350-701 Practice Question: Secure Network Access, Visibility and Enforcement
A university is implementing 802.1X for student wireless networks using Cisco Wireless LAN Controllers (WLCs) and ISE. Students connect with their personal devices using PEAP-MSCHAPv2. During heavy usage, some students report authentication failures and sporadic disconnections. The network team examines the ISE live logs and sees many 'Authentication failed' entries with reason 'Internal error - unable to find a suitable proxy target'. The team has configured two ISE nodes as authentication proxies for the wireless subnets. What is the most likely cause of this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The proxy target rules in ISE do not match the WLC's NAS-IP-Address
The error 'unable to find a suitable proxy target' indicates that the ISE node cannot determine which proxy to use for the authentication request, often due to proxy target rules not matching the incoming request attributes like NAS-IP-Address. Option D is correct because if the proxy target rules are missing or incorrect, ISE cannot forward the request. Option A would cause different errors. Option B might cause performance but not internal error. Option C would cause connection errors, not proxy target errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The WLC is not configured to use the ISE proxy nodes as RADIUS servers
Why it's wrong here
If WLC didn't point to ISE, authentication wouldn't reach ISE at all.
- ✗
The RADIUS shared secret is mismatched between WLC and ISE
Why it's wrong here
Shared secret mismatch would give a clear 'invalid secret' error.
- ✗
ISE node CPU is overloaded due to high authentication load
Why it's wrong here
CPU overload might cause timeouts but not 'unable to find proxy target'.
- ✓
The proxy target rules in ISE do not match the WLC's NAS-IP-Address
Why this is correct
Proxy target rules must include the NAS-IP-Address of the WLC to forward requests to the appropriate authentication node.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.