes over automatically, maintaining management plane operations. Other options like load balancing, standalone replication, or manual promotion do not provide the required automatic failover capability.

Answer

Enable PAN redundancy by promoting the secondary PAN to primary upon failure using the ISE CLI command 'application configure ise'.

Answer

Deploy the PANs in a load-balanced cluster with an external load balancer to distribute management traffic.

Answer

Configure both PANs as standalone nodes and use database replication to synchronize configuration.

Question 13

A network security administrator is configuring 802.1X authentication on a Cisco switch. The administrator wants to ensure that if the RADIUS server becomes unreachable, endpoints that were previously authenticated remain connected, but new devices are denied access. Which feature should be configured?

Accepted Answer

Inaccessible Authentication Bypass (IAB). Inaccessible Authentication Bypass (IAB) is designed for the scenario where the RADIUS server becomes unreachable. It allows endpoints that have already authenticated to maintain their network access, while new endpoints are denied or placed into a critical VLAN with limited access. This maintains productivity for known users while preventing unauthorized access. The other options either allow all devices (fail-open), deny all (fail-closed), or are an authentication method (MAB) that still depends on RADIUS.

Answer

MAC Authentication Bypass (MAB)

Answer

Authentication Fail-Open

Answer

Authentication Fail-Closed

Question 14

A security engineer is configuring Cisco ISE to support BYOD onboarding for employees. The goal is to allow employees to register their personal devices and receive certificates for 802.1X authentication. Which two actions are required to enable certificate-based authentication for BYOD devices? (Choose two.)

Accepted Answer

Ensure the endpoint supplicant is configured to use the issued certificate for authentication.. To enable certificate-based BYOD authentication, ISE must issue client certificates, which requires a certificate authority configured in ISE. Additionally, the endpoint supplicant must be provisioned to use the certificate for 802.1X EAP-TLS authentication. These two actions are fundamental for the BYOD certificate flow.

Answer

Add the BYOD devices to a static MAC address group in ISE.

Answer

Enable the 'Allow employees to use personal devices' option in the guest portal settings.

Answer

Configure an authorization policy that uses the 'EAP-TLS' authentication method for BYOD devices.

Question 15

A network security team is implementing Cisco TrustSec in their enterprise network. They want to ensure that traffic between different security groups is properly enforced. They have already configured SGTs and SGACLs in Cisco ISE. Which two additional components are required to enforce SGACLs on network devices that do not support hardware-based SGT tagging? (Choose two.)

Accepted Answer

Enable SGT Exchange Protocol (SXP) on the devices to propagate IP-to-SGT mappings.. For devices that cannot natively tag packets with SGTs, SXP is used to propagate IP-to-SGT mappings. The non-tagging device acts as an SXP listener, learning mappings from an SXP speaker. This allows the device to enforce SGACLs based on the IP-to-SGT mappings. Therefore, enabling SXP and configuring the device to learn mappings via SXP are the required steps.

Answer

Configure the devices to use 802.1X authentication to assign SGTs dynamically.

Answer

Configure the devices to use the Cisco TrustSec CLI to manually map IP addresses to SGTs.

Answer

Ensure that the devices support and are configured for Cisco Meta Data (CMD) tagging.