Knowledge + Practice

CCNA Secure Network Access, Visibility and Enforcement Questions

75 of 99 questions · Page 1/2 · Secure Network Access, Visibility and Enforcement · Answers revealed

Practice these questions Domain overview All questions

1

Multi-Selecthard

A company is deploying Cisco ISE for network access control. Which three policies must be configured to enforce access based on device posture? (Choose three)

Select 3 answers

A.Authorization policy

B.Posture policy

C.Guest access policy

D.Authentication policy

E.Profiling policy

AnswersA, B, D

Defines access based on posture results.

Why this answer

Authorization policy (A) is correct because it defines the final access permissions (e.g., permit, deny, VLAN assignment, ACL) based on the posture assessment results. After the endpoint's posture is evaluated, the authorization policy uses conditions like 'PostureStatus: Compliant' or 'PostureStatus: NonCompliant' to enforce network access control. Without an authorization policy, the posture check result would have no effect on actual network access.

Exam trap

Cisco often tests the misconception that Profiling policy (E) is involved in posture enforcement, but profiling only identifies the device type and does not evaluate security compliance or trigger remediation.

Practice this question →

2

MCQmedium

A multinational corporation is implementing ISE for wired network access using 802.1X with EAP-TLS certificate authentication. Their Windows 10 laptops have certificates issued by an internal PKI. During testing, some users report that they are repeatedly prompted to select a certificate after connecting, and eventually authentication fails. ISE logs show 'Authentication failed - No matching certificate found'. The engineer checks the client machine and sees multiple certificates, including the correct one, in the personal store. The ISE endpoint identity store is populated with the user's AD credentials. What is the most likely cause of this failure?

A.The client's certificate is expired

B.The Windows supplicant requires a registry modification to enable auto-selection

C.ISE trusted CA certificate list does not include the issuing CA

D.The client certificates lack the 'Client Authentication' extended key usage (EKU)

AnswerD

EAP-TLS requires a certificate with Client Authentication EKU; if missing, ISE will not accept it.

Why this answer

EAP-TLS requires the client to present a certificate that ISE can validate. If the client has multiple certificates and ISE receives one that does not contain the 'Client Authentication' extended key usage (EKU), ISE will reject it, logging 'No matching certificate found'. The correct answer is D because the client certificates must have the EKU for client authentication; otherwise, even if the certificates are trusted and valid, ISE will not accept them for 802.1X.

Option A (expired certificate) would cause a different error. Option B (registry modification) is not standard for Windows 10 supplicant. Option C (missing trusted CA) would cause ISE to not trust any client certificate, affecting all users, not just some.

Practice this question →

3

MCQmedium

A network engineer is implementing TrustSec on a Cisco switch. The goal is to tag traffic from the engineering VLAN with Security Group Tag (SGT) 10 and enforce policies on upstream switches. Which configuration is required on the access switch to propagate the SGT?

A.cts manual policy static sgt 10

B.switchport voice vlan 10

C.authentication host-mode multi-domain

D.spanning-tree portfast

AnswerA

This enables manual SGT tagging on the interface.

Why this answer

The 'cts manual policy static sgt 10' command assigns a static Security Group Tag (SGT) to the switch port, which is then propagated to upstream switches via Cisco TrustSec (CTS) using SGT Exchange Protocol (SXP) or inline tagging. This ensures that traffic from the engineering VLAN is tagged with SGT 10, enabling policy enforcement on upstream devices.

Exam trap

The trap here is that candidates confuse VLAN configuration (e.g., voice VLAN) with Security Group Tag assignment, or assume that authentication or STP features are involved in SGT propagation.

How to eliminate wrong answers

Option B is wrong because 'switchport voice vlan 10' configures a voice VLAN for VoIP traffic, not a Security Group Tag; it does not propagate SGTs. Option C is wrong because 'authentication host-mode multi-domain' is used for 802.1X multi-domain authentication (e.g., voice and data devices), not for static SGT assignment or propagation. Option D is wrong because 'spanning-tree portfast' accelerates the port transition to forwarding state to avoid STP delays, but it has no role in SGT tagging or propagation.

Practice this question →

4

MCQmedium

A company uses Cisco ISE for posture assessment. They require that all endpoints meet a certain set of compliance rules before being granted network access. Which service is responsible for performing the posture assessment on the endpoint?

A.ISE Policy Service

B.Cisco AnyConnect ISE Posture Module

C.Cisco ISE pxGrid

D.Network Access Device (switch)

AnswerB

The AnyConnect Posture Module runs on the endpoint and performs the actual posture checks.

Why this answer

The Cisco AnyConnect ISE Posture Module is the client-side software agent installed on the endpoint that performs the actual posture assessment. It collects compliance information such as OS patch level, antivirus status, and running processes, then reports this data to the ISE Policy Service for evaluation. Without this module running on the endpoint, ISE cannot perform a posture check.

Exam trap

Cisco often tests the distinction between the server-side policy evaluation (ISE Policy Service) and the client-side agent (AnyConnect Posture Module) that performs the actual endpoint scan, leading candidates to incorrectly select the Policy Service.

How to eliminate wrong answers

Option A is wrong because the ISE Policy Service is the server-side component that evaluates posture policies and makes access decisions, but it does not perform the assessment on the endpoint itself. Option C is wrong because pxGrid is a publish/subscribe messaging protocol used for sharing context data between ISE and other security systems, not for endpoint posture assessment. Option D is wrong because the Network Access Device (switch) enforces access control based on ISE decisions (e.g., via dACL or VLAN change) but does not perform posture assessment on the endpoint.

Practice this question →

5

MCQmedium

An engineer is troubleshooting a user who cannot access the network after successful 802.1X authentication. The user's PC receives an IP address from DHCP, but cannot reach the internet. The switch port is in the correct VLAN (10) after authentication. The ISE posture policy requires the user to install a corporate certificate, but the user skipped that step. What is the most likely cause of the internet access failure?

A.The user is not logged into the domain

B.The switchport is still in the default VLAN

C.The DHCP server does not have a scope for VLAN 10

D.The ISE posture policy returned 'NonCompliant' and ISE applied a Change of Authorization (CoA) to place the port in a remediation VLAN

AnswerD

ISE can use CoA to dynamically move the port to a remediation VLAN with no internet access.

Why this answer

The ISE posture policy requires a corporate certificate, and since the user skipped that step, the endpoint is marked as 'NonCompliant'. ISE then sends a Change of Authorization (CoA) to the switch, which dynamically moves the port from the authorized VLAN (10) to a remediation VLAN. This remediation VLAN typically has restricted access, such as no internet connectivity, while still allowing DHCP to assign an IP address from that VLAN's scope.

Exam trap

Cisco often tests the distinction between authentication success and posture compliance; the trap here is that candidates assume a successful 802.1X authentication and DHCP lease guarantee full network access, overlooking the fact that ISE can dynamically re-VLAN the port via CoA based on posture policy results.

How to eliminate wrong answers

Option A is wrong because domain login status is not directly tied to 802.1X posture enforcement; the user already authenticated successfully, and the issue is post-authentication compliance, not authentication itself. Option B is wrong because the question explicitly states the switch port is in the correct VLAN (10) after authentication, so it is not in the default VLAN. Option C is wrong because the user receives an IP address from DHCP, indicating that a DHCP scope exists for the VLAN the port is currently in; the problem is that the port was moved to a remediation VLAN with no internet access, not that DHCP failed.

Practice this question →

6

MCQeasy

Refer to the exhibit. An engineer configured ISE to use both Active Directory and LDAP for authentication. Users from Active Directory are unable to authenticate. What is the most likely reason?

A.Active Directory users are not allowed in the policy

B.The LDAP identity store is unreachable and ISE is attempting LDAP before AD

C.The Active Directory identity store is disconnected

D.The authentication sequence is set to 'AD then LDAP'

AnswerB

If LDAP is configured as the first authentication source, the timeout causes authentication to fail before AD is tried.

Why this answer

When ISE is configured with both Active Directory and LDAP identity stores, the authentication sequence determines the order in which they are tried. If the sequence is set to 'LDAP then AD' and the LDAP server is unreachable, ISE will attempt LDAP first, fail (due to unreachability), and then proceed to AD. However, if the LDAP server is unreachable but the sequence is 'AD then LDAP', AD would be tried first and succeed for AD users.

The most likely reason AD users fail is that the sequence is 'LDAP then AD' and LDAP is unreachable, causing ISE to attempt LDAP first and fail before ever reaching AD, or the sequence is misconfigured such that AD is not tried at all. This aligns with the exhibit's implication that LDAP is attempted before AD, and LDAP being unreachable blocks AD authentication.

Exam trap

Cisco often tests the misconception that a disconnected identity store is the root cause, when in fact the authentication sequence order and reachability of the first store in the list is the critical factor that causes users from a secondary store to fail authentication.

How to eliminate wrong answers

Option A is wrong because the policy itself does not inherently block Active Directory users; the issue is the authentication sequence order and reachability, not a policy rule that explicitly denies AD users. Option C is wrong because if the AD identity store were disconnected, ISE would typically log a join/disconnect error and authentication would fail for all AD users, but the question states AD users are unable to authenticate specifically, implying a sequencing issue rather than a complete disconnection. Option D is wrong because if the authentication sequence were set to 'AD then LDAP', AD would be tried first and succeed for AD users (assuming AD is reachable), so this would not cause AD users to fail; the failure occurs when LDAP is attempted first and is unreachable.

Practice this question →

7

MCQeasy

Which Cisco security product provides network visibility and traffic analytics using NetFlow and IPFIX?

A.Cisco Firepower Management Center

B.Cisco Stealthwatch

C.Cisco Umbrella

D.Cisco ISE

AnswerB

Cisco Stealthwatch uses NetFlow/IPFIX for network visibility and threat detection.

Why this answer

Cisco Stealthwatch uses NetFlow/IPFIX for network visibility and threat detection. Option A (FMC) is for firewall management. Option D (ISE) is for identity services.

Option C (Umbrella) is for cloud security.

Practice this question →

8

Multi-Selecthard

Which THREE of the following are required for a successful 802.1X authentication on a Cisco switch? (Choose THREE)

Select 3 answers

A.Security Group Tag (SGT) must be assigned

B.A downloadable ACL (dACL) must be configured on ISE

C.The switch must be configured as a RADIUS client to ISE

D.The switch port must be configured with 'authentication port-control auto'

E.The endpoint must have a valid credential (certificate or password)

AnswersC, D, E

The switch must communicate with ISE via RADIUS for authentication.

Why this answer

For 802.1X authentication, the switch must act as a RADIUS client (authenticator) forwarding EAP frames to the ISE (authentication server). Without this configuration, the switch cannot communicate with ISE to validate the endpoint's credentials, making it a mandatory requirement.

Exam trap

Cisco often tests the distinction between authentication prerequisites and post-authentication policies, leading candidates to mistakenly select optional features like dACLs or SGTs as mandatory for the 802.1X authentication step.

Practice this question →

9

MCQhard

You are troubleshooting a Cisco ISE deployment where some endpoints are stuck in the 'Not Compliant' posture after a posture scan. ISE logs show 'Conditional NAC Agent result: Not Compliant due to missing required application.' The application is installed on the endpoint. What should you check?

A.The NAC Agent is running an outdated version.

B.The posture policy requires a specific version that is not installed.

C.The endpoint's firewall is blocking the ISE posture probe.

D.The antivirus definition file is outdated.

AnswerB

The policy may require a particular version or update, causing the check to fail even if the application exists.

Why this answer

The log indicates a missing application, but it is installed. This often occurs when the posture policy requires a specific version or patch level. Option A is incorrect because antivirus definitions are separate.

Option C is incorrect because agent version would cause a different error. Option D is incorrect because firewall blocking would prevent scan results.

Practice this question →

10

MCQeasy

An organization wants to implement MAC Authentication Bypass (MAB) for devices that do not support 802.1X. Which configuration is required on a Cisco switch to allow MAB fallback?

