How should I use these 802.1X and TrustSec practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just 802.1X and TrustSec questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the 802.1X and TrustSec domain.

350-401 · topic practice

802.1X and TrustSec practice questions

Practise ENCOR 350-401 802.1X and TrustSec practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: 802.1X and TrustSec

Practice 10 questions Browse domain →

What the exam tests

What to know about 802.1X and TrustSec

802.1X and TrustSec questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common 802.1X and TrustSec exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

802.1X and TrustSec questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Study the full AAA explanation →

A network engineer is deploying 802.1X on a Cisco switch for a mixed environment of Windows laptops and IP phones. The engineer configures the switchport with 'authentication port-control auto' and 'dot1x pae authenticator'. After connecting a Windows laptop, the switch logs show 'Authentication failed' for the laptop. The engineer verifies that the RADIUS server is reachable and the laptop's supplicant is configured correctly. What is the most likely cause of the authentication failure?

Trap 1: The switch lacks 'aaa new-model' configuration.

Incorrect because AAA is needed for RADIUS authentication, but the RADIUS server is reachable, so AAA is likely configured.

Trap 2: The switchport is configured as 'switchport mode trunk' instead of…

Incorrect because 802.1X can work on trunk ports, and the issue is authentication failure, not VLAN mismatch.

Trap 3: The RADIUS server is not configured with the correct shared secret.

Incorrect because the engineer verified the RADIUS server is reachable, and shared secret issues would cause different errors.

Study all 802.1X and TrustSec common traps →

A
The switch lacks 'aaa new-model' configuration.
Why wrong: Incorrect because AAA is needed for RADIUS authentication, but the RADIUS server is reachable, so AAA is likely configured.
B
The switch is not configured to send EAP-Request/Identity packets; the 'dot1x timeout tx-period' is too long or missing.
Correct because without proper EAP initiation, the supplicant may not respond, leading to authentication failure.
C
The switchport is configured as 'switchport mode trunk' instead of 'switchport mode access'.
Why wrong: Incorrect because 802.1X can work on trunk ports, and the issue is authentication failure, not VLAN mismatch.
D
The RADIUS server is not configured with the correct shared secret.
Why wrong: Incorrect because the engineer verified the RADIUS server is reachable, and shared secret issues would cause different errors.

Full breakdown with real-world context →

Question 2hardmultiple choice

Study the full AAA explanation →

An enterprise is implementing Cisco TrustSec (CTS) to enforce role-based access control. The network engineer configures the switch with 'cts role-based enforcement' and 'cts manual' on an interface connecting to a trusted Cisco switch. The engineer also configures Security Group Tags (SGTs) on the RADIUS server. However, traffic between two hosts in different SGTs is not being filtered as expected. The engineer checks 'show cts role-based counters' and sees no drops. What is the most likely reason for the lack of enforcement?

Trap 1: The switch is not configured for 802.1X on the interface.

Incorrect because CTS can work with manual SGT assignment without 802.1X.

Trap 2: The 'cts manual' command is incorrect; 'cts dot1x' should be used…

Incorrect because 'cts manual' is valid for trusted interfaces where SGTs are manually assigned.

Trap 3: The 'show cts role-based counters' command shows no drops,…

Incorrect because no drops can also mean enforcement is not active; the command does not show ACL configuration.

Study all 802.1X and TrustSec common traps →

A
The switch is not configured for 802.1X on the interface.
Why wrong: Incorrect because CTS can work with manual SGT assignment without 802.1X.
B
The 'cts manual' command is incorrect; 'cts dot1x' should be used instead.
Why wrong: Incorrect because 'cts manual' is valid for trusted interfaces where SGTs are manually assigned.
C
The SGTs are not being propagated to the switch; the switch lacks SGT mappings for the hosts.
Correct because without SGTs, the switch cannot enforce role-based policies.
D
The 'show cts role-based counters' command shows no drops, indicating the ACLs are not configured.
Why wrong: Incorrect because no drops can also mean enforcement is not active; the command does not show ACL configuration.

