Courseiva

350-701 Practice Question: Secure Network Access, Visibility and Enforcement

A large enterprise has deployed Cisco ISE for network access control with 802.1X and MAB across its wired and wireless networks. The network consists of Cisco Catalyst switches, Cisco Wireless LAN Controllers (WLCs), and ISE in a distributed deployment with three Policy Service Nodes (PSNs) and an Admin Node. Recently, the company implemented a new security policy requiring all endpoints to pass posture assessment before gaining full network access. The posture assessment uses AnyConnect ISE Posture Module.

Shortly after the change, users report that some wired clients are unable to connect to the network. The ISE logs show that the authentication is successful, but the session is terminated immediately with a 'Session-Timeout' attribute set to 0. The network team notices that the affected clients are all connected to switches running older Cisco IOS versions. The ISE administrator confirms that the authorization profiles for the affected clients include a session-timeout of 1 hour. Which course of action should the network engineer take to resolve the issue?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Upgrade the switch IOS to a version that supports the new ISE posture attributes.

Older Cisco IOS versions on the switches may not properly interpret the new RADIUS attributes (such as posture-related attributes) sent by ISE during posture assessment. This can cause the switch to misinterpret the session-timeout value and immediately terminate the session (setting Session-Timeout to 0). Upgrading the switch IOS to a version that supports these attributes resolves the compatibility issue. Option B is incorrect because disabling posture assessment for affected ports bypasses the security policy without addressing the root cause. Option C is incorrect because configuring switches to ignore the Session-Timeout attribute can lead to security risks and does not solve the attribute interpretation problem. Option D is incorrect because increasing the session-timeout value in the ISE authorization profile does not fix the switch's inability to handle the attribute; the attribute is still misinterpreted.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Upgrade the switch IOS to a version that supports the new ISE posture attributes.

    Why this is correct

    Upgrading resolves the incompatibility and allows proper handling of posture attributes.

  • Disable posture assessment for the affected switch ports using a different authorization policy.

    Why it's wrong here

    This bypasses the security policy without addressing the underlying incompatibility.

  • Configure the switches to ignore the Session-Timeout attribute sent by ISE.

    Why it's wrong here

    Ignoring the attribute is not a proper fix; it may lead to other issues like no reauthentication.

  • Increase the session-timeout value in the ISE authorization profile to a larger value.

    Why it's wrong here

    Increasing the timeout does not fix the attribute interpretation issue on the switch.

Visual reference

Client Recursive Resolver Root DNS (13 root servers) TLD DNS (.com, .org, …) Authoritative example.com query IP addr answer

Quick reference

AAA Protocol Comparison

ProtocolPort(s)EncryptionTransportPrimary Use
RADIUS1812 / 1813Password onlyUDPNetwork access control
TACACS+49Full packetTCPDevice administration
Diameter3868Full sessionTCP / SCTPCarrier / mobile networks
802.1XEAP-basedLayer 2Port-based access control

TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.

About these practice questions

Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.