A.authentication priority dot1x mab

B.authentication port-control auto

C.authentication fallback mab

D.authentication order mab dot1x

AnswerD

This command configures MAB as the primary method with 802.1X as fallback.

Why this answer

The 'authentication order mab dot1x' command configures the switch to attempt MAB first and then fall back to 802.1X if MAB fails. This is the exact requirement for devices that do not support 802.1X, ensuring they are authenticated via MAC address while still allowing 802.1X for capable devices.

Exam trap

Cisco often tests the distinction between 'authentication order' and 'authentication priority' (which does not exist), leading candidates to incorrectly select a non-existent command or confuse the sequence of methods.

How to eliminate wrong answers

Option A is wrong because 'authentication priority dot1x mab' is not a valid Cisco IOS command; the correct keyword is 'order' not 'priority'. Option B is wrong because 'authentication port-control auto' enables 802.1X authentication on the port but does not specify any fallback mechanism to MAB; it simply sets the port to require authentication. Option C is wrong because 'authentication fallback mab' is not a valid command; the fallback behavior is configured using the 'authentication order' command, not a separate 'fallback' command.

Practice this question →

11

MCQhard

Refer to the exhibit. Based on the exhibit, what is the current state of the client and what action should the network administrator take to allow full network access?

A.The client is in a quarantine state due to posture assessment failure; the administrator should check the ISE posture policy and ensure the client meets compliance.

B.The client's authentication succeeded but authorization is incomplete; the administrator should configure a new dACL on the switch.

C.The client is being redirected to a guest portal; the administrator should disable the URL redirect and assign a new VLAN.

D.The client is fully authenticated and authorized; no action is needed.

AnswerA

The quarantine SGT and dACL, along with guest portal redirect, indicate the client failed posture assessment; fixing the client's compliance will allow full access.

Why this answer

The exhibit shows 'Authz Success' but the presence of a URL redirect to a guest portal and a dACL named 'PERMIT_QUARANTINE' along with SGT value 2 (commonly quarantine) indicates the client is in a quarantine state due to posture assessment failure. The administrator should check the ISE posture policy and ensure the client meets compliance to allow full network access. Option B is incorrect because the authentication is complete; the issue is posture non-compliance, not incomplete authorization.

Option C is incorrect because the redirect is a result of the quarantine policy, not an independent problem to be disabled. Option D is incorrect because the client does not have full access; the quarantine dACL restricts it.

Practice this question →

12

MCQhard

Refer to the exhibit. An ISE administrator sees this error in the logs. What is the most likely cause?

A.The ISE license does not support SGT.

B.The PassiveID identity source is not configured with the correct SGT mapping.

C.The SGT number is out of range.

D.The pxGrid connection is down.

AnswerB

PassiveID requires mapping between SGTs and identity groups; if missing, it cannot resolve the identity.

Why this answer

The error indicates that PassiveID received an SGT from a network device but does not have a mapping to convert it to an identity. This typically happens when the PassiveID identity source is not configured with the correct SGT-to-identity mapping. Option A is incorrect because licensing issues would produce different errors.

Option C is incorrect because the SGT number range is not the cause of missing mapping. Option D is incorrect because a pxGrid connection failure would show connection-related errors, not a missing SGT mapping.

Practice this question →

13

MCQhard

An organization is implementing TrustSec to enforce micro-segmentation. The Security Group Tag (SGT) is assigned to a user via ISE after authentication. However, traffic from this user to a server with SGT 5 is being dropped. The administrator checks the SGACL configuration on the switch and finds the following: 'permit ip source 2 destination 5'. What is the most likely reason for the traffic being dropped?

A.The PAC on the switch has expired

B.SXP is not configured between ISE and the switch

C.The CTRL protocol is not enabled on the switch

D.The SGACL defaults to deny if no explicit permit is found for the source-destination SGT pair

AnswerB

Correct. SXP is used to share SGT-to-IP bindings from ISE to the switch. Without SXP, the switch cannot associate the user with SGT 2, so even though an SGACL permit exists for source SGT 2 to destination SGT 5, the traffic is dropped because the switch treats the user as having an unknown SGT.

Why this answer

The SGACL entry 'permit ip source 2 destination 5' exists, but traffic from the user to the server with SGT 5 is still being dropped. This is likely because the switch does not know the user's SGT. TrustSec uses SXP to dynamically propagate SGT mappings from ISE to network devices.

Without SXP configured between ISE and the switch, the switch cannot map the user's authentication identity to the correct SGT (e.g., SGT 2). As a result, the switch either treats the user as untagged (SGT 0) or drops the traffic due to lack of a matching SGACL entry for the actual SGT pair. Thus, configuring SXP is essential for the switch to enforce SGACLs based on user-assigned SGTs.

Exam trap

Candidates often see a single SGACL permit entry and assume it applies to all users, forgetting that the SGT must be propagated to the switch via SXP. Without SXP, the switch cannot map users to SGTs, leading to implicit deny even if an SGACL appears to match.

How to eliminate wrong answers

Option A is wrong because a PAC (Protected Access Credential) expiration would prevent the switch from establishing a RADIUS or EAP-FAST session with ISE, but the SGACL is already present on the switch, indicating authentication and policy download succeeded. Option B is wrong because SXP (SGT Exchange Protocol) is used to propagate SGT bindings between network devices that do not support inline tagging; the switch already has the SGACL and the SGT assignment from ISE, so SXP is not required for enforcement. Option C is wrong because the CTRL protocol (Cisco TrustSec Control Protocol) is used for environment data download and SGT distribution between TrustSec-capable devices, but the SGACL is already configured on the switch, so the control plane is functioning; the issue is the ACL logic, not the protocol.

Practice this question →

14

Multi-Selectmedium

A network engineer is implementing Cisco TrustSec. Which two components are required to enforce Security Group Access Control List (SGACL) policies? (Choose two)

Select 2 answers

A.Cisco Wireless LAN Controller

B.Cisco Catalyst switch with CTS

C.Cisco ISE Policy Service Node

D.Cisco ASA Firewall

E.Cisco AnyConnect Secure Mobility Client

AnswersB, C

Enforces SGACL at the switch level.

Why this answer

Options B and C are correct. Cisco ISE Policy Service Node (C) defines SGACL rules and distributes them to enforcement points. A Cisco Catalyst switch with CTS (B) is the enforcement point that applies SGACLs based on SGTs.

Options A, D, and E are not required components for basic SGACL enforcement.

Practice this question →

15

MCQeasy

A junior engineer is configuring MAB (MAC Authentication Bypass) on a Cisco switch for legacy printers. After configuration, the printers are still being placed into the default VLAN instead of the authorized VLAN. Which configuration is missing?

A.authentication port-control auto

B.authentication order mab

C.dot1x pae authenticator

D.spanning-tree portfast

AnswerB

This sets MAB as the first authentication method, ensuring it is used.

Why this answer

'authentication order mab'. This command ensures that MAB is attempted before 802.1X on the interface. Without it, the switch may default to 802.1X first, which fails (since printers do not support 802.1X), and if MAB is not in the authentication order, the printer may be placed into the default VLAN instead of the authorized VLAN.

Option A ('authentication port-control auto') is required to enable authentication but does not set the order; it is likely already configured. Option C ('dot1x pae authenticator') enables 802.1X, which is not needed for MAB-only environments and does not affect MAB ordering. Option D ('spanning-tree portfast') speeds up STP convergence and is unrelated to authentication order.

Practice this question →

16

MCQmedium

A company uses Cisco ISE for network access control. They have deployed TrustSec and want to enforce segmentation using Security Group Tags (SGTs). The network team reports that SGTs are not being propagated correctly. Which protocol is responsible for SGT propagation between switches?

A.NETCONF

B.RADIUS

C.CDP

D.SXP

AnswerD

SXP is the protocol designed to exchange SGT mappings between Cisco devices.

Why this answer

SXP (SGT Exchange Protocol) is the protocol used for propagating Security Group Tags (SGTs) between switches that do not support inline tagging. Option A is incorrect because NETCONF is a network configuration protocol and not used for SGT propagation. Option B is incorrect because while RADIUS can carry SGTs in AV pairs from ISE to the network device, it is not used for switch-to-switch propagation.

Option C is incorrect because CDP (Cisco Discovery Protocol) is used for device discovery and not for SGT propagation.

Practice this question →

17

MCQmedium

An organization is using Cisco ISE to enforce posture compliance. Endpoints that are non-compliant should be placed into a quarantine VLAN. Which ISE policy component is used to assign the VLAN?

A.Authorization profile

B.Policy set

C.Profiling policy

D.Authentication policy

AnswerA

Authorization profile contains attributes like VLAN ID, dACL, etc.

Why this answer

An Authorization Profile in Cisco ISE defines the enforcement actions to be applied to an endpoint after successful authentication and authorization. When a posture assessment determines an endpoint is non-compliant, the authorization policy can match that condition and return an authorization profile that includes a specific VLAN ID (e.g., quarantine VLAN) via RADIUS attributes such as Tunnel-Private-Group-ID (RFC 2868). This VLAN assignment is a core function of the authorization profile, not of authentication or profiling.

Exam trap

The trap here is that candidates often confuse the role of the Authorization Profile with the Policy Set or Authentication Policy, mistakenly thinking that VLAN assignment is part of the authentication decision rather than a separate authorization action applied after successful authentication.

How to eliminate wrong answers

Option B is wrong because a Policy Set is a container that groups authentication and authorization policies based on conditions like identity source or network device; it does not itself assign VLANs or other enforcement attributes. Option C is wrong because a Profiling Policy is used to identify and classify endpoints based on attributes like MAC OUI or DHCP fingerprint, but it does not enforce network access restrictions such as VLAN assignment. Option D is wrong because an Authentication Policy determines whether a user or device is allowed to access the network (e.g., via credentials or certificate), but it does not define the post-authentication enforcement actions like VLAN placement.

Practice this question →

18

MCQhard

A network administrator has configured the above on a Cisco switch port for a device that supports both MAB and 802.1X. The device sends an EAPOL-start but the switch responds with an EAP-Request/Identity. The device does not respond to the EAP-Request/Identity. After a timeout, the switch attempts MAB. However, MAB also fails because the RADIUS server does not have the MAC address. Which of the following best describes the final port state?

A.The port will be placed in a critical authentication VLAN

B.The port will be error-disabled due to authentication failure

C.The port will remain in an unauthorized state, blocking all traffic

D.The port will be placed in VLAN 10 with restricted access

AnswerC

With auto port control, failed auth results in unauthorized state.

Why this answer

When 802.1X authentication fails because the device does not respond to the EAP-Request/Identity, and MAB also fails because the RADIUS server lacks the MAC address, the switch port remains in an unauthorized state. This is the default behavior for a port configured with both authentication methods: if neither succeeds, the port stays in the 802.1X unauthorized state, blocking all traffic until a successful authentication occurs or a fallback action (like a critical VLAN) is explicitly configured.

Exam trap

Cisco often tests the distinction between authentication failure and RADIUS server unavailability, where candidates mistakenly assume a guest VLAN or critical VLAN is automatically applied, but these require explicit configuration and are not default behaviors.

How to eliminate wrong answers

Option A is wrong because a critical authentication VLAN is only used when the RADIUS server is unreachable, not when authentication fails due to a missing MAC address or unresponsive client. Option B is wrong because authentication failure does not cause an error-disabled state; error-disable typically results from port security violations or other physical-layer issues, not from 802.1X or MAB failure. Option D is wrong because VLAN 10 is the configured guest VLAN, which would only be applied if the switch were configured to use a guest VLAN as a fallback for failed authentication, but the scenario does not mention any guest VLAN configuration, and the port remains unauthorized by default.

Practice this question →

19

Multi-Selecthard

Which THREE attributes can be used in an ISE authorization policy based on endpoint identity?

Select 3 answers

A.Certificate subject DN

B.AD user group

C.Time of day

D.Switch IP address

E.Device MAC address

AnswersA, B, E

Subject DN from a client certificate identifies the endpoint or user.