Full breakdown with real-world context →

Question 3mediummultiple choice

Study the full AAA explanation →

A network engineer is configuring 802.1X on a Cisco Catalyst 9300 switch for a wired network. The engineer wants to allow devices that do not support 802.1X (e.g., printers) to still access the network using MAB (MAC Authentication Bypass). The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'mab'. However, after connecting a printer, the switch logs show 'MAB failed' repeatedly. The printer's MAC address is in the RADIUS server database. What is the most likely cause?

Trap 1: The switch is not configured with 'dot1x timeout tx-period' to…

Incorrect because MAB is initiated by the switch after 802.1X times out; no separate timer is needed for MAB.

Trap 2: The interface is configured as 'switchport mode trunk', which does…

Incorrect because MAB works on trunk ports as well.

Trap 3: The printer is not responding to EAP-Request/Identity packets.

Incorrect because MAB is used for non-802.1X devices; the switch does not expect EAP responses.

Study all 802.1X and TrustSec common traps →

A
The RADIUS server is not configured to accept MAC addresses in the format sent by the switch (e.g., with dots or colons).
Correct because MAB uses the MAC address as credentials; format mismatch causes failure.
B
The switch is not configured with 'dot1x timeout tx-period' to initiate MAB.
Why wrong: Incorrect because MAB is initiated by the switch after 802.1X times out; no separate timer is needed for MAB.
C
The interface is configured as 'switchport mode trunk', which does not support MAB.
Why wrong: Incorrect because MAB works on trunk ports as well.
D
The printer is not responding to EAP-Request/Identity packets.
Why wrong: Incorrect because MAB is used for non-802.1X devices; the switch does not expect EAP responses.

Full breakdown with real-world context →

Question 4hardmultiple choice

Study the full ACL explanation →

A network engineer is deploying Cisco TrustSec (CTS) with Security Group Access Control Lists (SGACLs) on a campus network. The engineer configures the switch with 'cts role-based enforcement' and assigns SGTs to users via 802.1X. The engineer tests connectivity between a user in SGT 10 and a server in SGT 20. The SGACL permits traffic from SGT 10 to SGT 20, but the user cannot reach the server. The engineer checks 'show cts role-based sgt map' and sees that the user's SGT is 0. What is the most likely cause?

Trap 1: The SGACL is applied to the wrong interface.

Incorrect because SGACLs are role-based, not interface-based.

Trap 2: The switch is not configured with 'cts role-based enforcement'.

Incorrect because the engineer configured it, and the command is present.

Trap 3: The user's SGT is 0, which is a valid SGT that denies all traffic.

Incorrect because SGT 0 means no SGT assigned; it does not deny all traffic by default.

Study all 802.1X and TrustSec common traps →

A
The RADIUS server is not configured to send the SGT in the Access-Accept message.
Correct because the SGT must be assigned by the RADIUS server during authentication.
B
The SGACL is applied to the wrong interface.
Why wrong: Incorrect because SGACLs are role-based, not interface-based.
C
The switch is not configured with 'cts role-based enforcement'.
Why wrong: Incorrect because the engineer configured it, and the command is present.
D
The user's SGT is 0, which is a valid SGT that denies all traffic.
Why wrong: Incorrect because SGT 0 means no SGT assigned; it does not deny all traffic by default.

Full breakdown with real-world context →

Question 5mediummultiple choice

Open the full VLAN trunking answer →

An organization is implementing 802.1X for wireless users using Cisco ISE as the RADIUS server. The network engineer configures the wireless LAN controller (WLC) with 802.1X authentication. Users report that they can connect to the SSID but cannot access any network resources. The engineer checks the WLC and sees that users are authenticated and assigned to VLAN 100. The engineer also checks the switchport connecting the WLC and sees it is a trunk. What is the most likely issue?

Trap 1: The RADIUS server is not sending the correct VLAN ID in the…

Incorrect because users are assigned to VLAN 100, so the RADIUS server is sending the VLAN.

Trap 2: The WLC is not configured for 802.1X on the uplink to the switch.

Incorrect because the WLC uplink is typically a trunk, not an 802.1X port.

Trap 3: The users' devices are not configured for MAB.

Incorrect because wireless 802.1X does not use MAB.

