350-701 Secure Network Access, Visibility and Enforcement Practice Test 9 — 15 Questions

Question 1

A network engineer is configuring a Cisco Catalyst switch to enforce 802.1X on a port that connects to an IP phone with a PC daisy-chained behind it. The phone must authenticate first, and then the PC must authenticate separately. Which command sequence correctly enables this behavior on the switch port?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

authentication host-mode multi-domain. The multi-domain host mode is designed for voice and data convergence on a single switch port. It allows one authentication session for the voice domain (typically the IP phone) and a separate session for the data domain (the PC). This provides independent authentication and policy enforcement for each device, which is exactly what the scenario requires.

Answer

authentication host-mode multi-auth

Answer

authentication host-mode single-host

Answer

authentication host-mode multi-host

Question 2

A network security administrator is deploying Cisco TrustSec in a large enterprise. The company wants to assign Security Group Tags (SGTs) to endpoints based on the VLAN they belong to, without requiring 802.1X authentication. Which Cisco TrustSec feature should the administrator use to accomplish this?

Accepted Answer

Static VLAN-to-SGT mapping on the switch. In Cisco TrustSec, static VLAN-to-SGT mapping allows administrators to assign SGTs to endpoints based on their VLAN membership without requiring 802.1X. This is configured on the switch and is useful when dynamic authentication is not feasible. SGACLs enforce policies after tagging, dynamic SGT assignment requires authentication, and SXP propagates mappings but does not assign them.

Answer

Security Group ACLs (SGACLs)

Answer

Dynamic SGT assignment via Cisco ISE

Answer

SGT Exchange Protocol (SXP) listener

Question 3

A network security engineer is configuring TrustSec on Cisco Catalyst switches. The engineer wants to enforce a policy where traffic from the 'Engineering' Security Group (SGT 10) to the 'Finance' Security Group (SGT 20) is denied, while all other inter-group traffic is permitted. The engineer has already configured SGTs and SGACLs on Cisco ISE and downloaded them to the switches. Which additional step is required on the switches to enforce this policy?

Accepted Answer

Enable SGACL enforcement on the switch by configuring 'cts role-based enforcement' globally and on the VLANs.. TrustSec enforcement requires enabling role-based enforcement on the switches, both globally and on the relevant VLANs or interfaces. Even if SGTs and SGACLs are correctly configured on ISE and downloaded, without this step the switch will not apply the SGACLs to traffic. The other options are either authentication mechanisms or visibility features that do not directly enforce the group-based policy.

Answer

Enable IP Device Tracking on all access ports to detect endpoint IP addresses for SGT mapping.

Answer

Configure 802.1X on all access ports to authenticate users and assign SGTs dynamically.

Answer

Configure the switch to use Cisco ISE as the RADIUS server for authentication and authorization.

Question 4

A network administrator is configuring MACsec on a Cisco switch to secure traffic between two switches. The administrator wants to ensure that the MACsec session uses a pre-shared key for authentication. Which MACsec key agreement protocol should be used?

Accepted Answer

MKA (MACsec Key Agreement) with pre-shared key. MACsec on Cisco switches uses the MACsec Key Agreement (MKA) protocol to establish secure sessions. When a pre-shared key is used, the administrator configures a Connectivity Association Key (CAK) and a Connectivity Association Key Name (CKN) on both switches. MKA then negotiates the Secure Association Key (SAK) for encrypting traffic. This method is efficient for switch-to-switch links where a pre-shared key is acceptable and no external authentication server is needed.

Answer

IKEv2 with pre-shared key

Answer

RADIUS with MACsec extensions

Answer

802.1X EAP-TLS with MACsec

Question 5

A security engineer is configuring Cisco ISE to enforce endpoint posture. The requirement is to allow endpoints that have the latest antivirus signature and a specific registry key present. The engineer creates a posture policy with two conditions. However, endpoints that meet only one condition are still being marked compliant. What is the most likely cause?

Accepted Answer

The posture conditions are combined using an OR operator instead of AND.. In Cisco ISE posture policies, multiple conditions within a single policy can be combined with AND or OR. If the policy is set to OR, an endpoint satisfying any one condition is considered compliant. To require both antivirus signature and registry key, the policy must use AND. The other options do not explain why partial compliance results in a compliant status.

Answer

The antivirus condition is not supported by the posture agent.

Answer

The posture policy is assigned to the wrong endpoint group.

Answer

The registry key condition requires a reboot to take effect.

Question 6

A security administrator is deploying Cisco ISE with posture assessment for VPN users. The company uses AnyConnect as the VPN client and ISE for posture policy. After a user connects via VPN, the posture assessment reports the endpoint as non-compliant due to missing antivirus updates. The administrator wants to automatically remediate the endpoint by triggering an antivirus update and then re-assess. Which ISE feature should be configured to achieve this?

Accepted Answer

Configure a posture remediation policy that pushes a remediation action to the AnyConnect client, such as an antivirus update command.. Cisco ISE posture remediation policies allow administrators to define actions that endpoints must take to become compliant. For AnyConnect, remediation can include triggering antivirus updates or other software actions. After remediation, the endpoint is re-assessed. This automates the process and ensures compliance without manual intervention, which is exactly what the administrator needs.

Answer

Use ISE's external RESTful API to trigger a script on the endpoint that updates antivirus and then re-runs posture.

Answer

Configure a posture condition that checks for antivirus version and automatically grants access if the version is within one revision.

Answer

Enable Change of Authorization (CoA) to disconnect the user and force re-authentication after remediation.

Question 7

A security administrator is configuring Cisco ISE to enforce endpoint compliance. The administrator wants to ensure that endpoints without the latest antivirus definitions are denied network access. Which ISE policy element should be used to evaluate the antivirus status?

Accepted Answer

Posture policy. Cisco ISE posture policies are designed to assess the compliance of endpoints against specific conditions, including antivirus definition updates. The posture policy uses posture conditions to check the endpoint's state, and if the condition is not met, the endpoint is marked non-compliant. The authorization policy then uses this result to deny or restrict access. Therefore, the posture policy is the correct element for evaluating antivirus status.

Answer

Authentication policy

Answer

Authorization policy

Answer

Client provisioning policy

Question 8

A network administrator is configuring 802.1X on a Cisco switch. The switch is connected to a Cisco ISE server for authentication. The administrator wants to ensure that if the RADIUS server is unreachable, the switch will place the port in a restricted VLAN instead of denying access. Which command should be configured on the switch port?

Accepted Answer

authentication event server dead action authorize vlan 100. The authentication event server dead action authorize vlan command is used to define fallback behavior when the RADIUS server is unreachable. It allows the switch to place the port into a specific VLAN, ensuring that devices can still gain limited network access. This is commonly used for critical devices that must remain operational even if authentication infrastructure fails.

Answer

authentication event server alive action reinitialize

Answer

authentication event fail action authorize vlan 100

Answer

authentication event no-response action authorize vlan 100

Question 9

A network administrator is deploying Cisco TrustSec in a mixed-vendor environment. Some switches do not support hardware-based SGT tagging. The administrator needs to propagate SGT information to these switches so that they can enforce SGACLs. Which protocol should be used?

Accepted Answer

SGT Exchange Protocol (SXP). SXP is the protocol used to propagate IP-to-SGT mappings to network devices that do not support hardware-based SGT tagging. It enables enforcement of SGACLs on mixed-vendor or older switches by sharing SGT bindings over a TCP connection. RADIUS CoA, CDP, and LLDP do not serve this purpose.

Answer

Cisco Discovery Protocol (CDP)

Answer

RADIUS Change of Authorization (CoA)

Answer

Link Layer Discovery Protocol (LLDP)

Question 10

A security administrator is configuring Cisco ISE to enforce endpoint posture. The policy requires that endpoints must have the latest antivirus definitions and an enabled personal firewall. After a posture assessment, some endpoints are marked as non-compliant but remain in the original VLAN instead of being moved to a remediation VLAN. The administrator has verified that the posture policy conditions are correct and the remediation VLAN is configured. Which action should be taken to ensure non-compliant endpoints are moved to the remediation VLAN?

Accepted Answer

Verify that the switch supports and is configured for Change of Authorization (CoA) and that ISE is sending CoA requests.. For posture-based VLAN assignment to work, ISE must be able to send a Change of Authorization (CoA) to the switch after the posture assessment. The switch must support CoA and be configured to accept it. Without CoA, the endpoint remains in its initial VLAN even if marked non-compliant.

Answer

Configure the switch port to use the 'authentication violation restrict' command.

Answer

Ensure the switch is configured with the 'cisco-av-pair' attribute for VLAN assignment in the authorization profile.

Answer

Configure the posture policy to use the 'quarantine' action instead of 'remediate'.