Why this answer

Options A, B, and E are correct because endpoint identity attributes include the device's MAC address, its certificate subject DN (from certificates), and its Active Directory user group membership. Option C is incorrect because time of day is an environmental attribute, not an endpoint identity attribute. Option D is incorrect because switch IP address is a network location attribute, not endpoint identity.

Practice this question →

20

MCQhard

A company is using Cisco ISE for guest access. They have configured a guest portal with a self-registration page. Some guests report that after registering, they are not redirected to the success page but instead see a '401 Unauthorized' error. What is the most likely cause?

A.The ISE node is not configured for HTTP redirect.

B.The guest portal certificate is not trusted by the client.

C.The central web authentication (CWA) is not enabled on the switch.

D.The authorization policy for guests is missing.

AnswerC

Without CWA, the switch does not redirect HTTP traffic to ISE, causing a 401 unauthorized error.

Why this answer

Central web authentication (CWA) must be enabled on the switch to redirect HTTP traffic from unauthenticated guests to the ISE portal. If CWA is not enabled, the switch will not redirect the traffic, resulting in a 401 Unauthorized error after registration. Option A is incorrect because HTTP redirect is configured on the ISE portal itself, not the ISE node, and is not the cause of a 401 error.

Option B is incorrect because an untrusted portal certificate would cause a browser security warning, not a 401 error. Option D is incorrect because a missing authorization policy would typically result in an 'Access Denied' message after authentication, not a 401 during the registration redirect.

Practice this question →

21

MCQmedium

A company wants to implement software-defined segmentation using Cisco ISE and TrustSec. Which component is responsible for assigning the Security Group Tag (SGT) to packets at the ingress?

A.Endpoint with posture agent

B.Firewall with IPS capability

C.Cisco ISE Policy Service Node

D.Cisco Catalyst switch with CTS

AnswerD

Ingress switch classifies and tags packets with SGT.

Why this answer

The Cisco Catalyst switch with Cisco TrustSec (CTS) is responsible for assigning the Security Group Tag (SGT) to packets at the ingress. When a packet enters the network, the switch performs a lookup based on the source identity (e.g., IP address, user, or device) against the SGT mapping received from Cisco ISE, and then tags the packet with the appropriate SGT using the SGT header (Cisco proprietary, often carried in the MACsec or VXLAN header). This inline tagging at the ingress switch is the core mechanism of software-defined segmentation in TrustSec.

Exam trap

Cisco often tests the distinction between the policy decision point (ISE) and the enforcement point (switch/router), so the trap here is that candidates mistakenly think ISE itself assigns the SGT to packets, when in fact ISE only provides the classification rules while the ingress switch performs the actual tagging.

How to eliminate wrong answers

Option A is wrong because an endpoint with a posture agent can report the endpoint's security posture to ISE, but it does not assign SGTs to packets at the network ingress; SGT assignment is a network device function. Option B is wrong because a firewall with IPS capability inspects and filters traffic based on security policies, but it is not the device that tags packets with SGTs at the ingress; firewalls typically enforce policies based on SGTs already assigned by a switch or router. Option C is wrong because the Cisco ISE Policy Service Node (PSN) is the policy decision point that defines SGT-to-identity mappings and distributes them to network devices, but it does not perform the actual packet tagging at the ingress; that is the role of the enforcement device (e.g., switch).

Practice this question →

22

Drag & Dropmedium

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start with reachability, then check UDP 500, compare IKE proposals, verify pre-shared keys, and finally use debug for detailed errors.

Practice this question →

23

MCQmedium

An organization requires that all endpoint traffic be verified against a security policy before being forwarded. Which Cisco umbrella solution provides this capability?

A.Cisco AnyConnect

B.Cisco Stealthwatch

C.Cisco Umbrella

D.Cisco Firepower NGFW

AnswerC

Cloud-delivered security for traffic enforcement.

Why this answer

Cisco Umbrella is a cloud-delivered security service that enforces security policy by intercepting all DNS and IP-layer requests from endpoints and checking them against the organization's security policy before allowing traffic to proceed. This ensures that every connection attempt is verified at the DNS or IP layer, blocking threats before a TCP handshake is completed.

Exam trap

Cisco often tests the distinction between enforcement at the DNS layer (Umbrella) versus enforcement at the network layer (Firepower NGFW), and the trap here is that candidates may choose Firepower NGFW because it is a firewall, but the question specifically asks for a Cisco umbrella solution, which is cloud-based and operates before the traffic is forwarded.

How to eliminate wrong answers

Option A is wrong because Cisco AnyConnect is a VPN and secure connectivity client that provides remote access and posture assessment, but it does not perform inline security policy verification of all endpoint traffic before forwarding. Option B is wrong because Cisco Stealthwatch is a network visibility and analytics tool that uses NetFlow/IPFIX data to detect anomalies and threats after traffic has already been forwarded, not to enforce policy in real-time before forwarding. Option D is wrong because Cisco Firepower NGFW is a next-generation firewall that can enforce policy on traffic that passes through it, but it is a physical or virtual appliance that requires traffic to be routed through it, whereas the question specifies a Cisco umbrella solution that provides this capability at the cloud level.

Practice this question →

24

Multi-Selectmedium

Which TWO of the following are valid methods for Cisco ISE to collect endpoint attributes for profiling? (Choose TWO)

Select 2 answers

A.Syslog

B.RADIUS Accounting

C.NetFlow Probe

D.SNMP Polling

E.DHCP Probe

AnswersC, E

NetFlow probe analyzes traffic flows to profile endpoints.

Why this answer

Cisco ISE can use a NetFlow Probe to collect NetFlow records from network devices, which provide metadata about traffic flows (e.g., IP addresses, ports, protocols) that ISE analyzes to profile endpoints. This passive collection method helps identify endpoint attributes without requiring active agent deployment.

Exam trap

Cisco often tests the distinction between 'RADIUS Accounting' (session tracking) and 'RADIUS Authentication' (profiling probe) — candidates mistakenly assume Accounting is used for profiling, but only Authentication is a valid probe.

Practice this question →

25

MCQmedium

A company is deploying Cisco ISE to enforce access policies based on endpoint posture. Endpoints must be compliant before being granted full network access. Which policy type is used to define the compliance requirements?

A.Authentication policy

B.Profiling policy

C.Posture policy

D.Authorization policy

AnswerC

Defines compliance requirements.

Why this answer

Posture policy defines the compliance requirements (e.g., antivirus, patch level) and the remediation actions. Option A is incorrect because Authentication policy determines the method of authentication. Option B is incorrect because Profiling policy identifies device type.

Option D is incorrect because Authorization policy determines the resulting access after authentication and posture.

Practice this question →

26

Multi-Selecteasy

Which TWO of the following are features of Cisco TrustSec? (Choose TWO)

Select 2 answers

A.Security Group Tag Exchange Protocol (SXP)

B.Security Group Tag (SGT) assignment

C.IPsec VPN

D.Network Access Control (NAC)

E.802.1X authentication

AnswersA, B

SXP propagates SGTs across network devices.

Why this answer

Security Group Tag Exchange Protocol (SXP) is a Cisco TrustSec feature that propagates Security Group Tag (SGT) bindings between network devices without requiring inline tagging on every packet. It allows devices that do not natively support SGT in hardware to participate in TrustSec by exchanging IP-to-SGT mappings over TCP, enabling consistent policy enforcement across heterogeneous environments.

Exam trap

Cisco often tests the distinction between TrustSec features (SGT assignment and SXP) and supporting technologies like 802.1X or NAC, leading candidates to mistakenly select authentication or access control mechanisms as core TrustSec components.

Practice this question →

27

MCQmedium

Refer to the exhibit. A network administrator reviews the ISE live log for a successful 802.1X authentication. After authentication, the user is unable to make VoIP calls. What is the most likely cause?

A.The user's phone is not configured for 802.1X.

B.The RADIUS attribute 'device-traffic-class=voice' is incorrect.

C.The switch port is not configured with 'authentication host-mode multi-domain'.

D.The authorization profile does not include a voice VLAN.

AnswerD

VoIP requires a dedicated voice VLAN; without it, the phone cannot communicate with the call manager.

Why this answer

The authorization profile applied to the user does not include a voice VLAN assignment, which is required for VoIP traffic. Even though the RADIUS attribute 'device-traffic-class=voice' is present, this only marks the traffic for QoS and does not assign a VLAN. Without a voice VLAN configured in the authorization profile, the phone cannot obtain the necessary VLAN for voice services.

Option A is incorrect because whether the phone is configured for 802.1X is irrelevant; the issue is about VLAN assignment. Option B is incorrect because the RADIUS attribute 'device-traffic-class=voice' is correctly formatted for QoS marking, not for VLAN assignment. Option C is incorrect because multi-domain mode is used for scenarios with a phone behind a PC, but here the user's phone is authenticating directly and the problem is the lack of voice VLAN in the authorization profile.

Practice this question →

28

MCQeasy

A government agency is deploying Cisco ISE with a posture agent to ensure endpoints comply with security policies before accessing the network. The posture policy requires that all Windows computers have antivirus (AV) software running. The engineer configures a condition 'AV installed and running' and binds it to an authorization profile that grants full access if compliant, or quarantine if not. During testing, a computer that has AV installed and running (verified manually) is placed in quarantine. ISE logs show 'Posture - AV condition not satisfied'. The engineer checks the ISE posture configuration: the AV condition uses a default Cisco AV dictionary. What is the most likely cause?

A.The AV vendor is not supported by the ISE default posture dictionary

B.The posture policy is configured to require the AV version as well

C.The client's ISE posture agent is not installed

D.The client's firewall is blocking communication with ISE

AnswerA

ISE's default dictionary includes common AVs; if the vendor is unsupported, the condition cannot be evaluated correctly.

Why this answer

The posture condition uses a dictionary that maps known AV products. If the specific AV brand is not in the Cisco default dictionary, the condition will fail even if AV is running. Option A is correct.

Option B is incorrect because the condition does not require the AV version. Option C would cause other issues like no posture assessment. Option D is possible but less likely.

Practice this question →

29

MCQmedium

A large enterprise has deployed Cisco ISE for network access control. The network consists of multiple access switches and wireless LAN controllers. The security team wants to enforce that only domain-joined Windows computers with up-to-date antivirus can access the corporate network. Non-compliant devices should be placed in a quarantine VLAN with limited access to remediation servers. The ISE policies are configured with posture assessment. However, during a test, a non-compliant Windows computer is granted full network access instead of being quarantined. The ISE logs show that the posture assessment passed, but the computer's antivirus is outdated. What is the most likely reason for this behavior?

A.The authorization policy is matching before the posture policy is evaluated.

B.The posture policy is configured with 'continue' action for non-compliant status, allowing the user to proceed to authorization.

C.The posture agent is not installed on the endpoint, so the assessment is skipped.

D.The posture requirement is set to 'mandatory' but the agent is set to 'any', allowing non-compliant devices.

AnswerB

The 'continue' action does not enforce remediation; it passes the user to authorization.

Why this answer

In Cisco ISE, when a posture policy is configured with a 'continue' action for non-compliant status, the session does not terminate; instead, it proceeds to the authorization policy. This means the endpoint is evaluated by authorization rules, which may grant full network access if no quarantine rule is matched. The logs show the posture assessment passed because the 'continue' action treats non-compliance as a passing state for policy flow, not a failure.

Exam trap

Cisco often tests the distinction between posture policy actions ('continue' vs. 'block') and authorization policy conditions, trapping candidates who assume non-compliance always results in quarantine without considering the policy flow.

How to eliminate wrong answers

Option A is wrong because ISE evaluates posture policies before authorization policies; the authorization policy cannot match before posture is assessed. Option C is wrong because if the posture agent were not installed, the posture assessment would typically result in an 'unknown' or 'not applicable' status, not a 'passed' status, and the logs would reflect that. Option D is wrong because a 'mandatory' posture requirement with an 'any' agent setting would still enforce posture checks; the issue is the action taken on non-compliance, not the requirement or agent type.

Practice this question →

30

MCQmedium

A company is deploying Cisco ISE for guest access. They want to provide a self-service portal where guests can register their devices and receive a temporary username and password. Which ISE component is used to accomplish this?