Study all 802.1X and TrustSec common traps →

A
The RADIUS server is not sending the correct VLAN ID in the Access-Accept.
Why wrong: Incorrect because users are assigned to VLAN 100, so the RADIUS server is sending the VLAN.
B
The switch trunk port does not have VLAN 100 allowed.
Correct because the WLC sends tagged traffic on VLAN 100, and the trunk must permit it.
C
The WLC is not configured for 802.1X on the uplink to the switch.
Why wrong: Incorrect because the WLC uplink is typically a trunk, not an 802.1X port.
D
The users' devices are not configured for MAB.
Why wrong: Incorrect because wireless 802.1X does not use MAB.

Full breakdown with real-world context →

Question 6mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is configuring 802.1X on a Cisco switch for a voice VLAN deployment. The switchport is connected to an IP phone, which then connects to a PC. The engineer configures the interface with 'authentication port-control auto', 'dot1x pae authenticator', and 'switchport voice vlan 10'. The PC authenticates successfully, but the IP phone does not get an IP address from the voice VLAN. The engineer verifies that the phone is configured for 802.1X and the RADIUS server is correct. What is the most likely cause?

Trap 1: The switchport is missing 'switchport mode access' command.

Incorrect because the voice VLAN can work with access or trunk ports.

Trap 2: The RADIUS server is not sending the voice VLAN ID in the…

Incorrect because the voice VLAN is configured locally on the switch; RADIUS can override it but is not required.

Trap 3: The PC is using the voice VLAN instead of the data VLAN.

Incorrect because the PC authenticates separately and should be in the data VLAN.

Study all 802.1X and TrustSec common traps →

A
The IP phone does not support 802.1X and is not configured for MAB.
Correct because the phone must authenticate to be placed in the voice VLAN; if it fails, it may not get the voice VLAN.
B
The switchport is missing 'switchport mode access' command.
Why wrong: Incorrect because the voice VLAN can work with access or trunk ports.
C
The RADIUS server is not sending the voice VLAN ID in the Access-Accept.
Why wrong: Incorrect because the voice VLAN is configured locally on the switch; RADIUS can override it but is not required.
D
The PC is using the voice VLAN instead of the data VLAN.
Why wrong: Incorrect because the PC authenticates separately and should be in the data VLAN.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer is implementing Cisco TrustSec (CTS) with Security Group Tags (SGTs) using SXP (SGT Exchange Protocol). The engineer configures the switch as an SXP speaker and the Cisco ISE as an SXP listener. The engineer verifies that SXP peers are established. However, when the engineer checks 'show cts role-based sgt map', the SGT mappings for users are not present. What is the most likely cause?

Trap 1: The SXP version mismatch between the switch and ISE.

Incorrect because SXP versions are backward compatible, and peers are established.

Trap 2: The ISE is configured as an SXP speaker instead of a listener.

Incorrect because the engineer configured the switch as speaker and ISE as listener, which is valid.

Trap 3: The SXP connection is using the wrong TCP port.

Incorrect because SXP uses TCP port 64999 by default, and peers are established.

Study all 802.1X and TrustSec common traps →

A
The SXP version mismatch between the switch and ISE.
Why wrong: Incorrect because SXP versions are backward compatible, and peers are established.
B
The switch is not configured to assign SGTs to users via 802.1X or static mapping.
Correct because SXP propagates existing SGTs; if the switch has no mappings, nothing is sent.
C
The ISE is configured as an SXP speaker instead of a listener.
Why wrong: Incorrect because the engineer configured the switch as speaker and ISE as listener, which is valid.
D
The SXP connection is using the wrong TCP port.
Why wrong: Incorrect because SXP uses TCP port 64999 by default, and peers are established.

Full breakdown with real-world context →

Question 8mediummultiple choice

Study the full ACL explanation →

A network engineer is configuring 802.1X on a Cisco switch for a guest network. The engineer wants to allow guests to access the internet after authentication but restrict access to internal resources. The engineer configures the switch with 'authentication port-control auto' and a downloadable ACL (dACL) from the RADIUS server. After a guest authenticates, the engineer tests connectivity and finds that the guest can access internal servers. What is the most likely cause?

Trap 1: The switchport is configured as 'switchport mode trunk', which does…

Incorrect because dACLs work on trunk ports as well.

Trap 2: The guest is not being authenticated; the switch is using MAB…

Incorrect because the guest authenticated, and MAB would also apply dACLs.

Trap 3: The switch is not configured with 'ip access-group' to apply the…

Incorrect because dACLs are applied automatically by the switch when received from RADIUS.

