350-401 802.1X and TrustSec — 10 Questions

Question 1

A network engineer is deploying 802.1X on a Cisco switch for a mixed environment of Windows laptops and IP phones. The engineer configures the switchport with 'authentication port-control auto' and 'dot1x pae authenticator'. After connecting a Windows laptop, the switch logs show 'Authentication failed' for the laptop. The engineer verifies that the RADIUS server is reachable and the laptop's supplicant is configured correctly. What is the most likely cause of the authentication failure?

Accepted Answer

The switch is not configured to send EAP-Request/Identity packets; the 'dot1x timeout tx-period' is too long or missing.. The scenario describes a common issue where 802.1X is configured but the switch is not sending EAP requests because it is waiting for a trigger. Without 'dot1x timeout tx-period', the switch sends EAP-Request/Identity only once every 30 seconds by default. The laptop's supplicant may not initiate the process if it doesn't receive a prompt. Option B is correct because the switch must be configured to send EAP requests to start the authentication. Option A is incorrect because 'aaa new-model' is required for AAA but not the direct cause of the failure. Option C is incorrect because the switchport mode is not specified; 'switchport mode access' is typical but not the issue. Option D is incorrect because the RADIUS server is reachable per the engineer's verification.

Answer

The switch lacks 'aaa new-model' configuration.

Answer

The switchport is configured as 'switchport mode trunk' instead of 'switchport mode access'.

Answer

The RADIUS server is not configured with the correct shared secret.

Question 2

An enterprise is implementing Cisco TrustSec (CTS) to enforce role-based access control. The network engineer configures the switch with 'cts role-based enforcement' and 'cts manual' on an interface connecting to a trusted Cisco switch. The engineer also configures Security Group Tags (SGTs) on the RADIUS server. However, traffic between two hosts in different SGTs is not being filtered as expected. The engineer checks 'show cts role-based counters' and sees no drops. What is the most likely reason for the lack of enforcement?

Accepted Answer

The SGTs are not being propagated to the switch; the switch lacks SGT mappings for the hosts.. CTS role-based enforcement requires SGTs to be assigned to packets. If the switch does not have SGT information for the source or destination, it cannot enforce policies. Option C is correct because without SGTs, the switch treats traffic as untagged and does not apply SGACLs. Option A is incorrect because CTS does not require 802.1X; it can use manual or SXP. Option B is incorrect because 'cts manual' is a valid configuration for trusted interfaces. Option D is incorrect because 'show cts role-based counters' shows drops only if enforcement is active; no drops indicate no enforcement.

Answer

The switch is not configured for 802.1X on the interface.

Answer

The 'cts manual' command is incorrect; 'cts dot1x' should be used instead.

Answer

The 'show cts role-based counters' command shows no drops, indicating the ACLs are not configured.

Question 3

A network engineer is configuring 802.1X on a Cisco Catalyst 9300 switch for a wired network. The engineer wants to allow devices that do not support 802.1X (e.g., printers) to still access the network using MAB (MAC Authentication Bypass). The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'mab'. However, after connecting a printer, the switch logs show 'MAB failed' repeatedly. The printer's MAC address is in the RADIUS server database. What is the most likely cause?

Accepted Answer

The RADIUS server is not configured to accept MAC addresses in the format sent by the switch (e.g., with dots or colons).. MAB requires the switch to send a MAC address as the username and password. If the RADIUS server does not accept the format, authentication fails. Option A is correct because the RADIUS server must be configured to accept MAC addresses in the format sent by the switch (e.g., 'aaaa.bbbb.cccc'). Option B is incorrect because MAB does not require EAP. Option C is incorrect because the switchport mode does not affect MAB. Option D is incorrect because the printer does not support 802.1X, so it cannot respond to EAP.

Answer

The switch is not configured with 'dot1x timeout tx-period' to initiate MAB.

Answer

The interface is configured as 'switchport mode trunk', which does not support MAB.