A.BYOD Portal

B.Mobile Device Management (MDM)

C.Guest Portal

D.Profiler Service

AnswerC

Guest Portal provides self-service registration and temporary credentials for guests.

Why this answer

C is correct because the Guest Portal in Cisco ISE is specifically designed to provide a self-service registration page where guests can create their own accounts, receive temporary credentials, and gain network access. This portal handles the entire guest lifecycle, including sponsor approval if required, and can deliver the username/password via SMS, email, or on-screen display.

Exam trap

Cisco often tests the distinction between BYOD and Guest portals, and the trap here is that candidates confuse the BYOD Portal (which handles device onboarding with certificates) with the Guest Portal (which handles temporary user credentials for non-employees).

How to eliminate wrong answers

Option A is wrong because the BYOD Portal is used for employees to onboard their personal devices into the corporate network with certificate-based authentication, not for guest self-registration. Option B is wrong because Mobile Device Management (MDM) is an external system that enforces policies on enrolled devices (e.g., compliance checks, remote wipe) and is not a self-service portal for guest credential provisioning. Option D is wrong because the Profiler Service uses passive and active probing techniques (e.g., DHCP, HTTP, SNMP) to identify device attributes like OS or vendor, but it does not provide any user-facing portal for registration or credential delivery.

Practice this question →

31

MCQeasy

A network administrator wants to implement 802.1X authentication on a switch port that connects a printer. The printer does not support 802.1X, so the administrator configures MAC Authentication Bypass (MAB) as a fallback method. Which command must be included in the switch port configuration to ensure MAB is attempted after 802.1X times out?

A.authentication priority dot1x mab

B.authentication order dot1x mab

C.dot1x timeout tx-period 30

D.authentication port-control auto

AnswerB

This configures the switch to attempt 802.1X first, and if it fails, fall back to MAB.

Why this answer

The 'authentication order dot1x mab' command explicitly defines the sequence in which authentication methods are attempted on a switch port. When 802.1X times out (e.g., because the printer does not respond to EAPOL frames), the switch then falls back to MAB. This command ensures MAB is attempted only after 802.1X fails, which matches the requirement.

Exam trap

The trap here is confusing 'authentication priority' with 'authentication order' — candidates often pick 'priority' thinking it controls the fallback sequence, but 'priority' only resolves conflicts when multiple methods succeed simultaneously, not the order of attempts.

How to eliminate wrong answers

Option A is wrong because 'authentication priority dot1x mab' sets the priority for which method is preferred when multiple methods succeed, not the order of fallback; it does not control the sequence of attempts. Option B is the correct answer. Option C is wrong because 'dot1x timeout tx-period 30' adjusts the interval between EAPOL retransmissions (default 30 seconds), but it does not enable or sequence MAB as a fallback method.

Option D is wrong because 'authentication port-control auto' is required to enable 802.1X authentication on the port, but it alone does not define the fallback order to MAB; it must be combined with the 'authentication order' command.

Practice this question →

32

Multi-Selectmedium

Which TWO methods can be used to propagate SGT information between devices that do not support SGT inline tagging?

Select 2 answers

A.NetFlow

B.CDP

C.LLDP

D.SXP

E.VRF-lite

AnswersB, D

CDP can advertise SGTs in its TLVs.

Why this answer

The correct methods are CDP and SXP. CDP (Cisco Discovery Protocol) can propagate SGT information between devices that do not support inline tagging, particularly in Cisco environments. SXP (SGT Exchange Protocol) is the primary protocol used to exchange SGT mappings between devices that do not have inline SGT support.

NetFlow does not propagate SGTs; it is used for traffic flow monitoring. LLDP (Link Layer Discovery Protocol) does not support SGT. VRF-lite is not related to SGT propagation.

Practice this question →

33

MCQmedium

A university is using Cisco ISE to provide secure wireless access for students and faculty. The wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. Recently, some faculty members reported that they cannot connect to the wireless network from their personal laptops, while student devices connect without issues. The faculty members are using the same SSID and entering their credentials correctly. The ISE logs show that the authentication attempts from faculty devices are failing with 'RADIUS Access-Reject' due to incorrect credentials. However, the faculty members are certain they are using the correct password. The IT department has verified that the user accounts in Active Directory are active and not locked. What is the most likely cause of the issue?

A.The ISE authentication policy is not configured to query Active Directory for faculty users

B.The faculty laptops do not have a valid client certificate

C.The faculty accounts are locked due to multiple failed attempts

D.The RADIUS shared secret on the wireless controller is incorrect

AnswerA

If the identity store sequence does not include AD, authentication fails.

Why this answer

The most likely cause is that the ISE authentication policy is not configured to query Active Directory for faculty users. Since student devices connect successfully, the policy likely matches students to an AD identity source but fails for faculty because their accounts are in a different AD group or domain not included in the policy. The 'RADIUS Access-Reject' with 'incorrect credentials' error in ISE logs indicates the authentication policy is not finding the user in the configured identity stores, even though the password is correct.

Exam trap

Cisco often tests the misconception that 'incorrect credentials' always means a wrong password, when in fact it can indicate a missing or misconfigured identity source in the authentication policy, especially when some users succeed and others fail.

How to eliminate wrong answers

Option B is wrong because PEAP-MSCHAPv2 does not require client certificates; only the server side presents a certificate for the TLS tunnel, so missing client certificates would not cause authentication failures. Option C is wrong because the IT department has verified that the faculty accounts are active and not locked, so account lockout is not the issue. Option D is wrong because if the RADIUS shared secret were incorrect, the wireless controller would not even forward authentication requests to ISE, and the logs would show a different error (e.g., 'RADIUS Request dropped' or 'Invalid Shared Secret'), not an Access-Reject due to incorrect credentials.

Practice this question →

34

MCQhard

Refer to the exhibit. A switch port is configured for 802.1X with MAB. The switch has reached its maximum number of authentication sessions (platform limit). When a new device attempts to connect, what happens?

A.The new device is not authenticated and remains unauthorized

B.The new device is allowed to pass traffic due to fallback

C.The switch sends a CoA to ISE to free up a session

D.The port is automatically shut down

AnswerA

If the platform limit is reached, the switch cannot create new sessions, so the port remains unauthorized for the new device.

Why this answer

When the switch reaches its platform-specific limit for authentication sessions (e.g., 256 sessions on a Catalyst 3850), no new 802.1X or MAB sessions can be initiated. The new device remains in an unauthorized state (typically in the 'critical' or 'auth-fail' VLAN, or simply blocked) because the switch cannot allocate a new session context. There is no automatic fallback or CoA action to free a session; the port stays in the unauthorized state until an existing session expires or is manually cleared.

Exam trap

Cisco often tests the misconception that MAB or 802.1X fallback mechanisms will automatically handle session exhaustion, when in reality the session limit is a hard resource constraint that blocks all new authentications until an existing session is released.

How to eliminate wrong answers

Option B is wrong because MAB fallback (from 802.1X to MAB) is a per-host authentication method, not a mechanism to bypass session limits; once the session limit is reached, no new authentication attempts are processed regardless of method. Option C is wrong because a Change of Authorization (CoA) is initiated by the RADIUS server (ISE) to modify an existing session, not by the switch to free up a session; the switch cannot send a CoA to ISE for this purpose. Option D is wrong because the switch does not automatically shut down the port when the session limit is reached; it simply denies new authentication attempts while existing sessions remain active.

Practice this question →

35

MCQeasy

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

A.Profiling policy

B.Authentication policy

C.Authorization policy

D.Policy set

AnswerC

Authorization policy defines what access is granted after authentication.

Why this answer

Authorization policies in Cisco ISE define the access permissions granted to authenticated users, such as allowing or denying network access. In this scenario, after a user authenticates via Active Directory (handled by the authentication policy), the authorization policy evaluates conditions (e.g., AD group membership) to enforce the required access control for the corporate wireless network.

Exam trap

The trap here is confusing authentication (verifying identity) with authorization (granting permissions), leading candidates to select authentication policy when the question explicitly asks about enforcing access control after authentication.

How to eliminate wrong answers

Option A is wrong because profiling policies are used to identify and classify endpoints based on attributes like MAC address or DHCP fingerprints, not to enforce access control based on user authentication. Option B is wrong because authentication policies only verify user credentials (e.g., against Active Directory) and determine the identity store to use, but they do not grant or deny network access; that is the role of authorization. Option D is wrong because a policy set is a container that groups authentication, authorization, and profiling policies together; it is not a specific policy that enforces access control based on user authentication.

Practice this question →

36

MCQeasy

An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?

A.DNS records for the domain controller have not updated

B.ISE has cached the previous password and is still using it for authentication

C.The wireless controller has a local password cache

D.The RADIUS server on the wireless controller is caching credentials

AnswerB

ISE caches credentials to improve performance; after a password change, the cached old password is still used until the cache refreshes, causing a delay of about 30 minutes.

Why this answer

ISE caches user credentials for efficiency, including the password used during 802.1X authentication. When a user changes their domain password, ISE may still have the old password cached and will attempt to authenticate with it until the cache expires (typically up to 30 minutes). Option A is incorrect because DNS updates are not related to cached passwords; stale DNS records would affect all users, not just those with recent password changes.

Option C is incorrect because wireless controllers do not cache passwords for 802.1X; they forward credentials to the RADIUS server (ISE). Option D is incorrect because the RADIUS server (ISE) is the one caching credentials, not the wireless controller.

Practice this question →

37

MCQmedium

An organization wants to provide guest wireless access with a captive portal. Which Cisco ISE portal type should be used?

A.Sponsored Guest Portal

B.Central Web Authentication (CWA) Portal

C.Hotspot Guest Portal

D.Self-Registered Guest Portal

AnswerD

This portal allows guests to register themselves and create credentials.

Why this answer

(Self-Registered Guest Portal). This portal enables guests to self-register via a captive portal, creating their own credentials without needing a sponsor. Option A (Sponsored Guest Portal) requires an existing user to sponsor the guest.

Option B (Central Web Authentication Portal) is typically used for BYOD or device onboarding, not guest self-registration. Option C (Hotspot Guest Portal) provides simple internet access without any registration or authentication.

Practice this question →

38

Multi-Selecteasy

Which TWO of the following are authentication methods used for wired network access in Cisco ISE?

Select 2 answers

A.TACACS+

B.NetFlow

C.RADIUS

D.802.1X

E.MAC Authentication Bypass (MAB)

AnswersD, E

802.1X is a standard authentication method for wired and wireless.

Why this answer

Options D and E are correct because 802.1X and MAC Authentication Bypass (MAB) are the primary authentication methods used for wired network access in Cisco ISE. Option A (TACACS+) is used for device administration, not network access. Option B (NetFlow) is a network monitoring tool.

Option C (RADIUS) is a protocol that underpins authentication methods but is not itself an authentication method.

Practice this question →

39

Multi-Selecthard

Which TWO are valid options for configuring a switch port to handle authentication failures in an 802.1X environment? (Select two.)

Select 2 answers

A.authentication event no-response action authorize vlan 100

B.dot1x critical profile

C.authentication event server dead action reinitialize

D.authentication port-control force-authorized

E.authentication event fail action authorize vlan 999

AnswersA, E

This is used when the endpoint does not respond to 802.1X (e.g., non-802.1X device).

Why this answer

The 'authentication event no-response action authorize vlan 100' command configures the switch port to place the endpoint into a restricted VLAN (e.g., VLAN 100) when the supplicant fails to respond to 802.1X authentication requests. This is a valid method for handling authentication failures, specifically a 'no-response' scenario, by authorizing the port with a limited-access VLAN instead of denying all traffic.

Exam trap

Cisco often tests the distinction between 'no-response' (supplicant silent) and 'fail' (explicit authentication rejection) events, and candidates may incorrectly assume that only 'fail' actions are valid for handling authentication failures, missing that 'no-response' is also a valid failure scenario.