Study all 802.1X and TrustSec common traps →

A
The switchport is configured as 'switchport mode trunk', which does not support dACLs.
Why wrong: Incorrect because dACLs work on trunk ports as well.
B
The guest is not being authenticated; the switch is using MAB instead.
Why wrong: Incorrect because the guest authenticated, and MAB would also apply dACLs.
C
The switch is not configured with 'ip access-group' to apply the dACL.
Why wrong: Incorrect because dACLs are applied automatically by the switch when received from RADIUS.
D
The RADIUS server is not sending the dACL attributes in the Access-Accept message.
Correct because without dACL attributes, the switch applies no filter.

Full breakdown with real-world context →

Question 9hardmultiple choice

Open the full VLAN trunking answer →

A network engineer is deploying 802.1X with Cisco ISE for a wired network. The engineer wants to use CoA (Change of Authorization) to dynamically change the VLAN of a user after authentication. The engineer configures the switch with 'aaa server radius dynamic-author' and the ISE with CoA settings. When the engineer tests CoA from ISE, the switch logs show 'CoA request received' but the VLAN does not change. What is the most likely cause?

Trap 1: The ISE is not configured with the correct shared secret for CoA.

Incorrect because the switch received the request, indicating shared secret is correct.

Trap 2: The switch is not configured with 'dot1x pae authenticator' on the…

Incorrect because 802.1X is already working; CoA is a separate feature.

Trap 3: The switchport is configured as 'switchport mode trunk', which does…

Incorrect because CoA can change VLAN on trunk ports as well.

Study all 802.1X and TrustSec common traps →

A
The ISE is not configured with the correct shared secret for CoA.
Why wrong: Incorrect because the switch received the request, indicating shared secret is correct.
B
The switch is missing the 'authentication command bounce-port' or 'authentication command disable-port' configuration.
Correct because these commands enable the switch to apply CoA actions like VLAN change.
C
The switch is not configured with 'dot1x pae authenticator' on the interface.
Why wrong: Incorrect because 802.1X is already working; CoA is a separate feature.
D
The switchport is configured as 'switchport mode trunk', which does not support VLAN changes via CoA.
Why wrong: Incorrect because CoA can change VLAN on trunk ports as well.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer runs the following command on switch SW1:

SW1# show authentication sessions interface GigabitEthernet1/0/1

Interface: GigabitEthernet1/0/1

MAC Address: 0011.2233.4455

IP Address: 192.168.1.100

Status: Authz Success Domain: DATA Oper host mode: multi-auth Oper control dir: both Session timeout: N/A Common Session ID: 0A1B2C3D4E5F6G7H8I9J Acct Session ID: 0x0000000A Handle: 0x00000001

Current Method List: mab Method: MAB State: Authz Success

Based on this output, what can be concluded?

Trap 1: The client authenticated using 802.1X with a username and password.

The method shown is MAB, not 802.1X.

Trap 2: The port is in multi-domain mode, allowing one data and one voice…

The host mode is multi-auth, not multi-domain.

Trap 3: The session is for voice traffic because the domain is DATA.

Domain DATA indicates data traffic, not voice.

Study all 802.1X and TrustSec common traps →

A
The client authenticated using 802.1X with a username and password.
Why wrong: The method shown is MAB, not 802.1X.
B
The client was authenticated based on its MAC address via MAB.
The method is MAB and state is Authz Success, meaning MAC authentication succeeded.
C
The port is in multi-domain mode, allowing one data and one voice device.
Why wrong: The host mode is multi-auth, not multi-domain.
D
The session is for voice traffic because the domain is DATA.
Why wrong: Domain DATA indicates data traffic, not voice.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer runs the following command on switch SW2:

SW2# show cts role-based sgt-map

Active IPv4-SGT Mapping Table:

IP Address       SGT
192.168.1.10     10
192.168.1.20     20
192.168.1.30     30

Total number of entries: 3

Based on this output, what can be concluded?

Trap 1: The switch is using 802.1X to assign SGTs to endpoints.

The output does not show how the mappings were learned; they could be static or dynamic.

Trap 2: The switch has a static mapping of IP addresses to SGTs.

The output does not indicate whether the mappings are static or learned via SGT Exchange Protocol.

