hardMultiple ChoiceObjective-mapped
350-701 Practice Question: A university is deploying 802.1X authentication…
A university is deploying 802.1X authentication for wired access using Cisco ISE. The network consists of Cisco Catalyst switches. The authentication is working for most users, but some users in a specific building are experiencing frequent authentication failures, especially during peak hours. The switches in that building are configured with RADIUS settings pointing to ISE. ISE logs show that authentication requests are being sent but sometimes time out. The network team suspects that the issue is related to RADIUS server load balancing, as the ISE deployment includes two nodes in a distributed model. What is the most likely cause of the timeouts?
⚠ Common exam trap
Cisco often tests the distinction between authentication failures caused by misconfiguration (e.g., shared secret, VLAN) versus performance-related timeouts due to load balancing, tempting candidates to pick a configuration error when the real issue is capacity or distribution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ISE nodes are not configured for load balancing, causing one node to be overwhelmed.
The symptoms—intermittent timeouts during peak hours in a specific building—point to a load-balancing issue. In a distributed ISE deployment, if the switches are not configured with multiple RADIUS server entries or if ISE nodes are not properly load-balanced (e.g., using a single primary server or missing secondary server configuration), one node can become overwhelmed with authentication requests, leading to timeouts. The fact that authentication works for most users but fails during peak hours in one building strongly suggests that the switches in that building are sending all requests to a single ISE node that cannot handle the load.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The RADIUS shared secret is misconfigured on some switches.
Why it's wrong here
Shared secret misconfiguration would cause authentication failures consistently, not just during peak hours.
- ✗
The switches are not configured with the correct VLAN assignments.
Why it's wrong here
VLAN assignment issues would cause failures after authentication, not timeouts during authentication.
- ✗
The switches are using the wrong RADIUS accounting port.
Why it's wrong here
Wrong accounting port would affect accounting, not authentication.
- ✓
The ISE nodes are not configured for load balancing, causing one node to be overwhelmed.
Why this is correct
Without load balancing, all requests may go to one node, causing overload and timeouts during peak times.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.