350-701 Secure Network Access, Visibility and Enforcement Practice Test 6 — 15 Questions

Question 1

The ISE logs show 'Authentication failed - RADIUS attribute Calling-Station-ID is missing' for a wired client. What is the most likely cause?

Accepted Answer

The switch is not configured to include the calling-station-id in RADIUS requests.. The switch must be configured to include the Calling-Station-ID (MAC address) in RADIUS requests (e.g., with the 'access-session include-attributes' command). If this attribute is missing, ISE will fail authentication with the specific error. Option B is incorrect because 'authentication mac-move deny' controls MAC mobility, not attribute delivery. Option C is incorrect because trunk ports can still support 802.1X; the port mode does not directly cause missing Calling-Station-ID. Option D is incorrect because if the MAC is not registered, ISE would return a different failure reason (e.g., 'Unknown client'), not a missing attribute.

Answer

The switch is configured with 'authentication mac-move deny'.

Answer

The switch port is configured as a trunk port.

Answer

The client's MAC address is not registered in ISE.

Question 2

A company uses Cisco ISE for posture assessment. They require that all endpoints meet a certain set of compliance rules before being granted network access. Which service is responsible for performing the posture assessment on the endpoint?

Accepted Answer

Cisco AnyConnect ISE Posture Module. The Cisco AnyConnect ISE Posture Module is the client-side software agent installed on the endpoint that performs the actual posture assessment. It collects compliance information such as OS patch level, antivirus status, and running processes, then reports this data to the ISE Policy Service for evaluation. Without this module running on the endpoint, ISE cannot perform a posture check.

Answer

ISE Policy Service

Answer

Cisco ISE pxGrid

Answer

Network Access Device (switch)

Question 3

An organization is deploying Cisco TrustSec and uses SXP to propagate SGTs between routers that do not support SGT inline tagging. The SXP connection is established, but the SGT mappings are not being learned. The administrator checks 'show sxp connections' and sees the connection is in 'On' state. What is the most likely issue?

Accepted Answer

The SXP speaker and listener are both configured as listener.. In SXP, one side must act as a speaker and the other as a listener for SGT mappings to be exchanged. If both are configured as listeners, the connection can still reach the 'On' state, but no mappings are propagated because neither side is sending. Option A is incorrect because an unreachable source IP would prevent the connection from establishing, and the state would not be 'On'. Option B is incorrect because the hold-down timer affects the removal of stale mappings after a connection loss, not the initial learning of mappings. Option D is incorrect because an incorrect password would also prevent the connection from reaching the 'On' state.

Answer

The SXP source IP is not reachable.

Answer

The SXP hold-down timer expires too quickly.

Answer

The SXP password is incorrect.

Question 4

A junior engineer is configuring MAB (MAC Authentication Bypass) on a Cisco switch for legacy printers. After configuration, the printers are still being placed into the default VLAN instead of the authorized VLAN. Which configuration is missing?

Accepted Answer

authentication order mab. 'authentication order mab'. This command ensures that MAB is attempted before 802.1X on the interface. Without it, the switch may default to 802.1X first, which fails (since printers do not support 802.1X), and if MAB is not in the authentication order, the printer may be placed into the default VLAN instead of the authorized VLAN. Option A ('authentication port-control auto') is required to enable authentication but does not set the order; it is likely already configured. Option C ('dot1x pae authenticator') enables 802.1X, which is not needed for MAB-only environments and does not affect MAB ordering. Option D ('spanning-tree portfast') speeds up STP convergence and is unrelated to authentication order.

Answer

authentication port-control auto

Answer

dot1x pae authenticator

Answer

spanning-tree portfast

Question 5

A network engineer is troubleshooting an issue where a user's device is successfully authenticated via 802.1X, but the user cannot access the corporate network. ISE logs show that the user was granted access with a downloadable ACL (dACL). What could be the cause of no network access?

Accepted Answer

The switch does not support downloadable ACLs.. If the switch does not support downloadable ACLs, it will ignore the dACL attribute and not apply any filtering, potentially blocking traffic. Option B is incorrect because subnet placement does not affect dACL application. Option C is incorrect because the RADIUS server is not involved after authentication. Option D is incorrect because 'access-session port-control auto' is correct configuration.

Answer

The user's device is in a different subnet.

Answer

The RADIUS server is not reachable after authentication.

Answer

The switch port is configured with 'access-session port-control auto'.

Question 6

A company is using Cisco ISE for guest access. They have configured a guest portal with a self-registration page. Some guests report that after registering, they are not redirected to the success page but instead see a '401 Unauthorized' error. What is the most likely cause?

