350-701 Practice Question: Secure Network Access, Visibility and Enforcement
A large enterprise has deployed Cisco ISE for network access control with 802.1X and MAB across its wired and wireless networks. The network consists of Cisco Catalyst switches, Cisco Wireless LAN Controllers (WLCs), and ISE in a distributed deployment with three Policy Service Nodes (PSNs) and an Admin Node. Recently, the company implemented a new security policy requiring all endpoints to pass posture assessment before gaining full network access. The posture assessment uses AnyConnect ISE Posture Module.
Shortly after the change, users report that some wired clients are unable to connect to the network. The ISE logs show that the authentication is successful, but the session is terminated immediately with a 'Session-Timeout' attribute set to 0. The network team notices that the affected clients are all connected to switches running older Cisco IOS versions. The ISE administrator confirms that the authorization profiles for the affected clients include a session-timeout of 1 hour. Which course of action should the network engineer take to resolve the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upgrade the switch IOS to a version that supports the new ISE posture attributes.
Older Cisco IOS versions on the switches may not properly interpret the new RADIUS attributes (such as posture-related attributes) sent by ISE during posture assessment. This can cause the switch to misinterpret the session-timeout value and immediately terminate the session (setting Session-Timeout to 0). Upgrading the switch IOS to a version that supports these attributes resolves the compatibility issue. Option B is incorrect because disabling posture assessment for affected ports bypasses the security policy without addressing the root cause. Option C is incorrect because configuring switches to ignore the Session-Timeout attribute can lead to security risks and does not solve the attribute interpretation problem. Option D is incorrect because increasing the session-timeout value in the ISE authorization profile does not fix the switch's inability to handle the attribute; the attribute is still misinterpreted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Upgrade the switch IOS to a version that supports the new ISE posture attributes.
Why this is correct
Upgrading resolves the incompatibility and allows proper handling of posture attributes.
- ✗
Disable posture assessment for the affected switch ports using a different authorization policy.
Why it's wrong here
This bypasses the security policy without addressing the underlying incompatibility.
- ✗
Configure the switches to ignore the Session-Timeout attribute sent by ISE.
Why it's wrong here
Ignoring the attribute is not a proper fix; it may lead to other issues like no reauthentication.
- ✗
Increase the session-timeout value in the ISE authorization profile to a larger value.
Why it's wrong here
Increasing the timeout does not fix the attribute interpretation issue on the switch.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.