Practice this question →

40

MCQmedium

A laptop fails to authenticate via 802.1X on a Cisco switch. The switch logs show: 'Authentication failed for user 'jdoe' on interface GigabitEthernet1/0/24: EAP session timeout.' What is the most likely cause?

A.The supplicant is using an incorrect EAP method.

B.The wired authentication timeout on the switch is too low.

C.The RADIUS server is unreachable.

D.The switch is not configured with a RADIUS server.

AnswerB

Low timeout setting can cause the session to time out before authentication completes.

Why this answer

The 'EAP session timeout' error specifically indicates that the authentication process did not complete within the configured timeout period on the switch. Option A is incorrect because an incorrect EAP method would typically result in an EAP failure or NAK, not a timeout. Option C is incorrect because an unreachable RADIUS server would cause a different error, such as 'RADIUS server timeout' or 'No response from server'.

Option D is incorrect because if the switch had no RADIUS server configured, it would not even attempt 802.1X authentication or would fall back to other methods.

Practice this question →

41

MCQhard

A security engineer is configuring Cisco ISE to enforce SGT-based access control. The engineer creates an SGACL on the switch that permits traffic from SGT 10 to SGT 20. However, traffic from SGT 10 to SGT 20 is still being dropped. The engineer verifies that the SGTs are correctly assigned. What is a possible reason for the drop?

A.SXP is not configured

B.The CTRL protocol is not enabled

C.The PAC on the switch is expired

D.There is a deny SGACL with a higher priority that matches the traffic

AnswerD

SGACLs are evaluated in order; a deny rule earlier in the list would override the permit rule.

Why this answer

Cisco ISE enforces SGT-based access control using Security Group ACLs (SGACLs) that are evaluated in priority order. Even if a permit SGACL exists for SGT 10 to SGT 20, a deny SGACL with a higher priority (lower sequence number) that matches the same traffic will take precedence and cause the traffic to be dropped. The engineer must check the full SGACL list and their sequence numbers on the switch to identify conflicting rules.

Exam trap

Cisco often tests the concept that SGACLs are processed in priority order (lowest sequence number first) and that a higher-priority deny rule can silently override a lower-priority permit rule, leading candidates to incorrectly assume the issue is with SGT assignment or protocol configuration.

How to eliminate wrong answers

Option A is wrong because SXP (SGT Exchange Protocol) is used to propagate SGT bindings between network devices, not to enforce SGACL policies; if SGTs are already correctly assigned, SXP is not required for the switch to apply the SGACL. Option B is wrong because the CTRL protocol (Cisco TrustSec Control Protocol) is used for dynamic SGT assignment and environment data download, but the switch can still enforce locally configured SGACLs without it. Option C is wrong because an expired PAC (Protected Access Credential) would prevent the switch from authenticating to ISE or downloading policies, but the engineer has already verified that SGTs are correctly assigned, indicating the switch is already authenticated and has the necessary policies.

Practice this question →

42

Multi-Selecthard

Which TWO are common causes for CoA (Change of Authorization) failures in a Cisco ISE deployment? (Choose two.)

Select 2 answers

A.The switch does not support the CoA protocol.

B.The ISE node serving the CoA is not in the same subnet as the switch.

C.The RADIUS shared secret between ISE and switch is mismatched.

D.The switch port is configured with 'authentication periodic'.

E.The endpoint is connected through a wireless controller that proxies RADIUS.

AnswersA, C

Correct. The switch must support CoA (RFC 3576) for CoA packets to be processed. If it does not, CoA operations will fail.

Why this answer

Options A and C are correct. The switch must support CoA (RFC 3576) for the protocol to work, and the RADIUS shared secret between ISE and the switch must match for CoA packets to be accepted. Option B is not a common cause because ISE and the switch can be in different subnets as long as network connectivity exists.

Option D is incorrect because 'authentication periodic' is a feature that triggers reauthentication, not a cause of CoA failure. Option E is incorrect because a wireless controller that proxies RADIUS can still forward CoA packets.

Practice this question →

43

MCQmedium

A network engineer is deploying TrustSec using SGT over VXLAN in a data center fabric. The fabric switches are configured as VXLAN Tunnel Endpoints (VTEPs). The engineer must ensure that SGT information is propagated from the border leaves to the spine. Which mechanism should be used?

A.LISP (Locator/ID Separation Protocol)

B.VXLAN Group Policy Option (GPO) in the VXLAN header

C.SXP (SGT Exchange Protocol) between VTEPs

D.IS-IS protocol extensions for SGT

AnswerB

The VXLAN header includes a Group Policy ID field that carries the SGT.

Why this answer

VXLAN Group Policy Option (GPO) is the correct mechanism because it embeds the SGT directly into the VXLAN header (in the Group Policy ID field, bits 24-31 of the VXLAN Network Identifier). This allows the spine switches, which are also VTEPs, to receive and forward the SGT information without needing a separate control plane protocol. The border leaf encodes the SGT in the VXLAN encapsulation, and the spine decodes it from the header, ensuring end-to-end SGT propagation across the fabric.

Exam trap

The trap here is that candidates often confuse SXP (a control-plane protocol for SGT binding exchange) with the data-plane encapsulation mechanism needed to carry SGTs inside VXLAN packets, leading them to select SXP instead of VXLAN GPO.

How to eliminate wrong answers

Option A is wrong because LISP is a control plane protocol for endpoint location and identity separation, not a mechanism for embedding SGTs in VXLAN headers; it is used in some Cisco SD-Access fabrics but not for SGT propagation over VXLAN. Option C is wrong because SXP is a TCP-based protocol used to exchange SGT-to-IP bindings between network devices, but it operates at Layer 3 and is not designed to carry SGTs inside VXLAN encapsulation between VTEPs. Option D is wrong because IS-IS protocol extensions for SGT do not exist; IS-IS is a routing protocol and has no standardized extension to carry SGT information in VXLAN headers.

Practice this question →

44

MCQmedium

A company is deploying Cisco TrustSec to enforce micro-segmentation between data center servers. Security team wants to use Security Group Tags (SGTs) assigned dynamically via ISE. Which method should the engineer use to propagate SGTs to the access switches that connect the servers, assuming the network uses Cisco Nexus 9000 switches and ISE as the policy server?

A.Deploy SXP (SGT Exchange Protocol) between ISE and the Nexus switches

B.Configure ISE as a RADIUS server to send CoA with SGT

C.Enable SGT inline tagging on all interswitch links

D.Use a dedicated VLAN per security group

AnswerA

SXP is designed to exchange IP-to-SGT mappings between ISE (policy server) and network devices like Nexus switches.

Why this answer

For dynamic SGT propagation from ISE to network devices, SXP (SGT Exchange Protocol) is the standard method. It carries IP-to-SGT mappings from ISE to the Nexus switches, enabling the switches to enforce policies without requiring inline tagging on every link. Option B (CoA) is used for reauthentication and session changes, not for bulk SGT propagation.

Option C (SGT inline tagging) is a hardware-based method for carrying SGTs on frame headers between switches, but it does not propagate the bindings from ISE; it requires all links to support tagging. Option D (dedicated VLAN per security group) is a traditional segmentation method, not related to Cisco TrustSec SGTs. Therefore, A is correct.

Practice this question →

45

Multi-Selecthard

Which THREE capabilities are provided by Cisco ISE's visibility services within the Secure Network Access domain? (Choose three.)

Select 3 answers

A.Endpoint profiling and classification (including IoT)

B.802.1X authentication for wired and wireless

C.Security group access control enforcement

D.Guest user registration and sponsor workflows

E.Passive identity monitoring and contextual data collection

AnswersA, D, E

ISE profiles endpoints based on attributes like MAC OUI, DHCP options.

Why this answer

Cisco ISE visibility services focus on identifying and profiling endpoints, managing guest access, and collecting contextual data. Option A (Endpoint profiling and classification, including IoT) is correct because ISE uses profiling probes to classify devices. Option D (Guest user registration and sponsor workflows) is correct as ISE provides a guest portal for registration and sponsor approval.

Option E (Passive identity monitoring and contextual data collection) is correct as ISE can monitor network traffic passively via integrations like pxGrid to collect identity and context. Options B and C are incorrect: 802.1X authentication is an enforcement mechanism, not a visibility service, and Security Group Access (SGA) enforcement is a policy enforcement feature, not visibility.

Practice this question →

46

MCQhard

A hospital is deploying Cisco ISE for network access control. They have a mix of employee laptops, medical devices (e.g., infusion pumps), and guest smartphones. The network uses Cisco Catalyst 9300 switches and Aironet 3700 series access points. For medical devices, the policy must use Machine Authentication (MAB) since they are 802.1X incapable. The ISE policy authenticates via MAB and then assigns the device to a specific VLAN for medical devices. During a pilot, the network team notices that some infusion pumps (MAC: 00:1A:2B:3C:4D:5E) are failing MAB authentication. The switch logs show 'Authentication failed for MAC 001a.2b3c.4d5e on interface GigabitEthernet1/0/10'. ISE logs show 'Authentication failed - RADIUS server rejected - Reason: Invalid Endpoint ID'. The engineer has verified the MAC address is in the ISE endpoint repository with correct identity group. What should the engineer check next to resolve this issue?

A.Verify that the switch port is configured with 'authentication port-control auto'

B.Check the MAC address format in the ISE endpoint identity store (such as using lowercase with a hyphen separator)

C.Confirm that the ISE policy for MAB allows the device to authenticate

D.Ensure the RADIUS shared secret is correct on the switch and ISE

AnswerB

The switch sends MAC in form '001a.2b3c.4d5e' (no delimiter) or '00-1a-2b-3c-4d-5e'? ISE expects a specific format; mismatch causes 'Invalid Endpoint ID'.

Why this answer

The error 'Invalid Endpoint ID' typically indicates that the username/password used for MAB is not matching. For MAB, the switch sends the MAC address as both username and password. If the ISE repository has the MAC but the authentication profile expects a different format (e.g., lowercase, colon-separated), it can fail.

Option B is correct because the switch might be sending the MAC in different case (upper vs lower) or without dashes. Option A would cause different error. Option C would prevent any auth.

Option D would cause other services to fail, not specific to MAB.

Practice this question →

47

MCQhard

In a Cisco TrustSec deployment, you want to dynamically assign SGTs based on user authentication. Which mechanism should you use?

A.CTS SXP

B.CTS RBACL

C.CTS device classification

D.CTS identity-based networking (IBNS) with RADIUS CoA

AnswerD

IBNS with CoA can dynamically assign SGTs via RADIUS attributes.

Why this answer

Identity-Based Networking Services (IBNS) with RADIUS Change of Authorization (CoA) allows dynamic assignment of SGTs during authentication. Option A (CTS SXP) propagates SGTs but doesn't assign dynamically. Option B (CTS RBACL) is for role-based access control, not SGT assignment.

Option C (CTS device classification) is for static assignment.

Practice this question →

48

MCQhard

Refer to the exhibit. A network administrator is troubleshooting device tracking on a Cisco switch. The output shows two devices in VLAN 100. The switch is configured with IPv6 first-hop security features. The administrator notices that the device with MAC address aaaa.bbbb.cccc is not receiving RA guard protection. What is the most likely reason?

A.The interface Gi0/1/1 is not configured as a trusted interface for RA guard.

B.The device is not in the same VLAN as the RA guard policy.

C.The device tracking entry for aaaa.bbbb.cccc is invalid.

D.The device tracking table has reached its limit.

AnswerA

RA guard only applies to trusted interfaces.

Why this answer

RA Guard protection is applied per interface based on trust configuration. The exhibit shows the device with MAC aaaa.bbbb.cccc is reachable via Gi0/1/1, but if that interface is not explicitly configured as trusted for RA Guard (e.g., using `ipv6 nd raguard trust`), the switch will not apply RA Guard filtering to RAs received on that port. This allows rogue RA messages from that device to bypass protection, making A the correct answer.

Exam trap

Cisco often tests the distinction between device tracking entries being present and the interface trust configuration being applied, leading candidates to incorrectly assume a valid tracking entry implies protection is active.