Accepted Answer

The central web authentication (CWA) is not enabled on the switch.. Central web authentication (CWA) must be enabled on the switch to redirect HTTP traffic from unauthenticated guests to the ISE portal. If CWA is not enabled, the switch will not redirect the traffic, resulting in a 401 Unauthorized error after registration. Option A is incorrect because HTTP redirect is configured on the ISE portal itself, not the ISE node, and is not the cause of a 401 error. Option B is incorrect because an untrusted portal certificate would cause a browser security warning, not a 401 error. Option D is incorrect because a missing authorization policy would typically result in an 'Access Denied' message after authentication, not a 401 during the registration redirect.

Answer

The ISE node is not configured for HTTP redirect.

Answer

The guest portal certificate is not trusted by the client.

Answer

The authorization policy for guests is missing.

Question 7

Refer to the exhibit. A network administrator is troubleshooting a wired client that has successfully authenticated using MAB. However, the client is unable to access resources beyond the local subnet. What is the most likely cause?

Accepted Answer

The authorization policy is missing a downloadable ACL (dACL) to allow traffic.. The authorization policy 'Permit_Access' likely does not include a downloadable ACL (dACL), which is required on the switch to allow traffic beyond the local subnet. Without a dACL, the switch defaults to denying inter-subnet traffic. Option A is incorrect because the DHCP scope may include a default gateway, but the issue is about traffic filtering, not IP assignment. Option B is incorrect because VLAN 10 assignment is correct; the problem is the lack of a dACL to permit routing. Option C is incorrect because inter-VLAN routing is configured on the router or Layer 3 switch, but the switchport itself needs a dACL to allow traffic from the client.

Answer

The client's IP address is from a DHCP scope that does not include a default gateway.

Answer

The VLAN policy is incorrect; the client should be in VLAN 20.

Answer

The switch is not configured for inter-VLAN routing.

Question 8

Refer to the exhibit. A network administrator reviews the ISE live log for a successful 802.1X authentication. After authentication, the user is unable to make VoIP calls. What is the most likely cause?

Accepted Answer

The authorization profile does not include a voice VLAN.. The authorization profile applied to the user does not include a voice VLAN assignment, which is required for VoIP traffic. Even though the RADIUS attribute 'device-traffic-class=voice' is present, this only marks the traffic for QoS and does not assign a VLAN. Without a voice VLAN configured in the authorization profile, the phone cannot obtain the necessary VLAN for voice services. Option A is incorrect because whether the phone is configured for 802.1X is irrelevant; the issue is about VLAN assignment. Option B is incorrect because the RADIUS attribute 'device-traffic-class=voice' is correctly formatted for QoS marking, not for VLAN assignment. Option C is incorrect because multi-domain mode is used for scenarios with a phone behind a PC, but here the user's phone is authenticating directly and the problem is the lack of voice VLAN in the authorization profile.

Answer

The user's phone is not configured for 802.1X.

Answer

The RADIUS attribute 'device-traffic-class=voice' is incorrect.

Answer

The switch port is not configured with 'authentication host-mode multi-domain'.

Question 9

Which TWO of the following are authentication methods used for wired network access in Cisco ISE?

Accepted Answer

802.1X. Options D and E are correct because 802.1X and MAC Authentication Bypass (MAB) are the primary authentication methods used for wired network access in Cisco ISE. Option A (TACACS+) is used for device administration, not network access. Option B (NetFlow) is a network monitoring tool. Option C (RADIUS) is a protocol that underpins authentication methods but is not itself an authentication method.

Answer

TACACS+

Answer

NetFlow

Answer

RADIUS

Question 10

Which TWO methods can be used to propagate SGT information between devices that do not support SGT inline tagging?

Accepted Answer

CDP. The correct methods are CDP and SXP. CDP (Cisco Discovery Protocol) can propagate SGT information between devices that do not support inline tagging, particularly in Cisco environments. SXP (SGT Exchange Protocol) is the primary protocol used to exchange SGT mappings between devices that do not have inline SGT support. NetFlow does not propagate SGTs; it is used for traffic flow monitoring. LLDP (Link Layer Discovery Protocol) does not support SGT. VRF-lite is not related to SGT propagation.

Answer

NetFlow

Answer

LLDP

Answer

VRF-lite

Question 11

Which THREE attributes can be used in an ISE authorization policy based on endpoint identity?

Accepted Answer

Certificate subject DN. Options A, B, and E are correct because endpoint identity attributes include the device's MAC address, its certificate subject DN (from certificates), and its Active Directory user group membership. Option C is incorrect because time of day is an environmental attribute, not an endpoint identity attribute. Option D is incorrect because switch IP address is a network location attribute, not endpoint identity.