Answer

The printer is not responding to EAP-Request/Identity packets.

Question 4

A network engineer is deploying Cisco TrustSec (CTS) with Security Group Access Control Lists (SGACLs) on a campus network. The engineer configures the switch with 'cts role-based enforcement' and assigns SGTs to users via 802.1X. The engineer tests connectivity between a user in SGT 10 and a server in SGT 20. The SGACL permits traffic from SGT 10 to SGT 20, but the user cannot reach the server. The engineer checks 'show cts role-based sgt map' and sees that the user's SGT is 0. What is the most likely cause?

Accepted Answer

The RADIUS server is not configured to send the SGT in the Access-Accept message.. SGT 0 is the default untagged SGT. If the user's SGT is 0, it means the switch did not receive the SGT from the RADIUS server during 802.1X authentication. Option A is correct because the RADIUS server must send the SGT in the Access-Accept message. Option B is incorrect because SGACLs are applied per SGT, not per interface. Option C is incorrect because the switch is configured for enforcement. Option D is incorrect because SGT 0 is not a valid SGT for enforcement; the switch treats it as untagged.

Answer

The SGACL is applied to the wrong interface.

Answer

The switch is not configured with 'cts role-based enforcement'.

Answer

The user's SGT is 0, which is a valid SGT that denies all traffic.

Question 5

An organization is implementing 802.1X for wireless users using Cisco ISE as the RADIUS server. The network engineer configures the wireless LAN controller (WLC) with 802.1X authentication. Users report that they can connect to the SSID but cannot access any network resources. The engineer checks the WLC and sees that users are authenticated and assigned to VLAN 100. The engineer also checks the switchport connecting the WLC and sees it is a trunk. What is the most likely issue?

Accepted Answer

The switch trunk port does not have VLAN 100 allowed.. When using 802.1X with WLC, the WLC typically uses VLAN tagging. If the WLC is configured to tag traffic from the SSID with a specific VLAN, the switch trunk must allow that VLAN. Option B is correct because if VLAN 100 is not allowed on the trunk, traffic will be dropped. Option A is incorrect because the users are authenticated, so the RADIUS server is working. Option C is incorrect because the WLC does not need 802.1X on the uplink. Option D is incorrect because the WLC does not use MAB for wireless.

Answer

The RADIUS server is not sending the correct VLAN ID in the Access-Accept.

Answer

The WLC is not configured for 802.1X on the uplink to the switch.

Answer

The users' devices are not configured for MAB.

Question 6

A network engineer is configuring 802.1X on a Cisco switch for a voice VLAN deployment. The switchport is connected to an IP phone, which then connects to a PC. The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'switchport voice vlan 10'. The PC authenticates successfully, but the IP phone does not get an IP address from the voice VLAN. The engineer verifies that the phone is configured for 802.1X and the RADIUS server is correct. What is the most likely cause?

Accepted Answer

The IP phone does not support 802.1X and is not configured for MAB.. In a voice VLAN deployment, the switch must be configured to authenticate the phone separately from the PC. The phone typically uses 802.1X or MAB. If the phone does not authenticate, it may be placed in the data VLAN or denied. Option C is correct because the phone must authenticate to be placed in the voice VLAN. Option A is incorrect because the phone can use MAB. Option B is incorrect because the voice VLAN is configured. Option D is incorrect because the PC's authentication does not affect the phone's VLAN.

Answer

The switchport is missing 'switchport mode access' command.

Answer

The RADIUS server is not sending the voice VLAN ID in the Access-Accept.

Answer

The PC is using the voice VLAN instead of the data VLAN.

Question 7

A network engineer is implementing Cisco TrustSec (CTS) with Security Group Tags (SGTs) using SXP (SGT Exchange Protocol). The engineer configures the switch as an SXP speaker and the Cisco ISE as an SXP listener. The engineer verifies that SXP peers are established. However, when the engineer checks 'show cts role-based sgt map', the SGT mappings for users are not present. What is the most likely cause?