How to eliminate wrong answers

Option B is wrong because the device is in VLAN 100, and the RA Guard policy is applied to that VLAN (as shown in the exhibit), so the VLAN mismatch is not the issue. Option C is wrong because the device tracking entry for aaaa.bbbb.cccc is listed as valid (state REACHABLE), so it is not invalid. Option D is wrong because the device tracking table shows only two entries, far below typical limits (e.g., 4096 or more), so the table is not full.

Practice this question →

49

MCQhard

An engineer is implementing Cisco ISE posture assessment for corporate Windows laptops. The requirement: endpoints that are missing critical Microsoft security patches must be quarantined in a remediation VLAN. The ISE posture policy uses an 'Application Condition' to check for the patch. However, some laptops with missing patches are still allowed access. During testing, the engineer notices that the posture agent reports 'NAC Agent: Posture Unknown' for those laptops. What is the most likely cause?

A.The posture agent software is outdated

B.The missing patches are not on the ISE patch list

C.The ISE server is unreachable from the client VLAN

D.The authorization policy does not include a posture profile

AnswerD

Without a posture profile in the authorization result, the client does not receive instructions to perform posture assessment, leading to 'Posture Unknown'.

Why this answer

Posture Unknown indicates that the posture assessment did not complete. This often occurs when the authorization policy does not include a posture profile, so ISE does not issue a posture requirement to the agent, and the agent remains in an unknown state. Option D correctly identifies this cause.

Option A (outdated agent) could cause other issues but typically not Posture Unknown. Option B (patches not on ISE list) would lead to non-compliance, not unknown. Option C (ISE unreachable) would cause authentication failure entirely.

Practice this question →

50

MCQeasy

A network engineer is troubleshooting an 802.1X deployment where some Windows 10 endpoints fail to authenticate. Logs show that the client sends an EAPoL-Start but never receives an EAP-Request/Identity. The switch port configuration is: interface GigabitEthernet0/1 switchport mode access authentication port-control auto dot1x pae authenticator Which additional command is most likely needed?

A.dot1x reauthentication

B.dot1x system-auth-control

C.spanning-tree portfast

D.dot1x timeout tx-period 3

AnswerB

This global command enables 802.1X authentication on the switch, which is required for the port to process EAPoL messages.

Why this answer

The switch interface is configured for 802.1X with 'authentication port-control auto', but this alone is insufficient. The global command 'dot1x system-auth-control' must be enabled to activate the 802.1X feature on the switch. Without it, the switch ignores EAPoL-Start messages and does not send EAP-Request/Identity.

Option B is correct.

Practice this question →

51

MCQeasy

A security architect is designing network access control for a campus network. The requirement is to authenticate users before granting network access and to enforce policies based on user identity and device posture. Which solution should be deployed?

A.AAA server with TACACS+

B.VPN concentrator with client certificate authentication

C.Next-generation firewall with application control

D.Cisco Identity Services Engine (ISE)

AnswerD

ISE provides centralized policy enforcement for network access with user and device context.

Why this answer

Cisco ISE is the correct solution because it provides centralized policy-based network access control that authenticates users via 802.1X, MAB, or web authentication, and enforces dynamic VLAN assignment, ACLs, or SGTs based on user identity and device posture (e.g., compliance with antivirus, OS patches). Unlike a generic AAA server, ISE integrates with posture assessment (via AnyConnect or NAC Agent) and supports profiling, guest access, and BYOD onboarding, directly meeting the requirement for identity- and posture-based enforcement.

Exam trap

Cisco often tests the distinction between AAA for device administration (TACACS+) and AAA for network access (RADIUS/ISE), leading candidates to mistakenly choose a generic AAA server when the question specifically requires identity- and posture-based enforcement.

How to eliminate wrong answers

Option A is wrong because TACACS+ is a legacy AAA protocol that separates authentication, authorization, and accounting but does not support device posture assessment or dynamic policy enforcement based on endpoint health; it is typically used for device administration (e.g., router/switch CLI access), not for network access control of end-user devices. Option B is wrong because a VPN concentrator with client certificate authentication only secures remote access connections and does not control access to the campus network at the edge (wired/wireless); it lacks the ability to enforce policies based on device posture or integrate with switch/AP port-level control. Option C is wrong because a next-generation firewall with application control inspects traffic at the network perimeter and enforces policies based on application signatures, not user identity or device posture; it cannot authenticate users at the access layer or dynamically assign VLANs/ACLs on switches.

Practice this question →

52

MCQeasy

A guest device in VLAN 200 attempts to reach a server at 10.10.1.1. What happens to the traffic?

A.The traffic is permitted

B.The traffic is forwarded without any action

C.The traffic is dropped

D.The traffic is logged and forwarded

AnswerC

Destination 10.10.1.1 matches deny entry.

Why this answer

The VACL 'BLOCK_MAP' is applied to VLAN 200. The access-list BLOCK_GUEST denies traffic from any source to the 10.10.0.0/16 network. Since the destination 10.10.1.1 falls within this range, the traffic is dropped.

Therefore, option C is correct. Option A is incorrect because the ACL denies the traffic. Option B is incorrect because the VACL drops the traffic rather than forwarding without action.

Option D is incorrect because logging is not configured in the VACL.

Practice this question →

53

MCQhard

During a security incident, an investigator wants to identify all endpoints that communicated with a known malicious IP address within the last 24 hours. Which Cisco tool is best suited for this forensic analysis?

A.Cisco Firepower NGFW

B.Cisco Secure Network Analytics (Stealthwatch)

C.Cisco Umbrella

D.Cisco ISE

AnswerB

Provides network visibility and historical flow analysis.

Why this answer

Cisco Secure Network Analytics (Stealthwatch) is the correct tool because it provides network-wide visibility and flow-based analytics using NetFlow/IPFIX data. It can retroactively query all historical flow records to identify every endpoint that communicated with a known malicious IP address within a specified time window, making it ideal for forensic analysis.

Exam trap

Cisco often tests the distinction between real-time blocking tools (NGFW, Umbrella) and historical forensic analysis tools (Stealthwatch), leading candidates to choose a tool that prevents threats rather than one that retroactively identifies all affected hosts.

How to eliminate wrong answers

Option A is wrong because Cisco Firepower NGFW is a next-generation firewall focused on real-time threat prevention and inline blocking, not historical forensic analysis of all endpoints over a 24-hour period; it lacks the centralized flow record storage and query capabilities needed for this task. Option C is wrong because Cisco Umbrella is a cloud-delivered DNS-layer security solution that logs DNS queries, not direct IP communication flows; it cannot identify endpoints that communicated with a malicious IP via non-DNS protocols or direct IP connections. Option D is wrong because Cisco ISE is a policy-based network access control (NAC) and identity management platform; it does not capture or store network flow data for historical communication analysis between endpoints and external IPs.

Practice this question →

54

MCQeasy

A network administrator is troubleshooting intermittent authentication failures on a switch port configured for 802.1X with MAB fallback. Users can connect but get dropped after a few minutes. What is the most likely cause?

A.Incorrect VLAN assignment

B.Incorrect RADIUS shared secret

C.Reauthentication timer set too short

D.MAB timeout set too low

AnswerC

Frequent reauth can cause drops if client or server is slow.

Why this answer

The reauthentication timer on the switch port is set too short, causing the 802.1X session to expire and re-initiate authentication frequently. This results in users being dropped after a few minutes as the port cycles through reauthentication, even though MAB fallback may temporarily allow traffic. The default reauthentication timer is typically 3600 seconds, but if misconfigured to a very low value (e.g., 60 seconds), it will cause periodic disconnections.

Exam trap

Cisco often tests the distinction between initial authentication failures (caused by shared secret or MAB timeout issues) and post-authentication drops (caused by reauthentication timer misconfiguration), leading candidates to confuse MAB timeout with reauthentication timer.

How to eliminate wrong answers

Option A is wrong because incorrect VLAN assignment would cause persistent connectivity issues (e.g., wrong subnet or no access), not intermittent drops after a few minutes. Option B is wrong because an incorrect RADIUS shared secret would cause authentication to fail entirely from the start, not allow users to connect and then drop later. Option D is wrong because the MAB timeout controls how long the switch waits for a response from the RADIUS server during MAB fallback; setting it too low would cause MAB to fail quickly, but the symptom here is intermittent drops after successful connection, not initial authentication failure.

Practice this question →

55

Multi-Selecthard

Which THREE of the following are valid components of Cisco ISE's visibility and enforcement architecture?

Select 3 answers

A.TrustSec with SGTs

B.Profiling probes (e.g., DHCP, HTTP)

C.pxGrid (Platform Exchange Grid)

D.NetFlow for flow analysis

E.SNMP traps for alerting

AnswersA, B, C

TrustSec provides scalable role-based access control using SGTs.

Why this answer

Cisco ISE's visibility and enforcement architecture relies on TrustSec with Security Group Tags (SGTs) to enforce access policies based on logical groupings rather than IP addresses. SGTs are propagated via SXP or inline tagging, enabling dynamic policy enforcement across the network.

Exam trap

Cisco often tests the distinction between visibility/enforcement components (TrustSec, pxGrid, profiling) and general network monitoring tools (NetFlow, SNMP), leading candidates to incorrectly include the latter as core ISE architecture elements.

Practice this question →

56

MCQmedium

A network engineer configures ISE for 802.1X with PEAP-MSCHAPv2. Users report intermittent authentication failures on certain switches. The engineer checks ISE logs and sees 'Authentication failed' with reason 'User not found in identity store'. What is the most likely issue?

A.The switch port is configured with 'authentication periodic'.

B.The user is not in the Active Directory group that ISE is configured to query.

C.The switch is not configured with the correct shared secret.

D.The user's certificate is expired.

AnswerB

ISE cannot find the user in the identity store, likely due to group membership or search base issues.

Why this answer

The error 'User not found in identity store' indicates that ISE queried its configured identity sources (e.g., Active Directory) and could not locate the user account. Since PEAP-MSCHAPv2 authenticates users against a backend identity store (not certificates), the most likely cause is that the user is not a member of the specific AD group that ISE is configured to query, or the user object does not exist in the joined domain. This is a common misconfiguration when ISE uses group-based filtering or restricted identity stores.

Exam trap

Cisco often tests the distinction between authentication failures caused by credential/identity store issues versus RADIUS communication or certificate problems, and the trap here is that candidates confuse PEAP-MSCHAPv2 (which relies on AD credentials) with EAP-TLS (which relies on client certificates), leading them to incorrectly select an expired certificate option.

How to eliminate wrong answers

Option A is wrong because 'authentication periodic' triggers reauthentication at intervals but does not cause a 'User not found' error; it would instead cause periodic re-auth attempts that succeed or fail based on credentials. Option B is correct as explained. Option C is wrong because a mismatched shared secret between the switch and ISE would result in a RADIUS authentication failure with a reason like 'Invalid RADIUS shared secret' or 'RADIUS request dropped', not a user lookup failure.

Option D is wrong because PEAP-MSCHAPv2 does not use client certificates for user authentication; the user's certificate is irrelevant here—only the server certificate is used for the PEAP tunnel, and an expired user certificate would not produce a 'User not found' error.

Practice this question →

57

MCQmedium

An engineer is configuring ISE for guest access via a sponsor portal. The policy requires that a sponsor must approve each guest. However, guests are being automatically approved without sponsor interaction. What is the most likely misconfiguration?

A.The guest portal's 'Access setting' is set to 'Self-Registration' instead of 'Sponsor Approval'

B.The guest portal is not configured to send email notifications to sponsors

C.The sponsor user account is assigned to the wrong sponsor group

D.The guest endpoint is being profiled as a known device

AnswerA

If the portal is set to self-registration, guests are automatically approved. It must be set to sponsor approval to require manual approval.

Why this answer

The guest portal's 'Access setting' must be configured to require sponsor approval. If it is set to 'Self-Registration', guests are automatically approved upon registration without any sponsor action, which matches the described symptom. Option B is incorrect because email notifications to sponsors are optional and do not affect the approval process itself.