Trap 3: The switch is using MAB to assign SGTs to endpoints.

The output does not mention MAB or any authentication method.

Study all 802.1X and TrustSec common traps →

A
The switch is using 802.1X to assign SGTs to endpoints.
Why wrong: The output does not show how the mappings were learned; they could be static or dynamic.
B
The switch has a static mapping of IP addresses to SGTs.
Why wrong: The output does not indicate whether the mappings are static or learned via SGT Exchange Protocol.
C
The switch maintains a mapping table that associates IP addresses with SGTs for TrustSec policy enforcement.
This is exactly what the show cts role-based sgt-map command displays.
D
The switch is using MAB to assign SGTs to endpoints.
Why wrong: The output does not mention MAB or any authentication method.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer runs the following command on switch SW3:

SW3# show cts role-based permissions

IPv4 Role-based permissions:

Source Group Dest Group Action 10 20 PERMIT 10 30 DENY 20 30 PERMIT

Based on this output, what can be concluded?

Trap 1: Traffic from SGT 10 to SGT 20 is denied.

The output shows PERMIT for source 10 to dest 20.

Trap 2: Traffic from SGT 10 to SGT 30 is permitted.

The output shows DENY for source 10 to dest 30.

Trap 3: Traffic from SGT 30 to SGT 10 is denied.

The output does not show a policy for source 30 to dest 10; the table is directional.

Study all 802.1X and TrustSec common traps →

A
Traffic from SGT 10 to SGT 20 is denied.
Why wrong: The output shows PERMIT for source 10 to dest 20.
B
Traffic from SGT 10 to SGT 30 is permitted.
Why wrong: The output shows DENY for source 10 to dest 30.
C
Traffic from SGT 20 to SGT 30 is permitted.
The output shows PERMIT for source 20 to dest 30.
D
Traffic from SGT 30 to SGT 10 is denied.
Why wrong: The output does not show a policy for source 30 to dest 10; the table is directional.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer runs the following command on switch SW4:

SW4# show cts environment-data

CTS Environment Data:

Device ID: SW4.cisco.com Device Name: SW4 CTS Capabilities: SGT, SXP, CTSD, CTSA SGT: 100 SXP Node: Enabled SXP Connection: 10.1.1.1:64999

Based on this output, what can be concluded?

Trap 1: The switch is using 802.1X for authentication.

The output does not mention 802.1X.

Trap 2: The switch's SGT is 10.

The SGT shown is 100, not 10.

Trap 3: The switch is not capable of SGT assignment.

The CTS capabilities include SGT, indicating it is capable.

Study all 802.1X and TrustSec common traps →

A
The switch is using 802.1X for authentication.
Why wrong: The output does not mention 802.1X.
B
The switch has an SXP connection to a peer at 10.1.1.1.
The output shows SXP Node enabled and an SXP connection to 10.1.1.1:64999.
C
The switch's SGT is 10.
Why wrong: The SGT shown is 100, not 10.
D
The switch is not capable of SGT assignment.
Why wrong: The CTS capabilities include SGT, indicating it is capable.

Full breakdown with real-world context →

Question 14mediummultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer runs the following command on switch SW5:

SW5# show cts sxp connections

SXP Connections:

Peer IP Source IP Conn Status Duration

10.1.1.1        10.1.1.2        Up              2d3h
10.1.1.3        10.1.1.2        Down            0d0h

Based on this output, what can be concluded?

Trap 1: Both SXP connections are operational.

The connection to 10.1.1.3 is Down.

Trap 2: The switch is using 802.1X for authentication.

The output does not mention 802.1X.

Trap 3: The SXP connection to 10.1.1.3 is up.

The status for 10.1.1.3 is Down.

Study all 802.1X and TrustSec common traps →

A
Both SXP connections are operational.
Why wrong: The connection to 10.1.1.3 is Down.
B
The SXP connection to 10.1.1.1 has been up for 2 days and 3 hours.
The output shows Up and duration 2d3h for peer 10.1.1.1.
C
The switch is using 802.1X for authentication.
Why wrong: The output does not mention 802.1X.
D
The SXP connection to 10.1.1.3 is up.
Why wrong: The status for 10.1.1.3 is Down.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer runs the following command on switch SW6:

SW6# show cts role-based counters

Role-based counters:

Source Group Dest Group Packets Sent Bytes Sent Packets Denied Bytes Denied 10 20 1500 120000 0 0 10 30 0 0 500 40000

Based on this output, what can be concluded?

