350-701 Secure Network Access, Visibility and Enforcement Practice Test 8 — 15 Questions

Question 1

A network engineer configures ISE for 802.1X with PEAP-MSCHAPv2. Users report intermittent authentication failures on certain switches. The engineer checks ISE logs and sees 'Authentication failed' with reason 'User not found in identity store'. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user is not in the Active Directory group that ISE is configured to query.. The error 'User not found in identity store' indicates that ISE queried its configured identity sources (e.g., Active Directory) and could not locate the user account. Since PEAP-MSCHAPv2 authenticates users against a backend identity store (not certificates), the most likely cause is that the user is not a member of the specific AD group that ISE is configured to query, or the user object does not exist in the joined domain. This is a common misconfiguration when ISE uses group-based filtering or restricted identity stores.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The switch is not configured with the correct shared secret.

Answer

The user's certificate is expired.

Question 2

Which protocol does Cisco ISE use to communicate with the pxGrid controller for sharing contextual data?

Accepted Answer

JSON-RPC over certificate-based TLS. Cisco ISE uses the JSON-RPC protocol over certificate-based TLS to communicate with the pxGrid controller for sharing contextual data. This ensures encrypted, authenticated, and structured messaging between ISE and other pxGrid-enabled services, such as Cisco Threat Response or third-party integrations.

Answer

REST API over HTTPS

Answer

TACACS+

Answer

RADIUS

Question 3

You are troubleshooting a Cisco ISE deployment where some endpoints are stuck in the 'Not Compliant' posture after a posture scan. ISE logs show 'Conditional NAC Agent result: Not Compliant due to missing required application.' The application is installed on the endpoint. What should you check?

Accepted Answer

The posture policy requires a specific version that is not installed.. The error 'Not Compliant due to missing required application' despite the application being installed suggests that the posture policy is checking for a specific version of the application that is not present. ISE posture policies can require a minimum version or exact version, and if the installed version does not match, the endpoint is marked non-compliant.

Answer

The NAC Agent is running an outdated version.

Answer

The endpoint's firewall is blocking the ISE posture probe.

Answer

The antivirus definition file is outdated.

Question 4

Which Cisco security product provides network visibility and traffic analytics using NetFlow and IPFIX?

Accepted Answer

Cisco Stealthwatch. Cisco Stealthwatch is the network visibility and traffic analytics product that uses NetFlow and IPFIX to monitor network traffic, detect anomalies, and provide security intelligence. It collects flow data from routers and switches to build a comprehensive view of network behavior. This matches the requirement exactly.

Answer

Cisco Firepower Management Center

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 5

In a Cisco TrustSec deployment, you want to dynamically assign SGTs based on user authentication. Which mechanism should you use?

Accepted Answer

CTS identity-based networking (IBNS) with RADIUS CoA. Cisco TrustSec uses IBNS (Identity-Based Networking Services) with 802.1X or MAB authentication to identify users, and the RADIUS server (ISE) returns the SGT as a RADIUS attribute (cisco-av-pair) in the Access-Accept. When a user's authorization changes, RADIUS Change of Authorization (CoA, RFC 5176) dynamically pushes a new SGT to the switch port without requiring re-authentication. This is the only mechanism listed that ties user authentication directly to dynamic SGT assignment.

Answer

CTS SXP

Answer

CTS RBACL

Answer

CTS device classification

Question 6

Which TWO are common causes for CoA (Change of Authorization) failures in a Cisco ISE deployment? (Choose two.)

Accepted Answer

The switch does not support the CoA protocol.. Option A is correct because CoA requires the NAD (switch) to support the CoA protocol (RFC 5176, typically implemented as RADIUS Disconnect or CoA-Request messages); if the switch does not support CoA, ISE cannot send the Change of Authorization packet and the reauthentication/remediation action fails. Option C is correct because CoA messages are RADIUS packets that must be authenticated with the same shared secret configured between ISE and the switch; a mismatched RADIUS shared secret causes the switch to silently discard or reject the CoA-Request, resulting in CoA failure. Option B is not required — CoA is a normal RADIUS packet routed over IP, so ISE and the switch do not need to be in the same subnet as long as IP reachability and the correct RADIUS/CoA ports (UDP 3799 for CoA) are open. Option D is incorrect because 'authentication periodic' (via RADIUS reauthentication timers) actually enables periodic reauthentication and does not cause CoA failures; it is a valid configuration. Option E is incorrect because a wireless controller proxying RADIUS is a normal deployment model and does not inherently cause CoA failures, provided the WLC supports and forwards CoA to the correct AP/client.

