350-701 Secure Network Access, Visibility and Enforcement Practice Test 6 — 15 Questions

Question 1

The ISE logs show 'Authentication failed - RADIUS attribute Calling-Station-ID is missing' for a wired client. What is the most likely cause?

Accepted Answer

The switch is not configured to include the calling-station-id in RADIUS requests.. Option D is correct because the switch must be configured to include the calling-station-id (MAC address) in RADIUS requests; if not, the attribute is missing. Option A is incorrect because the MAC address not being registered would cause a different failure. Option B is incorrect because 'authentication mac-move deny' affects MAC mobility, not attribute delivery. Option C is incorrect because trunk ports do not affect 802.1X authentication.

Answer

The switch is configured with 'authentication mac-move deny'.

Answer

The switch port is configured as a trunk port.

Answer

The client's MAC address is not registered in ISE.

Question 2

A company uses Cisco ISE for posture assessment. They require that all endpoints meet a certain set of compliance rules before being granted network access. Which service is responsible for performing the posture assessment on the endpoint?

Accepted Answer

Cisco AnyConnect ISE Posture Module. Option B is correct because the Cisco AnyConnect ISE Posture Module runs on the endpoint, collects posture information, and sends it to ISE. Option A is incorrect because ISE Policy Service evaluates posture reports, not performs the assessment. Option C is incorrect because the network access device only forwards EAP packets. Option D is incorrect because pxGrid is for data sharing between security products.

Answer

ISE Policy Service

Answer

Cisco ISE pxGrid

Answer

Network Access Device (switch)

Question 3

An organization is deploying Cisco TrustSec and uses SXP to propagate SGTs between routers that do not support SGT inline tagging. The SXP connection is established, but the SGT mappings are not being learned. The administrator checks 'show sxp connections' and sees the connection is in 'On' state. What is the most likely issue?

Accepted Answer

The SXP speaker and listener are both configured as listener.. Option A is correct because for SXP, one side must be a speaker and the other a listener. If both are configured as listener, the connection state is 'On' but no mappings are exchanged. Option B is incorrect because an incorrect password would prevent the connection from establishing. Option C is incorrect because if the source IP is unreachable, the connection would not reach 'On' state. Option D is incorrect because the hold-down timer affects stale mappings but not initial learning.

Answer

The SXP source IP is not reachable.

Answer

The SXP hold-down timer expires too quickly.

Answer

The SXP password is incorrect.

Question 4

A junior engineer is configuring MAB (MAC Authentication Bypass) on a Cisco switch for legacy printers. After configuration, the printers are still being placed into the default VLAN instead of the authorized VLAN. Which configuration is missing?

Accepted Answer

authentication order mab. Option D is correct because the 'authentication order mab' command ensures that MAB is attempted before 802.1X. Without it, the switch may first try 802.1X, which fails, and then fall back to MAB, but if the order is not set, MAB might not be tried at all. Option A is incorrect because 'authentication port-control auto' enables authentication, which is likely already configured. Option B is incorrect because 'dot1x pae authenticator' is for 802.1X but not required for MAB. Option C is incorrect because 'spanning-tree portfast' is for convergence, not authentication.

Answer

authentication port-control auto

Answer

dot1x pae authenticator

Answer

spanning-tree portfast

Question 5

A network engineer is troubleshooting an issue where a user's device is successfully authenticated via 802.1X, but the user cannot access the corporate network. ISE logs show that the user was granted access with a downloadable ACL (dACL). What could be the cause of no network access?

Accepted Answer

The switch does not support downloadable ACLs.. Option A is correct because if the switch does not support downloadable ACLs, it will ignore the dACL attribute and not apply any filtering, potentially blocking traffic. Option B is incorrect because subnet placement does not affect dACL application. Option C is incorrect because the RADIUS server is not involved after authentication. Option D is incorrect because 'access-session port-control auto' is correct configuration.

Answer

The user's device is in a different subnet.

Answer

The RADIUS server is not reachable after authentication.

Answer

The switch port is configured with 'access-session port-control auto'.

Question 6

A company is using Cisco ISE for guest access. They have configured a guest portal with a self-registration page. Some guests report that after registering, they are not redirected to the success page but instead see a '401 Unauthorized' error. What is the most likely cause?