Trap 1: Traffic from SGT 10 to SGT 20 is being denied.

The counters show 0 packets denied for that flow.

Trap 2: Traffic from SGT 10 to SGT 30 is being permitted.

The counters show 500 packets denied for that flow.

Trap 3: No traffic has been sent between any SGTs.

Traffic has been sent from 10 to 20.

Study all 802.1X and TrustSec common traps →

A
Traffic from SGT 10 to SGT 20 is being denied.
Why wrong: The counters show 0 packets denied for that flow.
B
Traffic from SGT 10 to SGT 30 is being permitted.
Why wrong: The counters show 500 packets denied for that flow.
C
Traffic from SGT 10 to SGT 20 is being permitted, and traffic from SGT 10 to SGT 30 is being denied.
The counters confirm permit for 10->20 and deny for 10->30.
D
No traffic has been sent between any SGTs.
Why wrong: Traffic has been sent from 10 to 20.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer runs the following command on switch SW7:

SW7# show authentication registrations

Authentication Method Registrations:

Method Priority Type dot1x 10 Interface mab 20 Interface webauth 30 Interface

Based on this output, what can be concluded?

Trap 1: The switch will try MAB before 802.1X.

dot1x has higher priority (lower number) than mab, so it is tried first.

Trap 2: Web authentication is the primary method.

Web authentication has the lowest priority (30).

Trap 3: Only 802.1X is registered.

All three methods are registered.

Study all 802.1X and TrustSec common traps →

A
The switch will try MAB before 802.1X.
Why wrong: dot1x has higher priority (lower number) than mab, so it is tried first.
B
The switch will try 802.1X first, then MAB, then web authentication.
The priority order is dot1x (10), mab (20), webauth (30).
C
Web authentication is the primary method.
Why wrong: Web authentication has the lowest priority (30).
D
Only 802.1X is registered.
Why wrong: All three methods are registered.

Full breakdown with real-world context →

Question 17hardmultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer runs the following command on switch SW8:

SW8# show cts role-based sgt-map 192.168.1.10

IP Address: 192.168.1.10

SGT: 10 Source: SXP

Based on this output, what can be concluded?

Trap 1: The SGT mapping was configured manually.

The source is SXP, indicating it was learned dynamically.

Trap 2: The IP address 192.168.1.10 is not mapped to any SGT.

It is mapped to SGT 10.

Trap 3: The SGT mapping is from local authentication.

The source is SXP, not local.

Study all 802.1X and TrustSec common traps →

A
The SGT mapping was configured manually.
Why wrong: The source is SXP, indicating it was learned dynamically.
B
The SGT mapping was learned via SXP from a peer.
The source field shows SXP.
C
The IP address 192.168.1.10 is not mapped to any SGT.
Why wrong: It is mapped to SGT 10.
D
The SGT mapping is from local authentication.
Why wrong: The source is SXP, not local.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full 802.1X and TrustSec explanation →

A network engineer runs the following command on switch SW9:

SW9# show cts role-based policy

Role-based policy:

Source Group Dest Group Action 10 20 PERMIT 10 30 DENY 20 30 PERMIT

Based on this output, what can be concluded?

Trap 1: Traffic from SGT 10 to SGT 20 is denied.

The action is PERMIT.

Trap 2: Traffic from SGT 30 to SGT 10 is denied.

There is no entry for source 30 to dest 10.

Trap 3: The policy is configured on an ISE server.

The output does not indicate where the policy was configured; it could be local.

Study all 802.1X and TrustSec common traps →

A
Traffic from SGT 10 to SGT 20 is denied.
Why wrong: The action is PERMIT.
B
Traffic from SGT 20 to SGT 30 is permitted.
The action for source 20 to dest 30 is PERMIT.
C
Traffic from SGT 30 to SGT 10 is denied.
Why wrong: There is no entry for source 30 to dest 10.
D
The policy is configured on an ISE server.
Why wrong: The output does not indicate where the policy was configured; it could be local.