Answer

The ISE node serving the CoA is not in the same subnet as the switch.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The endpoint is connected through a wireless controller that proxies RADIUS.

Question 7

A company uses Cisco ISE for network access control. They have deployed TrustSec and want to enforce segmentation using Security Group Tags (SGTs). The network team reports that SGTs are not being propagated correctly. Which protocol is responsible for SGT propagation between switches?

Accepted Answer

SXP. SXP (SGT Exchange Protocol) is responsible for propagating Security Group Tags (SGTs) between network devices, especially when hardware does not support native inline tagging. It carries SGT-to-IP mappings over TCP port 64999, allowing enforcement devices to learn tag assignments. This makes SXP the correct answer for SGT propagation between switches.

Answer

NETCONF

Answer

RADIUS

Answer

CDP

Question 8

The ISE logs show 'Authentication failed - RADIUS attribute Calling-Station-ID is missing' for a wired client. What is the most likely cause?

Accepted Answer

The switch is not configured to include the calling-station-id in RADIUS requests.. The RADIUS Access-Request must include the Calling-Station-ID attribute (attribute 31) so ISE can identify the endpoint's MAC address for MAB or policy evaluation. If the switch does not send it, ISE logs the missing-attribute error and authentication fails. The fix is to configure the switch to include calling-station-id in RADIUS requests.

Answer

The switch is configured with 'authentication mac-move deny'.

Answer

The switch port is configured as a trunk port.

Answer

The client's MAC address is not registered in ISE.

Question 9

A company uses Cisco ISE for posture assessment. They require that all endpoints meet a certain set of compliance rules before being granted network access. Which service is responsible for performing the posture assessment on the endpoint?

Accepted Answer

Cisco AnyConnect ISE Posture Module. The Cisco AnyConnect ISE Posture Module is the client-side software agent installed on the endpoint that performs the actual posture assessment. It collects compliance information such as OS patch level, antivirus status, and running processes, then reports this data to the ISE Policy Service for evaluation. Without this module running on the endpoint, ISE cannot perform a posture check.

Answer

ISE Policy Service

Answer

Cisco ISE pxGrid

Answer

Network Access Device (switch)

Question 10

An organization is deploying Cisco TrustSec and uses SXP to propagate SGTs between routers that do not support SGT inline tagging. The SXP connection is established, but the SGT mappings are not being learned. The administrator checks 'show sxp connections' and sees the connection is in 'On' state. What is the most likely issue?

Accepted Answer

The SXP speaker and listener are both configured as listener.. In SXP, one side must act as a speaker and the other as a listener for SGT mappings to be exchanged. If both are configured as listeners, the connection can still reach the 'On' state, but no mappings are propagated because neither side is sending. Option A is incorrect because an unreachable source IP would prevent the connection from establishing, and the state would not be 'On'. Option B is incorrect because the hold-down timer affects the removal of stale mappings after a connection loss, not the initial learning of mappings. Option D is incorrect because an incorrect password would also prevent the connection from reaching the 'On' state.

Answer

The SXP source IP is not reachable.

Answer

The SXP hold-down timer expires too quickly.

Answer

The SXP password is incorrect.

Question 11

A network engineer is troubleshooting an 802.1X deployment where some Windows 10 endpoints fail to authenticate. Logs show that the client sends an EAPoL-Start but never receives an EAP-Request/Identity. The switch port configuration is:
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
Which additional command is most likely needed?

Accepted Answer

dot1x system-auth-control. The command dot1x system-auth-control is a global configuration command that enables 802.1X authentication on the switch. Without it, the per-interface dot1x pae authenticator and authentication port-control auto commands have no effect because the 802.1X process is not globally enabled. This is why the client sends EAPoL-Start but the switch never responds with EAP-Request/Identity.

Answer

dot1x reauthentication

Answer

spanning-tree portfast

Answer

dot1x timeout tx-period 3

Question 12

A large enterprise uses Cisco ISE with pxGrid to share context with Firepower for threat containment. When a Firepower detects an infected endpoint, it triggers a pxGrid quarantine action that changes the endpoint's authorization profile. The engineer observes that the quarantine is applied, but after the Firepower clears the threat, the endpoint does not regain its original access. What is the most likely reason?

