350-701 Secure Network Access, Visibility and Enforcement Practice Test 6 — 15 Questions

Question 1

A network engineer is configuring a Cisco Catalyst switch to support 802.1X for wired clients. The switch must authenticate users against a Cisco ISE server. The engineer wants to ensure that if the ISE server becomes unreachable, authenticated clients remain connected, but new clients are denied access. Which RADIUS communication setting should be configured on the switch?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

authentication server unreachable (ASU) with fail-closed. By default, when a RADIUS server is unreachable, the switch denies authentication for new clients but does not tear down existing authenticated sessions. This is the fail-closed behavior. To achieve this, the engineer should not configure critical or open authentication. The 'authentication server unreachable' setting with fail-closed ensures that only existing sessions continue, while new clients are rejected, aligning with the stated policy.

Answer

authentication critical

Answer

authentication open

Answer

dead-criteria time 30

Question 2

A network administrator is configuring a Cisco switch to support 802.1X authentication for wired users. The administrator wants to ensure that if the RADIUS server is unreachable, users are still granted limited network access to a guest VLAN. Which feature should the administrator configure on the switch to achieve this?

Accepted Answer

Enable the 'authentication critical' command and specify a critical VLAN.. The 'authentication critical' feature, also known as critical VLAN or critical voice VLAN, is designed to provide fallback access when the RADIUS server is unreachable. It places the port into a specified VLAN, allowing limited access. This is the standard method to maintain network connectivity during authentication server outages.

Answer

Set the switch to use the 'authentication host-mode multi-auth' command.

Answer

Configure the switch to use the 'authentication open' command on the ports.

Answer

Configure the switch to use MAC Authentication Bypass (MAB) as a fallback method.

Question 3

A security team is deploying Cisco TrustSec in a campus network. They want to enforce segmentation based on user roles without changing IP addresses or VLANs. They plan to use Security Group Tags (SGTs) and Security Group ACLs (SGACLs). Which two statements are correct about the enforcement of SGACLs on Cisco Catalyst switches? (Choose two.)

Accepted Answer

SGACLs are enforced only on switches that support hardware-based SGACL enforcement, such as Catalyst 9000 series.. SGACLs are enforced in hardware on supported switches, such as the Catalyst 9000 series, and they operate by examining the source and destination SGTs in the packet. The switch then applies the appropriate SGACL policy. They are defined centrally on ISE and referenced in authorization policies, but they are not downloaded as part of the authorization policy itself; rather, the switch pulls the SGACL content from ISE. SGACLs do not replace IP ACLs; they complement them.

Answer

SGACLs are defined on the Cisco ISE server and downloaded to the switches as part of the authorization policy.

Answer

SGACLs can be enforced on a switch even if the switch does not have an IP address configured on the enforcement interface.

Answer

SGACLs replace traditional IP ACLs entirely and must be used exclusively on all interfaces.

Question 4

A security engineer is deploying Cisco Stealthwatch to monitor network traffic and detect anomalies. The engineer wants to ensure that Stealthwatch can collect flow data from Cisco switches without the need for dedicated hardware probes. Which technology should the engineer use to export flow data from the switches to Stealthwatch?

Accepted Answer

NetFlow. NetFlow is the correct technology for exporting flow data from Cisco switches to Stealthwatch. It provides detailed information about IP flows, which Stealthwatch uses to detect anomalies and security threats. SNMP and Syslog do not provide flow-level data, and while IPFIX is a standard, NetFlow is the native Cisco solution.

Answer

IPFIX

Answer

SNMP

Answer

Syslog

Question 5

A company is deploying Cisco ISE for guest access. They want to provide a self-service portal where guests can register their devices and receive a temporary username and password. Which ISE component is used to accomplish this?

Accepted Answer

Guest Portal. C is correct because the Guest Portal in Cisco ISE is specifically designed to provide a self-service registration page where guests can create their own accounts, receive temporary credentials, and gain network access. This portal handles the entire guest lifecycle, including sponsor approval if required, and can deliver the username/password via SMS, email, or on-screen display.

Answer

BYOD Portal

Answer

Mobile Device Management (MDM)

Answer

Profiler Service

Question 6

A network administrator wants to implement 802.1X on a Cisco switch port for a device that does not support 802.1X. Which feature should be configured to allow the device to connect?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) is the correct feature because it allows a device that does not support 802.1X supplicant software to authenticate by using its MAC address as the identity. The switch acts as a proxy, sending the MAC address as the username and password to the RADIUS server, which can then grant or deny access based on the MAC address in its database.

