350-701 Secure Network Access, Visibility and Enforcement Practice Test 7 — 15 Questions

Question 1

Match each Cisco security product to its category.

Accepted Answer

Cisco Firepower: Next-Generation Firewall. Cisco Firepower is an NGFW; Cisco ISE is a NAC; Cisco Umbrella is a cloud security solution; Cisco Stealthwatch is for network security monitoring. Common confusions include swapping Firepower with ISE and Stealthwatch with Firepower.

Answer

Cisco Firepower: Network Access Control

Answer

Cisco Stealthwatch: Next-Generation Firewall

Question 2

An ISE deployment uses TrustSec with SGTs assigned by Active Directory group membership. A group of users in the 'Finance' AD group is correctly receiving SGT 5, but a new user added to that group is getting SGT 0. The ISE policy is unchanged, and other users in the group work fine. What is the most likely cause?

Accepted Answer

ISE has not synchronized the latest AD group membership. ISE uses Active Directory (AD) as an identity source and must synchronize group membership changes before it can map the new user to the correct Security Group Tag (SGT). If the AD group membership has not been refreshed via the scheduled or manual sync, ISE will not know the new user belongs to the 'Finance' group, resulting in a default SGT of 0 (unknown/untrusted). Other users already in the group work fine because their membership was present during the last successful sync.

Answer

The user endpoint has not been profiled by ISE yet

Answer

The user endpoint is running antivirus software that blocks SGT assignment

Answer

The user does not have a PAC (Protected Access Credential)

Answer

The switchport is configured with 'authentication violation restrict' which blocks the new user

Question 3

A network administrator wants to implement 802.1X authentication on a switch port that connects a printer. The printer does not support 802.1X, so the administrator configures MAC Authentication Bypass (MAB) as a fallback method. Which command must be included in the switch port configuration to ensure MAB is attempted after 802.1X times out?

Accepted Answer

authentication order dot1x mab. The 'authentication order dot1x mab' command explicitly defines the sequence in which authentication methods are attempted on a switch port. When 802.1X times out (e.g., because the printer does not respond to EAPOL frames), the switch then falls back to MAB. This command ensures MAB is attempted only after 802.1X fails, which matches the requirement.

Answer

authentication priority dot1x mab

Answer

dot1x timeout tx-period 30

Answer

authentication port-control auto

Question 4

An engineer is configuring ISE for guest access via a sponsor portal. The policy requires that a sponsor must approve each guest. However, guests are being automatically approved without sponsor interaction. What is the most likely misconfiguration?

Accepted Answer

The guest portal's 'Access setting' is set to 'Self-Registration' instead of 'Sponsor Approval'. If guests are auto-approved without sponsor interaction, the guest portal's access setting is likely configured for Self-Registration rather than Sponsor Approval. In Cisco ISE, the guest portal's 'Access setting' determines whether guests self-register or require sponsor approval, so this misconfiguration directly explains the symptom.

Answer

The guest portal is not configured to send email notifications to sponsors

Answer

The sponsor user account is assigned to the wrong sponsor group

Answer

The guest endpoint is being profiled as a known device

Question 5

Which TWO are valid methods for determining the SGT (Security Group Tag) assigned to an endpoint in a TrustSec deployment?

Accepted Answer

Static assignment on the network access device (switch) using the 'cts role-based sgt' command. The 'cts role-based sgt' command on a network access device (switch) statically assigns an SGT to an endpoint based on its IP address or MAC address. Option E is correct because ISE can dynamically assign an SGT to an endpoint as part of an authorization policy during authentication, using RADIUS attributes like cisco-av-pair=CTS:SGT=value.

Answer

DNS resolution of the endpoint hostname

Answer

The IP address of the endpoint

Answer

DHCP Option 141

Question 6

Which THREE are characteristics of Cisco ISE profiler service?

Accepted Answer

It can determine the endpoint operating system based on MAC OUI and DHCP fingerprints. Option A is correct because the ISE profiler collects endpoint identity attributes such as MAC OUI (the first 24 bits of the MAC address identifying the hardware vendor) and DHCP fingerprint data (DHCP parameter request list, hostname, and vendor class identifier) to infer the endpoint's operating system. Option B is correct because profiling relies on a mix of active probes (for example, SNMP queries, NetFlow, NMAP scans, and RADIUS probes) and passive probes (for example, DHCP, RADIUS, and HTTP snooping) to gather endpoint attributes. Option C is correct because the attributes discovered by the profiler (such as device type, OS, and manufacturer) are exposed as dictionary attributes that can be referenced in authorization policy conditions and rules. Option D is not correct because posture compliance checking is a separate ISE service that requires the AnyConnect posture module or the ISE posture agent, not the profiler. Option E is not correct because profiling is agentless and works through network-based probes, so no ISE agent must be installed on endpoints.

Answer

It performs posture compliance checking on endpoints

Answer

It requires the installation of an ISE agent on all endpoints

Question 7

Refer to the exhibit. A switch port is configured for 802.1X with MAB. The switch has reached its maximum number of authentication sessions (platform limit). When a new device attempts to connect, what happens?

Accepted Answer

The new device is not authenticated and remains unauthorized. When the switch reaches its platform-specific limit for authentication sessions (e.g., 256 sessions on a Catalyst 3850), no new 802.1X or MAB sessions can be initiated. The new device remains in an unauthorized state (typically in the 'critical' or 'auth-fail' VLAN, or simply blocked) because the switch cannot allocate a new session context. There is no automatic fallback or CoA action to free a session; the port stays in the unauthorized state until an existing session expires or is manually cleared.

