350-701 Practice Question: Secure Network Access, Visibility and Enforcement
An organization wants to implement MAC Authentication Bypass (MAB) for devices that do not support 802.1X. Which configuration is required on a Cisco switch to allow MAB fallback?
⚠ Common exam trap
Cisco often tests the distinction between 'authentication order' and 'authentication priority' (which does not exist), leading candidates to incorrectly select a non-existent command or confuse the sequence of methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
authentication order mab dot1x
The 'authentication order mab dot1x' command configures the switch to attempt MAB first and then fall back to 802.1X if MAB fails. This is the exact requirement for devices that do not support 802.1X, ensuring they are authenticated via MAC address while still allowing 802.1X for capable devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
authentication priority dot1x mab
Why it's wrong here
This is not a valid Cisco IOS command.
- ✗
authentication port-control auto
Why it's wrong here
This enables 802.1X but does not specify the fallback order.
- ✗
authentication fallback mab
Why it's wrong here
This command does not exist; the correct method is 'authentication order'.
- ✓
authentication order mab dot1x
Why this is correct
This command configures MAB as the primary method with 802.1X as fallback.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.