Answer

802.1X with EAP-MSCHAPv2

Answer

Downloadable ACL (dACL)

Answer

Web Authentication (WA)

Question 7

An organization is using Cisco ISE to enforce posture compliance. Endpoints that are non-compliant should be placed into a quarantine VLAN. Which ISE policy component is used to assign the VLAN?

Accepted Answer

Authorization profile. An Authorization Profile in Cisco ISE defines the enforcement actions to be applied to an endpoint after successful authentication and authorization. When a posture assessment determines an endpoint is non-compliant, the authorization policy can match that condition and return an authorization profile that includes a specific VLAN ID (e.g., quarantine VLAN) via RADIUS attributes such as Tunnel-Private-Group-ID (RFC 2868). This VLAN assignment is a core function of the authorization profile, not of authentication or profiling.

Answer

Policy set

Answer

Profiling policy

Answer

Authentication policy

Question 8

A security engineer is configuring Cisco ISE to enforce SGT-based access control. The engineer creates an SGACL on the switch that permits traffic from SGT 10 to SGT 20. However, traffic from SGT 10 to SGT 20 is still being dropped. The engineer verifies that the SGTs are correctly assigned. What is a possible reason for the drop?

Accepted Answer

There is a deny SGACL with a higher priority that matches the traffic. Cisco ISE enforces SGT-based access control using Security Group ACLs (SGACLs) that are evaluated in priority order. Even if a permit SGACL exists for SGT 10 to SGT 20, a deny SGACL with a higher priority (lower sequence number) that matches the same traffic will take precedence and cause the traffic to be dropped. The engineer must check the full SGACL list and their sequence numbers on the switch to identify conflicting rules.

Answer

SXP is not configured

Answer

The CTRL protocol is not enabled

Answer

The PAC on the switch is expired

Question 9

Which THREE of the following are required for a successful 802.1X authentication on a Cisco switch? (Choose THREE)

Accepted Answer

The switch must be configured as a RADIUS client to ISE. For 802.1X to work on a Cisco switch, the switch must act as the authenticator and be configured as a RADIUS client pointing to the authentication server (ISE), so option C is correct because the switch needs to send EAP/RADIUS Access-Request messages to ISE. Option D is correct because the interface must have 'authentication port-control auto' (or equivalent dot1x port-control auto) to enable 802.1X-controlled access on that port. Option E is correct because the supplicant endpoint must present valid credentials—an EAP method such as EAP-TLS with a certificate or PEAP/MSCHAPv2 with a username/password—for authentication to succeed. Option A is not required; an SGT is a Cisco TrustSec feature used for role-based enforcement and is not part of basic 802.1X authentication. Option B is not required; a downloadable ACL is an authorization policy pushed by ISE after successful authentication and is not needed for the authentication itself to succeed.

Answer

Security Group Tag (SGT) must be assigned

Answer

A downloadable ACL (dACL) must be configured on ISE

Question 10

Which TWO of the following are features of Cisco TrustSec? (Choose TWO)

Accepted Answer

Security Group Tag Exchange Protocol (SXP). Cisco TrustSec is a segmentation technology that relies on Security Group Tags (SGTs), so option B is correct: TrustSec assigns an SGT to a user or device's traffic (via 802.1X, SGT Exchange Protocol, or static mapping) and enforces policy based on that tag rather than IP addresses. Option A is also correct because the Security Group Tag Exchange Protocol (SXP) is a TrustSec feature that propagates SGT-to-IP mappings to devices that cannot natively tag traffic, such as older switches or non-TrustSec-capable platforms. The remaining options are not TrustSec-specific features: IPsec VPN (C) is a separate tunneling/encryption technology, Network Access Control (D) is a broader category of admission control that TrustSec can integrate with but does not define, and 802.1X authentication (E) is an IEEE port-based access control standard used to obtain identity/SGT information, not a feature unique to TrustSec.

Answer

IPsec VPN

Answer

Network Access Control (NAC)

Answer

802.1X authentication

Question 11

A security architect is designing network access control for a campus network. The requirement is to authenticate users before granting network access and to enforce policies based on user identity and device posture. Which solution should be deployed?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the correct solution because it provides centralized policy-based network access control that authenticates users via 802.1X, MAB, or web authentication, and enforces dynamic VLAN assignment, ACLs, or SGTs based on user identity and device posture (e.g., compliance with antivirus, OS patches). Unlike a generic AAA server, ISE integrates with posture assessment (via AnyConnect or NAC Agent) and supports profiling, guest access, and BYOD onboarding, directly meeting the requirement for identity- and posture-based enforcement.

