The answer is Cisco Identity Services Engine (ISE). This is the correct choice because ISE is purpose-built for network access control with identity and posture, combining 802.1X, MAB, and web authentication to verify users, then enforcing policies through dynamic VLAN assignment, downloadable ACLs, or Security Group Tags based on both who the user is and whether their device meets posture requirements like antivirus status or OS patch levels. On the Cisco SCOR 350-701 exam, this question tests your ability to distinguish ISE from a generic AAA server such as Cisco ACS or a standalone RADIUS solution—a common trap is assuming any AAA platform suffices, but only ISE integrates posture assessment via AnyConnect or the NAC Agent, along with profiling, guest access, and BYOD onboarding. A helpful memory tip: think of ISE as the “identity plus state enforcer”—it cares not just who you are, but what condition your device is in.
350-701 Practice Question: Secure Network Access, Visibility and Enforcement
This 350-701 practice question tests your understanding of secure network access, visibility and enforcement. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security architect is designing network access control for a campus network. The requirement is to authenticate users before granting network access and to enforce policies based on user identity and device posture. Which solution should be deployed?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cisco Identity Services Engine (ISE)
Cisco ISE is the correct solution because it provides centralized policy-based network access control that authenticates users via 802.1X, MAB, or web authentication, and enforces dynamic VLAN assignment, ACLs, or SGTs based on user identity and device posture (e.g., compliance with antivirus, OS patches). Unlike a generic AAA server, ISE integrates with posture assessment (via AnyConnect or NAC Agent) and supports profiling, guest access, and BYOD onboarding, directly meeting the requirement for identity- and posture-based enforcement.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
AAA server with TACACS+
Why it's wrong here
TACACS+ is for device administration, not network access control with posture.
✗
VPN concentrator with client certificate authentication
Why it's wrong here
VPN is for remote access, not campus network access control.
✗
Next-generation firewall with application control
Why it's wrong here
Firewalls do not perform user authentication and posture assessment for network access.
✓
Cisco Identity Services Engine (ISE)
Why this is correct
ISE provides centralized policy enforcement for network access with user and device context.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between AAA for device administration (TACACS+) and AAA for network access (RADIUS/ISE), leading candidates to mistakenly choose a generic AAA server when the question specifically requires identity- and posture-based enforcement.
Detailed technical explanation
How to think about this question
Cisco ISE uses the RADIUS protocol (RFC 2865/2866) to communicate with network devices (switches, WLCs) for 802.1X authentication, and it leverages the TrustSec architecture to propagate Security Group Tags (SGTs) for scalable policy enforcement. A subtle behavior is that ISE can perform posture assessment via the Cisco AnyConnect Network Access Manager or the ISE Posture Agent, which checks for compliance criteria such as running processes, registry keys, or file versions before granting full network access; non-compliant devices can be quarantined to a remediation VLAN. In a real-world scenario, a campus with BYOD might use ISE to redirect unauthenticated users to a captive portal, profile the device type, and then apply a restricted ACL until the device is registered and posture-checked.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Secure Network Access, Visibility and Enforcement — This question tests Secure Network Access, Visibility and Enforcement — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Cisco Identity Services Engine (ISE) — Cisco ISE is the correct solution because it provides centralized policy-based network access control that authenticates users via 802.1X, MAB, or web authentication, and enforces dynamic VLAN assignment, ACLs, or SGTs based on user identity and device posture (e.g., compliance with antivirus, OS patches). Unlike a generic AAA server, ISE integrates with posture assessment (via AnyConnect or NAC Agent) and supports profiling, guest access, and BYOD onboarding, directly meeting the requirement for identity- and posture-based enforcement.
What should I do if I get this 350-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator wants to centrally manage and enforce access policies for wired and wireless users. Which Cisco product provides this functionality?
easy
✓ A.Cisco Identity Services Engine (ISE)
B.Cisco Prime Infrastructure
C.Cisco Adaptive Security Appliance (ASA)
D.Cisco Wireless LAN Controller (WLC)
Why A: Option A is correct because Cisco ISE is the policy administration point for network access control across wired, wireless, and VPN. Option B is incorrect because WLC manages only wireless. Option C is incorrect because ASA is a firewall. Option D is incorrect because Prime Infrastructure is for management and assurance, not policy enforcement.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.