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full 802.1X and TrustSec explanation →

Consider the following configuration on a Cisco IOS-XE switch:

interface GigabitEthernet1/0/1
 switchport mode access

authentication port-control auto dot1x pae authenticator dot1x timeout tx-period 5

spanning-tree portfast

What is the effect of this configuration?

Trap 1: The port will immediately transition to forwarding state and then…

PortFast allows immediate transition to forwarding, but the port remains unauthorized until authentication completes.

Trap 2: The port will be placed in a VLAN assigned by the RADIUS server…

No RADIUS server or VLAN assignment configuration is shown; this statement is not supported by the given config.

Trap 3: The switch will act as a supplicant and respond to EAP requests…

The 'dot1x pae authenticator' command sets the switch as an authenticator, not a supplicant.

Study all 802.1X and TrustSec common traps →

A
The port will immediately transition to forwarding state and then wait for authentication.
Why wrong: PortFast allows immediate transition to forwarding, but the port remains unauthorized until authentication completes.
B
The switch will act as an 802.1X authenticator and the port will be unauthorized until a successful authentication.
The 'dot1x pae authenticator' sets the switch as authenticator, and 'authentication port-control auto' means the port is unauthorized until authentication succeeds.
C
The port will be placed in a VLAN assigned by the RADIUS server after authentication.
Why wrong: No RADIUS server or VLAN assignment configuration is shown; this statement is not supported by the given config.
D
The switch will act as a supplicant and respond to EAP requests from an upstream authenticator.
Why wrong: The 'dot1x pae authenticator' command sets the switch as an authenticator, not a supplicant.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full 802.1X and TrustSec explanation →

Examine the following configuration snippet:

interface GigabitEthernet1/0/2
 switchport mode access

authentication port-control auto mab dot1x pae authenticator dot1x timeout tx-period 10

Which statement about this configuration is true?

Trap 1: MAB will be attempted first, and if it fails, 802.1X will be used.

By default, 802.1X is attempted first; MAB is a fallback method.

Trap 2: The port will be placed in a guest VLAN if both 802.1X and MAB fail.

No guest VLAN is configured in this snippet.

Trap 3: The switch will act as a supplicant for MAB and an authenticator…

The switch is configured as an authenticator for both methods.

Study all 802.1X and TrustSec common traps →

A
MAB will be attempted first, and if it fails, 802.1X will be used.
Why wrong: By default, 802.1X is attempted first; MAB is a fallback method.
B
802.1X will be attempted first; if the client does not respond, MAB will be used as a fallback.
The switch tries 802.1X first; if no EAPOL is received, it falls back to MAB.
C
The port will be placed in a guest VLAN if both 802.1X and MAB fail.
Why wrong: No guest VLAN is configured in this snippet.
D
The switch will act as a supplicant for MAB and an authenticator for 802.1X.
Why wrong: The switch is configured as an authenticator for both methods.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused 802.1X and TrustSec sessions

Start a 802.1X and TrustSec only practice session

Every question in these sessions is drawn from the 802.1X and TrustSec domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all 802.1X and TrustSec questions →Mixed 350-401 session

Frequently asked questions

What does the 350-401 exam test about 802.1X and TrustSec?: 802.1X and TrustSec questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just 802.1X and TrustSec questions in a focused session?: Yes — the session launcher on this page draws every question from the 802.1X and TrustSec domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 350-401 topics?: Use the topic links above to move to related areas, or go back to the 350-401 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 350-401 exam covers. They are not copied from any real exam or dump site.

802.1X and TrustSec only

10 questions 20 questions 30 questions 50 questions

Mixed 350-401 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 350-401 questions 802.1X and TrustSec domain overview 350-401 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

802.1X and TrustSec practice questions

What to know about 802.1X and TrustSec

Common 802.1X and TrustSec exam traps

802.1X and TrustSec questions

Track your progress over time

Start a 802.1X and TrustSec only practice session

Related 350-401 topic practice pages

Architecture practice questions

Enterprise Network Design practice questions

SD-Access Architecture practice questions

SD-WAN Architecture practice questions

QoS Architecture practice questions

Virtualization practice questions

Network Function Virtualization practice questions

Virtual Machines and Hypervisors practice questions

VRF and Path Isolation practice questions

Infrastructure practice questions

OSPF practice questions

BGP practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid