350-701 Practice Question: Secure Network Access, Visibility and Enforcement
During a network audit, an engineer finds that a switch configured for 802.1X is allowing a device to access the network without authentication. The switch logs show 'MAB failed', 'dot1x failed', but the port is in the forwarding state. The port configuration includes 'authentication fallback final mab' and 'dot1x timeout server-timeout 10'. What is the most likely explanation?
⚠ Common exam trap
Cisco often tests the 'final' keyword in 'authentication fallback final mab' as a trap where candidates assume that 'fallback' means only trying MAB after 802.1X fails, but they miss that 'final' forces authorization even if MAB fails.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'authentication fallback final mab' command allows the port to become authorized even if MAB fails
The 'authentication fallback final mab' command includes the 'final' keyword, which configures the switch to authorize the port (place it in the forwarding state) even if MAB fails. In this scenario, both 802.1X and MAB failed, but the 'final' keyword overrides the failure and allows the port to forward traffic. This explains why the device gains network access despite authentication failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The device is using a MAC address that matches a static CAM entry
Why it's wrong here
Static CAM entries do not bypass 802.1X.
- ✓
The 'authentication fallback final mab' command allows the port to become authorized even if MAB fails
Why this is correct
This command treats 'mab' as the final method; if it fails, the port is still authorized.
- ✗
The switch has 'aaa authentication dot1x default local' which allows local fallback
Why it's wrong here
Local fallback would require local credentials, not bypass authentication.
- ✗
The 'dot1x timeout server-timeout' is too short, causing the switch to skip authentication
Why it's wrong here
The timeout only affects how long the switch waits for a RADIUS response.
- ✗
The switch is running an IOS version that treats 'authentication fallback final mab' as a no-op
Why it's wrong here
The command is valid and functions as described.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.