Answer

AAA server with TACACS+

Answer

VPN concentrator with client certificate authentication

Answer

Next-generation firewall with application control

Question 12

A company has deployed Cisco ISE for network access control. After a recent upgrade, the operations team notices that some users are being assigned incorrect authorization profiles. The ISE logs show that the users are being matched to the correct identity group, but the authorization result is different from expected. What is the most likely cause?

Accepted Answer

The authorization policy rules are not in the correct order, causing a different rule to match first.. In Cisco ISE, authorization policies are evaluated in top-down order, and the first matching rule is applied. Even if users are correctly assigned to an identity group, a higher-priority authorization policy rule that matches on other conditions (e.g., endpoint profile, device type, or time condition) can override the expected result. This is the most likely cause when authentication and group assignment are correct but the authorization result is unexpected.

Answer

The passive identity feature is overriding the user's group assignment.

Answer

The network device group assignment has changed, causing the device to be in a different group.

Answer

The authentication policy is misconfigured, causing users to be placed in the wrong identity group.

Question 13

Which THREE of the following are valid components of Cisco ISE's visibility and enforcement architecture?

Accepted Answer

TrustSec with SGTs. Option A is correct because TrustSec with Security Group Tags (SGTs) is a core enforcement mechanism in Cisco ISE, where SGTs are inserted into frames (via 802.1X/MACsec or SXP) and enforced by SGACL policies on network devices. Option B is correct because profiling probes such as DHCP, HTTP, RADIUS, SNMP, and NetFlow are used by ISE to collect endpoint attributes and classify devices into endpoint identity groups for visibility and policy decisions. Option C is correct because pxGrid (Platform Exchange Grid) is ISE's publish/subscribe integration fabric that shares contextual data (identity, posture, SGT, session) with ecosystem partners for enhanced visibility and enforcement. Option D is not a distinct ISE architectural component; NetFlow is a data source that can feed profiling, but it is not itself a named ISE visibility/enforcement component. Option E is not a distinct ISE architectural component either; SNMP traps are an alerting/telemetry mechanism, not a core ISE visibility and enforcement building block.

Answer

NetFlow for flow analysis

Answer

SNMP traps for alerting

Question 14

A network administrator has configured the above on a Cisco switch port for a device that supports both MAB and 802.1X. The device sends an EAPOL-start but the switch responds with an EAP-Request/Identity. The device does not respond to the EAP-Request/Identity. After a timeout, the switch attempts MAB. However, MAB also fails because the RADIUS server does not have the MAC address. Which of the following best describes the final port state?

Accepted Answer

The port will remain in an unauthorized state, blocking all traffic. When 802.1X authentication fails because the device does not respond to the EAP-Request/Identity, and MAB also fails because the RADIUS server lacks the MAC address, the switch port remains in an unauthorized state. This is the default behavior for a port configured with both authentication methods: if neither succeeds, the port stays in the 802.1X unauthorized state, blocking all traffic until a successful authentication occurs or a fallback action (like a critical VLAN) is explicitly configured.

Answer

The port will be placed in a critical authentication VLAN

Answer

The port will be error-disabled due to authentication failure

Answer

The port will be placed in VLAN 10 with restricted access

Question 15

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

Accepted Answer

1. Check IP reachability between peers. 2. Verify UDP port 500 is open. 3. Compare IKE proposals. 4. Verify pre-shared keys. 5. Use debug commands.. Start with reachability, then check UDP 500, compare IKE proposals, verify pre-shared keys, and finally use debug for detailed errors.

Answer

1. Verify pre-shared keys. 2. Check IP reachability. 3. Compare IKE proposals. 4. Verify UDP port 500 is open. 5. Use debug commands.

Answer

1. Use debug commands immediately. 2. Verify UDP port 500 is open. 3. Check IP reachability. 4. Compare IKE proposals. 5. Verify pre-shared keys.

Answer

1. Check IP reachability. 2. Compare IKE proposals. 3. Verify UDP port 500 is open. 4. Use debug commands. 5. Verify pre-shared keys.