easyMultiple ChoiceObjective-mapped
350-701 Practice Question: Is troubleshooting an issue where an endpoint is…
A network engineer is troubleshooting an issue where an endpoint is failing to authenticate via 802.1X on a Cisco switch. The switch port is in unauthorized state. Which step should the engineer take first to identify the root cause?
⚠ Common exam trap
Cisco often tests the principle of 'start at the most specific source of truth'—the trap here is that candidates jump to checking network connectivity (Option A) or client configuration (Option C) without first consulting the authentication server logs, which contain the definitive failure reason.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the ISE authentication logs for failure reasons.
The correct first step is to check the ISE authentication logs for failure reasons because the switch port is already in an unauthorized state, meaning the 802.1X authentication process has failed. ISE (the RADIUS server) logs provide the most granular failure reason, such as invalid credentials, unknown client, or EAP method mismatch, which directly pinpoints the root cause. Checking the switch's RADIUS reachability or endpoint configuration would be premature without first understanding why authentication was denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the switch's RADIUS server reachability.
Why it's wrong here
While important, checking server reachability is secondary if logs are available.
- ✓
Check the ISE authentication logs for failure reasons.
Why this is correct
ISE logs provide detailed failure reasons, often indicating the exact step where authentication fails. This is the best first step.
- ✗
Check the endpoint's supplicant configuration.
Why it's wrong here
Endpoint configuration is relevant but should be examined after reviewing logs.
- ✗
Check the CA server for certificate issues.
Why it's wrong here
Certificate issues are only one possible cause; logs would point to certificate problems if present.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.