Option C is incorrect because the sponsor group assignment determines which users can act as sponsors, not whether approval is required. Option D is incorrect because profiling a guest endpoint as a known device would affect authentication methods, not the approval workflow.

Practice this question →

58

Drag & Dropmedium

Drag and drop the steps to configure NetFlow on a Cisco IOS router for traffic monitoring in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First enable flow on interface, then configure exporter, create monitor, apply to interface, and verify.

Practice this question →

59

MCQhard

An ISE deployment uses TrustSec with SGTs assigned by Active Directory group membership. A group of users in the 'Finance' AD group is correctly receiving SGT 5, but a new user added to that group is getting SGT 0. The ISE policy is unchanged, and other users in the group work fine. What is the most likely cause?

A.The user endpoint has not been profiled by ISE yet

B.ISE has not synchronized the latest AD group membership

C.The user endpoint is running antivirus software that blocks SGT assignment

D.The user does not have a PAC (Protected Access Credential)

E.The switchport is configured with 'authentication violation restrict' which blocks the new user

AnswerB

ISE caches AD groups. If the user was recently added, the cache may be stale, causing ISE to assign a default SGT (0).

Why this answer

ISE uses Active Directory (AD) as an identity source and must synchronize group membership changes before it can map the new user to the correct Security Group Tag (SGT). If the AD group membership has not been refreshed via the scheduled or manual sync, ISE will not know the new user belongs to the 'Finance' group, resulting in a default SGT of 0 (unknown/untrusted). Other users already in the group work fine because their membership was present during the last successful sync.

Exam trap

Cisco often tests the misconception that SGT assignment is immediate upon AD group membership change, but the trap here is that ISE must synchronize the AD group membership before it can apply the correct SGT, and a default SGT of 0 indicates the user is not matched to any authorization policy.

How to eliminate wrong answers

Option A is wrong because endpoint profiling is not required for SGT assignment based on AD group membership; SGTs are assigned after authentication and authorization, not after profiling. Option C is wrong because antivirus software does not interfere with SGT assignment, which is a network-level attribute applied by the switch or ISE based on the user's identity, not a client-side process. Option D is wrong because a PAC (Protected Access Credential) is used in EAP-FAST for secure tunnel establishment, not for SGT assignment; SGTs are assigned via RADIUS attributes (e.g., Cisco-AVPair) after successful authentication.

Option E is wrong because 'authentication violation restrict' places the port in an err-disabled state upon a violation, but the scenario describes the user successfully authenticating (getting SGT 0), not being blocked; a violation would prevent access entirely.

Practice this question →

60

Multi-Selecteasy

Which TWO factors should be considered when designing a Cisco ISE deployment for network access control (NAC) in a multi-site environment? (Choose two.)

Select 2 answers

A.ISE node roles and placement (primary, secondary, monitoring)

B.Endpoint profiling needs

C.Number of endpoints per policy evaluator

D.Type of network access device (switch, WLC, VPN)

E.WAN link latency and reliability between sites

AnswersA, E

Roles define failover and administration; critical for multi-site.

Why this answer

Multi-site NAC design with Cisco ISE requires careful consideration of node roles and WAN connectivity. Option A is correct because ISE node roles (Administration, Policy Service, Monitoring) and placement across sites determine authentication flow, failover, and load balancing. Option E is correct because WAN link latency and reliability between sites directly impact authentication timeouts and replication.

Option B (Endpoint profiling) is a general ISE feature but not specific to multi-site design. Option C (Number of endpoints per policy evaluator) is a capacity planning detail, not a primary design factor for multi-site. Option D (Type of network access device) is more about compatibility than multi-site topology.

Practice this question →

61

MCQhard

A multinational corporation is deploying Cisco ISE to enforce network access for both wired and wireless users. The company has 5,000 employees and 2,000 guest users daily. The ISE deployment consists of two nodes: a primary Administration Node (PAN) and a Monitoring Node (MNT). All policies are configured on the PAN. Recently, the company has experienced intermittent authentication failures during peak hours. The failures affect both wired 802.1X and wireless users. The syslogs show 'RADIUS request dropped' messages on the ISE nodes. The network team has verified that the RADIUS shared secret is correct and that the network devices can reach the ISE nodes. The ISE nodes have sufficient CPU and memory. However, the authentication failures correlate with times when the number of concurrent sessions exceeds 500. What is the most likely cause of the issue?

A.The ISE node is running out of RADIUS session capacity

B.The ISE nodes are not reachable from the network devices

C.The RADIUS shared secret is mistyped on some network devices

D.The CPU and memory are insufficient despite appearing sufficient

AnswerA

ISE has a maximum number of concurrent RADIUS sessions; exceeding that causes drops.

Why this answer

The 'RADIUS request dropped' messages and correlation with concurrent sessions exceeding 500 indicate that the ISE node has reached its RADIUS session capacity. Cisco ISE nodes have a finite number of RADIUS session contexts (typically 500 for a single node in many deployments), and once this limit is exceeded, new authentication requests are dropped. This is a licensing and resource limitation, not a CPU or memory issue, and it explains why failures occur only during peak hours.

Exam trap

Cisco often tests the distinction between resource exhaustion (CPU/memory) and session capacity limits, trapping candidates who assume that sufficient CPU and memory means no capacity issue, when in fact the RADIUS session table is a separate finite resource.

How to eliminate wrong answers

Option B is wrong because the network team verified that the network devices can reach the ISE nodes, so reachability is not the issue. Option C is wrong because the RADIUS shared secret was verified as correct on all devices, and mistyped secrets would cause consistent failures, not intermittent ones correlated with session count. Option D is wrong because the ISE nodes have sufficient CPU and memory, and the problem is a session capacity limit, not a resource exhaustion issue.

Practice this question →

62

MCQhard

In a Cisco TrustSec environment, a network administrator observes that traffic between two endpoints in the same SGT group is being denied. The relevant switch has CTS configured with 'cts manual' and 'policy static sgt 10'. What is the most probable cause?

A.The SGT classification is not applied to the correct VLAN.

B.The SGT is not propagated to the downstream switch.

C.The endpoint's NAC agent is not reporting posture.

D.The IP-to-SGT mapping is missing on the switch.

AnswerA

If the VLAN on the switchport is not mapped to the SGT, the endpoint may be classified incorrectly, causing denial.

Why this answer

In Cisco TrustSec with 'cts manual' and 'policy static sgt 10', the SGT is statically assigned to an interface or VLAN. If traffic between two endpoints in the same SGT group is denied, the most probable cause is that the SGT classification is applied to the wrong VLAN, causing the switch to enforce SGACLs incorrectly. Since both endpoints share SGT 10, intra-group traffic should be permitted by default unless a specific SGACL denies it, but misclassification can lead to unexpected drops.

Exam trap

Cisco often tests the distinction between static and dynamic SGT assignment, and the trap here is that candidates assume IP-to-SGT mapping (Option D) is always required, when in fact static SGT bypasses mapping and relies on interface/VLAN classification.

How to eliminate wrong answers

Option B is wrong because SGT propagation to a downstream switch is irrelevant for intra-switch traffic between two endpoints on the same switch; propagation matters only when traffic crosses switches. Option C is wrong because NAC agent posture reporting is used for dynamic SGT assignment via ISE, not for static SGT configuration with 'cts manual' and 'policy static sgt 10'. Option D is wrong because IP-to-SGT mapping is not used in a static SGT environment; static SGT is assigned per interface or VLAN, not via IP mapping.

Practice this question →

63

MCQeasy

A network administrator is configuring 802.1X for wired access on a Cisco switch. The switch is configured for RADIUS using a Cisco ISE server. During testing, a client that supports 802.1X is unable to authenticate and fails to gain network access. The administrator checks the switch logs and sees "Authentication failed: invalid EAP code received". What is the most likely cause?

A.The client is using an unsupported EAP method (e.g., EAP-TLS instead of PEAP).

B.The RADIUS server is unreachable.

C.The switch is configured with the wrong shared secret for RADIUS.

D.The switch port is configured as a trunk port rather than an access port.

AnswerA

The switch cannot process an unrecognized EAP code, which occurs when the client negotiates an unsupported method.

Why this answer

The error 'invalid EAP code received' indicates that the switch received an EAP packet with a code it does not support, which typically occurs when the client uses an unsupported EAP method. Option A is correct because if the client attempts a method like EAP-TLS while the switch or RADIUS server expects PEAP, the EAP code may be unrecognized. Option B is wrong because RADIUS unreachability would result in timeouts or 'no response' errors, not EAP code errors.

Option C is wrong because a shared secret mismatch would cause RADIUS authentication rejections (e.g., 'Access-Reject'), not EAP parsing issues. Option D is wrong because a trunk port configuration would cause VLAN mismatches or connectivity issues, not EAP code errors.

Practice this question →

64

MCQhard

An organization is deploying Cisco TrustSec and uses SXP to propagate SGTs between routers that do not support SGT inline tagging. The SXP connection is established, but the SGT mappings are not being learned. The administrator checks 'show sxp connections' and sees the connection is in 'On' state. What is the most likely issue?

A.The SXP source IP is not reachable.

B.The SXP hold-down timer expires too quickly.

C.The SXP speaker and listener are both configured as listener.

D.The SXP password is incorrect.

AnswerC

SXP requires one side to be speaker and the other listener; both listener prevents mapping exchange.

Why this answer

In SXP, one side must act as a speaker and the other as a listener for SGT mappings to be exchanged. If both are configured as listeners, the connection can still reach the 'On' state, but no mappings are propagated because neither side is sending. Option A is incorrect because an unreachable source IP would prevent the connection from establishing, and the state would not be 'On'.

Option B is incorrect because the hold-down timer affects the removal of stale mappings after a connection loss, not the initial learning of mappings. Option D is incorrect because an incorrect password would also prevent the connection from reaching the 'On' state.

Practice this question →

65

Multi-Selectmedium

Which THREE are valid methods to obtain security group tags (SGTs) on a Cisco switch? (Choose three.)

Select 3 answers

A.IP-to-SGT mapping via RADIUS

B.CTS manual configuration

C.Cisco ISE pxGrid subscription

D.VLAN-to-SGT mapping

E.SXP

AnswersA, B, E

RADIUS can send SGT attributes during authentication.

Why this answer

Options A, B, and E are correct. IP-to-SGT mapping via RADIUS (A) dynamically assigns SGTs based on authentication results. CTS manual configuration (B) allows static SGT assignment per interface or port.

SXP (E) propagates SGTs between devices. Option C (Cisco ISE pxGrid subscription) is used for data sharing, not for a switch to obtain SGTs. Option D (VLAN-to-SGT mapping) is not a standard method; SGTs are assigned per host, not per VLAN.

Practice this question →

66

Matchingmedium

Match each Cisco security command to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Display IKE security associations

Display configured access control lists

Display firewall configuration and statistics

Enable IP packet debugging

Save running configuration to startup

Why these pairings

The correct matches are: ip access-group applies ACLs to interfaces; ip inspect enables stateful firewall inspection; crypto map configures IPSec. Common confusions include swapping the functions of 'ip access-group' and 'ip access-list', or misattributing encryption to 'ip inspect'.

Practice this question →

67

MCQhard

A large enterprise has deployed Cisco ISE for network access control with 802.1X and MAB across its wired and wireless networks. The network consists of Cisco Catalyst switches, Cisco Wireless LAN Controllers (WLCs), and ISE in a distributed deployment with three Policy Service Nodes (PSNs) and an Admin Node. Recently, the company implemented a new security policy requiring all endpoints to pass posture assessment before gaining full network access. The posture assessment uses AnyConnect ISE Posture Module. Shortly after the change, users report that some wired clients are unable to connect to the network. The ISE logs show that the authentication is successful, but the session is terminated immediately with a 'Session-Timeout' attribute set to 0. The network team notices that the affected clients are all connected to switches running older Cisco IOS versions. The ISE administrator confirms that the authorization profiles for the affected clients include a session-timeout of 1 hour. Which course of action should the network engineer take to resolve the issue?