Answer

Time of day

Answer

Switch IP address

Question 12

A large enterprise has deployed Cisco ISE for network access control with 802.1X and MAB across its wired and wireless networks. The network consists of Cisco Catalyst switches, Cisco Wireless LAN Controllers (WLCs), and ISE in a distributed deployment with three Policy Service Nodes (PSNs) and an Admin Node. Recently, the company implemented a new security policy requiring all endpoints to pass posture assessment before gaining full network access. The posture assessment uses AnyConnect ISE Posture Module.

Shortly after the change, users report that some wired clients are unable to connect to the network. The ISE logs show that the authentication is successful, but the session is terminated immediately with a 'Session-Timeout' attribute set to 0. The network team notices that the affected clients are all connected to switches running older Cisco IOS versions. The ISE administrator confirms that the authorization profiles for the affected clients include a session-timeout of 1 hour. Which course of action should the network engineer take to resolve the issue?

Accepted Answer

Upgrade the switch IOS to a version that supports the new ISE posture attributes.. Older Cisco IOS versions on the switches may not properly interpret the new RADIUS attributes (such as posture-related attributes) sent by ISE during posture assessment. This can cause the switch to misinterpret the session-timeout value and immediately terminate the session (setting Session-Timeout to 0). Upgrading the switch IOS to a version that supports these attributes resolves the compatibility issue. Option B is incorrect because disabling posture assessment for affected ports bypasses the security policy without addressing the root cause. Option C is incorrect because configuring switches to ignore the Session-Timeout attribute can lead to security risks and does not solve the attribute interpretation problem. Option D is incorrect because increasing the session-timeout value in the ISE authorization profile does not fix the switch's inability to handle the attribute; the attribute is still misinterpreted.

Answer

Disable posture assessment for the affected switch ports using a different authorization policy.

Answer

Configure the switches to ignore the Session-Timeout attribute sent by ISE.

Answer

Increase the session-timeout value in the ISE authorization profile to a larger value.

Question 13

A network engineer is troubleshooting an 802.1X deployment where some Windows 10 endpoints fail to authenticate. Logs show that the client sends an EAPoL-Start but never receives an EAP-Request/Identity. The switch port configuration is:
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
Which additional command is most likely needed?

Accepted Answer

dot1x system-auth-control. The switch interface is configured for 802.1X with 'authentication port-control auto', but this alone is insufficient. The global command 'dot1x system-auth-control' must be enabled to activate the 802.1X feature on the switch. Without it, the switch ignores EAPoL-Start messages and does not send EAP-Request/Identity. Option B is correct.

Answer

dot1x reauthentication

Answer

spanning-tree portfast

Answer

dot1x timeout tx-period 3

Question 14

A company is deploying Cisco TrustSec to enforce micro-segmentation between data center servers. Security team wants to use Security Group Tags (SGTs) assigned dynamically via ISE. Which method should the engineer use to propagate SGTs to the access switches that connect the servers, assuming the network uses Cisco Nexus 9000 switches and ISE as the policy server?

Accepted Answer

Deploy SXP (SGT Exchange Protocol) between ISE and the Nexus switches. For dynamic SGT propagation from ISE to network devices, SXP (SGT Exchange Protocol) is the standard method. It carries IP-to-SGT mappings from ISE to the Nexus switches, enabling the switches to enforce policies without requiring inline tagging on every link. Option B (CoA) is used for reauthentication and session changes, not for bulk SGT propagation. Option C (SGT inline tagging) is a hardware-based method for carrying SGTs on frame headers between switches, but it does not propagate the bindings from ISE; it requires all links to support tagging. Option D (dedicated VLAN per security group) is a traditional segmentation method, not related to Cisco TrustSec SGTs. Therefore, A is correct.

Answer

Configure ISE as a RADIUS server to send CoA with SGT

Answer

Enable SGT inline tagging on all interswitch links

Answer

Use a dedicated VLAN per security group

Question 15

An engineer is implementing Cisco ISE posture assessment for corporate Windows laptops. The requirement: endpoints that are missing critical Microsoft security patches must be quarantined in a remediation VLAN. The ISE posture policy uses an 'Application Condition' to check for the patch. However, some laptops with missing patches are still allowed access. During testing, the engineer notices that the posture agent reports 'NAC Agent: Posture Unknown' for those laptops. What is the most likely cause?

Accepted Answer

The authorization policy does not include a posture profile. Posture Unknown indicates that the posture assessment did not complete. This often occurs when the authorization policy does not include a posture profile, so ISE does not issue a posture requirement to the agent, and the agent remains in an unknown state. Option D correctly identifies this cause. Option A (outdated agent) could cause other issues but typically not Posture Unknown. Option B (patches not on ISE list) would lead to non-compliance, not unknown. Option C (ISE unreachable) would cause authentication failure entirely.

Answer

The posture agent software is outdated

Answer

The missing patches are not on the ISE patch list

Answer

The ISE server is unreachable from the client VLAN