Answer

The new device is allowed to pass traffic due to fallback

Answer

The switch sends a CoA to ISE to free up a session

Answer

The port is automatically shut down

Question 8

A network administrator is troubleshooting intermittent authentication failures on a switch port configured for 802.1X with MAB fallback. Users can connect but get dropped after a few minutes. What is the most likely cause?

Accepted Answer

Reauthentication timer set too short. The reauthentication timer on the switch port is set too short, causing the 802.1X session to expire and re-initiate authentication frequently. This results in users being dropped after a few minutes as the port cycles through reauthentication, even though MAB fallback may temporarily allow traffic. The default reauthentication timer is typically 3600 seconds, but if misconfigured to a very low value (e.g., 60 seconds), it will cause periodic disconnections.

Answer

Incorrect VLAN assignment

Answer

Incorrect RADIUS shared secret

Answer

MAB timeout set too low

Question 9

An engineer is deploying Cisco ISE for guest access. The guest portal uses a self-provisioned username and password. To ensure secure credential transmission, which protocol should be enforced on the portal?

Accepted Answer

HTTPS with a valid certificate. HTTPS with a valid certificate ensures that the username and password submitted by the guest are encrypted in transit between the browser and the Cisco ISE portal. This prevents man-in-the-middle attacks and credential sniffing, which is critical for a self-provisioned guest portal where users create their own credentials over an untrusted network.

Answer

DNSSEC

Answer

RADIUS over TLS

Answer

HTTP with redirect to captive portal

Question 10

An administrator needs to ensure that only authorized hosts can connect to a switch port. The port is connected to a single PC. Which 802.1X host mode should be configured?

Accepted Answer

Single-Host. The Single-Host mode (option A) is correct because it allows only one authenticated host per port, which matches the requirement of a single PC connected to the switch port. In this mode, the port is authorized only after a single supplicant successfully completes 802.1X authentication, and no other devices can gain network access through that port, ensuring strict access control.

Answer

Multi-Domain

Answer

Multi-Auth

Answer

Multi-Host

Question 11

A company is deploying Cisco ISE to enforce access policies based on endpoint posture. Endpoints must be compliant before being granted full network access. Which policy type is used to define the compliance requirements?

Accepted Answer

Posture policy. In Cisco ISE, a posture policy defines the compliance conditions an endpoint must satisfy (e.g., antivirus running, OS patches applied) before being granted full access. It is evaluated after authentication and profiling, and its result feeds into the authorization policy that assigns the appropriate authorization profile (full access vs. restricted/quarantine).

Answer

Authentication policy

Answer

Profiling policy

Answer

Authorization policy

Question 12

An engineer notices that the 'show authentication sessions' command on a switch shows a session in 'CRITICAL' state. What does this indicate?

Accepted Answer

The authentication server is unreachable and the port is using the critical VLAN. The 'CRITICAL' state in 'show authentication sessions' indicates that the switch port has lost connectivity to the authentication server (RADIUS) and has fallen back to the configured critical VLAN. This is a failover mechanism defined in IEEE 802.1X and Cisco's critical-auth feature, where the port is placed into a pre-configured VLAN to maintain network access for the host despite the server being unreachable.

Answer

The host is being authenticated via MAB

Answer

The port is administratively down

Answer

The authentication attempt was rejected by the RADIUS server

Question 13

A network administrator wants to centrally manage and enforce access policies for wired and wireless users. Which Cisco product provides this functionality?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco Identity Services Engine (ISE) is the correct answer because it provides centralized policy management for both wired and wireless users through a unified, context-aware platform. ISE uses 802.1X, MAC Authentication Bypass (MAB), and posture assessment to enforce access policies based on user identity, device type, and location, integrating with network devices via RADIUS (RFC 2865) and TACACS+ for authentication, authorization, and accounting (AAA).

Answer

Cisco Prime Infrastructure

Answer

Cisco Adaptive Security Appliance (ASA)

Answer

Cisco Wireless LAN Controller (WLC)

Question 14

During a security incident, an investigator wants to identify all endpoints that communicated with a known malicious IP address within the last 24 hours. Which Cisco tool is best suited for this forensic analysis?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch). Cisco Secure Network Analytics (Stealthwatch) is the correct tool because it provides network-wide visibility and flow-based analytics using NetFlow/IPFIX data. It can retroactively query all historical flow records to identify every endpoint that communicated with a known malicious IP address within a specified time window, making it ideal for forensic analysis.

Answer

Cisco Firepower NGFW

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 15

A network engineer is implementing Cisco TrustSec. Which two components are required to enforce Security Group Access Control List (SGACL) policies? (Choose two)

Accepted Answer

Cisco Catalyst switch with CTS. Option B (Cisco Catalyst switch with CTS) is correct because SGACL enforcement happens on TrustSec-capable network devices that tag traffic with Security Group Tags (SGTs) and apply the SGACL policy to the tagged packets; a Catalyst switch supporting Cisco TrustSec (CTS) is exactly such an enforcement point. Option C (Cisco ISE Policy Service Node) is correct because ISE acts as the policy controller that defines and distributes the SGACL policies (and the SGT-to-SGACL matrix) to the enforcing devices, making it a required component for SGACL policy enforcement. Option A (Cisco Wireless LAN Controller) is not required for SGACL enforcement, as it is an access-layer device that may propagate SGTs but does not itself enforce SGACLs. Option D (Cisco ASA Firewall) is not a required SGACL enforcement component in this scenario, since SGACLs are enforced by TrustSec-capable switches and routers, not by the ASA. Option E (Cisco AnyConnect Secure Mobility Client) is not required for SGACL enforcement, as it is an endpoint VPN/security client and plays no role in enforcing SGACLs on network devices.

Answer

Cisco Wireless LAN Controller

Answer

Cisco ASA Firewall

Answer

Cisco AnyConnect Secure Mobility Client