Accepted Answer

The central web authentication (CWA) is not enabled on the switch.. Option D is correct because for guest portal redirection after authentication, the switch must be configured for central web authentication (CWA). If CWA is not enabled, the switch does not redirect HTTP traffic to the ISE portal, resulting in a 401 error. Option A is incorrect because a certificate trust issue would cause a warning, not a 401. Option B is incorrect because ISE HTTP redirect is configured as part of the portal. Option C is incorrect because a missing authorization policy would cause a different error, such as 'Access Denied'.

Answer

The ISE node is not configured for HTTP redirect.

Answer

The guest portal certificate is not trusted by the client.

Answer

The authorization policy for guests is missing.

Question 7

Refer to the exhibit. A network administrator is troubleshooting a wired client that has successfully authenticated using MAB. However, the client is unable to access resources beyond the local subnet. What is the most likely cause?

Accepted Answer

The authorization policy is missing a downloadable ACL (dACL) to allow traffic.. Option C is correct because the authorization policy 'Permit_Access' likely does not include a downloadable ACL (dACL), so no traffic filtering is applied on the switch to allow inter-subnet traffic. Option A is incorrect because VLAN 10 is assigned; subnet routing is separate. Option B is incorrect because routing is not configured per port. Option D is incorrect because the DHCP scope is not directly related to the issue.

Answer

The client's IP address is from a DHCP scope that does not include a default gateway.

Answer

The VLAN policy is incorrect; the client should be in VLAN 20.

Answer

The switch is not configured for inter-VLAN routing.

Question 8

Refer to the exhibit. A network administrator reviews the ISE live log for a successful 802.1X authentication. After authentication, the user is unable to make VoIP calls. What is the most likely cause?

Accepted Answer

The authorization profile does not include a voice VLAN.. Option B is correct because the authorization profile 'Standard_Access' likely does not include a voice VLAN assignment, which is required for VoIP traffic. Though the session attributes show 'device-traffic-class=voice', this is a QoS marking, not a VLAN assignment. Option A is incorrect because multi-domain mode is for phones behind PCs, not directly related to VoIP capability. Option C is incorrect because the user's phone authenticates independently. Option D is incorrect because the attribute is correctly formatted.

Answer

The user's phone is not configured for 802.1X.

Answer

The RADIUS attribute 'device-traffic-class=voice' is incorrect.

Answer

The switch port is not configured with 'authentication host-mode multi-domain'.

Question 9

Which TWO of the following are authentication methods used for wired network access in Cisco ISE?

Accepted Answer

802.1X. Options A and B are correct because 802.1X and MAC Authentication Bypass (MAB) are the primary authentication methods for wired ports. Option C is incorrect because RADIUS is a protocol, not an authentication method. Option D is incorrect because TACACS+ is for device administration, not network access. Option E is incorrect because NetFlow is a monitoring tool.

Answer

TACACS+

Answer

NetFlow

Answer

RADIUS

Question 10

Which TWO methods can be used to propagate SGT information between devices that do not support SGT inline tagging?

Accepted Answer

CDP. Options A and B are correct because SXP (SGT Exchange Protocol) is the primary protocol for SGT propagation, and CDP can also carry SGT information in some implementations. Option C is incorrect because LLDP does not support SGT. Option D is incorrect because VRF-lite is not related to SGT. Option E is incorrect because NetFlow does not propagate SGTs.

Answer

NetFlow

Answer

LLDP

Answer

VRF-lite

Question 11

Which THREE attributes can be used in an ISE authorization policy based on endpoint identity?

Accepted Answer

Certificate subject DN. Options A, B, and C are correct because endpoint identity can be based on MAC address, Active Directory user group, or certificate subject DN. Option D is incorrect because switch IP address is a network location attribute, not endpoint identity. Option E is incorrect because time of day is an environmental attribute.

Answer

Time of day

Answer

Switch IP address

Question 12

A large enterprise has deployed Cisco ISE for network access control with 802.1X and MAB across its wired and wireless networks. The network consists of Cisco Catalyst switches, Cisco Wireless LAN Controllers (WLCs), and ISE in a distributed deployment with three Policy Service Nodes (PSNs) and an Admin Node. Recently, the company implemented a new security policy requiring all endpoints to pass posture assessment before gaining full network access. The posture assessment uses AnyConnect ISE Posture Module.