Accepted Answer

The switch is not configured to assign SGTs to users via 802.1X or static mapping.. SXP propagates SGTs from a speaker to a listener. If the switch is the speaker, it must have SGT mappings from authentication. If the switch does not have the mappings, it cannot propagate them. Option B is correct because the switch must first learn SGTs via 802.1X or manual configuration. Option A is incorrect because SXP does not require a specific version. Option C is incorrect because the listener is ISE, which is correct. Option D is incorrect because the peers are established.

Answer

The SXP version mismatch between the switch and ISE.

Answer

The ISE is configured as an SXP speaker instead of a listener.

Answer

The SXP connection is using the wrong TCP port.

Question 8

A network engineer is configuring 802.1X on a Cisco switch for a guest network. The engineer wants to allow guests to access the internet after authentication but restrict access to internal resources. The engineer configures the switch with 'authentication port-control auto' and a downloadable ACL (dACL) from the RADIUS server. After a guest authenticates, the engineer tests connectivity and finds that the guest can access internal servers. What is the most likely cause?

Accepted Answer

The RADIUS server is not sending the dACL attributes in the Access-Accept message.. dACLs are applied to the port after authentication to filter traffic. If the dACL is not applied, the guest may have full access. Option D is correct because the RADIUS server must send the dACL name or attributes. Option A is incorrect because the switchport mode does not affect dACL application. Option B is incorrect because the guest is authenticated. Option C is incorrect because the switch does not need a local ACL.

Answer

The switchport is configured as 'switchport mode trunk', which does not support dACLs.

Answer

The guest is not being authenticated; the switch is using MAB instead.

Answer

The switch is not configured with 'ip access-group' to apply the dACL.

Question 9

A network engineer is deploying 802.1X with Cisco ISE for a wired network. The engineer wants to use CoA (Change of Authorization) to dynamically change the VLAN of a user after authentication. The engineer configures the switch with 'aaa server radius dynamic-author' and the ISE with CoA settings. When the engineer tests CoA from ISE, the switch logs show 'CoA request received' but the VLAN does not change. What is the most likely cause?

Accepted Answer

The switch is missing the 'authentication command bounce-port' or 'authentication command disable-port' configuration.. CoA requires the switch to accept and process the request. The switch must have the 'authentication command bounce-port' or 'authentication command disable-port' configured to apply changes. Option B is correct because without this, the switch may acknowledge but not act. Option A is incorrect because the switch received the request. Option C is incorrect because the RADIUS server is reachable. Option D is incorrect because the switchport mode does not prevent CoA.

Answer

The ISE is not configured with the correct shared secret for CoA.

Answer

The switch is not configured with 'dot1x pae authenticator' on the interface.

Answer

The switchport is configured as 'switchport mode trunk', which does not support VLAN changes via CoA.

Question 10

A network engineer runs the following command on switch SW1:

SW1# show authentication sessions interface GigabitEthernet1/0/1

Interface: GigabitEthernet1/0/1
MAC Address: 0011.2233.4455
IP Address: 192.168.1.100
Status: Authz Success
Domain: DATA
Oper host mode: multi-auth
Oper control dir: both
Session timeout: N/A
Common Session ID: 0A1B2C3D4E5F6G7H8I9J
Acct Session ID: 0x0000000A
Handle: 0x00000001

Current Method List: mab
Method: MAB
State: Authz Success

Based on this output, what can be concluded?

Accepted Answer

The client was authenticated based on its MAC address via MAB.. The output shows the session status as 'Authz Success' and the method used is MAB (MAC Authentication Bypass). The host mode is multi-auth, meaning multiple devices can authenticate on the same port. The domain is DATA, indicating the session is for data traffic, not voice.

Answer

The client authenticated using 802.1X with a username and password.

Answer

The port is in multi-domain mode, allowing one data and one voice device.

Answer

The session is for voice traffic because the domain is DATA.