A.Upgrade the switch IOS to a version that supports the new ISE posture attributes.

B.Disable posture assessment for the affected switch ports using a different authorization policy.

C.Configure the switches to ignore the Session-Timeout attribute sent by ISE.

D.Increase the session-timeout value in the ISE authorization profile to a larger value.

AnswerA

Upgrading resolves the incompatibility and allows proper handling of posture attributes.

Why this answer

Older Cisco IOS versions on the switches may not properly interpret the new RADIUS attributes (such as posture-related attributes) sent by ISE during posture assessment. This can cause the switch to misinterpret the session-timeout value and immediately terminate the session (setting Session-Timeout to 0). Upgrading the switch IOS to a version that supports these attributes resolves the compatibility issue.

Option B is incorrect because disabling posture assessment for affected ports bypasses the security policy without addressing the root cause. Option C is incorrect because configuring switches to ignore the Session-Timeout attribute can lead to security risks and does not solve the attribute interpretation problem. Option D is incorrect because increasing the session-timeout value in the ISE authorization profile does not fix the switch's inability to handle the attribute; the attribute is still misinterpreted.

Practice this question →

68

Matchingmedium

Match each Cisco security product to its category.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Next-Generation Firewall

Cloud-Delivered Security

Advanced Malware Protection

Identity Services Engine

Network Visibility and Detection

Why these pairings

Cisco Firepower is an NGFW; Cisco ISE is a NAC; Cisco Umbrella is a cloud security solution; Cisco Stealthwatch is for network security monitoring. Common confusions include swapping Firepower with ISE and Stealthwatch with Firepower.

Practice this question →

69

MCQeasy

A network administrator wants to implement 802.1X on a Cisco switch port for a device that does not support 802.1X. Which feature should be configured to allow the device to connect?

A.802.1X with EAP-MSCHAPv2

B.Downloadable ACL (dACL)

C.Web Authentication (WA)

D.MAC Authentication Bypass (MAB)

AnswerD

MAB allows non-802.1X devices to authenticate using their MAC address.

Why this answer

MAC Authentication Bypass (MAB) is the correct feature because it allows a device that does not support 802.1X supplicant software to authenticate by using its MAC address as the identity. The switch acts as a proxy, sending the MAC address as the username and password to the RADIUS server, which can then grant or deny access based on the MAC address in its database.

Exam trap

The trap here is that candidates confuse MAB with a bypass that skips all security, when in fact MAB still enforces authentication via the RADIUS server using the MAC address as credentials.

How to eliminate wrong answers

Option A is wrong because 802.1X with EAP-MSCHAPv2 requires the endpoint to run an 802.1X supplicant that can respond to EAP challenges, which the non-802.1X device cannot do. Option B is wrong because a downloadable ACL (dACL) is a policy enforcement mechanism applied after authentication, not an authentication method; it does not allow an unsupported device to connect. Option C is wrong because Web Authentication (WA) requires the user to open a web browser to authenticate, which is not suitable for a headless device (e.g., printer, IP phone) that cannot perform interactive web login.

Practice this question →

70

MCQmedium

A network engineer is troubleshooting an issue where a user's device is successfully authenticated via 802.1X, but the user cannot access the corporate network. ISE logs show that the user was granted access with a downloadable ACL (dACL). What could be the cause of no network access?

A.The switch does not support downloadable ACLs.

B.The user's device is in a different subnet.

C.The RADIUS server is not reachable after authentication.

D.The switch port is configured with 'access-session port-control auto'.

AnswerA

Switches that do not support dACLs will ignore the attribute, resulting in no access.

Why this answer

If the switch does not support downloadable ACLs, it will ignore the dACL attribute and not apply any filtering, potentially blocking traffic. Option B is incorrect because subnet placement does not affect dACL application. Option C is incorrect because the RADIUS server is not involved after authentication.

Option D is incorrect because 'access-session port-control auto' is correct configuration.

Practice this question →

71

MCQmedium

Refer to the exhibit. A network analyst reviews a Stealthwatch flow analysis output. What is the most likely interpretation?

A.This is likely a data exfiltration attempt using a non-standard port.

B.This is a typical video streaming session.

C.This is normal database replication traffic.

D.This is a misconfigured backup job.

AnswerA

Large data transfer on an unusual port with high score suggests malicious activity.

Why this answer

The flow shows 1.2 GB of data transferred over 5 minutes on a non-standard TCP port 4444 with a high threat score of 85, which is characteristic of data exfiltration attempts. Option B is incorrect because video streaming typically uses standard ports like 80 or 443 and exhibits different traffic patterns. Option C is incorrect because database replication usually uses well-known ports (e.g., 1433 for SQL) and consistent transfer patterns.

Option D is incorrect because backup jobs often occur on standard ports and follow regular schedules.

Practice this question →

72

MCQhard

During a network audit, an engineer finds that a switch configured for 802.1X is allowing a device to access the network without authentication. The switch logs show 'MAB failed', 'dot1x failed', but the port is in the forwarding state. The port configuration includes 'authentication fallback final mab' and 'dot1x timeout server-timeout 10'. What is the most likely explanation?

A.The device is using a MAC address that matches a static CAM entry

B.The 'authentication fallback final mab' command allows the port to become authorized even if MAB fails

C.The switch has 'aaa authentication dot1x default local' which allows local fallback

D.The 'dot1x timeout server-timeout' is too short, causing the switch to skip authentication

E.The switch is running an IOS version that treats 'authentication fallback final mab' as a no-op

AnswerB

This command treats 'mab' as the final method; if it fails, the port is still authorized.

Why this answer

The 'authentication fallback final mab' command includes the 'final' keyword, which configures the switch to authorize the port (place it in the forwarding state) even if MAB fails. In this scenario, both 802.1X and MAB failed, but the 'final' keyword overrides the failure and allows the port to forward traffic. This explains why the device gains network access despite authentication failures.

Exam trap

Cisco often tests the 'final' keyword in 'authentication fallback final mab' as a trap where candidates assume that 'fallback' means only trying MAB after 802.1X fails, but they miss that 'final' forces authorization even if MAB fails.

How to eliminate wrong answers

Option A is wrong because a static CAM entry does not override 802.1X authentication; the port state is controlled by the authentication manager, not by CAM entries. Option C is wrong because 'aaa authentication dot1x default local' would cause fallback to local authentication (e.g., local user database), not bypass authentication entirely; the logs show MAB and dot1x failed, not that local authentication was attempted. Option D is wrong because the 'dot1x timeout server-timeout 10' sets a 10-second timeout for the RADIUS server response; if the server times out, the switch would typically fail authentication, not skip it, and the 'fallback final mab' command is the reason for forwarding, not the timeout.

Option E is wrong because 'authentication fallback final mab' is a valid command in IOS; it is not treated as a no-op, and the observed behavior matches its documented function.

Practice this question →

73

MCQmedium

A company uses Cisco ISE for network access control. Users connecting via wired 802.1X are successfully authenticated but cannot reach the internet. The administrator checks the authorization policy and notices that the correct dACL is being applied. What is the most likely cause of the issue?

A.The switchport is configured as dynamic desirable

B.The RADIUS server is not sending the dACL attribute in the Access-Accept

C.The switch port MTU is set to 1500 bytes

D.ISE is out of licenses for endpoint devices

AnswerB

If the dACL is not included in the RADIUS response, the switch will not apply it.

Why this answer

The most likely cause is that the RADIUS server (ISE) is not sending the dACL attribute in the Access-Accept packet. Even though the authorization policy applies a dACL, if the RADIUS message does not include the dACL name (e.g., Cisco-AV-Pair = "ip:inacl#100=...") or the switch does not receive it, the switch cannot enforce the filter, leaving the user authenticated but with no internet access due to default deny-all behavior.

Exam trap

Cisco often tests the misconception that a correctly configured authorization policy in ISE guarantees the dACL is sent; the trap is that the policy must be linked to an authorization profile that explicitly includes the dACL, and the RADIUS message must carry it—otherwise the switch never receives the filter.

How to eliminate wrong answers

Option A is wrong because switchport mode dynamic desirable is a DTP setting for trunk negotiation and does not affect 802.1X authentication or dACL enforcement. Option C is wrong because an MTU of 1500 bytes is standard and would not prevent internet access after successful authentication; it might cause fragmentation issues but not a complete lack of connectivity. Option D is wrong because ISE license depletion affects the ability to authenticate new endpoints, not the enforcement of already-applied dACLs for authenticated users.

Practice this question →

74

MCQhard

During a security incident, an engineer needs to quickly quarantine an endpoint that is connected to a switch via 802.1X. The engineer wants to use ISE to send a Change of Authorization (CoA) to move the port to a restrictive VLAN. What must be configured on the switch to allow ISE to send CoA?

A.The switch must listen on UDP port 1700 for CoA packets

B.The switch must have 'aaa server radius dynamic-author' configured with a client entry for ISE

C.The switch must have a VTY line configured with 'transport input ssh'

D.RADIUS accounting must be enabled on the switch

E.The switch must have 'authentication event server dead action authorize' configured

AnswerB

This command enables the switch to accept CoA requests from ISE.

Why this answer

The `aaa server radius dynamic-author` command defines a local RADIUS dynamic-author server on the switch, which listens for Change of Authorization (CoA) and Disconnect messages from ISE. The client entry specifies the ISE server's IP address and shared secret, allowing the switch to accept and process the CoA request to dynamically change the VLAN assignment for the 802.1X-authenticated endpoint.

Exam trap

Cisco often tests the misconception that CoA uses UDP port 1700 (the standard RADIUS authentication port) rather than the correct port 3799 defined in RFC 5176 for dynamic authorization changes.

How to eliminate wrong answers

Option A is wrong because CoA packets are sent to UDP port 3799 (as per RFC 5176), not UDP port 1700 (which is used for RADIUS accounting). Option C is wrong because VTY line configuration with 'transport input ssh' is for remote management access to the switch CLI, not for receiving CoA messages from ISE. Option D is wrong because while RADIUS accounting is often used in conjunction with CoA for session identification, it is not a mandatory prerequisite for the switch to accept CoA packets; the dynamic-author server configuration alone enables CoA processing.

Option E is wrong because 'authentication event server dead action authorize' is a fallback mechanism for when the RADIUS server is unreachable, not a configuration that allows the switch to receive CoA messages.

Practice this question →

75

MCQhard

A company has deployed Cisco ISE for network access control. After a recent upgrade, the operations team notices that some users are being assigned incorrect authorization profiles. The ISE logs show that the users are being matched to the correct identity group, but the authorization result is different from expected. What is the most likely cause?

A.The passive identity feature is overriding the user's group assignment.

B.The authorization policy rules are not in the correct order, causing a different rule to match first.

C.The network device group assignment has changed, causing the device to be in a different group.

D.The authentication policy is misconfigured, causing users to be placed in the wrong identity group.

AnswerB

ISE uses first-match logic for authorization policies.

Why this answer

In Cisco ISE, authorization policies are evaluated in top-down order, and the first matching rule is applied. Even if users are correctly assigned to an identity group, a higher-priority authorization policy rule that matches on other conditions (e.g., endpoint profile, device type, or time condition) can override the expected result. This is the most likely cause when authentication and group assignment are correct but the authorization result is unexpected.

Exam trap

Cisco often tests the concept that authorization policies are evaluated in order of precedence, and candidates mistakenly focus on authentication or group assignment when the real issue is rule ordering in the authorization policy.

How to eliminate wrong answers

Option A is wrong because the passive identity feature (e.g., Active Directory passive identity) is used for identity mapping and does not override group assignments; it only provides identity context for authentication. Option C is wrong because if the network device group assignment had changed, the device would likely fail authentication or be matched to a different policy set, not cause incorrect authorization profiles while still matching the correct identity group. Option D is wrong because the question states that users are being matched to the correct identity group, which means the authentication policy is working correctly; a misconfigured authentication policy would place users in the wrong group, not result in correct group matching with wrong authorization.

Practice this question →

Page 1 of 2 · 99 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Secure Network Access, Visibility and Enforcement questions.

Start 20-question session