Accepted Answer

The ISE session is not forced to reauthenticate after quarantine release. When Firepower clears a threat and sends a clearance message to ISE via pxGrid, ISE may update the endpoint's authorization policy but does not automatically force the existing session to reauthenticate. The endpoint remains in the quarantine state because the network access device (NAD) still has the old session attributes. To restore original access, a Change of Authorization (CoA) must be sent to the NAD to trigger reauthentication. Option B correctly identifies that the session is not forced to reauthenticate after quarantine release. Option A is incorrect because Firepower does send the clearance message. Option C is incorrect because the NAD accepted the quarantine CoA, indicating CoA support. Option D is incorrect because the authorization policy order is not the issue; the problem is the lack of reauthentication.

Answer

Firepower failed to send the clearance message to ISE

Answer

The network access device does not support CoA

Answer

ISE authorization policy is not ordered correctly

Question 13

A university is implementing 802.1X for student wireless networks using Cisco Wireless LAN Controllers (WLCs) and ISE. Students connect with their personal devices using PEAP-MSCHAPv2. During heavy usage, some students report authentication failures and sporadic disconnections. The network team examines the ISE live logs and sees many 'Authentication failed' entries with reason 'Internal error - unable to find a suitable proxy target'. The team has configured two ISE nodes as authentication proxies for the wireless subnets. What is the most likely cause of this issue?

Accepted Answer

The proxy target rules in ISE do not match the WLC's NAS-IP-Address. The error 'Internal error - unable to find a suitable proxy target' indicates that ISE could not match the incoming RADIUS request to a configured proxy target rule. Proxy target rules are based on attributes like NAS-IP-Address, and if the WLC's NAS-IP-Address does not match any rule, ISE cannot forward the request to the correct authentication node. Thus, the most likely cause is that the proxy target rules do not match the WLC's NAS-IP-Address.

Answer

The WLC is not configured to use the ISE proxy nodes as RADIUS servers

Answer

The RADIUS shared secret is mismatched between WLC and ISE

Answer

ISE node CPU is overloaded due to high authentication load

Question 14

A multinational corporation is implementing ISE for wired network access using 802.1X with EAP-TLS certificate authentication. Their Windows 10 laptops have certificates issued by an internal PKI. During testing, some users report that they are repeatedly prompted to select a certificate after connecting, and eventually authentication fails. ISE logs show 'Authentication failed - No matching certificate found'. The engineer checks the client machine and sees multiple certificates, including the correct one, in the personal store. The ISE endpoint identity store is populated with the user's AD credentials. What is the most likely cause of this failure?

Accepted Answer

The client certificates lack the 'Client Authentication' extended key usage (EKU). The most likely cause is that the client certificates lack the 'Client Authentication' extended key usage (EKU). For EAP-TLS, the client certificate must have the Client Authentication EKU to be used for authentication. If it's missing, the Windows supplicant will not select the certificate, and ISE will reject it with 'No matching certificate found'. Even if the certificate is in the personal store, it won't be used without the correct EKU.

Answer

The client's certificate is expired

Answer

The Windows supplicant requires a registry modification to enable auto-selection

Answer

ISE trusted CA certificate list does not include the issuing CA

Question 15

A Cisco TrustSec deployment is being implemented to enforce micro-segmentation. The security team needs to ensure that Security Group Tags (SGTs) are propagated across the network. Which THREE methods can be used to distribute SGT information in a TrustSec environment? (Choose three.)

Accepted Answer

SGT over SXP (SGT Exchange Protocol). Option A (SGT over SXP) is correct because the SGT Exchange Protocol is a dedicated TCP-based protocol (default port 64999) used to propagate IP-to-SGT bindings between TrustSec-capable devices and non-TrustSec devices or across network boundaries where inline tagging is not supported. Option C (SGT over VXLAN) is correct because in VXLAN-based fabrics, the Group Policy Option (GPO) flag allows the SGT to be carried in the VXLAN header (Group Policy ID field), enabling tag propagation across the overlay. Option D (SGT inline tagging in the Ethernet header) is correct because native TrustSec inline tagging inserts the 16-bit SGT into the Cisco Metadata (CMD) field of the Layer 2 Ethernet frame, allowing hop-by-hop propagation between TrustSec-capable hardware. Option B is incorrect because CDP is a Layer 2 discovery protocol used for neighbor information and does not carry SGT values. Option E is incorrect because MPLS does not natively transport SGTs; TrustSec tagging relies on Ethernet inline tagging, SXP, or VXLAN GPO rather than MPLS label fields.

Answer

SGT over Cisco Discovery Protocol (CDP)

Answer

SGT over MPLS