350-701 Practice Question: Secure Network Access, Visibility and Enforcement
A junior engineer is configuring MAB (MAC Authentication Bypass) on a Cisco switch for legacy printers. After configuration, the printers are still being placed into the default VLAN instead of the authorized VLAN. Which configuration is missing?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
authentication order mab
'authentication order mab'. This command ensures that MAB is attempted before 802.1X on the interface. Without it, the switch may default to 802.1X first, which fails (since printers do not support 802.1X), and if MAB is not in the authentication order, the printer may be placed into the default VLAN instead of the authorized VLAN. Option A ('authentication port-control auto') is required to enable authentication but does not set the order; it is likely already configured. Option C ('dot1x pae authenticator') enables 802.1X, which is not needed for MAB-only environments and does not affect MAB ordering. Option D ('spanning-tree portfast') speeds up STP convergence and is unrelated to authentication order.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
authentication port-control auto
Why it's wrong here
This command enables authentication, but without order, MAB may not be attempted.
- ✓
authentication order mab
Why this is correct
This sets MAB as the first authentication method, ensuring it is used.
- ✗
dot1x pae authenticator
Why it's wrong here
This is for 802.1X and not required for MAB.
- ✗
spanning-tree portfast
Why it's wrong here
Portfast affects STP convergence, not authentication.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.