350-701 Secure Network Access, Visibility and Enforcement — Timed 10 Questions

Question 1

A network administrator is troubleshooting an issue where users in the finance VLAN are unable to access a critical server in the server VLAN. The switch logs show multiple 'Authentication failed' messages for MAC addresses in the finance VLAN. The switchport security feature is enabled on the access ports. What is the most likely cause of the issue?

10 minute time limit — choose an answer to begin.

Accepted Answer

Switchport security violation has caused the ports to error-disable or drop traffic.. The switch logs show 'Authentication failed' messages, which are typically generated by 802.1X or MAC Authentication Bypass (MAB) processes. However, the switchport security feature is enabled on the access ports. When a switchport security violation occurs (e.g., due to an unauthorized MAC address or exceeding the allowed MAC limit), the port can be configured to error-disable (shutdown) or drop traffic (restrict). This action will prevent any traffic from passing, including authentication traffic, leading to connectivity loss. The 'Authentication failed' messages are likely a consequence of the port being in an error-disabled state, causing subsequent authentication attempts to fail. Therefore, the most likely root cause is a switchport security violation that has disabled or restricted the ports.

Answer

The switch ports are configured as trunks and are not allowing the finance VLAN.

Answer

802.1X authentication is failing for the finance users.

Answer

Spanning Tree Protocol (STP) is blocking the ports in the finance VLAN.

Question 2

Which TWO configuration steps are required to implement 802.1X authentication on a Cisco switch for wired clients?

Accepted Answer

Configure AAA authentication using RADIUS. Options D and E are both correct because 802.1X on a Cisco switch requires two mandatory steps: (1) AAA authentication using RADIUS must be configured with the 'aaa authentication dot1x default group radius' command so the switch can forward EAP messages to a RADIUS server; (2) the switchport must be configured in access mode (not trunk) to support single-host 802.1X. Option A (enable dot1x globally) is optional; 'dot1x port-control auto' can be applied per interface without global enablement. Option B (trunk) is incorrect because 802.1X is only supported on access ports. Option C (define RADIUS server) is part of the AAA configuration but is not listed as a separate required step in Cisco's typical multiple-choice framing.

Answer

Enable dot1x globally on the switch

Answer

Set the switchport mode to trunk

Answer

Define the RADIUS server IP and shared secret

Question 3

An organization is deploying Cisco ISE with passive identity mapping from Active Directory. They notice that users are not being correctly identified on the network, and some workstations are appearing with multiple IP addresses. What is the most likely cause?

Accepted Answer

The DHCP server is not configured to forward DHCP packets to ISE.. Passive identity mapping via DHCP requires the DHCP server to forward DHCP packets to ISE. Without this, IP-to-MAC mappings are incomplete. Option A is incorrect because domain join credentials affect ISE-AD communication, not DHCP mapping. Option C is incorrect because the passive identity service must be enabled, but the symptom points to missing DHCP data, not an inactive service. Option D is incorrect because SNMP traps for MAC notification are used for endpoint classification, not passive identity mapping.

Answer

ISE is configured with incorrect Active Directory domain join credentials.

Answer

The ISE node is not configured for passive identity service.

Answer

The network switches are not configured with SNMP traps for MAC notification.

Question 4

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

Accepted Answer

Authorization policy. Authorization policies in Cisco ISE define the access permissions granted to authenticated users, such as allowing or denying network access. In this scenario, after a user authenticates via Active Directory (handled by the authentication policy), the authorization policy evaluates conditions (e.g., AD group membership) to enforce the required access control for the corporate wireless network.

Answer

Profiling policy

Answer

Authentication policy

Answer

Policy set

Question 5

A company uses Cisco ISE for network access control. Users connecting via wired 802.1X are successfully authenticated but cannot reach the internet. The administrator checks the authorization policy and notices that the correct dACL is being applied. What is the most likely cause of the issue?

Accepted Answer

The RADIUS server is not sending the dACL attribute in the Access-Accept. The most likely cause is that the RADIUS server (ISE) is not sending the dACL attribute in the Access-Accept packet. Even though the authorization policy applies a dACL, if the RADIUS message does not include the dACL name (e.g., Cisco-AV-Pair = "ip:inacl#100=...") or the switch does not receive it, the switch cannot enforce the filter, leaving the user authenticated but with no internet access due to default deny-all behavior.

Answer

The switchport is configured as dynamic desirable

Answer

The switch port MTU is set to 1500 bytes

Answer

ISE is out of licenses for endpoint devices

Question 6

An organization is implementing TrustSec to enforce micro-segmentation. The Security Group Tag (SGT) is assigned to a user via ISE after authentication. However, traffic from this user to a server with SGT 5 is being dropped. The administrator checks the SGACL configuration on the switch and finds the following: 'permit ip source 2 destination 5'. What is the most likely reason for the traffic being dropped?

Accepted Answer

SXP is not configured between ISE and the switch. The SGACL entry 'permit ip source 2 destination 5' exists, but traffic from the user to the server with SGT 5 is still being dropped. This is likely because the switch does not know the user's SGT. TrustSec uses SXP to dynamically propagate SGT mappings from ISE to network devices. Without SXP configured between ISE and the switch, the switch cannot map the user's authentication identity to the correct SGT (e.g., SGT 2). As a result, the switch either treats the user as untagged (SGT 0) or drops the traffic due to lack of a matching SGACL entry for the actual SGT pair. Thus, configuring SXP is essential for the switch to enforce SGACLs based on user-assigned SGTs.

Answer

The PAC on the switch has expired

Answer

The CTRL protocol is not enabled on the switch

Answer

The SGACL defaults to deny if no explicit permit is found for the source-destination SGT pair

Question 7

A company is deploying Cisco ISE for guest access. They want to provide a self-service portal where guests can register their devices and receive a temporary username and password. Which ISE component is used to accomplish this?

Accepted Answer

Guest Portal. C is correct because the Guest Portal in Cisco ISE is specifically designed to provide a self-service registration page where guests can create their own accounts, receive temporary credentials, and gain network access. This portal handles the entire guest lifecycle, including sponsor approval if required, and can deliver the username/password via SMS, email, or on-screen display.

Answer

BYOD Portal

Answer

Mobile Device Management (MDM)

Answer

Profiler Service

Question 8

An engineer is troubleshooting a Cisco ISE deployment where some endpoints are not being profiled correctly. The administrator notices that the endpoints are not sending DHCP requests. Which profiling probe should be primarily used to identify these endpoints?

Accepted Answer

NetFlow probe. (NetFlow probe) because when endpoints do not send DHCP requests, the DHCP probe cannot collect any data. The NetFlow probe analyzes network traffic flows to identify endpoints based on IP addresses, ports, and protocols, even without DHCP activity. This allows Cisco ISE to profile endpoints by observing their communication patterns, such as HTTP or DNS traffic, which still occur even if DHCP is not used.

Answer

DHCP probe

Answer

HTTP probe

Answer

DNS probe

Question 9

A network administrator wants to implement 802.1X on a Cisco switch port for a device that does not support 802.1X. Which feature should be configured to allow the device to connect?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) is the correct feature because it allows a device that does not support 802.1X supplicant software to authenticate by using its MAC address as the identity. The switch acts as a proxy, sending the MAC address as the username and password to the RADIUS server, which can then grant or deny access based on the MAC address in its database.

Answer

802.1X with EAP-MSCHAPv2

Answer

Downloadable ACL (dACL)

Answer

Web Authentication (WA)

Question 10

An organization is using Cisco ISE to enforce posture compliance. Endpoints that are non-compliant should be placed into a quarantine VLAN. Which ISE policy component is used to assign the VLAN?

Accepted Answer

Authorization profile. An Authorization Profile in Cisco ISE defines the enforcement actions to be applied to an endpoint after successful authentication and authorization. When a posture assessment determines an endpoint is non-compliant, the authorization policy can match that condition and return an authorization profile that includes a specific VLAN ID (e.g., quarantine VLAN) via RADIUS attributes such as Tunnel-Private-Group-ID (RFC 2868). This VLAN assignment is a core function of the authorization profile, not of authentication or profiling.

Answer

Policy set

Answer

Profiling policy

Answer

Authentication policy