Shortly after the change, users report that some wired clients are unable to connect to the network. The ISE logs show that the authentication is successful, but the session is terminated immediately with a 'Session-Timeout' attribute set to 0. The network team notices that the affected clients are all connected to switches running older Cisco IOS versions. The ISE administrator confirms that the authorization profiles for the affected clients include a session-timeout of 1 hour. Which course of action should the network engineer take to resolve the issue?

Accepted Answer

Upgrade the switch IOS to a version that supports the new ISE posture attributes.. Option B is correct because older IOS versions may not properly interpret the new RADIUS attributes sent by ISE during posture assessment, causing session termination. Upgrading to a supported IOS version resolves the compatibility issue. Option A is incorrect because ignoring the Session-Timeout attribute is not a recommended practice and may cause security issues. Option C is incorrect because disabling posture for these ports is a workaround, not a solution. Option D is incorrect because increasing the timeout does not address the root cause, which is the switch's inability to handle the attribute.

Answer

Disable posture assessment for the affected switch ports using a different authorization policy.

Answer

Configure the switches to ignore the Session-Timeout attribute sent by ISE.

Answer

Increase the session-timeout value in the ISE authorization profile to a larger value.

Question 13

A network engineer is troubleshooting an 802.1X deployment where some Windows 10 endpoints fail to authenticate. Logs show that the client sends an EAPoL-Start but never receives an EAP-Request/Identity. The switch port configuration is:
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
Which additional command is most likely needed?

Accepted Answer

dot1x system-auth-control. The 'authentication port-control auto' enables 802.1X, but the switch must also be configured to use the RADIUS server for authentication. The missing command is 'dot1x timeout tx-period 3' is irrelevant; 'dot1x reauthentication' is optional; 'spanning-tree portfast' is for STP. The correct answer is A: 'aaa new-model' and 'radius-server host...' but the option must be listed. Actually the stem asks for 'additional command', so option C 'dot1x system-auth-control' is necessary globally. In many Cisco switches, 'dot1x system-auth-control' must be enabled globally. Thus answer is C.

Answer

dot1x reauthentication

Answer

spanning-tree portfast

Answer

dot1x timeout tx-period 3

Question 14

A company is deploying Cisco TrustSec to enforce micro-segmentation between data center servers. Security team wants to use Security Group Tags (SGTs) assigned dynamically via ISE. Which method should the engineer use to propagate SGTs to the access switches that connect the servers, assuming the network uses Cisco Nexus 9000 switches and ISE as the policy server?

Accepted Answer

Deploy SXP (SGT Exchange Protocol) between ISE and the Nexus switches. For dynamic SGT propagation, the best method is SXP (SGT Exchange Protocol) because it can carry SGT bindings from ISE to network devices without needing inline tagging on every link. Option A (SGT inline tagging) requires hardware support; B (CoA) is for reauthentication; D (RADIUS change of authorization) is not for SGT. So answer is C.

Answer

Configure ISE as a RADIUS server to send CoA with SGT

Answer

Enable SGT inline tagging on all interswitch links

Answer

Use a dedicated VLAN per security group

Question 15

An engineer is implementing Cisco ISE posture assessment for corporate Windows laptops. The requirement: endpoints that are missing critical Microsoft security patches must be quarantined in a remediation VLAN. The ISE posture policy uses an 'Application Condition' to check for the patch. However, some laptops with missing patches are still allowed access. During testing, the engineer notices that the posture agent reports 'NAC Agent: Posture Unknown' for those laptops. What is the most likely cause?

Accepted Answer

The authorization policy does not include a posture profile. Posture Unknown typically means the posture assessment timed out or the client did not complete the scan. Common cause is the posture agent not receiving the necessary credentials or probe from ISE due to a missing 'posture' authorization profile. Option B is correct because if the authorization policy does not invoke posture (i.e., the result includes a posture profile), the agent may not perform the scan. Option A (patch not installed) would result in non-compliance, not unknown. Option C (ISE not reachable) would break all authentication. Option D (agent version) might cause issues but typically not 'unknown'. So answer is B.

Answer

The posture agent software is outdated

Answer

The missing patches are not on the ISE patch list

Answer

The ISE server is unreachable from the client VLAN