Question 11

A network administrator is deploying Cisco TrustSec in a data center. The requirement is to assign Security Group Tags (SGTs) to traffic based on the source IP address of the endpoint, without relying on 802.1X or any client software. The administrator plans to use a Cisco Identity Services Engine (ISE) and a Cisco Nexus switch as the enforcement point. Which ISE feature should be used to assign SGTs dynamically based on IP address?

Accepted Answer

IP-to-SGT mapping in ISE. ISE supports IP-to-SGT mapping, which allows SGTs to be assigned to endpoints based on their IP address. This mapping can be distributed to network devices via SXP or directly queried from ISE. This method does not require 802.1X or any client software, making it suitable for the data center scenario where only source IP is available for classification.

Answer

Security Group Access (SGA) with SXP

Answer

802.1X with EAP-TLS

Answer

RADIUS Change of Authorization (CoA) with MAB

Question 12

A security engineer is deploying Cisco TrustSec in a large enterprise. The engineer wants to assign Security Group Tags (SGTs) to endpoints based on user identity and device type, and enforce policies across multiple network devices without using VLANs or ACLs on every device. Which component is responsible for propagating the SGT information to network enforcement devices?

Accepted Answer

Security Group Exchange Protocol (SXP). SXP is specifically designed to propagate IP-to-SGT mappings from devices that have the mapping (like access switches that receive it from ISE) to other devices that need to enforce TrustSec policies but lack direct ISE integration or inline tagging capability. It allows for gradual deployment and interoperability with non-TrustSec hardware. The other options either assign SGTs (ISE), provide context sharing (pxGrid), or are a transport mechanism (inline tagging), but none are the dedicated propagation protocol for SGT mappings.

Answer

Cisco TrustSec inline tagging

Answer

Cisco ISE as the SGT Assignment Authority

Answer

Cisco Platform Exchange Grid (pxGrid)

Question 13

A network administrator is implementing Cisco TrustSec in a campus network. The administrator wants to enforce access policies based on user roles without changing IP addresses or VLANs. Which component of Cisco TrustSec is responsible for tagging packets with Security Group Tags (SGTs)?

Accepted Answer

Ingress Policy Enforcement Point (PEP). In Cisco TrustSec, the ingress Policy Enforcement Point (PEP) tags packets with Security Group Tags (SGTs) based on the source's identity. This tagging allows other devices in the TrustSec domain to enforce policies without needing to re-authenticate the source, enabling scalable role-based access control.

Answer

Security Group Tag Exchange Protocol (SXP)

Answer

Identity Services Engine (ISE)

Answer

Egress Policy Enforcement Point (PEP)

Question 14

A security engineer is configuring Cisco ISE to enforce endpoint posture compliance. The engineer wants to ensure that endpoints without the latest antivirus definitions are denied network access and placed in a remediation VLAN. After configuring the posture policy, the engineer notices that some non-compliant endpoints are still granted full access. The engineer verifies that the posture policy conditions are correct and that the endpoints are being profiled correctly. Which action should the engineer take to resolve this issue?

Accepted Answer

Verify that the posture policy is assigned to the correct authorization policy and that the authorization result for non-compliance is set to the remediation VLAN.. The authorization policy is responsible for enforcing the outcome of posture assessment. Even if posture policies correctly identify non-compliance, the authorization policy must have a rule that matches the non-compliant posture status and assigns the remediation VLAN. Without this, endpoints will fall through to a default permit rule. Therefore, verifying the authorization policy configuration is the correct action.

Answer

Ensure that the endpoint's supplicant is configured to send the posture assessment to ISE and that the posture agent is installed.

Answer

Check that the remediation VLAN is configured on the switch and that the switch port is set to access mode.

Answer

Restart the Cisco ISE posture service to ensure that posture policies are applied correctly.

Question 15

A security administrator is configuring Cisco ISE to monitor endpoints connecting to the network. The goal is to create a report that shows all endpoints that have connected in the past 30 days, including their MAC addresses, IP addresses, and operating systems. Which ISE feature should be used to generate this report?

Accepted Answer

Context Visibility. Context Visibility is the ISE feature that provides endpoint visibility and reporting. It aggregates data from various sources, including profiling, authentication, and accounting, and presents it in dashboards. Administrators can generate reports on endpoints, including historical data, and filter by attributes such as MAC address, IP address, and OS. This meets the requirement for a 30-day endpoint report.

Answer

Profiling Policy

Answer

Endpoint Identity Group

Answer

Live Logs